Docs: Pin the verified Panama bootstrap

2026-08-27 10:14:55 -04:00
parent 0d1841cf86
commit dce00e45d1
5 changed files with 156 additions and 16 deletions
@@ -72,6 +72,28 @@ record both the reviewed archive digest and this reviewed installed-byte digest
 in `.panama-provenance`; later runs require the receipt and re-hash the installed
 binary before treating an existing directory as trusted.

+## Panama bootstrap
+
+The public desktop and server commands use the same committed `boot` blob:
+
+```text
+commit  0d1841cf86975d52485c94c0caa5d1b67e5c54a1
+SHA-256 fd8dcd70d1266da109972df346e3d85d1037f6f6e1942b0157064412ab892372
+URL     https://git.gbrown.org/gib/Panama/raw/commit/0d1841cf86975d52485c94c0caa5d1b67e5c54a1/boot
+```
+
+The digest was derived from the committed blob with:
+
+```bash
+git show 0d1841cf86975d52485c94c0caa5d1b67e5c54a1:boot | sha256sum
+```
+
+That implementation commit contains only `boot` and its boot/root-server
+contracts. The following documentation commit records the pin and does not
+contribute bytes to it. Rotate the bootstrap pin only through the same two-step
+sequence: commit the boot implementation first, derive its committed blob
+digest, then update the command and this ledger in a second commit.
+
 ## Rotation policy

 Do not replace a key on an automated update. A key rotation is a reviewed