fix(bundler): cover recipe.yaml with bundle checksums (#1750)

Signed-off-by: Yuan Chen <yuanchen97@gmail.com>

Author: yuanchen8911

demos/bundle-attestation-demo-slides.html

@@ -191,7 +191,7 @@ <h2>Generated artifacts have no upstream tag</h2>
     </table>
     <div class="grid2">
       <div class="mini"><h4>Without attestation</h4><p>Bundle is just files. <code class="inl">checksums.txt</code> catches accidental corruption, nothing else.</p></div>
-      <div class="mini"><h4>With <code class="inl">--attest</code></h4><p>The files listed in <code class="inl">checksums.txt</code> are cryptographically bound to the creator <em>and</em> the binary that produced it (recipe.yaml excluded, #1549). Recursive provenance.</p></div>
+      <div class="mini"><h4>With <code class="inl">--attest</code></h4><p>The generated payload files listed in <code class="inl">checksums.txt</code>, including <code class="inl">recipe.yaml</code>, are cryptographically bound to the creator <em>and</em> the binary that produced it. Recursive provenance.</p></div>
     </div>
   </div>
 </section>
@@ -233,7 +233,7 @@ <h2><code class="inl">aicr bundle --attest</code></h2>
           <text x="46" y="214">recipe.yaml &#183; deploy.sh &#183; README.md</text>
           <text x="46" y="234">&lt;component&gt;/values.yaml &#183; ...</text>
           <text x="46" y="266" fill="#9aa7b4">checksums.txt</text>
-          <text x="46" y="282" fill="#6b7785" font-size="11">(SHA256 of the listed files; recipe.yaml excluded — #1549)</text>
+          <text x="46" y="282" fill="#6b7785" font-size="11">(SHA256 of every generated payload file)</text>
         </g>
         <rect class="node-g" x="432" y="170" width="398" height="186" rx="9"/>
         <text class="ttl-g nlabel" x="448" y="194">attestation/</text>

demos/bundle-attestation-demo.sh

@@ -233,7 +233,7 @@ run bash -c "set -o pipefail; '$AICR' verify '$BUNDLE' --format json | jq '{ tru
 # --- tamper -------------------------------------------------------------------
 
 banner "Tamper-evident: mutate a content file, verify fails"
-note "The signature's subject is the digest of checksums.txt, which pins every file it lists (recipe.yaml is not yet covered, #1549)."
+note "The signature's subject is the digest of checksums.txt, which pins every generated payload file, including recipe.yaml."
 note "Mutating any file listed in checksums.txt breaks its checksum; mutating checksums.txt breaks the signature."
 # Pick a file the bundle is guaranteed to contain. README.md is always present.
 TAMPER_TARGET="$BUNDLE/README.md"

demos/bundle-attestation.md

@@ -3,12 +3,12 @@
 Bundle attestation provides cryptographic proof of **who** created a deployment
 bundle and **which AICR CLI** built it. When `aicr bundle --attest` runs, the
 CLI signs the bundle's `checksums.txt` (which inventories the deployment
-payload; `recipe.yaml` is currently excluded, #1549, and the attestation files
-are verified separately) using [Sigstore](https://www.sigstore.dev/) and
+payload, including `recipe.yaml`; the attestation files are verified separately)
+using [Sigstore](https://www.sigstore.dev/) and
 generates SLSA Build Provenance v1 metadata. Anyone can later verify the
 bundle with `aicr verify` to confirm:
 
-* The files listed in `checksums.txt` haven't been tampered with (recipe.yaml is excluded, #1549).
+* The generated payload files listed in `checksums.txt`, including `recipe.yaml`, haven't been tampered with.
 * It was created by a trusted identity.
 * It was built by an attested NVIDIA-CI-released AICR CLI.
 
@@ -88,7 +88,7 @@ permissions.
 
 ```text
 my-bundle/
-├── checksums.txt                          # SHA256 of every listed file (excludes recipe.yaml, #1549)
+├── checksums.txt                          # SHA256 of every generated payload file
 ├── recipe.yaml                            # canonical post-resolution recipe
 ├── deploy.sh                              # automation script
 ├── README.md                              # deployment guide
@@ -105,10 +105,9 @@ The two attestations together form the chain that makes `verified` reachable:
 
 * **`bundle-attestation.sigstore.json`** — Sigstore Bundle (DSSE + Fulcio cert
   + Rekor inclusion proof). Its in-toto subject is the SHA256 of
-  `checksums.txt`, so signing this one file transitively pins every content
-  file that `checksums.txt` lists. The signer identity is the creator's OIDC
-  identity. (Caveat: `recipe.yaml` is currently written *after* `checksums.txt`
-  and is not yet covered — tracked in #1549.)
+  `checksums.txt`, so signing this one file transitively pins every generated
+  payload file that `checksums.txt` lists, including `recipe.yaml`. The signer
+  identity is the creator's OIDC identity.
 * **`aicr-attestation.sigstore.json`** — the SLSA Build Provenance attestation
   *of the AICR CLI binary that produced the bundle*, copied in at bundle time.
   Its signer identity is NVIDIA CI (`https://github.com/NVIDIA/aicr/.github/workflows/on-tag.yaml@...`).
@@ -143,7 +142,7 @@ Bundle verification: PASSED
 
 Five gates run, top to bottom:
 
-1. **Checksums** — every file listed in `checksums.txt` is hashed and compared (recipe.yaml is not yet listed — #1549).
+1. **Checksums** — every generated payload file listed in `checksums.txt`, including `recipe.yaml`, is hashed and compared.
 2. **Bundle signature** — the Sigstore Bundle is verified against the trusted root.
 3. **Bundle predicate** — the in-toto subject is checked against the actual `checksums.txt` digest.
 4. **Binary attestation chain** — `aicr-attestation.sigstore.json` is verified and its subject is checked against the CLI binary digest claimed in the bundle predicate.

demos/cuj2-demo.md

@@ -37,8 +37,8 @@
   │  recipe.yaml ──▶ bundle/                                               │
   │    ├── deploy.sh        (root automation script)                       │
   │    ├── README.md        (root deployment guide)                        │
-  │    ├── checksums.txt    (SHA256 of listed files; excludes recipe.yaml) │
-  │    ├── recipe.yaml      (resolved recipe; not yet in checksums, #1549) │
+  │    ├── checksums.txt    (SHA256 of all generated payload files)        │
+  │    ├── recipe.yaml      (resolved recipe; covered by checksums)        │
   │    ├── 001-agentgateway-crds/              (agentgateway.dev CRDs)     │
   │    ├── 002-agentgateway-crds-post/         (Gateway API + Inf-Ext CRDs)│
   │    ├── 003-aws-ebs-csi-driver/             (EBS storage)               │

demos/images/data.md

@@ -42,8 +42,7 @@ Visual: File system tree structure showing multiple component folders
 bundle/
 ├── deploy.sh                     # root automation script (executable)
 ├── README.md                     # root deployment guide
-├── checksums.txt                 # SHA256 of the listed bundle files (recipe.yaml is written
-│                                 # afterward and is not yet covered — see issue #1549)
+├── checksums.txt                 # SHA256 of every generated payload file
 ├── recipe.yaml                   # canonical post-resolution recipe
 ├── NNN-cert-manager/             # each folder is prefixed with its NNN deployment-order
 │   ├── install.sh                # index (computed from the dependency graph — e.g. cert-manager

docs/integrator/data-flow.md

@@ -385,8 +385,8 @@ RecipeResult
                                    CR, for components that ship one)
          - go:embed templates  -> per-component install.sh, and the root
                                    README.md + deploy.sh
+  -> write canonical recipe.yaml
   -> compute root checksums.txt over every emitted file
-     (recipe.yaml is written afterward and is not covered, #1549)
 ```
 
 `pkg/bundler/registry` exists but is **not** used by the production path: the
@@ -507,7 +507,8 @@ The `deploymentOrder` field in recipes specifies component deployment sequence.
 bundle-output/
 ├── README.md                    # Root deployment guide with ordered steps
 ├── deploy.sh                    # Automation script (0755)
-├── checksums.txt                # SHA256 of all listed files (recipe.yaml excluded, #1549)
+├── recipe.yaml                  # Canonical post-resolution recipe
+├── checksums.txt                # SHA256 of all generated payload files
 ├── 001-cert-manager/
 │   ├── install.sh               # Per-folder install script (0755)
 │   ├── values.yaml              # Static Helm values
@@ -584,7 +585,7 @@ spec:
 │ Complete Bundle + Deploy Flow                                │
 ├──────────────────────────────────────────────────────────────┤
 │                                                              │
-│  aicr bundle -r recipe.yaml --deployer argocd \            │
+│  aicr bundle -r recipe.yaml --deployer argocd \              │
 │    --repo https://github.com/my-org/my-repo.git -o ./out     │
 │                                                              │
 │  1. Parse recipe                                             │
@@ -599,13 +600,13 @@ spec:
 │     └─ network-operator → values.yaml, manifests/            │
 │                                                              │
 │  4. Run deployer (argocd) → numbered NNN-<name>/ folders     │
-│     ├─ 001-cert-manager/application.yaml (wave: 0)          │
-│     ├─ 002-gpu-operator/application.yaml (wave: 1)          │
-│     └─ 003-network-operator/application.yaml (wave: 2)      │
+│     ├─ 001-cert-manager/application.yaml (wave: 0)           │
+│     ├─ 002-gpu-operator/application.yaml (wave: 1)           │
+│     └─ 003-network-operator/application.yaml (wave: 2)       │
 │     └─ app-of-apps.yaml (bundle root, uses --repo URL)       │
 │                                                              │
 │  5. Generate checksums                                       │
-│     └─ checksums.txt (root; all listed files, no recipe.yaml)│
+│     └─ checksums.txt (root; all emitted Argo CD files)       │
 │                                                              │
 └──────────────────────────────────────────────────────────────┘
 ```

docs/integrator/openshift.md

@@ -146,7 +146,7 @@ ocp-bundle/
 ├── undeploy.sh                             # Cleanup script
 ├── README.md                               # Bundle documentation
 ├── recipe.yaml                             # Recipe used to generate bundle
-├── checksums.txt                           # SHA256 of all listed files (recipe.yaml excluded, #1549)
+├── checksums.txt                           # SHA256 of all generated payload files, including recipe.yaml
 │
 │   # ── Per-operator three-folder cycle ──
 │

docs/integrator/supply-chain-verification.md

@@ -305,8 +305,8 @@ release.
 ### Bundle attestation
 
 When `aicr bundle` runs with `--attest`, it signs the bundle using Sigstore
-keyless OIDC, binding the bundle creator's identity to the files listed in `checksums.txt`
-(recipe.yaml is currently excluded, #1549) and the binary that produced it (via
+keyless OIDC, binding the bundle creator's identity to the generated payload
+files listed in `checksums.txt`, including `recipe.yaml` in Helm bundles, and the binary that produced it (via
 `resolvedDependencies`). Attestation is opt-in; bundles are unsigned by
 default. The bundle output includes `bundle-attestation.sigstore.json`
 (SLSA Build Provenance v1 for the bundle) and a copy of the binary's

docs/user/artifact-verification.md

@@ -53,7 +53,7 @@ aicr verify ./my-bundle
 
 Under the hood this runs three checks:
 
-1. **Checksums**: every file listed in `checksums.txt` is hashed and matched (recipe.yaml is not yet listed — #1549).
+1. **Checksums**: every generated payload file listed in `checksums.txt`, including `recipe.yaml` in Helm bundles, is hashed and matched.
 2. **Bundle attestation**: the bundle's signature is verified against the Sigstore trusted root.
 3. **Binary attestation**: the provenance chain is verified with identity pinned to NVIDIA CI.
 

docs/user/cli-reference.md

@@ -1747,7 +1747,7 @@ Use `--dynamic` for values that genuinely vary per cluster — cluster names, su
 | Cluster-specific value (varies per deployment) | `--dynamic` | `--dynamic alloy:clusterName` |
 | Static override (same for all deployments of this bundle) | `--set` | `--set gpuoperator:driver.version=580.105.08` |
 
-> **Attestation scope:** Dynamic values are supplied at install time and are **not covered by `--attest`**. Attestation binds the files listed in `checksums.txt` (recipe.yaml excluded, #1549), not operator-provided overrides. If you need to constrain dynamic values at deploy time, use admission control or Argo sync hooks — see [Attestation Scope](#attestation-scope).
+> **Attestation scope:** Dynamic values are supplied at install time and are **not covered by `--attest`**. Attestation binds the generated payload files listed in `checksums.txt`, including `recipe.yaml` in Helm bundles, not operator-provided overrides. If you need to constrain dynamic values at deploy time, use admission control or Argo sync hooks — see [Attestation Scope](#attestation-scope).
 
 ```shell
 --dynamic component:path.to.field
@@ -2169,7 +2169,7 @@ When `--attest` is passed, the bundle command performs five steps:
 1. **Verifies the binary attestation file exists** — The running `aicr` binary must have a valid SLSA provenance file (`aicr-attestation.sigstore.json`) alongside it, included by the install script from a release archive. If missing, the command fails immediately with guidance on how to install correctly.
 2. **Acquires a signing credential** — in the default keyless mode this is an OIDC token (see [OIDC Token Sources](#oidc-token-sources) below); with `--signing-key` this step instead resolves the KMS key and no OIDC token is acquired (see [KMS-Backed Signing](#kms-backed-signing)).
 3. **Verifies the binary's own attestation** — Cryptographically verifies the SLSA provenance binds to the running binary and was signed by NVIDIA CI. This ensures only NVIDIA-built binaries can produce attested bundles.
-4. **Signs the bundle** — Creates a SLSA Build Provenance v1 in-toto statement binding the creator's identity to the files listed in `checksums.txt` (recipe.yaml is currently excluded, #1549) and the binary that produced it.
+4. **Signs the bundle** — Creates a SLSA Build Provenance v1 in-toto statement binding the creator's identity to the generated payload files listed in `checksums.txt`, including `recipe.yaml` in Helm bundles, and the binary that produced it.
 5. **Writes attestation files** — `attestation/bundle-attestation.sigstore.json` and `attestation/aicr-attestation.sigstore.json` are added to the bundle output.
 
 Attestation is opt-in; bundles are unsigned by default. By default, signing uses Sigstore keyless signing (Fulcio CA + Rekor transparency log) and records the entry in **Rekor v2** (the signing config is fetched from Sigstore's TUF repository, so shard rotation is handled automatically; a cold cache is fetched on demand). Verifying such bundles with `aicr verify` needs only the `aicr` binary; verifying them with `cosign verify-blob-attestation` needs Cosign v3.0.1+. For CI/CD environments without OIDC, pass `--signing-key` to sign with a cloud KMS key instead; see [KMS-Backed Signing](#kms-backed-signing) below. For verification, see [`aicr verify`](#aicr-verify).
@@ -2296,7 +2296,7 @@ HashiCorp Vault (`hashivault://`) is not supported: its client libraries are MPL
 
 ##### Attestation Scope
 
-Attestation binds the files listed in `checksums.txt` (recipe.yaml is currently excluded, #1549; the attestation files are verified separately) — defaults, dynamic-value stubs, and any external `--data` files copied into the bundle. It does **not** bind install-time values supplied via `helm --set`, a user-provided `-f extra.yaml`, or Argo `Application.spec.source.helm.parameters`. That boundary is intentional: dynamic values are the operator's domain by design.
+Attestation binds the generated payload files listed in `checksums.txt` — including `recipe.yaml` in Helm bundles, defaults, dynamic-value stubs, and any external `--data` files copied into the bundle. The attestation files are verified separately. It does **not** bind install-time values supplied via `helm --set`, a user-provided `-f extra.yaml`, or Argo `Application.spec.source.helm.parameters`. That boundary is intentional: dynamic values are the operator's domain by design.
 
 If you need to enforce specific install-time values (e.g., pinning `driver.version`), that is a **policy concern**, not an attestation one. Use admission control (Kyverno, Gatekeeper) or Argo sync hooks to reject deployments that violate the policy. `aicr verify` checks bundle integrity and provenance; it does not evaluate install-time value constraints.