Tracepack is local-first: your projects and evidence files live in your browser's IndexedDB storage. Nothing is uploaded anywhere by default: there is currently no server, no account, and no cloud sync.

Every piece of evidence gets a SHA-256 contentHash. Attachments coming through the tracepack-evidence interchange contract get two separate hashes:

• Attachment integrity (content_hash): SHA-256 of the original binary bytes. Proves the bytes weren't altered relative to what was hashed.
• Payload consistency (integrity.payload_hash): SHA-256 of the RFC 8785 canonical form of the structured claims. Proves the structured data (observations, timestamps, metadata) wasn't altered relative to what was hashed.

Neither proves who sent the data, or that any claim inside it is true. See packages/evidence-interchange/SPEC.md §5 and §13 for the full reasoning.

A payload's source.producer_id and source.producer_name are declared by the producer, not cryptographically authenticated by Tracepack. Nothing currently stops a different producer from claiming the same producer_id. Tracepack's UI and exports are written to never imply otherwise: look for "self-asserted" and "not cryptographically verified" language anywhere producer identity is shown. If you find a place where this isn't true (a verification badge shown without actual verification behind it, or wording that overstates what a hash proves), that's a real bug and should be reported (see below).

When an interchange payload has no attachments, Tracepack synthesizes a deterministic text/plain rendering of the producer's claims to satisfy the one-evidence-item-one-file model. That rendering is generated by Tracepack, not supplied by the producer; it says so explicitly in its own text ("GENERATED BY TRACEPACK... not an original document"). Its hash proves the rendering is intact, never that an original external document existed.

TracePack Attestation v1 is separate from the tracepack-evidence producer identity model.

A pack attestation binds a signed statement to one immutable pack subject digest. @tracepack/pack-attestation constructs deterministic pack snapshots and verifies the included evidence bytes against their recorded SHA-256 hashes before creating that subject. @tracepack/attestation-sigstore can then sign or verify the statement using Sigstore.

A successfully verified Sigstore attestation can authenticate the signing identity represented by the certificate and can be evaluated against explicit signer and multi-attestation policy. It does not prove that a self-asserted producer identity inside an evidence payload is genuine, that an evidence item or observation is factually true, or that the signer created the original evidence.

See packages/attestation/SPEC.md for the normative Attestation v1 rules.

Tracepack uses npm provenance for public developer packages released from the public GitHub repository. The provenance statement is created from GitHub Actions workload identity and can be checked through npm. Release files are also signed without a long lived signing key and published with a Sigstore bundle that can be verified with cosign. See docs/VERIFYING_RELEASES.md for the identity pinned verification command.

This proves that a software release came from the named public repository and release workflow. It does not prove that an evidence payload came from that software, identify the person who created evidence, or prove that a claim is true. TracePack does not send evidence file contents or support conversations to Sigstore as part of attestation signing. Sigstore signing does process the canonical attestation statement, which contains its subject digest, and transparency-log upload is enabled by default. Do not place secrets or unnecessary personal data in attestation statements.

The release workflow is intentionally restricted to ace2016/tracepack. Running the same file from the private development repository cannot publish a Tracepack package.

Cryptographically authenticating the producer identity declared by a tracepack-evidence v1 payload remains deliberately out of scope for that contract. Software release provenance and pack attestations must not be presented as producer or payload authentication.

No home-grown signing cryptography will be added for evidence producers.

Please report security issues privately rather than as a public GitHub issue. Open a private security advisory on this repository.

Please include:

• What you found and why it's a security issue (not just a bug)
• Steps to reproduce
• What you'd expect to happen instead

We'll acknowledge reports and aim to respond with next steps promptly. Please don't publicly disclose a vulnerability before it's been addressed.

In scope: the packages and apps in this repository (apps/, packages/, examples/).

Out of scope: issues that require physical access to an already-unlocked device, or that rely on a compromised browser/OS. Tracepack's local-first model assumes the browser environment itself is trusted, the same way any browser-based application does.