Consume Sigstore-authorized enclave releases

[AnthonyRonning]

Summary

• move the Sigstore consumer work into the in-tree TypeScript/Rust SDK and maple-proxy
• replace GitHub PCR-file consumption with generated, reviewable trusted-release snapshots imported offline from verified Sigstore bundles
• enforce exact environment binding and full PCR0/PCR1/PCR2 authorization before key exchange, with no runtime GitHub fallback
• make the current empty snapshots fail closed until the first approved backend release is imported
• have proxy and Maple use the in-tree SDK policy, surface release/Rekor metadata, and redact attestation failures
• compile mock attestation only behind explicit local-development features; ordinary builds exclude it
• document trust chain and staged rollout

Rollout status

This PR intentionally remains a draft. OpenSecretCloud/opensecret#240 must be reviewed/merged and a protected tagged backend release published before generated snapshots are populated. No SDK version, Sigstore evidence, deployment, or smoke test was published/run.

Backend transition behavior is dual-publication for old clients. These new clients are Sigstore-only and do not fall back to GitHub PCR JSON.

Validation

• trusted-release updater: 3/3
• frontend: 765/765
• Rust SDK: 74 default + 82 all-feature tests
• maple-proxy: 22 default + 22 all-feature tests
• Maple native: 395 pass/2 ignored plus 3 CLI tests; local feature slice 11/11
• default/local-feature Tauri compile checks: pass
• dependency graph proves exactly one in-tree SDK/proxy, mock excluded by default and enabled only explicitly
• independent integration/security reviews: no remaining major findings

Snapshots remain intentionally empty/fail closed; no live release/import or end-to-end smoke was possible.

[cloudflare-workers-and-pages]

Deploying maple with Cloudflare Pages

Latest commit:	03e5112
Status:	✅ Deploy successful!
Preview URL:	https://7e8de0ac.maple-ca8.pages.dev
Branch Preview URL:	https://codex-sigstore-tee-attestati.maple-ca8.pages.dev

View logs