Add deterministic C++ release artifacts

Author: sukujgrg

Makefile

@@ -58,6 +58,7 @@ endif
 .PHONY: test-integration-adapters test-syslog-adapters
 .PHONY: test-conformance test-cli test-integration test-syslog test-deadline
 .PHONY: test-openssh test-live test-sanitize test-fuzz-smoke fuzz _fuzz-smoke test-readme check
+.PHONY: test-release release-metadata release-package
 .PHONY: dependencies-check crypto-check fuzz-check diagnostics verify-binary clean _not-implemented FORCE
 
 build: $(BINARY)
@@ -195,12 +196,26 @@ diagnostics: dependencies-check crypto-check
 	@echo "libcrypto=$$($(PKG_CONFIG) --modversion libcrypto)"
 	@$(PYTHON) -c 'import json; value=json.load(open("third_party/dependencies.json")); print(" ".join(item["name"]+"="+item["version"] for item in value["dependencies"]))'
 
-check: dependencies-check test build verify-binary
+check: dependencies-check test build verify-binary test-release
 
 verify-binary: build
 	@test "$(TARGET)" = "$(HOST_SYSTEM)-$(HOST_ARCH)" || { echo "verify-binary requires the host target" >&2; exit 1; }
 	$(PYTHON) scripts/verify_binary.py --binary "$(BINARY)" --target "$(TARGET)" --version "$(VERSION)" --revision "$(REVISION)" --source-date-epoch "$(SOURCE_DATE_EPOCH)"
 
+release-metadata: verify-binary
+	$(PYTHON) scripts/package_release.py --cxx "$(CXX)" --pkg-config "$(PKG_CONFIG)" \
+		--dist "$(DIST_DIR)" --version "$(VERSION)" --revision "$(REVISION)" \
+		--source-date-epoch "$(SOURCE_DATE_EPOCH)" --target "$(TARGET)"
+
+test-release: release-metadata
+	$(PYTHON) scripts/release_package_test.py "$(CXX)" "$(PKG_CONFIG)" "$(DIST_DIR)" \
+		"$(VERSION)" "$(REVISION)" "$(SOURCE_DATE_EPOCH)" "$(TARGET)" "$(PYTHON)"
+
+release-package: check
+	$(PYTHON) scripts/package_release.py --cxx "$(CXX)" --pkg-config "$(PKG_CONFIG)" \
+		--dist "$(DIST_DIR)" --version "$(VERSION)" --revision "$(REVISION)" \
+		--source-date-epoch "$(SOURCE_DATE_EPOCH)" --target "$(TARGET)" --archive
+
 test-openssh: build
 	$(PYTHON) tests/integration/openssh_authorized_keys_test.py \
 		"$(OPENSSH_TEST_BINARY)" "$(CREDBIND_GO_ROOT)"

README.md

@@ -20,6 +20,7 @@ make build
 make test-unit
 make dependencies-check
 make verify-binary
+make test-release
 ```
 
 The command now also contains the bounded configuration, CLI and local-syslog
@@ -40,6 +41,18 @@ requires that command to be root-owned and not group/world writable. A local
 checkout binary therefore fails closed; provide an explicitly installed test
 copy with `OPENSSH_TEST_BINARY=/absolute/path` rather than using a wrapper.
 
+`make release-metadata` deterministically writes the verifier checksum, exact
+vendored/system dependency license inventory and redistributed license texts,
+an SPDX 2.3 SBOM and an in-toto/SLSA v1 provenance statement below the selected
+target directory. `make release-package VERSION=vMAJOR.MINOR.PATCH` also
+requires an exact clean `HEAD` and matching source epoch, then creates a
+normalized timestamp/owner/mode archive and archive checksum. These outputs
+also pin the immutable conformance artifact, manifest and specification
+revision as provenance materials. They are deliberately unsigned; platform
+signing and publication remain separate
+owner-controlled release operations and are never a side effect of
+`make check`.
+
 `make test-live` extends that same joint harness only for the four accepted
 Google/Auth0 workload cells. It consumes an owner-provided protected Go
 initialization request and existing ADC/native-store credentials, requires the

scripts/check_dependencies.py

@@ -33,6 +33,7 @@ def main() -> None:
 			dependency.get("name") != "OpenSSL libcrypto"
 			or dependency.get("minimum_version") != "3.0.0"
 			or dependency.get("api_baseline") != "OpenSSL 3.0"
+			or dependency.get("license") != "Apache-2.0"
 			or dependency.get("linkage") != "dynamic system libcrypto only"
 			or dependency.get("pkg_config") != "libcrypto"
 			or dependency.get("prohibited_linkage")