@codyswann/lisa 4.70.4 → 4.71.1

package/all/copy-overwrite/scripts/lib/npm-update-recovery.mjs

@@ -0,0 +1,264 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/**
+ * @file npm-update-recovery.mjs
+ * @description Durable public bytes survive runner loss without supplying authority.
+ * @module npm-updater
+ */
+import { join } from "node:path";
+import { canonicalJson } from "../lisa-automation-provenance.mjs";
+import { readBytes, readJson, writeJson } from "./npm-update-process.mjs";
+import { authorizeAllocation } from "./npm-update-leaf.mjs";
+import {
+  sha256,
+  verifyDescriptorAttestation,
+  verifyCurrentProvider,
+} from "./github-attestation-verifier.mjs";
+import {
+  verifyRecoveryOrigin,
+  predictedCommit,
+} from "./github-attestation-recovery.mjs";
+import { persistCheckpoint } from "./npm-update-checkpoint.mjs";
+import { required, validateProposal } from "./npm-update-contract.mjs";
+
+import {
+  checkpointComments,
+  decodeCheckpoint,
+} from "./npm-update-checkpoint.mjs";
+
+/** A new issuer binds current authority to the immutable original artifact and destination. */
+export function recoveryRecord(
+  proposal,
+  allocation,
+  preview,
+  policy,
+  automation,
+  issue,
+  snapshot
+) {
+  const d = preview.descriptor;
+  return {
+    version: 1,
+    purpose: "resume-identical-npm-proposal",
+    repository: policy.repository,
+    repositoryId: automation.repositoryId,
+    ownerId: automation.ownerId,
+    queue: d.queue,
+    workItem: d.workItem,
+    proposalKey: proposal.key,
+    bindingKey: d.proposalKey,
+    npmPolicySha256: proposal.policySha256,
+    automationPolicySha256: d.policySha256,
+    originDescriptorSha256: sha256(`${canonicalJson(d)}\n`),
+    originRunId: d.runId,
+    originRunAttempt: d.runAttempt,
+    commit: predictedCommit(d, Buffer.from(preview.message)),
+    parent: d.parent,
+    tree: d.tree,
+    messageSha256: d.messageSha256,
+    claimCommentId: allocation.claimCommentId,
+    claimSha256: allocation.claimSha256,
+    leafBodySha256: sha256(issue.body),
+    ...snapshot,
+    runId: process.env.GITHUB_RUN_ID,
+    runAttempt: process.env.GITHUB_RUN_ATTEMPT,
+  };
+}
+
+/** Complete untrusted chunks can restore missing transport metadata, never authority. */
+export function recoverPartialCheckpoint(comments, digest) {
+  required(
+    Array.isArray(comments) && comments.length <= 2000,
+    "partial checkpoint inventory exceeds bound"
+  );
+  const bodies = comments.filter(comment =>
+    comment.body?.startsWith(`[lisa-npm-checkpoint] v1 ${digest} `)
+  );
+  const chunks = new Map();
+  let count;
+  for (const { body } of bodies) {
+    const match =
+      /^\[lisa-npm-checkpoint\] v1 ([a-f0-9]{64}) chunk (0|[1-9]\d*)\/([1-9]\d*) ([a-f0-9]{64})\n([A-Za-z0-9+/]+=*)$/.exec(
+        body
+      );
+    required(
+      match && Buffer.byteLength(body) <= 24_576 && match[1] === digest,
+      "partial checkpoint chunk differs"
+    );
+    count ??= Number(match[3]);
+    const index = Number(match[2]);
+    const bytes = Buffer.from(match[5], "base64");
+    required(
+      count <= 256 &&
+        Number(match[3]) === count &&
+        index < count &&
+        bytes.length <= 16_384 &&
+        bytes.toString("base64") === match[5] &&
+        sha256(bytes) === match[4],
+      "partial checkpoint bounds or digest differ"
+    );
+    required(
+      !chunks.has(index) || chunks.get(index).equals(bytes),
+      "partial checkpoint has differing duplicate chunk"
+    );
+    chunks.set(index, bytes);
+  }
+  required(
+    count > 0 && chunks.size === count,
+    "partial checkpoint has missing original material"
+  );
+  const bytes = Buffer.concat(
+    Array.from({ length: count }, (_, index) => chunks.get(index))
+  );
+  required(
+    bytes.length <= 4_194_304,
+    "partial checkpoint exceeds aggregate bound"
+  );
+  const payload = JSON.parse(
+    new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes)
+  );
+  const complete = checkpointComments(payload, digest).at(-1);
+  return decodeCheckpoint([...comments, { body: complete }], digest);
+}
+
+/** Unsigned draft bytes aid retry; only the separately verified origin can authorize gates. */
+export function locateCheckpoint(comments, proposal, policy) {
+  const digests = new Set(
+    comments.flatMap(comment => {
+      const match =
+        /^\[lisa-npm-checkpoint\] v1 ([a-f0-9]{64}) (?:chunk|complete)\b/.exec(
+          comment.body ?? ""
+        );
+      return match && match[1] !== proposal.key ? [match[1]] : [];
+    })
+  );
+  required(digests.size <= 1, "multiple origin checkpoints are preserved");
+  const digest = [...digests][0] ?? proposal.key;
+  const present = comments.filter(comment =>
+    comment.body?.startsWith(`[lisa-npm-checkpoint] v1 ${digest} `)
+  );
+  const complete = present.some(comment =>
+    comment.body.startsWith(`[lisa-npm-checkpoint] v1 ${digest} complete\n`)
+  );
+  const payload = complete
+    ? decodeCheckpoint(comments, digest)
+    : present.length
+      ? recoverPartialCheckpoint(comments, digest)
+      : undefined;
+  if (!payload) return undefined;
+  const restored = validateProposal(payload.proposal, policy);
+  required(
+    restored.selectionKey === proposal.selectionKey &&
+      restored.parent === proposal.parent,
+    "checkpoint selection or base differs"
+  );
+  const signed = digest !== proposal.key;
+  required(
+    signed
+      ? payload.preview?.descriptor && payload.bundle.length > 0
+      : payload.preview === null && payload.bundle === "",
+    "checkpoint origin role differs"
+  );
+  return { payload, digest, signed, complete };
+}
+
+export {
+  checkpointComments,
+  decodeCheckpoint,
+  persistCheckpoint,
+} from "./npm-update-checkpoint.mjs";
+
+/** Renewal verifies fresh authority against every immutable original identity field. */
+function verifyRenewal({
+  api,
+  preview,
+  paths,
+  digest,
+  proposal,
+  issue,
+  policy,
+}) {
+  const recovery = readJson(paths.recovery, 65_536);
+  verifyRecoveryOrigin(
+    api.policy,
+    preview.descriptor,
+    recovery,
+    digest,
+    paths,
+    {
+      npmPolicySha256: proposal.policySha256,
+      proposalKey: proposal.key,
+      leafBodySha256: sha256(issue.body),
+      commit: predictedCommit(preview.descriptor, Buffer.from(preview.message)),
+      maintainer: policy.maintainer,
+      recoverySha256: sha256(readBytes(paths.recovery, 65_536)),
+    }
+  );
+}
+
+/** Completion after official issuance is required before ordinary commit construction. */
+export async function finalizeAuthorization({
+  api,
+  output,
+  proposal,
+  allocation,
+  preview,
+  policy,
+  config,
+}) {
+  const paths = {
+    descriptor: join(output, "descriptor.json"),
+    bundle: join(output, "bundle.json"),
+    recovery: join(output, "recovery.json"),
+    recoveryBundle: join(output, "recovery-bundle.json"),
+  };
+  const digest = sha256(readBytes(paths.descriptor, 65_536));
+  const issue = await authorizeAllocation(
+    api,
+    proposal,
+    allocation,
+    policy,
+    config
+  );
+  const mode = readJson(join(output, "authorization.json")).mode;
+  if (mode === "recovery") {
+    verifyRenewal({ api, preview, paths, digest, proposal, issue, policy });
+  } else {
+    required(mode === "origin", "unknown authorization role");
+    verifyDescriptorAttestation(api.policy, preview.descriptor, paths, digest);
+    verifyCurrentProvider(api.policy, preview.descriptor);
+    await persistCheckpoint(
+      api,
+      allocation.number,
+      {
+        version: 1,
+        proposal,
+        allocation,
+        preview,
+        bundle: readBytes(paths.bundle, 1_048_576).toString("utf8"),
+      },
+      digest,
+      () => authorizeAllocation(api, proposal, allocation, policy, config)
+    );
+  }
+  const checkpoint = locateCheckpoint(
+    (await api.issue(allocation.number)).comments,
+    proposal,
+    policy
+  );
+  required(
+    checkpoint?.signed &&
+      checkpoint.complete === true &&
+      checkpoint.digest === digest &&
+      canonicalJson(checkpoint.payload.preview) === canonicalJson(preview) &&
+      canonicalJson(checkpoint.payload.proposal) === canonicalJson(proposal),
+    "durable original checkpoint differs"
+  );
+  writeJson(join(output, "checkpoint.json"), {
+    version: 1,
+    originDescriptorSha256: digest,
+    complete: true,
+  });
+  return { mode, complete: true };
+}

package/all/copy-overwrite/scripts/lib/npm-update-runtime-archive.mjs

@@ -0,0 +1,204 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Bounded archive bytes and the complete OCI graph are checked without host extraction. @module npm-updater */
+import { createHash } from "node:crypto";
+import { openSync, closeSync, fstatSync, constants, readSync } from "node:fs";
+import { Transform, Writable, Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { createGunzip } from "node:zlib";
+import { required } from "./npm-update-contract.mjs";
+import { validateArchiveGraph } from "./npm-update-runtime-graph.mjs";
+export { validateArchiveGraph } from "./npm-update-runtime-graph.mjs";
+const MAXIMUM = 1_500_000_000;
+
+/** Duplicate member names, alias records and unsigned trailing payloads are never extracted. */
+function tarHeader(bytes) {
+  const number = field => {
+    required(/^[0-7]+$/.test(field), "invalid archive numeric field");
+    return parseInt(field, 8);
+  };
+  const text = field => {
+    const end = field.indexOf(0);
+    return field.subarray(0, end < 0 ? field.length : end).toString("ascii");
+  };
+  const checksum = number(text(bytes.subarray(148, 156)).trim());
+  let actual = 0;
+  for (let i = 0; i < 512; i++) actual += i >= 148 && i < 156 ? 32 : bytes[i];
+  required(
+    checksum === actual && bytes.subarray(345, 500).every(value => value === 0),
+    "archive header checksum or prefix differs"
+  );
+  const name = text(bytes.subarray(0, 100));
+  const size = number(text(bytes.subarray(124, 136)).trim());
+  const type = bytes[156];
+  const directory = type === 53 && ["blobs/", "blobs/sha256/"].includes(name);
+  required(
+    (directory && size === 0) ||
+      ([0, 48].includes(type) &&
+        /^(?:index\.json|manifest\.json|oci-layout|blobs\/sha256\/[a-f0-9]{64})$/.test(
+          name
+        )),
+    "archive contains foreign member or alias"
+  );
+  required(
+    bytes.subarray(157, 257).every(value => value === 0) && size <= MAXIMUM,
+    "archive alias or member size differs"
+  );
+  return {
+    name,
+    size,
+    directory,
+    left: size,
+    padding: (512 - (size % 512)) % 512,
+    hash: createHash("sha256"),
+    chunks: [],
+  };
+}
+
+function completeMember(state) {
+  const member = state.member;
+  const digest = member.hash.digest("hex");
+  if (!member.directory && member.name.startsWith("blobs/sha256/"))
+    required(member.name.slice(13) === digest, "archive blob digest differs");
+  if (!member.directory)
+    state.members.set(member.name, {
+      size: member.size,
+      sha256: digest,
+      bytes: member.size <= 1_048_576 ? Buffer.concat(member.chunks) : null,
+    });
+  state.member = null;
+}
+
+/** Streaming state keeps large layer bodies out of memory and checks padding and terminators. */
+function consumeTar(state, chunk) {
+  state.total += chunk.length;
+  required(state.total <= MAXIMUM, "archive expanded size exceeds bound");
+  state.buffer = Buffer.concat([state.buffer, chunk]);
+  while (state.buffer.length) {
+    if (state.end) {
+      required(
+        state.buffer.every(value => value === 0),
+        "archive trailing payload differs"
+      );
+      state.zeros += state.buffer.length;
+      state.buffer = Buffer.alloc(0);
+      return;
+    }
+    if (!state.member) {
+      if (state.buffer.length < 512) return;
+      const header = state.buffer.subarray(0, 512);
+      state.buffer = state.buffer.subarray(512);
+      if (header.every(value => value === 0)) {
+        state.end = true;
+        state.zeros = 512;
+        continue;
+      }
+      state.member = tarHeader(header);
+      required(
+        ++state.count <= 256 && !state.names.has(state.member.name),
+        "archive duplicate or excessive members"
+      );
+      state.names.add(state.member.name);
+    }
+    const member = state.member;
+    if (member.left) {
+      const length = Math.min(member.left, state.buffer.length);
+      const bytes = state.buffer.subarray(0, length);
+      member.hash.update(bytes);
+      if (member.size <= 1_048_576) member.chunks.push(Buffer.from(bytes));
+      member.left -= length;
+      state.buffer = state.buffer.subarray(length);
+      if (member.left) return;
+    }
+    if (state.buffer.length < member.padding) return;
+    required(
+      state.buffer.subarray(0, member.padding).every(value => value === 0),
+      "archive padding differs"
+    );
+    state.buffer = state.buffer.subarray(member.padding);
+    completeMember(state);
+  }
+}
+
+/** One caller owns descriptor closure even when pipeline rejects a malformed archive. */
+async function* archiveChunks(fd) {
+  const buffer = Buffer.alloc(65_536);
+  let length;
+  while ((length = readSync(fd, buffer, 0, buffer.length, null)) > 0)
+    yield Buffer.from(buffer.subarray(0, length));
+}
+
+/** Whole compressed bytes are bound before this data can become a daemon-load input. */
+export async function inspectRuntimeArchive(file, expected) {
+  const fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    const stat = fstatSync(fd);
+    required(
+      stat.isFile() &&
+        stat.uid === process.getuid() &&
+        stat.nlink === 1 &&
+        (stat.mode & 0o077) === 0 &&
+        stat.size === expected.bytes &&
+        stat.size > 0 &&
+        stat.size < 1_000_000_000,
+      "runtime archive is not bounded private data"
+    );
+    const hash = createHash("sha256");
+    const state = {
+      buffer: Buffer.alloc(0),
+      member: null,
+      members: new Map(),
+      names: new Set(),
+      total: 0,
+      count: 0,
+      end: false,
+      zeros: 0,
+    };
+    let compressed = 0;
+    const guard = new Transform({
+      transform(chunk, encoding, callback) {
+        try {
+          compressed += chunk.length;
+          required(compressed <= stat.size, "runtime archive grew");
+          hash.update(chunk);
+          callback(null, chunk);
+        } catch (error) {
+          callback(error);
+        }
+      },
+    });
+    const sink = new Writable({
+      write(chunk, encoding, callback) {
+        try {
+          consumeTar(state, chunk);
+          callback();
+        } catch (error) {
+          callback(error);
+        }
+      },
+    });
+    await pipeline(
+      Readable.from(archiveChunks(fd)),
+      guard,
+      createGunzip(),
+      sink
+    );
+    required(
+      compressed === stat.size &&
+        hash.digest("hex") === expected.sha256 &&
+        state.total === expected.uncompressedBytes,
+      "runtime archive complete byte identity differs"
+    );
+    required(
+      state.end &&
+        state.zeros >= 1024 &&
+        !state.member &&
+        state.buffer.length === 0,
+      "runtime archive is truncated"
+    );
+    return validateArchiveGraph(state.members, expected);
+  } finally {
+    closeSync(fd);
+  }
+}

package/all/copy-overwrite/scripts/lib/npm-update-runtime-graph.mjs

@@ -0,0 +1,185 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** The complete tagless OCI closure binds distinct index, platform manifest and config identities. @module npm-updater */
+import { required } from "./npm-update-contract.mjs";
+const INDEX = "application/vnd.oci.image.index.v1+json";
+const MANIFEST = "application/vnd.oci.image.manifest.v1+json";
+const CONFIG = "application/vnd.oci.image.config.v1+json";
+const DIGEST = /^sha256:[a-f0-9]{64}$/;
+const MAXIMUM = 1_500_000_000;
+
+function jsonMember(members, path) {
+  const member = members.get(path);
+  required(
+    member?.bytes && member.size <= 1_048_576,
+    "archive metadata is absent or unbounded"
+  );
+  return JSON.parse(
+    new TextDecoder("utf8", { fatal: true }).decode(member.bytes)
+  );
+}
+
+/** Every referenced descriptor is bound to the actual member digest and byte length. */
+function descriptorMember(members, descriptor, seen) {
+  required(
+    descriptor &&
+      DIGEST.test(descriptor.digest) &&
+      Number.isSafeInteger(descriptor.size) &&
+      descriptor.size > 0 &&
+      descriptor.size <= MAXIMUM,
+    "invalid archive OCI descriptor"
+  );
+  const path = `blobs/sha256/${descriptor.digest.slice(7)}`;
+  const member = members.get(path);
+  required(
+    member?.sha256 === descriptor.digest.slice(7) &&
+      member.size === descriptor.size,
+    "archive OCI descriptor bytes differ"
+  );
+  required(
+    !descriptor.annotations ||
+      Object.keys(descriptor.annotations).every(key =>
+        [
+          "vnd.docker.reference.digest",
+          "vnd.docker.reference.type",
+          "in-toto.io/predicate-type",
+        ].includes(key)
+      ),
+    "archive repository tag annotation is forbidden"
+  );
+  seen.add(path);
+  return path;
+}
+
+function manifestMember(members, descriptor, seen) {
+  required(
+    descriptor.mediaType === MANIFEST,
+    "unsupported archive manifest type"
+  );
+  const manifest = jsonMember(
+    members,
+    descriptorMember(members, descriptor, seen)
+  );
+  required(
+    manifest.schemaVersion === 2 &&
+      manifest.mediaType === MANIFEST &&
+      manifest.config?.mediaType === CONFIG &&
+      Array.isArray(manifest.layers) &&
+      manifest.layers.length <= 128,
+    "invalid archive OCI manifest"
+  );
+  descriptorMember(members, manifest.config, seen);
+  for (const layer of manifest.layers) {
+    required(
+      [
+        "application/vnd.oci.image.layer.v1.tar+gzip",
+        "application/vnd.oci.image.layer.v1.tar",
+        "application/vnd.in-toto+json",
+      ].includes(layer.mediaType),
+      "unsupported archive layer type"
+    );
+    descriptorMember(members, layer, seen);
+  }
+  return manifest;
+}
+
+/** Docker's index ID and config ID are distinct; both and every graph member must match. */
+export function validateArchiveGraph(members, expected) {
+  required(
+    DIGEST.test(expected.image) &&
+      DIGEST.test(expected.config) &&
+      ["linux/arm64", "linux/amd64"].includes(expected.platform),
+    "invalid archive expected identity"
+  );
+  required(
+    jsonMember(members, "oci-layout").imageLayoutVersion === "1.0.0",
+    "archive OCI layout differs"
+  );
+  const top = jsonMember(members, "index.json");
+  required(
+    top.schemaVersion === 2 &&
+      top.mediaType === INDEX &&
+      top.manifests?.length === 1 &&
+      top.manifests[0].digest === expected.image &&
+      top.manifests[0].mediaType === INDEX,
+    "archive index identity differs"
+  );
+  const seen = new Set();
+  const index = jsonMember(
+    members,
+    descriptorMember(members, top.manifests[0], seen)
+  );
+  required(
+    index.schemaVersion === 2 &&
+      index.mediaType === INDEX &&
+      Array.isArray(index.manifests) &&
+      index.manifests.length > 0 &&
+      index.manifests.length <= 2,
+    "archive image index differs"
+  );
+  const selected = index.manifests.filter(
+    value =>
+      `${value.platform?.os}/${value.platform?.architecture}` ===
+      expected.platform
+  );
+  required(selected.length === 1, "archive platform is absent or ambiguous");
+  let manifest;
+  for (const entry of index.manifests) {
+    const current = manifestMember(members, entry, seen);
+    if (entry === selected[0]) manifest = current;
+    else
+      required(
+        entry.platform?.os === "unknown" &&
+          entry.platform?.architecture === "unknown" &&
+          entry.annotations?.["vnd.docker.reference.type"] ===
+            "attestation-manifest" &&
+          entry.annotations?.["vnd.docker.reference.digest"] ===
+            selected[0].digest,
+        "archive contains a foreign platform image"
+      );
+  }
+  required(
+    manifest.config.digest === expected.config,
+    "archive config identity differs"
+  );
+  const config = jsonMember(
+    members,
+    `blobs/sha256/${expected.config.slice(7)}`
+  );
+  required(
+    `${config.os}/${config.architecture}` === expected.platform,
+    "archive config platform differs"
+  );
+  legacyClosure(members, expected, manifest, seen);
+  return {
+    image: expected.image,
+    config: expected.config,
+    platform: expected.platform,
+  };
+}
+
+/** A tagless legacy manifest must describe exactly the same referenced OCI image. */
+function legacyClosure(members, expected, manifest, seen) {
+  const legacy = jsonMember(members, "manifest.json");
+  required(
+    Array.isArray(legacy) && legacy.length === 1 && legacy[0].RepoTags === null,
+    "archive repository tags are forbidden"
+  );
+  required(
+    legacy[0].Config === `blobs/sha256/${expected.config.slice(7)}` &&
+      JSON.stringify(legacy[0].Layers) ===
+        JSON.stringify(
+          manifest.layers.map(layer => `blobs/sha256/${layer.digest.slice(7)}`)
+        ),
+    "archive legacy config/layer graph differs"
+  );
+  required(
+    [...members.keys()].every(
+      path =>
+        ["index.json", "manifest.json", "oci-layout"].includes(path) ||
+        seen.has(path)
+    ),
+    "archive contains unreferenced blobs"
+  );
+}