diff --git a/engine/web/src/admission/signing.jsx b/engine/web/src/admission/signing.jsx index 1c72326..bad6457 100644 --- a/engine/web/src/admission/signing.jsx +++ b/engine/web/src/admission/signing.jsx @@ -191,18 +191,34 @@ function SigningRow({ r, strength: repoStrength }) { )} - - - {prov.word} - - {provInfo ? ( - - {" \u{00B7} "} - {provInfo["builder-short"]} + {r.provenance === "absent" ? ( + // Almost no image ships a SLSA build-provenance attestation, so an "absent" chip would + // shout "no provenance" on nearly every row — pure noise. The calm default reads as a + // quiet muted dash (mirroring the no-signer cell); the loud chip is kept only for the + // meaningful states (verified / unverifiable / checking). The expandable detail still + // explains the absence for anyone who looks. + + {"\u{2014}"} - ) : null} + ) : ( + <> + + + {prov.word} + + {provInfo ? ( + + {" \u{00B7} "} + {provInfo["builder-short"]} + + ) : null} + + )} {repoStrength === "unknown" ? ( diff --git a/engine/web/test/admission.test.jsx b/engine/web/test/admission.test.jsx index a8a2338..d08da97 100644 --- a/engine/web/test/admission.test.jsx +++ b/engine/web/test/admission.test.jsx @@ -85,6 +85,44 @@ describe("Admission honesty", () => { }); }); +describe("Provenance column is quiet by default", () => { + // Almost no image ships a SLSA attestation, so an "absent" chip on every row is pure noise — the + // calm default reads as a muted dash, never the loud "no provenance" chip. + it("renders an ABSENT-provenance image as a muted dash, not the no-provenance chip", () => { + const { container } = render( + , + ); + const cell = container.querySelector('tr[data-signing="img-a"] .cell-provenance'); + expect(cell).toBeTruthy(); + expect(cell.getAttribute("data-provenance")).toBe("absent"); // still honestly tagged + expect(cell.querySelector(".gate-chip")).toBeNull(); // but no loud chip + expect(cell.textContent).not.toContain("no provenance"); + expect(cell.textContent).toContain("—"); // a quiet dash + }); + + it("still renders the loud chip for a VERIFIED build provenance", () => { + const { container } = render( + , + ); + const cell = container.querySelector('tr[data-signing="img-a"] .cell-provenance'); + expect(cell.querySelector(".gate-chip.prov-verified")).toBeTruthy(); + expect(cell.textContent).toContain("org/repo"); + }); +}); + describe("Admission escaping", () => { it("renders an XSS subject/image/signer identity as inert text", () => { window.__pwned = undefined;