REF-073: Cryptographic Registry Provenance
REF-073: Cryptographic Registry Provenance
Citation
McCann, A. L. (2026). Cryptographic Registry Provenance: Structural Defense Against Dependency Confusion in AI Package Ecosystems. arXiv:2605.03309v2. https://arxiv.org/abs/2605.03309
Local source corpus: `/home/roctinam/dev/research/research-papers` REF-1814.
Document Profile
| Attribute | Value |
|---|---|
| Year | 2026 |
| Type | arXiv preprint |
| Source status | Full PDF/text archived in local research corpus |
| GRADE / Quality | B - technically coherent preprint; not peer reviewed at induction time |
| AIWG Relevance | High - Direct model for registry identity and namespace binding |
Executive Summary
McCann frames dependency confusion as a missing distribution-provenance problem. The proposed defense gives registries cryptographic identities, has publishers sign provenance manifests, has registries countersign publication events, and lets consumers pin authoritative registry fingerprints for namespaces.
For AIWG, this is relevant because web-backed resources create a first-party registry-like surface. Signing the release manifest proves integrity under the AIWG trust root, but higher-assurance deployment may also need explicit distribution authority: which host, key, and namespace were authorized to serve which resource family.
AIWG Implementation Mapping
| Paper Concept | AIWG Resource Implication |
|---|---|
| Registry identity | Publish and pin release-host signing identity |
| Publisher signature | AIWG release signing key signs manifests |
| Registry countersignature | Future release-host attestation can bind publication event |
| Namespace binding | Restrict `aiwg://frameworks`, `aiwg://addons`, and `aiwg://core` to first-party authority |
| Resolver enforcement | Reject resources whose host/key/path do not match first-party policy |
Design Implications
- Treat release host identity as part of the trust contract, not just a URL.
- Keep logical resource IDs separate from physical URLs so resolver policy can
enforce first-party ownership.
- Consider registry/publication attestations as a future layer above the
current signed manifest.
Cross-References
- REF-072: TUF protects update metadata and rollback-sensitive publication.
- REF-074: Provenance graph verification complements artifact and registry
signatures.
- REF-075: Agent skills need content-level review in addition to provenance.
- `src/resources/resolver.ts`: AIWG logical resource resolver.