# Sign, admit, publish, and revoke

This recipe publishes an exact provider package and admits it without trusting
a package name, registry location, or signature alone.

The `.one` and command outputs below are illustrative end-product examples.

## 1. Lock every Build input

```text
source snapshot source:sha256:11a0…
semantic package parcelhub.shipping@1 revision:sha256:20b1…
provider claim acme_carrier.provider@1 revision:sha256:31c2…
Rust toolchain tool:sha256:42d3…
dependency closure closure:sha256:53e4…
build action graph action-graph:sha256:64f5…
```

## 2. Build the publication artifact

```console
$ one build --root AcmeShipmentProvider
artifact artifact:sha256:aa01…
report build:sha256:bb02…
sbom sbom:sha256:cc03…
provenance provenance:sha256:dd04…
reproducible true
```

## 3. Request governed publication

```one
semantic acme_carrier.publication
    domain one.providers@1
    publication AcmeShipmentProvider@1
        package acme_carrier.provider@1
        artifact artifact:sha256:aa01...
        target one.catalog#PublicProviders@1
        base snapshot:sha256:7701...
        evidence [build:sha256:bb02..., conformance:sha256:9901...]
```

Publication is a durable provider-catalog effect with base/target constraints,
fresh authorization, observation, and reconciliation.

## 4. Admit the exact claim

```console
$ one plan --root AcmeShipmentPublication
$ one apply plan:revision:sha256:…
$ one inspect publication:operation:sha256:…
state admitted
catalog snapshot:sha256:8802…
```

A valid signature proves key control over bytes. Admission separately proves
identity, ownership, contract compatibility, conformance, policy, target,
freshness, and revocation posture.

## 5. Revoke with bounded impact

```console
$ one invoke one.providers#RevokeClaim@1 revoke-claim.json
$ one inspect revocation:sha256:… --affected-roots
FulfillmentWorker release:sha256:f421… action replan
OrdersApi none
```

Previously recorded facts remain. New selection and activation reject the
revoked claim according to policy.

See [supply chain](/one/platform/supply-chain).