@cejel/cejel 0.4.11 → 0.6.0

package/dist/index.js

@@ -9,10 +9,12 @@ import {
   WitanReportSchema,
   assertSelectableRubricVersion,
   buildRelyingPartySummary,
+  computeApplicableMeasuredCoverage,
   createWitanAttestation,
   formatCertificateMetricAppliedWeightPercent,
   formatCertificateMetricLabel,
   formatCertificateMetricValue,
+  formatCoverageSummary,
   formatExternalSourceLine,
   isProspectiveRubricVersion,
   renderWitanBadgeEndpoint,
@@ -21,7 +23,7 @@ import {
   runCejelScan,
   serializeWitanReport,
   verifyWitanAttestationBinding
-} from "./chunk-UBCIGOIP.js";
+} from "./chunk-2453M7C2.js";
 import "./chunk-63XQDYQ5.js";
 import {
   external_exports
@@ -32,7 +34,7 @@ import {
 
 // src/index.ts
 init_esm_shims();
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "fs";
 import { dirname, join, resolve } from "path";
 import { fileURLToPath, pathToFileURL } from "url";
@@ -370,7 +372,7 @@ function verifyWitanIssuanceSignature(options) {
       reason: `key type ${JSON.stringify(parsed.keyType)} is not one this build verifies (supported: ${WITAN_ISSUANCE_SUPPORTED_KEY_TYPES.join(", ")}); verify with OpenSSH instead \u2014 see docs/issuance.md`
     };
   }
-  const fingerprint = sshPublicKeyFingerprint(parsed.publicKeyBlob);
+  const fingerprint2 = sshPublicKeyFingerprint(parsed.publicKeyBlob);
   let signatureVerified;
   try {
     const publicKey = ed25519PublicKeyFromBlob(parsed.publicKeyBlob);
@@ -405,16 +407,16 @@ function verifyWitanIssuanceSignature(options) {
     return { status: "invalid", reason: error instanceof Error ? error.message : String(error) };
   }
   if (signers.length === 0) {
-    return { status: "unlisted_key", keyType: parsed.keyType, fingerprint };
+    return { status: "unlisted_key", keyType: parsed.keyType, fingerprint: fingerprint2 };
   }
   const signedKeyBase64 = parsed.publicKeyBlob.toString("base64");
   const listed = signers.some(
     (entry) => entry.uninterpretedOptions === void 0 && entry.keyType === parsed.keyType && normalizeBase64(entry.keyBase64) === signedKeyBase64 && entry.principals.includes(expectedPrincipal) && (entry.namespaces === void 0 || entry.namespaces.includes(expectedNamespace))
   );
   if (!listed) {
-    return { status: "unlisted_key", keyType: parsed.keyType, fingerprint };
+    return { status: "unlisted_key", keyType: parsed.keyType, fingerprint: fingerprint2 };
   }
-  return { status: "valid", principal: expectedPrincipal, keyType: parsed.keyType, fingerprint };
+  return { status: "valid", principal: expectedPrincipal, keyType: parsed.keyType, fingerprint: fingerprint2 };
 }
 function normalizeBase64(value) {
   return Buffer.from(value, "base64").toString("base64");
@@ -468,6 +470,71 @@ function parseIssuerPublicKey(contents) {
   return { keyType, keyBase64, fingerprint: sshPublicKeyFingerprint(blob) };
 }
 
+// src/export/gitlab-codequality.ts
+init_esm_shims();
+import { createHash as createHash2 } from "crypto";
+var GITLAB_CODEQUALITY_SEVERITY = {
+  critical: "critical",
+  warning: "major",
+  info: "info"
+};
+function normalizeRepoRelativePath(raw) {
+  let path = raw.replaceAll("\\", "/");
+  while (path.startsWith("./")) path = path.slice(2);
+  if (path.length === 0 || path.startsWith("/") || /^[A-Za-z]:/.test(path)) return void 0;
+  if (path.split("/").some((segment) => segment === ".." || segment === "")) return void 0;
+  return path;
+}
+function fingerprint(rule, path, line, identity) {
+  return createHash2("sha256").update(JSON.stringify([rule, path, line, identity])).digest("hex");
+}
+function exportGitLabCodeQuality(report) {
+  const ingestedCount = (report.consumedSignals ?? []).reduce(
+    (total, signal) => total + signal.findings.length,
+    0
+  );
+  if (report.verdict === "insufficient_source") {
+    return {
+      entries: [],
+      excludedUnlocated: 0,
+      excludedIngested: ingestedCount,
+      abstainedReason: report.insufficientSourceReason
+    };
+  }
+  const entries = [];
+  let excludedUnlocated = 0;
+  const seen = /* @__PURE__ */ new Set();
+  for (const criterion of report.criteria) {
+    for (const finding of criterion.findings) {
+      const path = finding.evidence.path === void 0 ? void 0 : normalizeRepoRelativePath(finding.evidence.path);
+      const line = finding.evidence.line;
+      if (path === void 0 || line == null) {
+        excludedUnlocated += 1;
+        continue;
+      }
+      const print = fingerprint(criterion.id, path, line, finding.summary);
+      if (seen.has(print)) continue;
+      seen.add(print);
+      entries.push({
+        description: finding.summary,
+        check_name: criterion.id,
+        fingerprint: print,
+        location: { path, lines: { begin: line } },
+        severity: GITLAB_CODEQUALITY_SEVERITY[finding.severity]
+      });
+    }
+  }
+  return { entries, excludedUnlocated, excludedIngested: ingestedCount };
+}
+function renderGitLabCodeQualityFooter(result) {
+  if (result.abstainedReason !== void 0) {
+    return `Cejel: abstained report (insufficient_source): exported 0 entries. ${result.abstainedReason}
+`;
+  }
+  return `Cejel: exported ${result.entries.length} located finding(s); ${result.excludedUnlocated} without a file and line excluded; ${result.excludedIngested} ingested third-party finding(s) not exported.
+`;
+}
+
 // src/terminal.ts
 init_esm_shims();
 function renderMinScoreAbstentionFailure(summary, minScore) {
@@ -484,6 +551,13 @@ function renderMinScoreLimitationFailure(summary, minScore) {
   return `Cejel: cannot evaluate the required minimum ${minScore.toFixed(1)}/4.0 because the scan has limited evidence (${summary.scanLimitations.length} limitation${summary.scanLimitations.length === 1 ? "" : "s"}). Resolve the reported limitations and re-scan.
 `;
 }
+function renderMinScoreCoverageFailure(coverage, minScore) {
+  if (!coverage.lowConfidence) {
+    throw new Error("A minimum-score coverage message requires low measurement coverage.");
+  }
+  return `Cejel: cannot evaluate the required minimum ${minScore.toFixed(1)}/4.0 because fewer than half of the applicable dimensions were measured in at least one score (${formatCoverageSummary(coverage)}). Resolve the reported evidence gaps and re-scan.
+`;
+}
 function renderTerminalCertificate(summary, report) {
   const abstained = summary.verdict === "Insufficient source" || summary.verdict === "Insufficient evidence";
   if (!abstained && (summary.overallScore === null || summary.codeTrustScore === null || summary.processTrustScore === null)) {
@@ -636,7 +710,7 @@ var CLI_FLAG_SPECS = [
   {
     tokens: ["--min-score"],
     value: "<0-4>",
-    description: "exit nonzero below this overall score",
+    description: "exit nonzero below this overall score or with insufficient measurement coverage",
     kind: "minScore"
   },
   {
@@ -730,12 +804,14 @@ Usage:
   npx ${NPX_PACKAGE_NAME} [path] [options]
   npx ${NPX_PACKAGE_NAME} scan [path] [options]
   npx ${NPX_PACKAGE_NAME} verify <report.json> <attestation.json> [issuance.json issuance.json.sig]
+  npx ${NPX_PACKAGE_NAME} export gitlab-codequality <report.json> [-o gl-code-quality-report.json]
   npx ${NPX_PACKAGE_NAME} issue [path] --report <report.json> --attestation <attestation.json> --key <key.pub> --engagement-ref <ref>
 
 Commands:
   scan    score a repository (default when the command is omitted)
   verify  verify the report/attestation binding; with an issuance pair, also check the issuer
           signature against docs/security/${ISSUER_SIGNERS_FILE} and docs/security/${ISSUER_REVOCATIONS_FILE}
+  export  write report.json's located findings as a GitLab Code Quality report (offline)
   issue   re-run this version at the certificate's revision and, only if report.json reproduces
           byte for byte, write an unsigned issuance.json for the issuer to sign through ssh-agent
 
@@ -780,6 +856,9 @@ async function runWitanCli(args, rubricVersion) {
   if (invocation.command === "issue") {
     return runIssue(invocation.options);
   }
+  if (invocation.command === "export") {
+    return runExport(invocation);
+  }
   const options = invocation.options;
   if (options.showVersion) {
     process.stdout.write(`${cliVersion()}
@@ -851,6 +930,11 @@ Wrote:
       process.stderr.write(renderMinScoreAbstentionFailure(summary, options.minScore));
       return 1;
     }
+    const coverage = computeApplicableMeasuredCoverage(report);
+    if (coverage.lowConfidence) {
+      process.stderr.write(renderMinScoreCoverageFailure(coverage, options.minScore));
+      return 1;
+    }
     if (report.overallScore < options.minScore) {
       process.stderr.write(
         `Cejel: overall score ${report.overallScore.toFixed(1)}/4.0 is below the required minimum ${options.minScore.toFixed(1)}/4.0
@@ -876,6 +960,13 @@ function parseCliInvocation(args) {
     }
     return parseVerifyArgs(verifyArgs);
   }
+  if (command === "export") {
+    const exportArgs = args.slice(1);
+    if (exportArgs.some((arg) => arg === "-h" || arg === "--help")) {
+      return { command: "scan", options: parseArgs(["--help"]) };
+    }
+    return parseExportArgs(exportArgs);
+  }
   if (command === "issue") {
     const issueArgs = args.slice(1);
     if (issueArgs.some((arg) => arg === "-h" || arg === "--help")) {
@@ -888,6 +979,54 @@ function parseCliInvocation(args) {
   }
   return { command: "scan", options: parseArgs(args) };
 }
+var EXPORT_USAGE = () => `Usage: npx ${NPX_PACKAGE_NAME} export gitlab-codequality <report.json> [-o gl-code-quality-report.json]`;
+function parseExportArgs(args) {
+  const [format, ...rest] = args;
+  if (format !== "gitlab-codequality") throw new Error(EXPORT_USAGE());
+  const positionals = [];
+  let outPath = "gl-code-quality-report.json";
+  for (let index = 0; index < rest.length; index += 1) {
+    const arg = rest[index];
+    if (arg === void 0) continue;
+    if (arg === "-o" || arg === "--out") {
+      const value = rest[index + 1];
+      if (!value) throw new Error(`Missing value for ${arg}`);
+      outPath = value;
+      index += 1;
+      continue;
+    }
+    if (arg.startsWith("-")) throw new Error(`Unknown Cejel export flag: ${arg}`);
+    positionals.push(arg);
+  }
+  const [reportPath] = positionals;
+  if (positionals.length !== 1 || !reportPath) throw new Error(EXPORT_USAGE());
+  return {
+    command: "export",
+    format,
+    reportPath: resolve(reportPath),
+    outPath: resolve(outPath)
+  };
+}
+function runExport(invocation) {
+  const reportArtifact = readJsonArtifact(invocation.reportPath, "report");
+  const reportResult = WitanReportSchema.safeParse(reportArtifact.value);
+  if (!reportResult.success) {
+    const members = reportResult.error.issues.map(
+      (issue) => `${issue.path.join(".") || "<root>"}: ${issue.message}`
+    );
+    process.stderr.write(
+      `Cejel: report validation failed:
+${members.map((member) => `  - ${member}`).join("\n")}
+`
+    );
+    return 1;
+  }
+  const result = exportGitLabCodeQuality(reportResult.data);
+  writeFileSync(invocation.outPath, `${JSON.stringify(result.entries, null, 2)}
+`, "utf8");
+  process.stderr.write(renderGitLabCodeQualityFooter(result));
+  return 0;
+}
 var VERIFY_USAGE = () => `Usage: npx ${NPX_PACKAGE_NAME} verify <report.json> <attestation.json> [issuance.json issuance.json.sig] [--signers <file>] [--revocations <file>]`;
 function parseVerifyArgs(args) {
   const positionals = [];
@@ -1029,7 +1168,7 @@ ${members.map((member) => `  - ${member}`).join("\n")}
     return 1;
   }
   const statement = readJsonArtifact(invocation.attestationPath, "attestation");
-  const reportSha256 = createHash2("sha256").update(reportArtifact.contents).digest("hex");
+  const reportSha256 = createHash3("sha256").update(reportArtifact.contents).digest("hex");
   const result = verifyWitanAttestationBinding(statement.value, reportResult.data, {
     reportSha256
   });
@@ -1046,7 +1185,7 @@ ${result.errors.map((error) => `  - ${error}`).join("\n")}
     process.stdout.write("Cejel: signature and signer identity were not verified.\n");
     return 0;
   }
-  const attestationSha256 = createHash2("sha256").update(statement.contents).digest("hex");
+  const attestationSha256 = createHash3("sha256").update(statement.contents).digest("hex");
   return runVerifyIssuance(invocation, {
     reportSha256,
     attestationSha256,
@@ -1149,8 +1288,8 @@ ${members.map((member) => `  - ${member}`).join("\n")}
   }
   const suppliedReport = reportResult.data;
   const attestationArtifact = readJsonArtifact(options.attestationPath, "attestation");
-  const reportSha256 = createHash2("sha256").update(reportArtifact.contents).digest("hex");
-  const attestationSha256 = createHash2("sha256").update(attestationArtifact.contents).digest("hex");
+  const reportSha256 = createHash3("sha256").update(reportArtifact.contents).digest("hex");
+  const attestationSha256 = createHash3("sha256").update(attestationArtifact.contents).digest("hex");
   const attestationBinding = verifyWitanAttestationBinding(
     attestationArtifact.value,
     suppliedReport,
@@ -1182,7 +1321,7 @@ ${attestationBinding.errors.map((error) => `  - ${error}`).join("\n")}
     toolVersion: cliVersion()
   });
   const reproducedBytes = serializeWitanReport(reproduction.report);
-  const reproducedSha256 = createHash2("sha256").update(reproducedBytes, "utf8").digest("hex");
+  const reproducedSha256 = createHash3("sha256").update(reproducedBytes, "utf8").digest("hex");
   if (reproducedSha256 !== reportSha256) {
     process.stderr.write(
       [
@@ -1403,6 +1542,7 @@ export {
   WitanReportSchema,
   parseArgs,
   parseCliInvocation,
+  parseExportArgs,
   parseIssueArgs,
   parseVerifyArgs,
   runWitanFreeCli,

package/dist/mcp/index.js

@@ -5,7 +5,7 @@ import {
   renderWitanBadgeSvg,
   renderWitanHtmlReport,
   runCejelScan
-} from "../chunk-UBCIGOIP.js";
+} from "../chunk-2453M7C2.js";
 import "../chunk-63XQDYQ5.js";
 import {
   ZodFirstPartyTypeKind,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cejel/cejel",
-  "version": "0.4.11",
+  "version": "0.6.0",
   "mcpName": "io.github.BargLabs/cejel",
   "private": false,
   "publishConfig": {
@@ -63,6 +63,7 @@
     "gate:d5": "pnpm run build && node scripts/d5-precision-gate.mjs",
     "gate:d6": "pnpm run build && node scripts/d6-precision-gate.mjs",
     "validate:distribution": "node scripts/validate-distribution-metadata.mjs",
+    "test:release": "bash scripts/release_tests.sh",
     "pnpm:devPreinstall": "node scripts/assert-dev-environment.mjs --phase=preinstall",
     "prepublishOnly": "pnpm run build",
     "prepack": "pnpm run build",