@calltelemetry/ct-lab-mcp 0.8.106 → 0.8.107

package/dist/src/stig/evidence.js

@@ -0,0 +1,637 @@
+/**
+ * collect_stig_evidence: the claim-governed driver of the DoD evidence package (E1-E10) for one STIG clone.
+ *
+ * One source of truth. The generators are the ct-meta `rhel8-stig-template` skill's own Python tools, run with the same
+ * arguments `evidence.sh` passes them (tools/stig-parity.mjs and test/stig/evidence.test.ts diff the argument lists);
+ * the clone-side collection stages (`clone.sh scan|oval|keyhash|collect|verify`) run through the claim's guest access
+ * path with guest scripts that are the same commands (assets/stig/guest/collect-*.sh, oval-*.sh).
+ *
+ * Guards: claim first (the clone's claim must exist, be Ready and carry a clone descriptor), the clone must come from the
+ * named template, and nothing here can create, change, publish or destroy a template, a clone or a claim: the guest
+ * scripts only read (scratch files under /var/tmp are removed at the end), the Proxmox shell runs `qm config` and
+ * `pveversion`, and the claim port is used for `get` only. The tool returns a content-free receipt.
+ */
+import { createHash } from "node:crypto";
+import { chmodSync, copyFileSync, cpSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync, createReadStream } from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
+import { dopplerKeyFor, verifyGuestFacts } from "./runner.js";
+import { clearStage, cloneIdentity, markStage, stageCurrent } from "./markers.js";
+import { redact, stigDescriptor, parseKv } from "./model.js";
+import { STIG_EVIDENCE_FPR, STIG_NODE_NAMES, nodeForClaimNode, resolveStigNode } from "./nodes.js";
+export const SKILL_REL = "plugins/ct-lab/skills/rhel8-stig-template";
+export const LEDGER_REL = "knowledge/rhel8-stig";
+export const OVAL_FEED_URL = "https://security.access.redhat.com/data/oval/v2/RHEL8/rhel-8.oval.xml.bz2";
+const CI_USER = "ctadmin";
+const XZ_THRESHOLD = 5 * 1024 * 1024;
+/** The stage order of evidence.sh (its STAGES array); the parity test compares `evidence.sh --list`. */
+export const EVIDENCE_STAGES = [
+    "preflight", "scan", "oval", "keyhash", "collect", "verify", "receipt", "e1", "e7", "e3", "e6", "e8", "e5", "report", "e2", "e4", "e10", "docs",
+    "distribution", "sign", "explorer", "resign", "verify-bundle", "tests",
+];
+/** Stages that read the clone (guest or hypervisor, read-only). */
+export const CLONE_STAGES = ["scan", "oval", "keyhash", "collect", "verify"];
+/** Generator stages that are one python invocation. */
+export const GENERATOR_STAGES = ["e1", "e7", "e3", "e6", "e8", "e5", "report", "e2", "e4", "e10", "docs"];
+const digest = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
+const sha256Text = (t) => createHash("sha256").update(t).digest("hex");
+async function sha256File(path) {
+    const h = createHash("sha256");
+    await new Promise((res, rej) => { const s = createReadStream(path); s.on("data", (c) => h.update(c)); s.on("end", () => res()); s.on("error", rej); });
+    return h.digest("hex");
+}
+const shq = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
+export const skillDir = (ctMeta) => join(ctMeta, SKILL_REL);
+const toolsDir = (c) => join(skillDir(c.ctMeta), "tools");
+export const pinsFile = (ctMeta) => join(skillDir(ctMeta), "scripts", "evidence-pins.json");
+export const tailoringFile = (ctMeta) => join(skillDir(ctMeta), "scripts", "tailoring.xml");
+/** `--plan-root ... --pins ...` (evidence.sh CA) */
+const commonArgs = (c) => ["--plan-root", c.planRoot, "--build", c.template, "--clone", c.clone, "--state-dir", c.state, "--pins", pinsFile(c.ctMeta)];
+/** evidence.sh EXTRA */
+const extraArgs = (c) => [
+    "--manual-stig", c.manualStigZip, "--schema-dir", c.schemaDir, "--run-dir", c.runDir, "--work-dir", join(c.state, "trivy-work"),
+    ...(c.benchmarkZip ? ["--benchmark-zip", c.benchmarkZip] : []), ...(c.benchmarkXml ? ["--benchmark-xml", c.benchmarkXml] : []),
+];
+/**
+ * The argument list evidence.sh passes the generator of `stage` (null for stages that are not one python call).
+ * `receipt` yields the receipt gate; `verify-bundle` the bundle verification; `preflight` the pins check.
+ */
+export function generatorCommand(stage, c) {
+    const py = c.python ?? "python3";
+    const tool = (name) => join(toolsDir(c), name);
+    const ev = join(c.planRoot, "evidence", c.template);
+    const receipts = join(c.planRoot, "receipts");
+    const fpr = STIG_EVIDENCE_FPR;
+    switch (stage) {
+        case "preflight": return [py, tool("rhel8_stig_evidence.py"), "pins-check", ...commonArgs(c), ...extraArgs(c)];
+        case "e1":
+        case "e7":
+        case "e3":
+        case "e6":
+        case "e8": return [py, tool("rhel8_stig_evidence.py"), stage, ...commonArgs(c), ...extraArgs(c)];
+        case "receipt": return [py, tool("rhel8_stig_evidence_docs.py"), "receipt-gate", ...commonArgs(c)];
+        case "e5": return [py, tool("rhel8_stig_evidence_docs.py"), "e5", ...commonArgs(c), "--tailoring", tailoringFile(c.ctMeta), "--today", c.today];
+        case "report":
+        case "e10":
+        case "docs": return [py, tool("rhel8_stig_evidence_docs.py"), stage, ...commonArgs(c), "--today", c.today];
+        case "e2": return [py, tool("rhel8_stig_ckl.py"), "--build", c.template, "--manual-stig", c.manualStigZip,
+            "--scanner-lock", join(c.planRoot, "rhel8-stig-scanner-lock.json"), "--disa-results", join(ev, "E1-disa-benchmark", "e1-xccdf-results.xml"),
+            "--ssg-arf", join(receipts, `${c.template}-clone-arf.xml.xz`), "--report", join(receipts, `${c.template}-report.md`),
+            "--deviations", join(ev, "E5-deviations", "E5-deviation-register.csv"), "--out-dir", join(ev, "E2-ckl")];
+        case "e4": return [py, tool("rhel8_stig_poam.py"), "--build", c.template, "--disa-results", join(ev, "E1-disa-benchmark", "e1-xccdf-results.xml"),
+            "--ckl-summary", join(ev, "E2-ckl", "E2-summary.json"), "--trivy-csv", join(ev, "E3-vuln-scan", "e3-trivy-standin-critical-high.csv"),
+            "--deviations", join(ev, "E5-deviations", "E5-deviation-register.csv"), "--ppsm", join(ev, "E6-ppsm", "E6-ppsm.csv"),
+            "--crypto", join(ev, "E8-crypto-modules", "E8-crypto-modules.csv"), "--report", join(receipts, `${c.template}-report.md`),
+            "--receipt-json", join(receipts, `${c.template}.json`), "--as-of", c.today, "--out-dir", join(ev, "E4-poam")];
+        case "sign":
+        case "resign": return [py, tool("rhel8_stig_bundle.py"), "all", ev, "--fingerprint", fpr, "--claim-name", c.clone, "--claim-uid", c.claimUid];
+        case "explorer": return [py, tool("rhel8_stig_explorer.py"), "--plan-root", c.planRoot, "--build", c.template];
+        case "verify-bundle": return [py, tool("rhel8_stig_bundle.py"), "verify", ev, "--pubkey", join(c.planRoot, "keys", "stig-evidence-signing.pub.asc"), "--fingerprint", fpr];
+        case "tests": return [py, "-m", "pytest", "-q", join(toolsDir(c), "tests")];
+        default: return null;
+    }
+}
+/**
+ * The plan root is written (and, when scratch, re-seeded) by the tool, so it must never be, contain or sit inside the ct-meta
+ * checkout or the ledger, except the ledger itself; a scratch root must be new, empty, or one this tool seeded.
+ */
+export function assertSafePlanRoot(planRoot, ctMeta, ledger, baseDir) {
+    const inside = (child, parent) => child === parent || child.startsWith(`${parent}/`);
+    if (planRoot === ledger)
+        return;
+    if (planRoot === "/" || planRoot === resolve(process.env.HOME ?? "/nonexistent"))
+        throw new Error(`refusing planRoot ${planRoot}: not a work directory`);
+    if (inside(planRoot, ctMeta) || inside(ctMeta, planRoot) || inside(planRoot, ledger) || inside(ledger, planRoot))
+        throw new Error(`refusing planRoot ${planRoot}: it overlaps the ct-meta checkout (name the ledger exactly, or a directory outside it)`);
+    if (inside(planRoot, baseDir) || inside(baseDir, planRoot)) {
+        if (inside(baseDir, planRoot) && planRoot !== baseDir)
+            throw new Error(`refusing planRoot ${planRoot}: it contains the run directory`);
+    }
+    if (existsSync(planRoot)) {
+        const entries = readdirSync(planRoot);
+        if (entries.length > 0 && !entries.includes(".seeded-for"))
+            throw new Error(`refusing planRoot ${planRoot}: it is not empty and was not seeded by this tool`);
+    }
+}
+export class EvidenceError extends Error {
+}
+/* ------------------------------------------------------------ the collector */
+export class StigEvidence {
+    d;
+    constructor(d) {
+        this.d = d;
+    }
+    log(line) { this.d.log.info(redact(line)); }
+    resolveInputs(i) {
+        const cloneName = i.cloneName ?? (i.claimName ? i.claimName.replace(/^clone-/, "") : undefined);
+        if (!cloneName || (i.cloneName && i.claimName && i.claimName !== `clone-${i.cloneName}`))
+            throw new Error("name exactly one clone: cloneName, or claimName clone-<cloneName>");
+        const ctMeta = resolve(i.ctMetaPath);
+        // The generators are Python run from this checkout: when an operator pins the allowed checkouts, only those are accepted.
+        const allowed = (process.env.CT_LAB_STIG_CTMETA_ROOTS ?? "").split(":").filter(Boolean).map((p) => resolve(p));
+        if (allowed.length && !allowed.some((a) => ctMeta === a || ctMeta.startsWith(`${a}/`)))
+            throw new Error(`ctMetaPath ${ctMeta} is not under CT_LAB_STIG_CTMETA_ROOTS`);
+        if (!existsSync(join(skillDir(ctMeta), "tools", "rhel8_stig_evidence.py")))
+            throw new Error(`ctMetaPath ${ctMeta} has no ${SKILL_REL}/tools (point it at a ct-meta checkout)`);
+        const ledger = join(ctMeta, LEDGER_REL);
+        const planRoot = resolve(i.planRoot ?? join(this.d.baseDir, "evidence-out", i.template, LEDGER_REL));
+        const env = process.env;
+        const manualStigZip = i.manualStigZip ?? env.MANUAL_STIG_ZIP ?? "";
+        const ssgDatastream = i.ssgDatastream ?? env.SSG_DATASTREAM ?? "";
+        const schemaDir = i.schemaDir ?? env.SBOM_SCHEMA_DIR ?? join(this.d.baseDir, "sbom-schemas");
+        return {
+            cloneName, claim: `clone-${cloneName}`, ctMeta, ledger, planRoot, isLedger: planRoot === ledger,
+            manualStigZip, ssgDatastream, schemaDir,
+            benchmarkZip: i.benchmarkZip ?? env.DISA_BENCHMARK_ZIP, benchmarkXml: i.benchmarkXml ?? env.DISA_BENCHMARK_XML,
+            today: i.today ?? env.TODAY ?? new Date(this.d.clock.now()).toISOString().slice(0, 10),
+            state: join(this.d.baseDir, `clone-${cloneName}`),
+            distDir: resolve(i.distDir ?? join(this.d.baseDir, "dist")),
+        };
+    }
+    /** Read-only checks plus the stage table. Throws when a guard refuses. */
+    async plan(i) {
+        const r = this.resolveInputs(i);
+        const rec = await this.d.claims.get(r.claim);
+        if (!rec)
+            throw new Error(`claim ${r.claim} not found; claim first (create_stig_claim)`);
+        let desc = null;
+        try {
+            desc = stigDescriptor(rec);
+        }
+        catch {
+            desc = null;
+        }
+        if (desc?.mode !== "clone")
+            throw new Error(`refusing: claim ${r.claim} is not a STIG clone claim; evidence is collected from clones only, never from a template`);
+        if (rec.status?.phase !== "Ready")
+            throw new Error(`claim ${r.claim} is not Ready (phase=${rec.status?.phase ?? "none"}); claim first`);
+        const node = nodeForClaimNode(rec.spec?.node);
+        if (!node)
+            throw new Error(`claim ${r.claim} is on node '${rec.spec?.node}', which is not in the STIG node map`);
+        if (i.node !== undefined && resolveStigNode(i.node).name !== node.name)
+            throw new Error(`claim ${r.claim} lives on ${node.name}, not ${resolveStigNode(i.node).name}`);
+        for (const f of ["ctadmin_password", "ip", "id_key", "vmid", "template", "known_hosts"]) {
+            if (!existsSync(join(r.state, f)))
+                throw new Error(`no runner state for clone ${r.cloneName} (${f} missing); it must be created by create_stig_claim on this host`);
+        }
+        const tpl = readFileSync(join(r.state, "template"), "utf8").trim();
+        if (tpl !== i.template)
+            throw new Error(`clone ${r.cloneName} was made from ${tpl}, not ${i.template}; recreate it (create_stig_claim recreate=true)`);
+        if (!existsSync(pinsFile(r.ctMeta)))
+            throw new Error(`missing ${pinsFile(r.ctMeta)}`);
+        if (!existsSync(join(r.ledger, "rhel8-stig-scanner-lock.json")))
+            throw new Error(`missing ${join(r.ledger, "rhel8-stig-scanner-lock.json")}`);
+        const vmid = Number(readFileSync(join(r.state, "vmid"), "utf8").trim());
+        if (rec.spec?.vmid !== vmid)
+            throw new Error(`runner state for clone ${r.cloneName} is VMID ${vmid}, the claim is VMID ${rec.spec?.vmid}; the state is stale (recreate the clone)`);
+        assertSafePlanRoot(r.planRoot, r.ctMeta, r.ledger, this.d.baseDir);
+        const identity = cloneIdentity(tpl, vmid, rec.metadata.uid);
+        let started = i.from === undefined;
+        const stages = EVIDENCE_STAGES.map((stage) => {
+            if (i.from === stage)
+                started = true;
+            const selected = (i.only ? stage === i.only : true) && started;
+            const kind = CLONE_STAGES.includes(stage) ? "clone-read" : "controller";
+            const state = !selected ? "not-selected" : kind === "clone-read" && !i.force && stageCurrent(r.state, stage, identity) ? "current" : "pending";
+            return { stage, kind, state };
+        });
+        const receiptSource = i.templateRunDir ? "regenerate" : "ledger";
+        const guards = [
+            "claim exists, is Ready and carries a clone descriptor (never a template claim)",
+            `clone was made from ${tpl}`,
+            "read-only on the guest (scratch files under /var/tmp are removed) and on Proxmox (qm config, pveversion); no claim, clone or template is created, changed, published or destroyed",
+            r.isLedger ? "planRoot is the ct-meta ledger: generated evidence overwrites the ledger copy" : "output goes to a scratch plan root; the ct-meta ledger is not written",
+        ];
+        const base = {
+            cloneName: r.cloneName, claimUid: rec.metadata.uid, node: node.name, template: i.template, vmid, planRoot: r.planRoot, ctMeta: r.ctMeta, receiptSource,
+            stages: stages.map((s) => `${s.stage}:${s.state}`), today: r.today, noSign: !!i.noSign, skipTests: !!i.skipTests, force: !!i.force,
+            inputs: [i.templateRunDir, r.distDir, r.manualStigZip, r.ssgDatastream, r.schemaDir, r.benchmarkZip, r.benchmarkXml].map((x) => (x ? resolve(x) : null)),
+        };
+        return {
+            mode: "plan", cloneName: r.cloneName, claim: r.claim, claimUid: rec.metadata.uid, node: node.name, template: i.template, vmid,
+            planRoot: r.planRoot, ledger: r.isLedger, ctMeta: r.ctMeta, receiptSource, stages, guards, planDigest: digest({ kind: "evidence", ...base }),
+        };
+    }
+    async collect(i) {
+        const plan = await this.plan(i);
+        if (!i.apply)
+            return plan;
+        if (!i.planDigest || i.planDigest !== plan.planDigest)
+            throw new Error("plan digest missing or stale; re-run the plan and apply with its planDigest");
+        return this.apply(i, plan);
+    }
+    /* ---------------------------------------------------------------- apply */
+    async apply(i, plan) {
+        const r = this.resolveInputs(i);
+        const node = resolveStigNode(plan.node);
+        const identity = cloneIdentity(i.template, plan.vmid, plan.claimUid);
+        const pw = readFileSync(join(r.state, "ctadmin_password"), "utf8");
+        const sudoStdin = (extra = "") => `${pw}\n${extra}`;
+        const runDir = i.templateRunDir ? resolve(i.templateRunDir) : join(this.d.baseDir, i.template);
+        const ctx = {
+            ctMeta: r.ctMeta, template: i.template, clone: r.cloneName, planRoot: r.planRoot, state: r.state, runDir,
+            manualStigZip: r.manualStigZip, schemaDir: r.schemaDir, ssgDatastream: r.ssgDatastream, benchmarkZip: r.benchmarkZip, benchmarkXml: r.benchmarkXml,
+            today: r.today, claimUid: plan.claimUid,
+        };
+        this.d.guest.configure({ user: CI_USER, keyFile: join(r.state, "id_key"), knownHostsFile: join(r.state, "known_hosts") });
+        this.d.guest.setTarget(readFileSync(join(r.state, "ip"), "utf8").trim());
+        this.seedPlanRoot(r, i);
+        const outcomes = [];
+        for (const st of plan.stages) {
+            if (st.state === "not-selected")
+                continue;
+            if (st.stage === "sign" || st.stage === "explorer" || st.stage === "resign" || st.stage === "verify-bundle") {
+                if (i.noSign) {
+                    outcomes.push({ stage: st.stage, status: "skipped", detail: "noSign", ms: 0 });
+                    continue;
+                }
+            }
+            if (st.stage === "tests" && i.skipTests) {
+                outcomes.push({ stage: st.stage, status: "skipped", detail: "skipTests", ms: 0 });
+                continue;
+            }
+            if (st.state === "current") {
+                this.log(`${st.stage}: current for this clone (marker matches); skipped (force=true to redo)`);
+                outcomes.push({ stage: st.stage, status: "skipped-current", ms: 0 });
+                continue;
+            }
+            const t0 = this.d.clock.now();
+            this.log(`stage ${st.stage}`);
+            if (st.kind === "clone-read")
+                clearStage(r.state, st.stage); // a failed stage must not leave a marker vouching for partial evidence
+            try {
+                const detail = await this.runStage(st.stage, { ctx, r, node, plan, i, sudoStdin });
+                if (st.kind === "clone-read")
+                    markStage(r.state, st.stage, identity);
+                outcomes.push({ stage: st.stage, status: "ran", ...(detail ? { detail } : {}), ms: this.d.clock.now() - t0 });
+            }
+            catch (e) {
+                throw new Error(`evidence stage ${st.stage} failed: ${redact(String(e?.message ?? e)).slice(0, 600)} (fix the cause and re-apply with from=${st.stage})`);
+            }
+        }
+        return { ok: true, ...this.receiptOf(plan, r, ctx, outcomes, i) };
+    }
+    async runStage(stage, h) {
+        const { ctx, r, node, plan, sudoStdin } = h;
+        const g = this.d.guest;
+        switch (stage) {
+            case "preflight": return this.preflight(h);
+            case "scan": {
+                if (!(await g.waitSsh("yes", 3)))
+                    throw new Error("clone is not reachable over ssh (strict host key)");
+                const ev = join(r.state, "evidence");
+                try {
+                    await g.runScript(this.d.readAsset("guest/scan.sh"), { sudo: true, stdin: sudoStdin(), timeoutMs: 30 * 60_000 });
+                    await g.runScript(this.d.readAsset("guest/scan-disa.sh"), { sudo: true, stdin: sudoStdin(), timeoutMs: 30 * 60_000 });
+                    rmSync(ev, { recursive: true, force: true });
+                    await g.fetchDir("/var/tmp/ct-scan", ev);
+                }
+                finally {
+                    await g.runScript("rm -rf /var/tmp/ct-scan\n", { sudo: true, stdin: sudoStdin() }).catch(() => undefined); // scratch never stays on the guest
+                }
+                if (!existsSync(join(ev, "clone-disa-summary.txt")))
+                    throw new Error("the clone has no DISA benchmark scan (the template predates the dual-scan recipe)");
+                await this.compressScanArtifacts(ev);
+                return undefined;
+            }
+            case "oval": return this.oval(h);
+            case "keyhash": {
+                const rec = await this.d.secrets.get(dopplerKeyFor(r.cloneName));
+                if (!rec)
+                    throw new Error("recovery passphrase is not in the secret store; cannot take the volume key digest");
+                const out = await g.runScript(this.d.readAsset("guest/keyhash.sh"), { sudo: true, stdin: sudoStdin(rec) });
+                const hex = out.stdout.trim().split("\n").pop() ?? "";
+                if (!/^[a-f0-9]{64}$/.test(hex))
+                    throw new Error("keyhash did not return a sha256");
+                writeFileSync(join(r.state, "keyhash.txt"), `${hex}\n`, { mode: 0o600 });
+                return undefined;
+            }
+            case "collect": return this.collectHost(h);
+            case "verify": {
+                const v = await verifyGuestFacts(this.d, dopplerKeyFor(r.cloneName), sudoStdin);
+                writeFileSync(join(r.state, "verify.txt"), v.text, { mode: 0o600 });
+                return `fips=${v.kv.fips_enabled} selinux=${v.kv.selinux} tpm_bound=${v.kv.tpm_bound} bootstrap_key=${v.kv.bootstrap_key_file}`;
+            }
+            case "receipt": return this.receipt(h);
+            case "distribution": return this.distribution(h);
+            case "verify-bundle": {
+                const out = await this.gen("verify-bundle", ctx);
+                const tmp = join(this.d.baseDir, `explorer-check-${plan.cloneName}.html`);
+                const ex = generatorCommand("explorer", ctx);
+                const res = await this.d.local.run([...ex, "--out", tmp], { env: this.genEnv(ctx) });
+                if (res.code !== 0)
+                    throw new Error(`explorer regeneration failed: ${redact(res.stderr).slice(-300)}`);
+                const same = existsSync(tmp) && sha256Text(readFileSync(tmp)) === sha256Text(readFileSync(join(ctx.planRoot, "evidence", ctx.template, "explorer", "index.html")));
+                rmSync(tmp, { force: true });
+                if (!same)
+                    throw new Error("explorer page is not current after signing");
+                return out.split("\n").filter(Boolean).pop();
+            }
+            default: {
+                const out = await this.gen(stage, ctx);
+                return out.split("\n").filter(Boolean).pop()?.slice(0, 160);
+            }
+        }
+    }
+    genEnv(ctx) {
+        return { STIG_RECEIPT_DIR: join(ctx.planRoot, "receipts"), SSG_DATASTREAM: ctx.ssgDatastream };
+    }
+    async gen(stage, ctx) {
+        const argv = generatorCommand(stage, ctx);
+        if (!argv)
+            throw new Error(`stage ${stage} has no generator`);
+        const res = await this.d.local.run(argv, { env: this.genEnv(ctx), timeoutMs: 40 * 60_000 });
+        if (res.code !== 0)
+            throw new Error(`${basename(argv[1] ?? "generator")} ${stage} exited ${res.code}: ${redact(res.stderr || res.stdout).slice(-500)}`);
+        return res.stdout;
+    }
+    /* ---------------------------------------------------------------- stages */
+    async preflight(h) {
+        const { ctx, r, i } = h;
+        const missing = [];
+        const need = i.noSign ? ["python3", "xz", "trivy", "bzip2"] : ["python3", "xz", "trivy", "bzip2", "gpg", "doppler"];
+        for (const t of need)
+            if ((await this.d.local.run(["sh", "-c", `command -v ${t}`])).code !== 0)
+                missing.push(t);
+        if (missing.length)
+            throw new Error(`missing tool: ${missing.join(", ")}`);
+        const py = await this.d.local.run(["python3", "-c", "import jsonschema, referencing"]);
+        if (py.code !== 0)
+            throw new Error("python needs jsonschema and referencing (pip install --user jsonschema referencing)");
+        if (!ctx.manualStigZip || !existsSync(ctx.manualStigZip))
+            throw new Error("DISA manual STIG zip not found (manualStigZip or MANUAL_STIG_ZIP)");
+        if (!ctx.ssgDatastream || !existsSync(ctx.ssgDatastream))
+            throw new Error("SSG 0.1.82 datastream not found (ssgDatastream or SSG_DATASTREAM)");
+        await this.fetchSchemas(ctx.schemaDir, ctx.ctMeta);
+        const res = await this.d.local.run(generatorCommand("preflight", ctx), { env: this.genEnv(ctx) });
+        if (res.code !== 0)
+            throw new Error(`pinned input check failed: ${redact(res.stderr || res.stdout).slice(-400)}`);
+        if (!r.isLedger && !existsSync(join(r.planRoot, "rhel8-stig-scanner-lock.json")))
+            throw new Error("scratch plan root was not seeded");
+        return "pins OK";
+    }
+    /** SBOM schemas pinned by sha256 (evidence-pins.json); downloaded when the cache is missing or stale. */
+    async fetchSchemas(dir, ctMeta) {
+        const pins = JSON.parse(readFileSync(pinsFile(ctMeta), "utf8"));
+        mkdirSync(dir, { recursive: true });
+        for (const [name, want] of Object.entries(pins.sbom_schemas)) {
+            const f = join(dir, name);
+            if (existsSync(f) && sha256Text(readFileSync(f)) === want)
+                continue;
+            this.log(`fetching SBOM schema ${name}`);
+            const part = `${f}.part`;
+            await this.d.local.download(pins.sbom_schema_urls[name], part);
+            if (sha256Text(readFileSync(part)) !== want) {
+                rmSync(part, { force: true });
+                throw new Error(`SBOM schema ${name} does not match the pinned sha256`);
+            }
+            copyFileSync(part, f);
+            rmSync(part, { force: true });
+        }
+    }
+    async oval(h) {
+        const { r, sudoStdin } = h;
+        const g = this.d.guest;
+        const feed = join(this.d.baseDir, "oval-feed");
+        mkdirSync(feed, { recursive: true, mode: 0o700 });
+        const bz = join(feed, "rhel-8.oval.xml.bz2");
+        const xml = join(feed, "rhel-8.oval.xml");
+        const { headers } = await this.d.local.download(OVAL_FEED_URL, bz);
+        writeFileSync(`${bz}.headers`, Object.entries(headers).map(([k, v]) => `${k}: ${v}`).join("\n") + "\n");
+        const unz = await this.d.local.run(["sh", "-c", 'bzip2 -dc "$1" > "$2"', "sh", bz, xml]);
+        if (unz.code !== 0)
+            throw new Error("could not decompress the OVAL feed");
+        const o = join(r.state, "oval");
+        rmSync(o, { recursive: true, force: true });
+        mkdirSync(o, { recursive: true, mode: 0o700 });
+        try {
+            await g.runScript(this.d.readAsset("guest/oval-prep.sh"), { sudo: true, stdin: sudoStdin() });
+            await g.putFile(xml, "/var/tmp/ct-oval/rhel-8.oval.xml");
+            await g.runScript(this.d.readAsset("guest/oval-eval.sh"), { sudo: true, stdin: sudoStdin(), timeoutMs: 60 * 60_000 });
+            await g.fetchDir("/var/tmp/ct-oval", o);
+        }
+        finally {
+            await g.runScript("rm -rf /var/tmp/ct-oval\n", { sudo: true, stdin: sudoStdin() }).catch(() => undefined);
+        }
+        const lastModified = headers["last-modified"] ?? "";
+        const summary = [
+            readFileSync(join(o, "oval-summary.txt"), "utf8").trimEnd(),
+            `oval_feed_bz2_sha256=${await sha256File(bz)}`, `oval_feed_xml_sha256=${await sha256File(xml)}`, `oval_feed_url=${OVAL_FEED_URL}`,
+            `oval_feed_last_modified=${lastModified}`, `oval_feed_date=${new Date(this.d.clock.now()).toISOString().replace(/\.\d{3}Z$/, "Z")}`,
+        ].join("\n") + "\n";
+        writeFileSync(join(r.state, "oval-summary.txt"), summary, { mode: 0o600 });
+        copyFileSync(xml, join(o, "rhel-8.oval.xml")); // kept for the offline NEVRA cross-check
+        const kv = parseKv(summary);
+        return `oval_true=${kv.oval_true} oval_false=${kv.oval_false}`;
+    }
+    /** Read-only host facts for E3/E6/E7/E8 (clone.sh `do_collect`). */
+    async collectHost(h) {
+        const { r, node, plan, sudoStdin } = h;
+        const c = join(r.state, "collect");
+        rmSync(c, { recursive: true, force: true });
+        mkdirSync(c, { recursive: true, mode: 0o700 });
+        const TSV_HEADER = "name\tepoch\tversion\trelease\tarch\tvendor\tlicense\tsourcerpm\tsignature_rsa_header\tsignature_sigpgp\tsignature_dsa_header\tsha256_header\tpackager\n";
+        for (const [file, asset, header] of COLLECT_FILES) {
+            const res = await this.d.guest.runScript(this.d.readAsset(`guest/${asset}`), { sudo: true, stdin: sudoStdin(), timeoutMs: 15 * 60_000 });
+            if (res.code === 255 || res.code === 124 || res.code === 127)
+                throw new Error(`${asset} failed (exit ${res.code}): ${redact(res.stderr).slice(0, 200)}`);
+            if (REQUIRED_NONEMPTY.has(file) && !res.stdout.trim())
+                throw new Error(`${asset} returned nothing`);
+            writeFileSync(join(c, file), (header ? TSV_HEADER : "") + res.stdout);
+        }
+        // qm config must succeed (the pipeline's last command is head, so its own status would hide a failure)
+        const hv = await this.d.pveFor(node.host).run(`out=$(qm config ${plan.vmid}) || exit 1; printf '%s\\n' "$out" | grep -vE '^(sshkeys|cipassword|ciuser):'; echo; pveversion; kvm --version | head -1`);
+        if (hv.code !== 0 || !/^name: /m.test(hv.stdout))
+            throw new Error(`could not read the guest's Proxmox config (qm config ${plan.vmid} exit ${hv.code}): ${redact(hv.stderr).slice(0, 200)}`);
+        writeFileSync(join(c, "hypervisor.txt"), hv.stdout);
+        const names = readdirSync(c).sort();
+        writeFileSync(join(c, "SHA256SUMS"), names.map((n) => `${sha256Text(readFileSync(join(c, n)))}  ${n}`).join("\n") + "\n");
+        writeFileSync(join(c, "collect.json"), `{"template":"${plan.template}","clone":"${plan.cloneName}","vmid":${plan.vmid},"collected":"${new Date(this.d.clock.now()).toISOString().replace(/\.\d{3}Z$/, "Z")}"}\n`);
+        return `${names.length + 1} files`;
+    }
+    /** receipt.sh (receipt.py plus the artifact copies) then the receipt gate; or the gate alone when the ledger holds the receipt. */
+    /**
+     * clone.sh `scan` stores an ARF over 5 MB as `.xz` with `.raw.sha256` and `.xz.sha256` beside it; validate_stig_claim leaves the
+     * raw file. Normalize to the shell recipe's form (idempotent), because receipt.sh and the E2 generator read the `.xz`.
+     */
+    async compressScanArtifacts(ev) {
+        for (const f of ["clone-arf.xml", "clone-disa-arf.xml"]) {
+            const raw = join(ev, f);
+            if (!existsSync(raw) || statSync(raw).size <= XZ_THRESHOLD)
+                continue;
+            writeFileSync(`${raw}.raw.sha256`, `${await sha256File(raw)}\n`);
+            const x = await this.d.local.run(["sh", "-c", 'xz -9e -c "$1" > "$2"', "sh", raw, `${raw}.xz`], { timeoutMs: 20 * 60_000 });
+            if (x.code !== 0)
+                throw new Error(`xz of ${f} failed`);
+            writeFileSync(`${raw}.xz.sha256`, `${await sha256File(`${raw}.xz`)}\n`);
+            rmSync(raw);
+        }
+    }
+    async receipt(h) {
+        const { ctx, r, i } = h;
+        await this.compressScanArtifacts(join(r.state, "evidence"));
+        const out = join(ctx.planRoot, "receipts");
+        mkdirSync(out, { recursive: true });
+        if (i.templateRunDir) {
+            const ev = join(ctx.runDir, "evidence", "stig-report");
+            if (!existsSync(ev))
+                throw new Error(`no template build evidence in ${ev}`);
+            const cs = join(r.state, "evidence");
+            const tpl = ctx.template;
+            const cpbig = async (src, dst) => {
+                if (statSync(src).size > XZ_THRESHOLD) {
+                    const x = await this.d.local.run(["sh", "-c", 'xz -9e -c "$1" > "$2"', "sh", src, `${dst}.xz`]);
+                    if (x.code !== 0)
+                        throw new Error(`xz of ${basename(src)} failed`);
+                }
+                else
+                    copyFileSync(src, dst);
+            };
+            await cpbig(join(ev, "final-report.html"), join(out, `${tpl}-template-report.html`));
+            await cpbig(join(ev, "final-disa-report.html"), join(out, `${tpl}-template-disa-report.html`));
+            await cpbig(join(cs, "clone-report.html"), join(out, `${tpl}-clone-report.html`));
+            await cpbig(join(cs, "clone-disa-report.html"), join(out, `${tpl}-clone-disa-report.html`));
+            copyFileSync(join(ev, "final-arf.xml.xz"), join(out, `${tpl}-template-arf.xml.xz`));
+            copyFileSync(join(ev, "final-disa-arf.xml.xz"), join(out, `${tpl}-template-disa-arf.xml.xz`));
+            copyFileSync(join(cs, "clone-arf.xml.xz"), join(out, `${tpl}-clone-arf.xml.xz`));
+            copyFileSync(join(cs, "clone-disa-arf.xml.xz"), join(out, `${tpl}-clone-disa-arf.xml.xz`));
+            const res = await this.d.local.run([ctx.python ?? "python3", "-I", join(skillDir(ctx.ctMeta), "scripts", "receipt.py"), tpl, ctx.clone, ctx.runDir, r.state, out, ctx.ssgDatastream], { env: this.genEnv(ctx) });
+            if (res.code !== 0)
+                throw new Error(`receipt.py exited ${res.code}: ${redact(res.stderr || res.stdout).slice(-400)}`);
+        }
+        else if (!existsSync(join(out, `${ctx.template}.json`))) {
+            throw new Error(`no receipt for ${ctx.template} in ${out}; pass templateRunDir (the template build evidence) to write it for this clone`);
+        }
+        const gate = await this.d.local.run(generatorCommand("receipt", ctx), { env: this.genEnv(ctx) });
+        if (gate.code !== 0)
+            throw new Error(`receipt gate failed: ${redact(gate.stderr || gate.stdout).slice(-600)}`);
+        return gate.stdout.trim().split("\n").pop() ?? "";
+    }
+    async distribution(h) {
+        const { ctx, r } = h;
+        const tpl = ctx.template;
+        const pub = join(r.distDir, `publish-${tpl}.json`);
+        if (!existsSync(pub))
+            return "no publish receipt for this template; skipped";
+        const out = join(ctx.planRoot, "receipts");
+        mkdirSync(out, { recursive: true });
+        copyFileSync(pub, join(out, `${tpl}-publish.json`));
+        let n = 0;
+        for (const node of STIG_NODE_NAMES) {
+            const f = `sync-${tpl}-${node}.json`;
+            if (existsSync(join(r.distDir, f))) {
+                copyFileSync(join(r.distDir, f), join(out, `${tpl}-sync-${node}.json`));
+                n++;
+            }
+        }
+        return `publish receipt and ${n} node sync receipts`;
+    }
+    /* ---------------------------------------------------------------- plan root */
+    /** A scratch plan root is a copy of the ledger without this template's evidence (and, when the receipt is regenerated, its receipt files). */
+    seedPlanRoot(r, i) {
+        if (r.isLedger)
+            return;
+        const seeded = join(r.planRoot, ".seeded-for");
+        const tag = `${i.template}|${r.cloneName}\n`;
+        if (existsSync(seeded) && readFileSync(seeded, "utf8") === tag)
+            return;
+        rmSync(r.planRoot, { recursive: true, force: true });
+        mkdirSync(dirname(r.planRoot), { recursive: true, mode: 0o700 });
+        const tpl = i.template;
+        const regenerate = !!i.templateRunDir;
+        const ownReceipt = new RegExp(`^${tpl.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(\\.json|\\.md|-(template|clone)-(disa-)?(report\\.html|arf\\.xml\\.xz)(\\.xz)?)$`);
+        cpSync(r.ledger, r.planRoot, {
+            recursive: true,
+            filter: (src) => {
+                const rel = src.slice(r.ledger.length + 1);
+                if (rel === `evidence/${tpl}` || rel.startsWith(`evidence/${tpl}/`))
+                    return false;
+                if (regenerate && rel.startsWith("receipts/") && ownReceipt.test(basename(rel)))
+                    return false;
+                return true;
+            },
+        });
+        chmodSync(r.planRoot, 0o700);
+        writeFileSync(seeded, tag);
+    }
+    /* ---------------------------------------------------------------- content-free receipt */
+    receiptOf(plan, r, ctx, outcomes, i) {
+        const ev = join(ctx.planRoot, "evidence", ctx.template);
+        const kv = (p) => (existsSync(p) ? parseKv(readFileSync(p, "utf8")) : {});
+        const num = (m, keys) => Object.fromEntries(keys.filter((k) => m[k] !== undefined).map((k) => [k.replace(/^result_/, ""), Number(m[k])]));
+        const scanKeys = ["result_pass", "result_fail", "result_notapplicable", "result_notchecked", "result_informational", "result_error"];
+        const json = (p) => { try {
+            return JSON.parse(readFileSync(p, "utf8"));
+        }
+        catch {
+            return null;
+        } };
+        const csvRows = (p) => {
+            if (!existsSync(p))
+                return null;
+            // records, not lines: count rows whose first field starts a record (quotes balanced)
+            let rows = 0;
+            let inQ = false;
+            let atStart = true;
+            for (const ch of readFileSync(p, "utf8")) {
+                if (ch === '"')
+                    inQ = !inQ;
+                if (ch === "\n" && !inQ) {
+                    atStart = true;
+                    continue;
+                }
+                if (atStart && ch !== "\n") {
+                    rows++;
+                    atStart = false;
+                }
+            }
+            return Math.max(0, rows - 1);
+        };
+        const ckl = json(join(ev, "E2-ckl", "E2-summary.json"))?.summary ?? null;
+        const poam = json(join(ev, "E4-poam", "E4-poam.json"));
+        const spdx = json(join(ev, "E7-sbom", "sbom.spdx.json"));
+        const cdx = json(join(ev, "E7-sbom", "sbom.cdx.json"));
+        const manifest = join(ev, "MANIFEST.sha256");
+        const bundle = outcomes.find((o) => o.stage === "verify-bundle");
+        const oval = kv(join(r.state, "oval-summary.txt"));
+        return {
+            node: plan.node, claim: plan.claim, template: plan.template, planRoot: plan.planRoot, ledgerWritten: plan.ledger,
+            stages: outcomes.map((o) => ({ stage: o.stage, status: o.status, ms: o.ms })),
+            counts: {
+                ssgClone: num(kv(join(r.state, "evidence", "clone-summary.txt")), scanKeys),
+                disaClone: num(kv(join(r.state, "evidence", "clone-disa-summary.txt")), [...scanKeys, "result_unknown"]),
+                oval: { true: Number(oval.oval_true ?? NaN), false: Number(oval.oval_false ?? NaN) },
+                ckl: ckl ? { total: ckl.total, byStatus: ckl.by_status } : null,
+                poamItems: Array.isArray(poam?.items) ? poam.items.length : null,
+                deviations: csvRows(join(ev, "E5-deviations", "E5-deviation-register.csv")),
+                ppsmRows: csvRows(join(ev, "E6-ppsm", "E6-ppsm.csv")),
+                cryptoModules: csvRows(join(ev, "E8-crypto-modules", "E8-crypto-modules.csv")),
+                rpmInventory: existsSync(join(ev, "E7-sbom", "rpm-inventory.tsv")) ? readFileSync(join(ev, "E7-sbom", "rpm-inventory.tsv"), "utf8").split("\n").filter(Boolean).length - 1 : null,
+                sbomSpdxPackages: Array.isArray(spdx?.packages) ? spdx.packages.length : null,
+                sbomCycloneDxComponents: Array.isArray(cdx?.components) ? cdx.components.length : null,
+            },
+            bundle: {
+                manifestFiles: existsSync(manifest) ? readFileSync(manifest, "utf8").split("\n").filter(Boolean).length : null,
+                manifestSha256: existsSync(manifest) ? sha256Text(readFileSync(manifest)) : null,
+                signed: existsSync(`${manifest}.asc`),
+                verify: bundle ? (/VERIFY OK/.test(bundle.detail ?? "") ? "VERIFY OK" : (bundle.detail ?? "ran")) : i.noSign ? "not run (noSign)" : "not run",
+            },
+        };
+    }
+}
+/** [evidence file, guest script, add the rpm-inventory header]. Order = clone.sh `do_collect`. */
+const COLLECT_FILES = [
+    ["rpm-inventory.tsv", "collect-rpm-inventory.sh", true],
+    ["rpm-nevra.txt", "collect-rpm-nevra.sh", false],
+    ["rpmlist.txt", "collect-rpmlist.sh", false],
+    ["repolist.txt", "collect-repolist.sh", false],
+    ["updateinfo-all.txt", "collect-updateinfo-all.sh", false],
+    ["updateinfo-security.txt", "collect-updateinfo-security.sh", false],
+    ["updateinfo-summary.txt", "collect-updateinfo-summary.sh", false],
+    ["network-services.txt", "collect-network-services.sh", false],
+    ["fips-state.txt", "collect-fips-state.sh", false],
+    ["hardware.txt", "collect-hardware.sh", false],
+    ["host-checks.txt", "collect-host-checks.sh", false],
+];
+const REQUIRED_NONEMPTY = new Set(["rpm-inventory.tsv", "rpm-nevra.txt", "rpmlist.txt", "fips-state.txt", "hardware.txt"]);
+export { COLLECT_FILES, shq };
+//# sourceMappingURL=evidence.js.map