Add SEP-58 bldarg for arguments ahead of bldopt

[leighmcculloch]

What

Add a bldarg field to SEP-58. bldarg is an ordered list of arguments injected ahead of the existing bldopt entries. When no bldarg is present it defaults to contract then build. bldopt is unchanged.

Why

The change is additive. Existing records use bldopt against an assumed contract build baseline, and keeping bldopt leaves those valid. bldarg makes that baseline explicit and overridable for builds whose leading arguments differ, and can carry positional arguments or flags. Producers that only deviate by a flag keep using bldopt alone, so contract and build need not be recorded.

Discussion:

• Contract Source Verification using Docker without Attestation #1923 (reply in thread)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4679db5625

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

This PR updates SEP-58 (Contract Build Reproducibility for Verification) to rename the build metadata field from bldopt to bldarg and redefine it as an ordered, verbatim-replayed argument list for reproducible contract builds, expanding support to include positional arguments (e.g. contract, build) and adding guidance on treating producer-supplied arguments as untrusted.

Changes:

• Renames bldopt → bldarg and redefines it as an ordered list of CLI arguments to replay verbatim.
• Updates rationale, security concerns, and Appendix A examples to reflect the new field semantics.
• Bumps SEP version to 0.6.0 and records the change in the changelog.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 264f8152bb

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[leighmcculloch]

Reworked this to be additive instead of a rename.

bldopt stays exactly as it was. New bldarg is an ordered list injected ahead of bldopt, defaulting to contract then build when absent. It can carry positional arguments or flags. Existing bldopt-only records stay valid, and producers can omit bldarg so contract and build need not be recorded.

---

Generated by Claude Code

[fnando]

Made a few comments, but looking good! 👍