From b6a9e2be02d8c67ac6ff6e00c1cb5ed138800908 Mon Sep 17 00:00:00 2001
From: "Jayper.Z" <zjp@ppl.shop>
Date: Tue, 21 Jul 2026 10:32:29 +0800
Subject: [PATCH] fix: publish current VM RC on Pages

---
 scripts/verify-pages-releases.py |  7 +++++--
 tests/test_pages_provenance.py   | 25 ++++++++++++++++++++++++-
 2 files changed, 29 insertions(+), 3 deletions(-)

diff --git a/scripts/verify-pages-releases.py b/scripts/verify-pages-releases.py
index f723fbf..5afb18f 100755
--- a/scripts/verify-pages-releases.py
+++ b/scripts/verify-pages-releases.py
@@ -76,8 +76,9 @@
         "ARTIFACT_CLASS", "OPENWRT_VERSION", "TARGET", "MODE", "VM_ONLY",
         "NOT_AX9000_FIRMWARE", "HARDWARE_VALIDATION", "NSS_VALIDATION",
         "VALIDATION_SCOPE", "IMAGEBUILDER_URL", "IMAGEBUILDER_SHA256",
-        "RELEASE_TAG", "RELEASE_VERSION", "SSH_DEFAULT", "SSH_AUTHORIZED_KEYS",
-        "RELEASE_CONTRACT", "PUBLISHED_VARIANTS", "ESXI_VALIDATION",
+        "RELEASE_TAG", "RELEASE_VERSION", "RELEASE_CHANNEL", "PROJECT_COMMIT",
+        "SSH_DEFAULT", "SSH_AUTHORIZED_KEYS", "RELEASE_CONTRACT",
+        "PUBLISHED_VARIANTS", "ESXI_VALIDATION",
     },
 }
 VM_SMOKE_REPORT_KEYS = {
@@ -811,6 +812,8 @@ def verify_vm_candidate(gh: Path, candidate: tuple[int, str, str, str, int, dict
         if contract_version == VM_CONTRACT_V2:
             expected_labels.update({
                 "RELEASE_CONTRACT": "vm-x86_64/v2",
+                "RELEASE_CHANNEL": "rc",
+                "PROJECT_COMMIT": source_digest,
                 "PUBLISHED_VARIANTS": VM_PUBLISHED_VARIANTS,
                 "ESXI_VALIDATION": "not-tested",
             })
diff --git a/tests/test_pages_provenance.py b/tests/test_pages_provenance.py
index 59929e7..d4b12fd 100755
--- a/tests/test_pages_provenance.py
+++ b/tests/test_pages_provenance.py
@@ -216,6 +216,8 @@ def vm_evidence_payloads(version: str = "v0.1.0-rc.1", *,
     else:
         labels.update({
             "RELEASE_CONTRACT": "vm-x86_64/v2",
+            "RELEASE_CHANNEL": "rc",
+            "PROJECT_COMMIT": "c" * 40,
             "PUBLISHED_VARIANTS": module.VM_PUBLISHED_VARIANTS,
             "ESXI_VALIDATION": "not-tested",
         })
@@ -658,13 +660,34 @@ def fake_attestation(gh: Path, subject: Path, bundle: Path, tag: str, digest: st
         "draft": False, "prerelease": False, "immutable": True, "published_at": "2026-07-19T02:00:00Z", "assets": [],
     }
     assert module.vm_candidate_assets(invalid_stable) is None
-    for key in ("RELEASE_CONTRACT", "PUBLISHED_VARIANTS", "ESXI_VALIDATION"):
+    assert len(module.VM_ARTIFACT_LABEL_KEYS[module.VM_CONTRACT_V2]) == 20
+    for key in (
+        "RELEASE_CONTRACT", "RELEASE_CHANNEL", "PROJECT_COMMIT",
+        "PUBLISHED_VARIANTS", "ESXI_VALIDATION",
+    ):
         expect_verification_error(
             lambda key=key: verify_vm_fixture(
                 vm_evidence_payloads(contract_version=2, missing_label=key), contract_version=2,
             ),
             f"v2 artifact labels accepted missing contract key: {key}",
         )
+    for key, value in (
+        ("RELEASE_CHANNEL", "stable"),
+        ("PROJECT_COMMIT", "d" * 40),
+    ):
+        expect_verification_error(
+            lambda key=key, value=value: verify_vm_fixture(
+                vm_evidence_payloads(contract_version=2, label_updates={key: value}), contract_version=2,
+            ),
+            f"v2 artifact labels accepted an unbound contract value: {key}={value}",
+        )
+    expect_verification_error(
+        lambda: verify_vm_fixture(
+            vm_evidence_payloads(contract_version=2, label_updates={"UNSUPPORTED_LABEL": "true"}),
+            contract_version=2,
+        ),
+        "v2 artifact labels accepted an unknown extra key",
+    )
     for key in ("release_contract", "raw_bios_file", "iso_bios_qemu", "vmdk_efi_file", "esxi_validation"):
         expect_verification_error(
             lambda key=key: verify_vm_fixture(