Expose read-only attestation authority header

server.py

@@ -59,6 +59,7 @@ class HardenedHandler(SimpleHTTPRequestHandler):
         self.send_header("X-SZL-Transport-State", str(payload["transport_state"]))
         self.send_header("X-SZL-Evidence-State", str(payload["evidence_state"]))
         self.send_header("X-SZL-Verification-State", str(payload["verification_state"]))
+        self.send_header("X-SZL-Authority-State", str(payload["authority_state"]))
         self.end_headers()
         self.wfile.write(body)
 

tests/test_source_attestation.py

@@ -46,6 +46,7 @@ class SourceAttestationTests(unittest.TestCase):
                     self.assertEqual(200, response.status)
                     self.assertEqual("no-store", response.headers["Cache-Control"])
                     self.assertEqual("COMPUTED", response.headers["X-SZL-Evidence-State"])
+                    self.assertEqual("READ_ONLY", response.headers["X-SZL-Authority-State"])
                     self.assertEqual("b" * 40, payload["deployment"]["hf_revision"])
         finally:
             httpd.shutdown()