Review six release claims

Objectives

Six release dossier claims await approval. The manager says every claim mentioning a signature or a security acronym should pass. Evaluate whether each claim supports its stated conclusion, not whether the terminology sounds reassuring.

Accept claims with sufficient scoped evidence. For a rejection choose the most specific reason: origin for resolver trust-boundary errors, binding for missing byte identity, assurance for unsupported build-level claims, or applicability for unsupported exploitability conclusions.

Verdicts are accept or reject. Every rejection needs one reason code from: origin | binding | assurance | applicability.

SC-1 | Internal namespace can fall back to a public registry when a public package has the highest version; this prevents dependency confusion.
SC-2 | Release SBOM records exact component versions and dependency edges, declares scope, and identifies the deployed artefact by verified digest.
SC-3 | A valid artefact signature alone proves this build meets SLSA v1.0 Build L3; no builder isolation evidence is needed.
SC-4 | The retained SBOM is associated only with a mutable release label; no digest links it to deployed bytes, but it proves their inventory.
SC-5 | A not-affected VEX decision needs no technical justification because the download has a valid signature.
SC-6 | A high affected finding is due 168 hours after confirmed detection; closure requires evidence that the corrected version is deployed.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

1. Step 1

   Read the request before the artefact

   Read each line as an assertion with a specific conclusion. Useful evidence can still be insufficient for that conclusion.

2. Step 2

   Judge every line, including the boring ones

   Account for every dossier line exactly once, including those that already meet the requirements.

   Every line in the fixture carries a verdict

3. Step 3

   Separate what is wrong from what is merely ugly

   Compare the claimed protection against the failure it would actually prevent. Avoid treating an authenticity result as a universal safety result.

   Accept and reject land on the right lines

4. Step 4

   Say why, in the vocabulary the programme uses

   For rejected claims, map the missing control to the supplied reason definitions rather than choosing a code merely because a word appears in the line.

   Each rejection cites a valid reason code

Rules summary

• XP on pass

  40 bonus XP the first time every check goes green.

• Paid hints

  2 available. Each costs 25% of the lab XP (about 10 XP).

• Reveal solution

  Scores 0 XP and unlocks only after 3 check runs.

• Attempt cap

  60 check runs per learner. The runner warns you in the last 10.

• Drafts

  Your editor content is saved in this browser, so a reload will not lose work.

• Walkthrough

  Always free and never penalised: use it before spending a hint.