发布管道防篡改治理（Artifacts-签名-不可变存储）最佳实践

实现示例type Artifact = { name: string; sha256: string; sig?: { alg: string; kid: string; b64: string } } function hex64(h: string): boolean { return /^[A-Fa-f0-9]{64}$/.test(h) } function valid(a: Artifact): boolean { return !!a.name && hex64(a.sha256) && (!a.sig || (a.sig.alg === 'RS256' && !!a.sig.kid && /^[A-Za-z0-9+/=]+$/.test(a.sig.b64))) } function immutableWrite(store: Map<string, Artifact>, a: Artifact): boolean { if (!valid(a)) return false if (store.has(a.name)) return false store.set(a.name, a) return true } 审计与运行治理存储策略不可变：写入后禁止覆盖；异常需新版本与审计记录。发布前后校验哈希与签名；不一致阻断并回滚到最近可信版本。