# Re-sign an existing serviceification candidate

Candidate generation owns immutable artifact bytes, source identity, the exact
producer run and its receipt. Publication owns the reviewed signing policy and
signer. Updating that policy does not require rebuilding the candidate.

Run `publish-serviceification-test-stack.yml` from reviewed main with the
successful `producer_run_id`, its `producer_run_attempt`, and `subject_role`
(`frontend` or `resolved_bom`). The publisher derives the original source ref,
commit, OCI digest and binding from that run. Do not rebuild or rewrite a receipt
to make its source commit match the publication controller.

The isolated signing gate validates the producer run once. It executes the
verifier from a fixed reviewed authority revision, treating producer files as
data. `release/serviceification-image-signing-policy.json` is the sole owner of
`approved_producer_closures`: exact reviewed build-code digests eligible for
signing. Retain an existing digest to re-sign its candidates; remove it to deny
new signatures from that build implementation. A new build implementation must
have its digest reviewed in the same change. The producer receipt still binds
and verifies every original build-code file, source, run, subject and binding.

The v3 signature carries the signing policy bytes and their digest, plus the
exact authority revision. Provenance binds that same authority to the original
artifact source. Verifiers authenticate these facts with the pinned owner KMS
public key; they do not require policy bytes from the producer checkout to equal
the policy used later for signing. Historical v1/v2 signatures retain their
original verification rules. Policy-only re-signing may add signatures to one
unchanged digest; it does not replace or rebuild its OCI manifest or SBOM.

The caller no longer repeats the signing gate, and the signer no longer requires
publisher and producer commits/branches or policy files to match. KMS/OIDC
identity, approved producer code, immutable subject/receipt binding, provenance,
SBOM and post-sign verification remain enforced.

AWS trusts the repository and the named reusable signing workflow on
`refs/heads/main`, not a commit hash. The caller uses that workflow at `@main`;
its OIDC identity and the signing policy use the canonical `@refs/heads/main`.
Repository, audience, workflow path and reviewed-branch restrictions remain
explicit. Ordinary main updates require no IAM trust rotation. Historical
signatures that name a pinned workflow commit remain verifiable.