Problem

Package binary hashes can match a JSON file uploaded by the wrong producer. Validate the JSON origin against the producers in the executing test_packages task's Evergreen dependency chain.

Scope

• Resolve package, archive, and crypt producers by dependency task IDs and verify build, variant, and version identity.
• Require JSON task_id, task_name, build_id, build_variant, and version_id to match independently fetched producer metadata.
• Validate the distro from the recorded execution; reject malformed or future executions while accepting earlier executions of the same producer.
• Have archive producers create and publish their own provenance, including future-tag build invocation capture.

Validation

Focused provenance tests and Evergreen package/crypt task chains.

Related Work

Provenance draft PR. Migration PR 64927 has been merged into this branch; its implementation is tracked separately. Uploader infrastructure: SERVER-137882.