docs: record v1.1.0-rc1 publication

Author: Zimbo88

docs/v1.1.0-rc1-publication-report.md

@@ -0,0 +1,143 @@
+# v1.1.0-rc1 Publication Report
+
+Date: 2026-07-31
+
+## Repository
+
+- Owner: `Zimbo88`
+- Repository: `stm32-security-lab`
+- URL: https://github.com/Zimbo88/stm32-security-lab
+- Visibility: `PUBLIC`
+- Default branch: `master`
+- Publication type: GitHub pre-release
+- Source commit: `b8b72f4e624d5139a18ac4c3d7ad17651b8d0139`
+
+The release represents the five-part hardening campaign as an open-source
+research-platform candidate. It is not a production-ready, certified, or
+formally verified security system.
+
+## Preflight
+
+The following checks were run on the release branch and again on the merged
+default branch:
+
+- `python3 tools/publication_scan.py --tracked`: clean; no error-level findings.
+- `python3 tools/check_no_private_keys.py`: passed; no tracked private-key material.
+- `python3 tools/check_documentation.py`: passed; no missing relative links.
+- `python3 tools/check_workflows.py`: passed; all four repository workflows parsed and passed policy checks.
+- Git history scan: no private Ed25519 seed, PEM private key, token, or credential was found.
+- `git diff --check`: passed.
+
+The current release tree excludes local flash dumps, hardware baselines, raw
+HIL logs, logic-analyzer captures, and local device data. Older research
+captures remain in historical commits that were already present in the public
+repository; history was not rewritten because no actual secret or credential
+was found. This is a documented historical-artifact limitation.
+
+The initial remote branch runs found two environment omissions. They were
+fixed without weakening tests:
+
+- `02acb00`: install the ARM GCC toolchain in the security-test workflow.
+- `9f764bd`: make PyYAML an explicit base test dependency.
+
+## Remote CI
+
+All required branch, PR, and post-merge checks passed.
+
+Branch checks for `9f764bd`:
+
+- CI: run `30647173093` — success
+- Firmware build: run `30647172936` — success
+- Security tests: run `30647173069` — success
+- Documentation and repository hygiene: run `30647173694` — success
+
+Pull request checks for PR #4:
+
+- CI: run `30647447104` — success
+- Firmware build: run `30647447089` — success
+- Security tests: run `30647447007` — success
+- Documentation and repository hygiene: run `30647447050` — success
+
+Post-merge `master` checks for `b8b72f4`:
+
+- CI: run `30647750622` — success
+- Firmware build: run `30647750586` — success
+- Security tests: run `30647750585` — success
+- Documentation and repository hygiene: run `30647750557` — success
+
+## Pull Request
+
+- PR: #4
+- URL: https://github.com/Zimbo88/stm32-security-lab/pull/4
+- Branches: `release/v1.1.0-rc1` → `master`
+- Merge commit: `b8b72f4e624d5139a18ac4c3d7ad17651b8d0139`
+- Merge method: normal merge commit
+- Merged: 2026-07-31
+
+## Release
+
+- Tag: `v1.1.0-rc1`
+- Tag target: `b8b72f4e624d5139a18ac4c3d7ad17651b8d0139`
+- Release URL: https://github.com/Zimbo88/stm32-security-lab/releases/tag/v1.1.0-rc1
+- Title: `STM32 Security Lab v1.1.0-rc1 — Security Hardening and Hardware Validation Candidate`
+- Status: pre-release, not draft, not a stable release
+- Published: 2026-07-31
+
+Published assets:
+
+- `v1.1.0-rc1.tar.gz` — release archive; SHA-256 `4ea5a01c3aa9f52bee7383a1def78c237925a1881e7865538fceeebc08bb7b87`
+- `SHA256SUMS`
+- `release-manifest.json`
+- `release-provenance.json`
+- `sbom.spdx.json`
+- `THIRD_PARTY_NOTICES.md`
+- `embedded-public-key.hex`
+- `public-key.hex`
+
+The release archive contains the checked bootloader, legacy image, Slot-A and
+Slot-B artifacts and signed example update packages. All signed examples use
+the synthetic CI test key and are explicitly not intended for production or
+for devices provisioned with another root key.
+
+Public fingerprints recorded in the manifest and release notes:
+
+- embedded public key: `482dd9daac3d406f779995a50a00eb2ac9948eb412cba4403e2f81091780499a`
+- synthetic signing test key: `56475aa75463474c0285df5dbf2bcab73da651358839e9b77481b2eab107708c`
+
+## Local reproducibility
+
+Two clean checkouts of the pre-merge release branch produced identical
+archives with SHA-256
+`91bdb2633f10d21fb2b32328b261ae361ca80b594f4dd0b698d848d71c57bc2d`.
+
+After merging, a fresh checkout of `master` ran `make test-fast`, built the
+release candidate, verified it, and produced the same final archive hash as
+the local merged checkout:
+
+`4ea5a01c3aa9f52bee7383a1def78c237925a1881e7865538fceeebc08bb7b87`
+
+This is local reproducibility evidence, not a claim of bit-for-bit
+reproducibility across arbitrary toolchains.
+
+## Security status
+
+- RDP2 was not enabled.
+- WRP was not enabled.
+- Option Bytes were not changed.
+- No private key was committed or uploaded.
+- Only public synthetic test-key material and test-key-signed examples were published.
+- No automatic RDP2 or WRP command was added or executed.
+
+## Known limitations
+
+- No complete controlled Power-Loss campaign was performed.
+- The final hardware corruption campaign remains incomplete.
+- The fully debugger-independent reset/recovery lifecycle was not completely proven because NRST availability was limited.
+- No external security review was performed.
+- No long-duration libFuzzer/AFL++ campaign was completed.
+- The platform is not production-qualified, certified, or suitable for arbitrary STM32 boards.
+- Hardware evidence is limited to the documented STM32F429 reference setup.
+
+## Publication status
+
+REPOSITORY PUBLISHED – REMOTE CI PASSED – V1.1.0-RC1 PRE-RELEASE CREATED