@codyswann/lisa 4.70.4 → 4.71.0

package/all/copy-overwrite/scripts/lib/github-attestation-verifier.mjs

@@ -0,0 +1,244 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Bounded official verification followed by exact authorization policy. */
+import { createHash } from "node:crypto";
+import { lstatSync, readFileSync } from "node:fs";
+import { isAbsolute } from "node:path";
+import { boundedSpawnSync } from "./bounded-spawn.mjs";
+
+export const ACTIONS_ISSUER = "https://token.actions.githubusercontent.com";
+export const PROPOSAL_PREDICATE =
+  "https://lisa.dev/attestations/npm-proposal/v1";
+export const RECOVERY_PREDICATE =
+  "https://lisa.dev/attestations/npm-recovery/v1";
+
+/** Hash exact bytes; never an estimated identifier. */
+export function sha256(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+
+/** Require a predicate, hiding potentially sensitive provider output. */
+export function requireProof(condition, reason) {
+  if (!condition) throw new Error(`Invalid automation provenance: ${reason}`);
+}
+
+/** Run only the trusted, hash-pinned official executable with bounded output. */
+export function assertPinnedVerifier(policy) {
+  requireProof(
+    isAbsolute(policy.ghExecutable ?? ""),
+    "official gh executable is not pinned"
+  );
+  const stat = lstatSync(policy.ghExecutable);
+  requireProof(
+    stat.isFile() && stat.size <= 150_000_000,
+    "invalid official gh file"
+  );
+  requireProof(
+    sha256(readFileSync(policy.ghExecutable)) === policy.ghSha256,
+    "official gh bytes differ"
+  );
+}
+
+/** Run only the already pinned verifier/provider reader under fixed bounds. */
+export function ghJson(policy, args, execute = boundedSpawnSync) {
+  assertPinnedVerifier(policy);
+  const result = execute(policy.ghExecutable, args, {
+    encoding: "utf8",
+    timeout: 30_000,
+    maxBuffer: 1_048_576,
+    env: { ...process.env, GH_HOST: "github.com" },
+  });
+  requireProof(
+    !result.error && !result.signal && result.status === 0,
+    "official verifier/provider request failed"
+  );
+  requireProof(
+    typeof result.stdout === "string" &&
+      Buffer.byteLength(result.stdout) <= 1_048_576,
+    "oversize verifier result"
+  );
+  return JSON.parse(result.stdout);
+}
+
+/** Strictly match fields from a successfully verified certificate. */
+function matchCertificate(certificate, descriptor, policy) {
+  const expected = {
+    issuer: ACTIONS_ISSUER,
+    buildSignerURI: `https://github.com/${policy.signerWorkflow}@${policy.signerDigest}`,
+    buildSignerDigest: policy.signerDigest,
+    buildConfigURI: `https://github.com/${policy.callerWorkflow}@refs/heads/main`,
+    buildConfigDigest: descriptor.parent,
+    sourceRepositoryURI: `https://github.com/${policy.repository}`,
+    sourceRepositoryDigest: descriptor.parent,
+    sourceRepositoryRef: "refs/heads/main",
+    sourceRepositoryIdentifier: policy.repositoryId,
+    sourceRepositoryOwnerIdentifier: policy.ownerId,
+    runInvocationURI: `https://github.com/${policy.repository}/actions/runs/${descriptor.runId}/attempts/${descriptor.runAttempt}`,
+    runnerEnvironment: "github-hosted",
+  };
+  for (const [key, value] of Object.entries(expected)) {
+    requireProof(
+      typeof value === "string" && value !== "" && certificate?.[key] === value,
+      `certificate ${key} differs`
+    );
+  }
+  requireProof(
+    policy.allowedTriggers.includes(certificate.buildTrigger),
+    "unapproved workflow trigger"
+  );
+}
+
+/** Only authenticated observer times count; current-time-only is insufficient. */
+export function matchSigningTime(timestamps, policy, now) {
+  requireProof(
+    Array.isArray(timestamps) &&
+      timestamps.length > 0 &&
+      timestamps.length <= 8,
+    "missing signing timestamp"
+  );
+  for (const time of timestamps) {
+    const milliseconds = Date.parse(time.timestamp);
+    requireProof(
+      ["Tlog", "TimestampAuthority"].includes(time.type),
+      "unsigned/current signing time"
+    );
+    requireProof(
+      typeof time.uri === "string" && time.uri.startsWith("https://"),
+      "missing timestamp authority"
+    );
+    requireProof(
+      Number.isFinite(milliseconds) && milliseconds <= now + 60_000,
+      "future/invalid signing time"
+    );
+    requireProof(
+      now - milliseconds <= policy.maxAgeSeconds * 1000,
+      "proposal authorization expired"
+    );
+  }
+}
+
+/** Fixed role matching never accepts a caller-selected expiry or predicate waiver. */
+export function verifiedRole(
+  results,
+  descriptor,
+  digest,
+  policy,
+  predicate,
+  name
+) {
+  requireProof(
+    Array.isArray(results) && results.length === 1,
+    "ambiguous/missing attestation"
+  );
+  const result = results[0].verificationResult;
+  requireProof(
+    result?.statement?._type === "https://in-toto.io/Statement/v1",
+    "unsupported statement"
+  );
+  requireProof(
+    result.statement.predicateType === predicate,
+    "wrong predicate type"
+  );
+  const subjects = result.statement.subject;
+  requireProof(
+    Array.isArray(subjects) && subjects.length === 1,
+    "ambiguous subject"
+  );
+  requireProof(
+    subjects[0].name === name && subjects[0].digest?.sha256 === digest,
+    "proof subject differs"
+  );
+  matchCertificate(result.signature?.certificate, descriptor, policy);
+  return result;
+}
+
+/** Ordinary v1 remains short-lived current authorization. */
+export function assertVerifiedAttestation(
+  results,
+  descriptor,
+  digest,
+  policy,
+  now = Date.now()
+) {
+  const result = verifiedRole(
+    results,
+    descriptor,
+    digest,
+    policy,
+    PROPOSAL_PREDICATE,
+    "descriptor.json"
+  );
+  matchSigningTime(result.verifiedTimestamps, policy, now);
+  return result.signature.certificate;
+}
+
+/** Shared literal argv does not replace official verification or authorization policy. */
+export function officialArguments(policy, identity, file, bundle, predicate) {
+  return [
+    "attestation",
+    "verify",
+    file,
+    "--bundle",
+    bundle,
+    "--repo",
+    policy.repository,
+    "--signer-workflow",
+    policy.signerWorkflow,
+    "--signer-digest",
+    policy.signerDigest,
+    "--source-digest",
+    identity.parent,
+    "--source-ref",
+    "refs/heads/main",
+    "--predicate-type",
+    predicate,
+    "--cert-oidc-issuer",
+    ACTIONS_ISSUER,
+    "--deny-self-hosted-runners",
+    "--format",
+    "json",
+  ];
+}
+
+/** The three explicit entry points select fixed official verification roles. */
+export function officialResult(
+  policy,
+  identity,
+  file,
+  bundle,
+  predicate,
+  execute
+) {
+  return ghJson(
+    policy,
+    officialArguments(policy, identity, file, bundle, predicate),
+    execute
+  );
+}
+
+/** Invoke official signature/root/timestamp verification before applying policy. */
+export function verifyDescriptorAttestation(
+  policy,
+  descriptor,
+  paths,
+  digest,
+  execute = boundedSpawnSync
+) {
+  return assertVerifiedAttestation(
+    officialResult(
+      policy,
+      descriptor,
+      paths.descriptor,
+      paths.bundle,
+      PROPOSAL_PREDICATE,
+      execute
+    ),
+    descriptor,
+    digest,
+    policy
+  );
+}
+
+// Compatibility exports retain ordinary callers without top-level provider work.
+export { verifyCurrentProvider } from "./github-attestation-provider.mjs";

package/all/copy-overwrite/scripts/lib/npm-update-allocate.mjs

@@ -0,0 +1,289 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Fixed-schema writer evidence and idempotent current claim. @module npm-updater */
+import { required, CLAIM, validateProposal } from "./npm-update-contract.mjs";
+import { baseline } from "./npm-update-prepare.mjs";
+import { locateCheckpoint } from "./npm-update-recovery.mjs";
+import { runProcess } from "./npm-update-process.mjs";
+import { sha256 } from "./github-attestation-verifier.mjs";
+import { registryVersion } from "./npm-update-npm.mjs";
+import {
+  buildDraft,
+  qualityGates,
+  inspectLeaf,
+  leafRoles,
+  historicalFiling,
+  claimLeaf,
+} from "./npm-update-leaf.mjs";
+/** Probe the named surfaces, all-state relationships and committed history before filing. */
+export async function filingEvidence(api, proposal, config, cwd) {
+  await baseline(
+    cwd,
+    { PATH: process.env.PATH, HOME: "/nonexistent", GIT_TERMINAL_PROMPT: "0" },
+    proposal
+  );
+  await api.main(proposal.parent);
+  const query = `repo:${proposal.repository} npm is:issue in:title,body`;
+  const search = await api.request(
+    `search/issues?q=${encodeURIComponent(query)}&per_page=100`
+  );
+  required(
+    !search.incomplete_results && search.total_count <= 100,
+    "relationship search is incomplete or oversized"
+  );
+  for (const item of search.items) await api.issue(item.number);
+  const history = await runProcess(
+    "git",
+    [
+      "log",
+      proposal.parent,
+      "--max-count=20",
+      "--format=%H %s",
+      "--",
+      "package.json",
+      "package-lock.json",
+    ],
+    {
+      cwd,
+      env: {
+        PATH: process.env.PATH,
+        HOME: "/nonexistent",
+        GIT_TERMINAL_PROMPT: "0",
+      },
+    }
+  );
+  const registry = [];
+  for (const update of proposal.updates)
+    registry.push(await registryVersion(update, proposal));
+  const labels = (await api.list(`repos/${proposal.repository}/labels`)).map(
+    label => label.name
+  );
+  return {
+    history: {
+      command: `git log ${proposal.parent} --max-count=20 -- package.json package-lock.json`,
+      result: history.stdout.toString() || "No matching history.",
+    },
+    search: { query, total: search.total_count },
+    registry,
+    labels,
+    main: proposal.parent,
+  };
+}
+
+/** Same selected versions are discovered before deriving a new parent-bound key. */
+export async function discoverPrior(api, proposal) {
+  const query = `repo:${proposal.repository} "${proposal.selectionKey}" is:issue in:body`;
+  const found = await api.request(
+    `search/issues?q=${encodeURIComponent(query)}&per_page=100`
+  );
+  required(
+    found.incomplete_results === false &&
+      Number.isSafeInteger(found.total_count) &&
+      found.total_count <= 1 &&
+      Array.isArray(found.items) &&
+      found.items.length === found.total_count,
+    "prior selection search is incomplete or ambiguous"
+  );
+  if (!found.total_count) return { status: "new" };
+  const issue = await api.issue(found.items[0].number);
+  required(
+    issue.state === "open" &&
+      !issue.pull_request &&
+      typeof issue.body === "string",
+    "closed or foreign prior proposal is preserved"
+  );
+  const selected = [
+    ...issue.body.matchAll(/^Selection key: ([a-f0-9]{64})$/gm),
+  ];
+  const parents = [...issue.body.matchAll(/^Base parent: ([a-f0-9]{40})$/gm)];
+  required(
+    selected.length === 1 &&
+      selected[0][1] === proposal.selectionKey &&
+      parents.length === 1,
+    "prior proposal identity differs"
+  );
+  return {
+    status:
+      parents[0][1] === proposal.parent ? "existing" : "stale-outstanding",
+    issue,
+  };
+}
+
+/** Restoration preserves original filing bytes while checking the live claim and holds. */
+async function restoredAllocation({
+  api,
+  proposal,
+  policy,
+  config,
+  prior,
+  checkpoint,
+  evidence,
+  currentEvidence,
+}) {
+  if (prior.issue) {
+    const state = await inspectLeaf(
+      prior.issue,
+      buildDraft(proposal, policy, config, evidence),
+      policy,
+      config
+    );
+    if (checkpoint?.signed) {
+      const allocation = checkpoint.payload.allocation;
+      required(
+        state.claimed &&
+          !state.unassigned &&
+          state.claims.length === 1 &&
+          String(state.claims[0].id) === allocation.claimCommentId &&
+          sha256(state.claims[0].body) === allocation.claimSha256 &&
+          String(state.claims[0].user?.id) === api.policy.claimActorId &&
+          state.claims[0].user?.type === "Bot",
+        "origin checkpoint current claim changed"
+      );
+      qualityGates(
+        {
+          ...allocation.draft,
+          title: prior.issue.title,
+          body: prior.issue.body,
+        },
+        proposal,
+        policy,
+        config,
+        evidence
+      );
+      return { ...allocation, currentEvidence, origin: checkpoint };
+    }
+  }
+}
+
+/** Missing configured lifecycle labels are provisioned before the fresh fixed draft. */
+async function ensureLabels({
+  api,
+  policy,
+  roles,
+  currentEvidence,
+  prior,
+  evidence,
+}) {
+  for (const name of [
+    "type:Task",
+    "priority:medium",
+    roles.ready,
+    roles.claimed,
+  ]) {
+    if (!currentEvidence.labels.includes(name)) {
+      await api.request(`repos/${policy.repository}/labels`, "POST", {
+        name,
+        color: "ededed",
+        description: "Managed dependency Task lifecycle",
+      });
+      currentEvidence.labels.push(name);
+      if (!prior.issue) evidence.labels = currentEvidence.labels;
+    }
+  }
+}
+
+/** The shipped claim and post-write quality check complete one canonical leaf. */
+async function completeAllocation({
+  api,
+  proposal,
+  policy,
+  config,
+  prior,
+  evidence,
+  currentEvidence,
+  roles,
+}) {
+  const draft = buildDraft(proposal, policy, config, evidence);
+  const before = qualityGates(draft, proposal, policy, config, evidence);
+  let issue =
+    prior.issue ??
+    (await api.request(`repos/${policy.repository}/issues`, "POST", {
+      title: draft.title,
+      body: draft.body,
+      labels: draft.labels,
+      assignees: draft.assignees,
+    }));
+  const claimed = await claimLeaf(
+    api,
+    issue,
+    draft,
+    proposal,
+    policy,
+    config,
+    evidence,
+    roles
+  );
+  issue = claimed.issue;
+  const state = claimed.state;
+  const after = qualityGates(
+    { ...draft, title: issue.title, body: issue.body },
+    proposal,
+    policy,
+    config,
+    evidence
+  );
+  const announcement = `[${policy.repository.split("/")[1]}] Fresh dependency Task ${policy.repository}#${issue.number} is assigned to ${policy.maintainer}. Proposal key: ${proposal.key}. Pre/post writer quality gates completed; ordinary gates and runtime evidence remain required.`;
+  if (!issue.comments.some(comment => comment.body === announcement))
+    await api.request(
+      `repos/${policy.repository}/issues/${issue.number}/comments`,
+      "POST",
+      { body: announcement }
+    );
+  return {
+    number: issue.number,
+    workItem: `${policy.repository}#${issue.number}`,
+    claimCommentId: String(state.claims[0].id),
+    claimSha256: sha256(CLAIM),
+    draft,
+    evidence,
+    quality: { before, after },
+    currentEvidence,
+    originalProposal: proposal,
+  };
+}
+
+/** Fixed writer pre/post quality plus real idempotent claim; no Skill RPC is invented. */
+export async function allocateLeaf({
+  api,
+  proposal: suppliedProposal,
+  policy,
+  config,
+  cwd,
+}) {
+  let proposal = suppliedProposal;
+  validateProposal(proposal, policy);
+  await api.main(proposal.parent);
+  const prior = await discoverPrior(api, proposal);
+  if (prior.status === "stale-outstanding")
+    return {
+      status: prior.status,
+      number: prior.issue.number,
+      workItem: `${policy.repository}#${prior.issue.number}`,
+    };
+  await api.assignable(policy.maintainer);
+  const currentEvidence = await filingEvidence(api, proposal, config, cwd);
+  const checkpoint = prior.issue
+    ? locateCheckpoint(prior.issue.comments, proposal, policy)
+    : undefined;
+  if (checkpoint) proposal = checkpoint.payload.proposal;
+  const evidence = prior.issue
+    ? historicalFiling(prior.issue)
+    : currentEvidence;
+  const roles = leafRoles(config, policy.repository);
+  const inputs = {
+    api,
+    proposal,
+    policy,
+    config,
+    prior,
+    checkpoint,
+    evidence,
+    currentEvidence,
+    roles,
+  };
+  const restored = await restoredAllocation(inputs);
+  if (restored) return restored;
+  await ensureLabels(inputs);
+  return completeAllocation(inputs);
+}