refactor: consolidate Debian official evidence registry

[SSobol77]

Summary

Consolidate the Debian official-source evidence registry.

This is a behavior-preserving refactor. It does not add new official evidence records, does not promote new mappings, and does not change generated evidence semantics.

What changed

• Replaced repeated literal Debian official evidence dictionaries with:

  • DebianOfficialEvidenceSpec
  • DEBIAN_OFFICIAL_EVIDENCE_SPECS
  • _debian_official_evidence_entry()
  • derived OFFICIAL_DISTRO_EVIDENCE_BY_POLICY

• Centralized common official evidence fields:

  • official-distro-metadata
  • verified-official-source
  • distro-package-index
  • package-name-and-executable
  • external_verification_required_for_new_mappings = false
  • release_blocking = false
  • blocker_reason = None

Behavior preserved

Exactly six generated Debian evidence records remain verified-official-source:

• deb/yamllint
• deb/shellcheck
• deb/clang-tidy
• deb/cppcheck
• deb/clang-format
• deb/checkstyle

No Docker helper record is promoted.

No non-Debian mapping is promoted.

Registry contract

The official evidence registry is still keyed only by Debian package-manager policy keys:

("deb", "yamllint")
("deb", "shellcheck")
("deb", "clang-tidy")
("deb", "cppcheck")
("deb", "clang-format")
("deb", "checkstyle")

Tests now assert this exact registry key set and assert that no non-Debian official override exists.

Scope controls

This PR does not:

• add official evidence records
• promote additional mappings
• demote existing mappings
• change package names
• change executable names
• change URLs
• change OS_PACKAGE_NAMES
• change versions
• add checksums
• run package managers
• download anything
• perform network operations
• vendor binaries or archives
• add generated artifacts
• weaken verifier logic
• change promotion-gate policy
• touch UI/provider/parser/runtime/TextMate/theme code

Verifier behavior

The existing verifier and promotion-gate behavior are preserved.

Existing negative tamper tests continue to pass.

Validation

Passed locally / by agent report:

uv run ruff check src tests scripts
uv run ruff format --check src tests scripts
uv run python scripts/check_runtime_imports.py
uv run pytest -q tests/packaging/test_f4_linter_linux_provisioning.py
uv run pytest -q tests/packaging
uv run pytest -q tests/extensions/linters
uv run pytest -q tests/docs
git diff --check

Observed results:

tests/packaging/test_f4_linter_linux_provisioning.py: 117 passed
tests/packaging: 490 passed
tests/extensions/linters: 226 passed
tests/docs: 18 passed

Safety:

No new package names.
No OS_PACKAGE_NAMES changes.
No executable-name changes.
No URL changes.
No package versions as contract fields.
No checksums.
No package-manager calls.
No downloads.
No network operations.
No generated artifacts.
No vendored binaries.
No UI/provider/parser/runtime/TextMate/theme changes.

Next work

A follow-up PR can add a generic official-evidence drift snapshot/report helper before promoting additional distro families.

Summary by CodeRabbit

• Refactor

  • Improved the internal structure of Debian official evidence records while preserving existing packaging behavior.
  • Standardized evidence details across supported linting tools.

• Tests

  • Strengthened validation of Debian evidence records and their metadata.
  • Added checks ensuring the official evidence registry contains exactly the expected entries.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: baf7d401-1e49-42d6-a07c-95a0aebf66e6

📥 Commits

Reviewing files that changed from the base of the PR and between d771012 and 0a66484.

📒 Files selected for processing (2)

• scripts/f4_linter_linux_provisioning.py
• tests/packaging/test_f4_linter_linux_provisioning.py

---

📝 Walkthrough

Walkthrough

The Debian official evidence catalog is refactored into typed specifications and generated records. Tests now validate the exact registry keys, record metadata, and Debian artifact targeting.

Changes

Debian evidence registry

Layer / File(s)	Summary
Spec-driven evidence generation scripts/f4_linter_linux_provisioning.py	Defines typed Debian evidence specifications, converts them into canonical records, and rebuilds the registry through a dictionary comprehension.
Evidence registry validation tests/packaging/test_f4_linter_linux_provisioning.py	Adds canonical expected keys and verifies registry identity, classification fields, verification scope, and deb artifact targeting.

Estimated code review effort: 2 (Simple) | ~15 minutes

Possibly related PRs

• SSobol77/ecli#131: Adds promotion-gate and schema validation for the official-source metadata generated by this refactor.
• SSobol77/ecli#133: Extends the Debian shellcheck evidence entry and its related tests.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main refactor: consolidating the Debian official evidence registry.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/f4-linux-debian-official-evidence-registry

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud