@codyswann/lisa 4.70.4 → 4.71.0

package/all/copy-overwrite/scripts/lib/github-attestation-provider.mjs

@@ -0,0 +1,241 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Fixed bounded provider reads distinguish historical origin from current authority. */
+import { boundedSpawnSync } from "./bounded-spawn.mjs";
+import {
+  ghJson,
+  requireProof,
+  sha256,
+  assertPinnedVerifier,
+} from "./github-attestation-verifier.mjs";
+
+const API = "api";
+const HOST_FLAG = "--hostname";
+const PUBLIC_HOST = "github.com";
+
+/** Provider identity never treats unavailable state as an absent scope. */
+function repositoryState(read, policy, parent) {
+  const repo = read(`repos/${policy.repository}`);
+  requireProof(
+    String(repo.id) === policy.repositoryId &&
+      String(repo.owner?.id) === policy.ownerId,
+    "provider repository identity differs"
+  );
+  requireProof(
+    repo.full_name === policy.repository && repo.default_branch === "main",
+    "provider main scope differs"
+  );
+  const main = read(`repos/${policy.repository}/git/ref/heads/main`);
+  requireProof(
+    main.ref === "refs/heads/main" && main.object?.sha === parent,
+    "provider main base differs"
+  );
+}
+
+/** Private role selection is fixed by separate exported ordinary/historical entry points. */
+function runState(read, policy, descriptor, historical) {
+  const run = read(
+    `repos/${policy.repository}/actions/runs/${descriptor.runId}/attempts/${descriptor.runAttempt}`
+  );
+  requireProof(
+    String(run.id) === descriptor.runId &&
+      String(run.run_attempt) === descriptor.runAttempt,
+    "provider run differs"
+  );
+  requireProof(
+    run.head_sha === descriptor.parent &&
+      run.head_branch === "main" &&
+      (historical
+        ? ["in_progress", "completed"].includes(run.status)
+        : run.status === "in_progress"),
+    "stale/cancelled provider run"
+  );
+  requireProof(
+    String(run.head_repository?.id) === policy.repositoryId &&
+      policy.allowedTriggers.includes(run.event),
+    "fork/unapproved provider run"
+  );
+  requireProof(
+    Array.isArray(run.referenced_workflows) &&
+      run.referenced_workflows.some(
+        workflow =>
+          workflow.path?.split("@")[0] === policy.signerWorkflow &&
+          workflow.sha === policy.signerDigest
+      ),
+    "actual reusable workflow differs"
+  );
+  return run;
+}
+
+/** A current exact Bot claim remains required even when origin is historical. */
+function claimState(read, policy, descriptor) {
+  const comment = read(
+    `repos/${descriptor.queue}/issues/comments/${descriptor.claimCommentId}`
+  );
+  const issueNumber = descriptor.workItem.slice(
+    descriptor.workItem.lastIndexOf("#") + 1
+  );
+  requireProof(
+    String(comment.id) === descriptor.claimCommentId &&
+      comment.issue_url ===
+        `https://api.github.com/repos/${descriptor.queue}/issues/${issueNumber}`,
+    "claim scope differs"
+  );
+  requireProof(
+    String(comment.user?.id) === policy.claimActorId &&
+      comment.user?.type === "Bot",
+    "claim actor differs"
+  );
+  requireProof(
+    typeof comment.body === "string" &&
+      sha256(comment.body) === descriptor.claimSha256,
+    "claim announcement changed"
+  );
+  return comment;
+}
+
+/** Every role shares bounded pinned reads and immutable repository identity. */
+function providerOrigin(policy, descriptor, historical, execute) {
+  const read = endpoint =>
+    ghJson(policy, [API, HOST_FLAG, PUBLIC_HOST, endpoint], execute);
+  repositoryState(read, policy, descriptor.parent);
+  return {
+    run: runState(read, policy, descriptor, historical),
+    claim: claimState(read, policy, descriptor),
+  };
+}
+
+/** Prove the trusted human remains assignable using the actual documented status. */
+export function verifyAssignable(
+  policy,
+  maintainer,
+  execute = boundedSpawnSync
+) {
+  requireProof(
+    typeof maintainer === "string" &&
+      /^[A-Za-z0-9][A-Za-z0-9-]{0,38}$/.test(maintainer),
+    "invalid trusted maintainer"
+  );
+  assertPinnedVerifier(policy);
+  const result = execute(
+    policy.ghExecutable,
+    [
+      API,
+      HOST_FLAG,
+      PUBLIC_HOST,
+      "--include",
+      `repos/${policy.repository}/assignees/${maintainer}`,
+    ],
+    {
+      encoding: "utf8",
+      timeout: 30_000,
+      maxBuffer: 65_536,
+      env: { ...process.env, GH_HOST: PUBLIC_HOST },
+    }
+  );
+  requireProof(
+    !result.error &&
+      !result.signal &&
+      result.status === 0 &&
+      typeof result.stdout === "string" &&
+      Buffer.byteLength(result.stdout) <= 65_536 &&
+      /^HTTP\/\S+ 204\b/.test(result.stdout),
+    "trusted maintainer is not assignable"
+  );
+}
+
+/** Current v1 authorization always requires its own live run. */
+export function verifyCurrentProvider(
+  policy,
+  descriptor,
+  execute = boundedSpawnSync
+) {
+  return providerOrigin(policy, descriptor, false, execute);
+}
+
+/** Historical origin returns qualified provider chronology, never current authority. */
+export function verifyHistoricalProvider(
+  policy,
+  descriptor,
+  execute = boundedSpawnSync
+) {
+  return providerOrigin(policy, descriptor, true, execute);
+}
+
+/** Fresh permission checks its own invocation and the exact observed destination. */
+export function verifyRecoveryProvider(
+  policy,
+  descriptor,
+  recovery,
+  maintainer,
+  execute = boundedSpawnSync
+) {
+  verifyCurrentProvider(
+    policy,
+    { ...descriptor, runId: recovery.runId, runAttempt: recovery.runAttempt },
+    execute
+  );
+  const read = endpoint =>
+    ghJson(policy, [API, HOST_FLAG, PUBLIC_HOST, endpoint], execute);
+  const number = descriptor.workItem.slice(
+    descriptor.workItem.lastIndexOf("#") + 1
+  );
+  const issue = read(`repos/${policy.repository}/issues/${number}`);
+  requireProof(
+    issue.state === "open" &&
+      !issue.pull_request &&
+      sha256(issue.body) === recovery.leafBodySha256 &&
+      Array.isArray(issue.assignees) &&
+      issue.assignees.length === 1 &&
+      issue.assignees[0].login === maintainer &&
+      issue.assignees[0].type === "User",
+    "current recovery leaf or owner differs"
+  );
+  const refs = read(
+    `repos/${policy.repository}/git/matching-refs/heads/${recovery.branch}`
+  );
+  requireProof(
+    Array.isArray(refs) && refs.length <= 1,
+    "ambiguous recovery branch"
+  );
+  const head = refs.length ? refs[0].object?.sha : null;
+  requireProof(
+    !refs.length || refs[0].ref === `refs/heads/${recovery.branch}`,
+    "foreign recovery ref"
+  );
+  requireProof(
+    head === recovery.expectedBranchHead,
+    "recovery destination changed"
+  );
+  const pulls = [];
+  for (let page = 1; page <= 20; page++) {
+    const values = read(
+      `repos/${policy.repository}/pulls?state=all&head=${encodeURIComponent(`${policy.repository.split("/")[0]}:${recovery.branch}`)}&per_page=100&page=${page}`
+    );
+    requireProof(
+      Array.isArray(values) && values.length <= 100,
+      "invalid recovery PR page"
+    );
+    pulls.push(...values);
+    if (values.length < 100) break;
+    requireProof(page < 20, "incomplete recovery PR pages");
+  }
+  requireProof(pulls.length <= 1, "ambiguous recovery PR");
+  if (!pulls.length)
+    requireProof(
+      recovery.prNumber === null && recovery.expectedPrHead === null,
+      "missing expected recovery PR"
+    );
+  else
+    requireProof(
+      pulls[0].number === recovery.prNumber &&
+        pulls[0].state === "open" &&
+        pulls[0].head?.sha === recovery.expectedPrHead &&
+        pulls[0].head?.ref === recovery.branch &&
+        pulls[0].head?.repo?.full_name === policy.repository &&
+        pulls[0].base?.ref === "main" &&
+        pulls[0].base?.repo?.full_name === policy.repository,
+      "foreign/closed/changed recovery PR"
+    );
+}

package/all/copy-overwrite/scripts/lib/github-attestation-recovery.mjs

@@ -0,0 +1,283 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Fixed historical-origin and fresh-recovery roles preserve ordinary v1 authority. */
+import {
+  verifyHistoricalProvider,
+  verifyRecoveryProvider,
+  verifyAssignable,
+} from "./github-attestation-provider.mjs";
+import { boundedSpawnSync } from "./bounded-spawn.mjs";
+import {
+  requireProof,
+  verifiedRole,
+  matchSigningTime,
+  officialResult,
+  PROPOSAL_PREDICATE,
+  RECOVERY_PREDICATE,
+} from "./github-attestation-verifier.mjs";
+
+/** Historical origin authenticates bytes only within witnessed provider chronology. */
+export function assertHistoricalAttestation(
+  results,
+  descriptor,
+  digest,
+  policy,
+  run,
+  claim,
+  now = Date.now()
+) {
+  const result = verifiedRole(
+    results,
+    descriptor,
+    digest,
+    policy,
+    PROPOSAL_PREDICATE,
+    "descriptor.json"
+  );
+  const start = Date.parse(run.run_started_at),
+    updated = Date.parse(run.updated_at),
+    claimed = Date.parse(claim.created_at);
+  requireProof(
+    [start, updated, claimed].every(Number.isFinite) &&
+      start <= updated &&
+      updated <= now + 60_000,
+    "missing/invalid historical provider chronology"
+  );
+  // Official signature/timestamp verification already authenticates these times.
+  matchSigningTime(
+    result.verifiedTimestamps,
+    { ...policy, maxAgeSeconds: Number.MAX_SAFE_INTEGER },
+    now
+  );
+  for (const time of result.verifiedTimestamps) {
+    const signed = Date.parse(time.timestamp);
+    requireProof(
+      signed >= start - 60_000 &&
+        signed >= claimed - 60_000 &&
+        signed <= updated + 60_000,
+      "origin signed outside provider chronology"
+    );
+  }
+  return result.signature.certificate;
+}
+
+const RECOVERY_KEYS = [
+  "version",
+  "purpose",
+  "repository",
+  "repositoryId",
+  "ownerId",
+  "queue",
+  "workItem",
+  "proposalKey",
+  "bindingKey",
+  "npmPolicySha256",
+  "automationPolicySha256",
+  "originDescriptorSha256",
+  "originRunId",
+  "originRunAttempt",
+  "commit",
+  "parent",
+  "tree",
+  "messageSha256",
+  "claimCommentId",
+  "claimSha256",
+  "leafBodySha256",
+  "branch",
+  "expectedBranchHead",
+  "prNumber",
+  "expectedPrHead",
+  "runId",
+  "runAttempt",
+];
+
+/** Closed recovery fields bind fresh permission to one unchanged origin. */
+export function validateRecovery(value, origin, digest, policy) {
+  requireProof(
+    value &&
+      typeof value === "object" &&
+      !Array.isArray(value) &&
+      Object.keys(value).sort().join("\n") ===
+        [...RECOVERY_KEYS].sort().join("\n"),
+    "recovery fields differ"
+  );
+  const expected = {
+    version: 1,
+    purpose: "resume-identical-npm-proposal",
+    repository: policy.repository,
+    repositoryId: policy.repositoryId,
+    ownerId: policy.ownerId,
+    queue: origin.queue,
+    workItem: origin.workItem,
+    bindingKey: origin.proposalKey,
+    automationPolicySha256: origin.policySha256,
+    originDescriptorSha256: digest,
+    originRunId: origin.runId,
+    originRunAttempt: origin.runAttempt,
+    parent: origin.parent,
+    tree: origin.tree,
+    messageSha256: origin.messageSha256,
+    claimCommentId: origin.claimCommentId,
+    claimSha256: origin.claimSha256,
+  };
+  for (const [key, expectedValue] of Object.entries(expected))
+    requireProof(value[key] === expectedValue, `recovery ${key} differs`);
+  for (const key of ["proposalKey", "npmPolicySha256", "leafBodySha256"])
+    requireProof(/^[a-f0-9]{64}$/.test(value[key]), "invalid recovery digest");
+  requireProof(
+    /^[a-f0-9]{40}$/.test(value.commit) &&
+      value.branch === `lisa/npm-${value.proposalKey}`,
+    "invalid recovery destination"
+  );
+  requireProof(
+    [value.runId, value.runAttempt].every(
+      item => typeof item === "string" && /^[1-9]\d*$/.test(item)
+    ),
+    "invalid recovery invocation"
+  );
+  requireProof(
+    value.runId !== origin.runId || value.runAttempt !== origin.runAttempt,
+    "recovery repeats origin invocation"
+  );
+  requireProof(
+    value.expectedBranchHead === null ||
+      value.expectedBranchHead === value.commit,
+    "foreign recovery branch"
+  );
+  requireProof(
+    (value.prNumber === null && value.expectedPrHead === null) ||
+      (Number.isSafeInteger(value.prNumber) &&
+        value.prNumber > 0 &&
+        value.expectedPrHead === value.commit &&
+        value.expectedBranchHead === value.commit),
+    "partial/foreign recovery PR"
+  );
+  return value;
+}
+
+/** Fresh recovery has its own signed subject and retains ordinary freshness. */
+export function assertRecoveryAttestation(
+  results,
+  recovery,
+  digest,
+  policy,
+  now = Date.now()
+) {
+  const result = verifiedRole(
+    results,
+    recovery,
+    digest,
+    policy,
+    RECOVERY_PREDICATE,
+    "recovery.json"
+  );
+  matchSigningTime(result.verifiedTimestamps, policy, now);
+  return result.signature.certificate;
+}
+
+/** Historical verification cannot be selected by an ordinary-v1 caller flag. */
+export function verifyHistoricalDescriptor(
+  policy,
+  descriptor,
+  paths,
+  digest,
+  run,
+  claim,
+  execute = boundedSpawnSync
+) {
+  return assertHistoricalAttestation(
+    officialResult(
+      policy,
+      descriptor,
+      paths.descriptor,
+      paths.bundle,
+      PROPOSAL_PREDICATE,
+      execute
+    ),
+    descriptor,
+    digest,
+    policy,
+    run,
+    claim
+  );
+}
+
+/** Recovery verification uses only its fixed separate private subject and bundle. */
+export function verifyRecoveryAttestation(
+  policy,
+  recovery,
+  paths,
+  digest,
+  execute = boundedSpawnSync
+) {
+  return assertRecoveryAttestation(
+    officialResult(
+      policy,
+      recovery,
+      paths.recovery,
+      paths.recoveryBundle,
+      RECOVERY_PREDICATE,
+      execute
+    ),
+    recovery,
+    digest,
+    policy
+  );
+}
+
+// Compatibility export preserves callers of the fixed local Git construction.
+export { predictedCommit } from "./automation-provenance-local.mjs";
+
+/** Both proofs and current live authority are necessary; historical data alone grants nothing. */
+export function verifyRecoveryOrigin(
+  policy,
+  descriptor,
+  recovery,
+  digest,
+  paths,
+  scope,
+  execute = boundedSpawnSync
+) {
+  validateRecovery(recovery, descriptor, digest, policy);
+  for (const key of [
+    "npmPolicySha256",
+    "proposalKey",
+    "leafBodySha256",
+    "commit",
+  ])
+    requireProof(
+      recovery[key] === scope[key],
+      `current recovery ${key} differs`
+    );
+  requireProof(
+    process.env.GITHUB_RUN_ID === recovery.runId &&
+      process.env.GITHUB_RUN_ATTEMPT === recovery.runAttempt,
+    "recovery replayed into different current invocation"
+  );
+  const origin = verifyHistoricalProvider(policy, descriptor, execute);
+  verifyHistoricalDescriptor(
+    policy,
+    descriptor,
+    paths,
+    digest,
+    origin.run,
+    origin.claim,
+    execute
+  );
+  verifyRecoveryAttestation(
+    policy,
+    recovery,
+    paths,
+    scope.recoverySha256,
+    execute
+  );
+  verifyRecoveryProvider(
+    policy,
+    descriptor,
+    recovery,
+    scope.maintainer,
+    execute
+  );
+  verifyAssignable(policy, scope.maintainer, execute);
+}