# SPDX-License-Identifier: AGPL-3.0-or-later
# Scoped gitleaks allowlist — fingerprints only, each with a stated reason.
# This is NOT a blanket mute: any new finding not listed here still fails the
# CI gate, the pre-commit hook, and the scheduled full-history scan.
#
# site/sample-packet/bundle.json ships a synthetic demo evidence packet (no real
# tenant data — see `make demo` / docs/productionization.md) that embeds base64
# RFC 3161 CMS timestamp tokens ("token_b64"). Their high entropy trips
# gitleaks' generic-api-key heuristic; they are DER-encoded timestamp tokens
# from the bundled DevTSA, not credentials. Verified by hand on 2026-07-05
# (decodes as ASN.1 SEQUENCE / CMS SignedData, not a key/token format).
bd2e8596b0c2bfcedefd39a94fd9745e4bd66863:site/sample-packet/bundle.json:generic-api-key:1
# tests/golden/packet-v3 is generated by scripts/make_golden_packet.py from
# synthetic media, a local self-signed RFC 3161 test authority, and a per-case
# HMAC order token. Both high-entropy test values share this exact one-line
# finding fingerprint; neither is a credential. Reviewed 2026-07-10.
cf55f34c7ad4f29b097c90b7187b37f66d56b2f9:tests/golden/packet-v3/bundle.json:generic-api-key:1

# PR #80 rebased history: both packet generations contain only synthetic RFC 3161
# CMS SignedData tokens. The later commit upgrades the sample from packet v2 to v3;
# neither finding is a credential. Reviewed 2026-07-10.
8f831229472e3ab605c78f26daa417e12f4984e7:site/sample-packet/bundle.json:generic-api-key:1
b1f6a922e793eb226f67a0e7e71a123c096bcc56:site/sample-packet/bundle.json:generic-api-key:1

# Packet-v4 regeneration for the profile-driven workflow release. The one-line
# canonical JSON contains three public RFC 3161 CMS SignedData values and opaque
# per-case ordering tokens. Gitleaks reports five matches under this one exact
# commit/file/rule/line fingerprint; none is a credential. Reviewed 2026-07-23.
fecb126250590a097de19d01256d777db296a213:site/sample-packet/bundle.json:generic-api-key:1

# tests/golden/packet-v4 (issue #160): the committed fixture that pins the format
# habitable actually emits. scripts/make_golden_packet.py builds it from
# synthetic media, a local self-signed RFC 3161 test authority ("golden-tsa"),
# and a fixed clock -- no real tenant data and no credential. Its one-line
# canonical JSON produces three matches under this one exact
# commit/file/rule/line fingerprint; each was decoded and identified by hand on
# 2026-08-14 before this entry was written:
#   * two `items[].timestamp.token_b64` values (entropy 5.88 / 5.87) -- both
#     load as CMS SignedData whose encapsulated content type is
#     1.2.840.113549.1.9.16.1.4 (id-ct-TSTInfo), i.e. RFC 3161 timestamp tokens
#     from the local test authority, not key or credential material;
#   * one `relationships[].order_token` value, "hlc-<16 hex>" (entropy 3.78) --
#     the pseudonymized hybrid-logical-clock ordering label `packet.opaque_hlc`
#     writes so the shared bundle leaks neither device wall-clock time nor the
#     node id. It is derived from the per-case salt and is an ordering label, not
#     a secret; it grants nothing.
# Same rule, same cause, and same review as the packet-v3 entry above.
d4771afeaf9e628c1d63432d4cc2cface8121803:tests/golden/packet-v4/bundle.json:generic-api-key:1
