@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.11

package/src/supply-chain/generated-scanner-command.js

@@ -0,0 +1,777 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderSupplyChainScannerCommand = renderSupplyChainScannerCommand;
+function renderSupplyChainScannerCommand() {
+    return String.raw `import {
+  OSV_SCANNER_RELEASES,
+  OSV_SCANNER_TOOL,
+  OSV_SCANNER_VERSION,
+  createInstalledLicenseFindings,
+  createSupplyChainInventory,
+  createSupplyChainScannerInput,
+  assertWorkspaceImporterCoverage,
+  deriveWorkspaceManifestPathsFromPnpmLock,
+  discoverLifecycleScripts,
+  frameworkActionPinInventory,
+  normalizeOsvScannerResults,
+  requireActiveVendoredSourceRegistry,
+  vendoredSourceRegistryDigest,
+  verifyActionPinInventory,
+  workspacePackageGlobs,
+} from '@empire-builder-kit/nx/supply-chain';
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import {
+  chmodSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  realpathSync,
+  renameSync,
+  statSync,
+  writeFileSync,
+} from 'node:fs';
+import { dirname, join, relative, resolve, sep } from 'node:path';
+
+const MAX_INPUT_BYTES = 5 * 1024 * 1024;
+const MAX_LOCK_BYTES = 25 * 1024 * 1024;
+const MAX_RESULT_BYTES = 20 * 1024 * 1024;
+const MAX_PACKAGE_COUNT = 20_000;
+const MAX_SOURCE_DIRECTORIES = 4_096;
+const MAX_SOURCE_ENTRIES = 50_000;
+const MAX_SOURCE_FILES = 10_000;
+const MAX_SOURCE_TOTAL_BYTES = 100 * 1024 * 1024;
+const MAX_VENDORED_FILES = 10_000;
+const MAX_VENDORED_TOTAL_BYTES = 100 * 1024 * 1024;
+const workspaceRoot = realpathSync(process.cwd());
+const options = {
+  actionScope: 'consumer',
+  now: undefined,
+  osv: undefined,
+  output: undefined,
+};
+
+for (const argument of process.argv.slice(2)) {
+  if (argument === '--action-scope=framework') {
+    options.actionScope = 'framework';
+  } else if (argument.startsWith('--now=')) {
+    options.now = argument.slice('--now='.length);
+  } else if (argument.startsWith('--osv=')) {
+    options.osv = argument.slice('--osv='.length);
+  } else if (argument.startsWith('--output=')) {
+    options.output = argument.slice('--output='.length);
+  } else {
+    throw new Error('Unsupported supply-chain scanner argument: ' + argument);
+  }
+}
+if (!options.output) {
+  throw new Error('Supply-chain scanner requires --output=<path>.');
+}
+const generatedAt = options.now ?? new Date().toISOString();
+if (
+  !Number.isFinite(Date.parse(generatedAt)) ||
+  new Date(generatedAt).toISOString() !== generatedAt
+) {
+  throw new Error('--now must be a canonical ISO-8601 timestamp.');
+}
+
+function insideWorkspace(path) {
+  const candidate = resolve(workspaceRoot, path);
+  const child = relative(workspaceRoot, candidate);
+  if (child === '..' || child.startsWith('..' + sep) || candidate === resolve(sep)) {
+    throw new Error('Supply-chain scanner path escapes the workspace: ' + path);
+  }
+  return candidate;
+}
+
+function assertNoSymlinkTraversal(candidate, label, allowMissing = false) {
+  const child = relative(workspaceRoot, candidate);
+  let current = workspaceRoot;
+  for (const segment of child.split(sep).filter(Boolean)) {
+    current = join(current, segment);
+    if (!existsSync(current)) {
+      if (allowMissing) return;
+      throw new Error(label + ' is absent.');
+    }
+    if (lstatSync(current).isSymbolicLink()) {
+      throw new Error(label + ' may not traverse symbolic links.');
+    }
+  }
+}
+
+function readBoundedBytes(
+  path,
+  maximum,
+  label,
+  { rejectSymlinks = false } = {},
+) {
+  const candidate = insideWorkspace(path);
+  if (rejectSymlinks) assertNoSymlinkTraversal(candidate, label);
+  const metadata = lstatSync(candidate);
+  if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size > maximum) {
+    throw new Error(label + ' must be a regular bounded file: ' + path);
+  }
+  const real = realpathSync(candidate);
+  const child = relative(workspaceRoot, real);
+  if (child === '..' || child.startsWith('..' + sep)) {
+    throw new Error(label + ' resolves outside the workspace: ' + path);
+  }
+  const bytes = readFileSync(real);
+  if (bytes.byteLength > maximum) {
+    throw new Error(label + ' changed beyond its bounded size while being read.');
+  }
+  return bytes;
+}
+
+function readBounded(path, maximum, label, options) {
+  return readBoundedBytes(path, maximum, label, options).toString('utf8');
+}
+
+function readJson(path, maximum = MAX_INPUT_BYTES) {
+  return JSON.parse(readBounded(path, maximum, path));
+}
+
+function records(value, path) {
+  if (
+    !value ||
+    typeof value !== 'object' ||
+    JSON.stringify(Object.keys(value).sort()) !==
+      JSON.stringify(['records', 'schemaVersion']) ||
+    value.schemaVersion !== 1 ||
+    !Array.isArray(value.records)
+  ) {
+    throw new Error(path + ' must contain a schema-v1 records array.');
+  }
+  return value.records;
+}
+
+function canonical(value) {
+  if (Array.isArray(value)) return value.map(canonical);
+  if (!value || typeof value !== 'object') return value;
+  return Object.fromEntries(
+    Object.keys(value)
+      .sort()
+      .map((key) => [key, canonical(value[key])]),
+  );
+}
+
+function digest(value) {
+  const bytes =
+    typeof value === 'string' || Buffer.isBuffer(value)
+      ? value
+      : JSON.stringify(canonical(value));
+  return createHash('sha256').update(bytes).digest('hex');
+}
+
+function atomicWrite(path, contents, mode = 0o600) {
+  const target = insideWorkspace(path);
+  mkdirSync(dirname(target), { recursive: true, mode: 0o700 });
+  const temporary = target + '.tmp-' + process.pid;
+  writeFileSync(temporary, contents, { encoding: 'utf8', flag: 'wx', mode });
+  renameSync(temporary, target);
+}
+
+function discoverGlobbedManifestPaths(globs) {
+  // Walk only the directory depth each glob declares so a manifest present on
+  // disk but absent from the lockfile importers is still observed.
+  const discovered = new Set();
+  const walk = (segments, index, prefix) => {
+    if (index === segments.length) {
+      const manifest = prefix ? prefix + '/package.json' : 'package.json';
+      if (existsSync(insideWorkspace(manifest))) discovered.add(manifest);
+      return;
+    }
+    const segment = segments[index];
+    const directory = prefix ? insideWorkspace(prefix) : workspaceRoot;
+    if (!existsSync(directory) || !statSync(directory).isDirectory()) return;
+    if (segment === '*' || segment === '**') {
+      for (const entry of readdirSync(directory, { withFileTypes: true })) {
+        if (!entry.isDirectory() || entry.name.startsWith('.')) continue;
+        if (entry.name === 'node_modules') continue;
+        const next = prefix ? prefix + '/' + entry.name : entry.name;
+        walk(segments, index + 1, next);
+        if (segment === '**') walk(segments, index, next);
+      }
+      return;
+    }
+    if (segment.includes('*')) {
+      throw new Error(
+        'Workspace package glob segment ' + segment + ' is not supported by the manifest drift sweep.',
+      );
+    }
+    walk(segments, index + 1, prefix ? prefix + '/' + segment : segment);
+  };
+  for (const glob of globs) {
+    walk(glob.split('/').filter((segment) => segment !== '' && segment !== '.'), 0, '');
+  }
+  return [...discovered];
+}
+
+function workspaceManifests(lockfile, workspacePolicy) {
+  const importerPaths = deriveWorkspaceManifestPathsFromPnpmLock(lockfile);
+  assertWorkspaceImporterCoverage(
+    discoverGlobbedManifestPaths(workspacePackageGlobs(workspacePolicy)),
+    importerPaths,
+  );
+  const manifests = {};
+  for (const path of importerPaths) {
+    manifests[path] = readJson(path);
+  }
+  return manifests;
+}
+
+function installedPackageMetadata() {
+  const store = insideWorkspace('node_modules/.pnpm');
+  if (!existsSync(store) || !statSync(store).isDirectory()) {
+    throw new Error('Installed dependency metadata is absent after the frozen install.');
+  }
+  const metadata = [];
+  for (const packageStore of readdirSync(store, { withFileTypes: true })) {
+    if (!packageStore.isDirectory()) continue;
+    const modules = join(store, packageStore.name, 'node_modules');
+    if (!existsSync(modules) || !statSync(modules).isDirectory()) continue;
+    for (const entry of readdirSync(modules, { withFileTypes: true })) {
+      if (!entry.isDirectory()) continue;
+      if (entry.name.startsWith('@')) {
+        const scope = join(modules, entry.name);
+        for (const scoped of readdirSync(scope, { withFileTypes: true })) {
+          if (scoped.isDirectory()) {
+            const path = relative(
+              workspaceRoot,
+              join(scope, scoped.name, 'package.json'),
+            );
+            if (existsSync(insideWorkspace(path))) {
+              metadata.push(readJson(path, 1024 * 1024));
+            }
+          }
+        }
+      } else {
+        const path = relative(
+          workspaceRoot,
+          join(modules, entry.name, 'package.json'),
+        );
+        if (existsSync(insideWorkspace(path))) {
+          metadata.push(readJson(path, 1024 * 1024));
+        }
+      }
+      if (metadata.length > MAX_PACKAGE_COUNT) {
+        throw new Error('Installed dependency inventory exceeds 20,000 packages.');
+      }
+    }
+  }
+  return metadata;
+}
+
+const ignoredDirectories = new Set([
+  '.ebk',
+  '.git',
+  '.next',
+  '.nx',
+  '.open-next',
+  '.sst',
+  'coverage',
+  'dist',
+  'node_modules',
+]);
+
+function sourceFilesBelow(root, accept) {
+  const files = {};
+  const pending = [insideWorkspace(root)];
+  let acceptedFiles = 0;
+  let acceptedBytes = 0;
+  let visitedDirectories = 0;
+  let visitedEntries = 0;
+  while (pending.length > 0) {
+    const current = pending.pop();
+    visitedDirectories += 1;
+    if (visitedDirectories > MAX_SOURCE_DIRECTORIES) {
+      throw new Error(
+        'Source inventory exceeds ' +
+          MAX_SOURCE_DIRECTORIES +
+          ' visited directories.',
+      );
+    }
+    for (const entry of readdirSync(current, { withFileTypes: true })) {
+      visitedEntries += 1;
+      if (visitedEntries > MAX_SOURCE_ENTRIES) {
+        throw new Error(
+          'Source inventory exceeds ' + MAX_SOURCE_ENTRIES + ' visited entries.',
+        );
+      }
+      if (entry.isSymbolicLink()) {
+        if (ignoredDirectories.has(entry.name)) continue;
+        const path = relative(workspaceRoot, join(current, entry.name))
+          .split(sep)
+          .join('/');
+        throw new Error(
+          'Source inventory may not contain symbolic links: ' + path,
+        );
+      }
+      const absolute = join(current, entry.name);
+      if (entry.isDirectory()) {
+        if (!ignoredDirectories.has(entry.name)) pending.push(absolute);
+      } else if (entry.isFile()) {
+        const path = relative(workspaceRoot, absolute).split(sep).join('/');
+        if (accept(path)) {
+          acceptedFiles += 1;
+          if (acceptedFiles > MAX_SOURCE_FILES) {
+            throw new Error(
+              'Source inventory exceeds ' +
+                MAX_SOURCE_FILES +
+                ' accepted files.',
+            );
+          }
+          const bytes = readBoundedBytes(path, 2 * 1024 * 1024, path);
+          acceptedBytes += bytes.byteLength;
+          if (acceptedBytes > MAX_SOURCE_TOTAL_BYTES) {
+            throw new Error(
+              'Source inventory exceeds its cumulative byte bound.',
+            );
+          }
+          files[path] = bytes.toString('utf8');
+        }
+      }
+    }
+  }
+  return files;
+}
+
+function verifyVendoredFiles(registry) {
+  let visitedFiles = 0;
+  let visitedBytes = 0;
+  const accountFor = (bytes) => {
+    visitedBytes += bytes.byteLength;
+    if (visitedBytes > MAX_VENDORED_TOTAL_BYTES) {
+      throw new Error(
+        'Vendored source inventory exceeds its cumulative byte bound.',
+      );
+    }
+    return bytes;
+  };
+  for (const record of registry.records) {
+    for (const file of record.filePlan) {
+      visitedFiles += 1;
+      if (visitedFiles > MAX_VENDORED_FILES) {
+        throw new Error('Vendored source inventory exceeds its file bound.');
+      }
+      const target = insideWorkspace(file.path);
+      assertNoSymlinkTraversal(target, file.path, file.change === 'delete');
+      if (file.change === 'delete') {
+        if (existsSync(target)) {
+          throw new Error('Deleted vendored path remains present: ' + file.path);
+        }
+      } else {
+        const bytes = accountFor(
+          readBoundedBytes(file.path, MAX_RESULT_BYTES, file.path, {
+            rejectSymlinks: true,
+          }),
+        );
+        if (digest(bytes) !== file.afterSha256) {
+          throw new Error('Vendored source hash drifted: ' + file.path);
+        }
+      }
+    }
+    for (const asset of record.assets) {
+      visitedFiles += 1;
+      if (visitedFiles > MAX_VENDORED_FILES) {
+        throw new Error('Vendored source inventory exceeds its file bound.');
+      }
+      const bytes = accountFor(
+        readBoundedBytes(asset.path, MAX_RESULT_BYTES, asset.path, {
+          rejectSymlinks: true,
+        }),
+      );
+      if (digest(bytes) !== asset.sha256) {
+        throw new Error('Vendored asset hash drifted: ' + asset.path);
+      }
+    }
+    for (const license of record.licenses) {
+      visitedFiles += 1;
+      if (visitedFiles > MAX_VENDORED_FILES) {
+        throw new Error('Vendored source inventory exceeds its file bound.');
+      }
+      accountFor(
+        readBoundedBytes(
+          license.noticePath,
+          MAX_INPUT_BYTES,
+          license.noticePath,
+          { rejectSymlinks: true },
+        ),
+      );
+    }
+  }
+}
+
+function gitCommit() {
+  const result = spawnSync('git', ['rev-parse', 'HEAD'], {
+    cwd: workspaceRoot,
+    encoding: 'utf8',
+    maxBuffer: 1024,
+    shell: false,
+  });
+  const commit = String(result.stdout).trim();
+  if (result.status !== 0 || !/^[a-f0-9]{40}$/.test(commit)) {
+    throw new Error('Scanner cannot bind the current Git commit.');
+  }
+  return commit;
+}
+
+async function resolveOsvBinary() {
+  const release = OSV_SCANNER_RELEASES[process.platform + '-' + process.arch];
+  if (!release) {
+    throw new Error(
+      'OSV-Scanner has no pinned binary for ' + process.platform + '-' + process.arch,
+    );
+  }
+  const target = options.osv
+    ? insideWorkspace(options.osv)
+    : insideWorkspace('.ebk/tools/' + release.name);
+  if (!options.osv && !existsSync(target)) {
+    const response = await fetch(
+      'https://github.com/google/osv-scanner/releases/download/v' +
+        OSV_SCANNER_VERSION +
+      '/' +
+        release.name,
+      {
+        redirect: 'follow',
+        signal: AbortSignal.timeout(30_000),
+      },
+    );
+    if (!response.ok) {
+      throw new Error('Pinned OSV-Scanner download failed with ' + response.status + '.');
+    }
+    const declared = Number(response.headers.get('content-length') ?? '0');
+    if (declared > 100 * 1024 * 1024) {
+      throw new Error('Pinned OSV-Scanner binary exceeds 100 MiB.');
+    }
+    const bytes = Buffer.from(await response.arrayBuffer());
+    if (bytes.length === 0 || bytes.length > 100 * 1024 * 1024) {
+      throw new Error('Pinned OSV-Scanner binary has an invalid size.');
+    }
+    mkdirSync(dirname(target), { recursive: true, mode: 0o700 });
+    writeFileSync(target, bytes, { flag: 'wx', mode: 0o700 });
+  }
+  const metadata = lstatSync(target);
+  if (!metadata.isFile() || metadata.isSymbolicLink()) {
+    throw new Error('OSV-Scanner path must be a regular file.');
+  }
+  const bytes = readFileSync(target);
+  if (digest(bytes) !== release.sha256) {
+    throw new Error('OSV-Scanner binary digest does not match pinned v' + OSV_SCANNER_VERSION + '.');
+  }
+  if (process.platform !== 'win32') chmodSync(target, 0o700);
+  const version = spawnSync(target, ['--version'], {
+    cwd: workspaceRoot,
+    encoding: 'utf8',
+    maxBuffer: 1024 * 1024,
+    shell: false,
+  });
+  if (
+    version.status !== 0 ||
+    !String(version.stdout + version.stderr).includes(OSV_SCANNER_VERSION)
+  ) {
+    throw new Error('OSV-Scanner executable does not report the pinned version.');
+  }
+  return { path: target, release };
+}
+
+function runOsv(binary, args) {
+  const result = spawnSync(binary, args, {
+    cwd: workspaceRoot,
+    encoding: 'utf8',
+    maxBuffer: MAX_RESULT_BYTES,
+    shell: false,
+  });
+  if (![0, 1].includes(result.status ?? -1)) {
+    throw new Error(
+      'OSV-Scanner failed outside its result exit codes: ' +
+        String(result.stderr).trim().slice(0, 2_000),
+    );
+  }
+  let document;
+  try {
+    document = JSON.parse(result.stdout);
+  } catch {
+    throw new Error('OSV-Scanner did not return bounded JSON.');
+  }
+  if (!document || !Array.isArray(document.results)) {
+    throw new Error('OSV-Scanner JSON has no results array.');
+  }
+  return document;
+}
+
+const metadata = installedPackageMetadata();
+const vendoredRegistry = requireActiveVendoredSourceRegistry(
+  readJson('supply-chain/vendored-sources.json'),
+);
+verifyVendoredFiles(vendoredRegistry);
+const actionInventory = readJson('.github/actions-pins.json');
+if (
+  options.actionScope === 'framework' &&
+  JSON.stringify(canonical(actionInventory)) !==
+    JSON.stringify(canonical(frameworkActionPinInventory()))
+) {
+  throw new Error(
+    'Framework action pin file differs from the source-owned pin inventory.',
+  );
+}
+const actionUses = verifyActionPinInventory(
+  sourceFilesBelow('.github', (path) => /\.ya?ml$/i.test(path)),
+  actionInventory,
+  options.actionScope,
+);
+const workflowContainers = actionUses
+  .filter(({ kind }) => kind === 'container')
+  .map(({ reference }) => reference.replace(/^docker:\/\//, ''))
+  .sort();
+const containers = sourceFilesBelow(
+  '.',
+  (path) => /(?:^|\/)Dockerfile$/i.test(path) || /\.Dockerfile$/i.test(path),
+);
+const lockfile = readBounded(
+  'pnpm-lock.yaml',
+  MAX_LOCK_BYTES,
+  'pnpm lockfile',
+);
+const workspacePolicy = readBounded(
+  'pnpm-workspace.yaml',
+  MAX_INPUT_BYTES,
+  'pnpm workspace policy',
+);
+const inventory = createSupplyChainInventory({
+  containers,
+  downloadedTools: records(
+    readJson('supply-chain/downloaded-tools.json'),
+    'supply-chain/downloaded-tools.json',
+  ),
+  lifecycleScripts: discoverLifecycleScripts(metadata),
+  lockfile,
+  manifests: workspaceManifests(lockfile, workspacePolicy),
+  nodeVersion: readBounded(
+    '.node-version',
+    64,
+    'Node.js version pin',
+  ).trim(),
+  vendoredInputs: vendoredRegistry.records.map((record) => ({
+    identity:
+      record.identity.registry +
+      '/' +
+      record.identity.publisher +
+      '/' +
+      record.identity.item,
+    revision: record.identity.revision,
+    sha256: record.retrieval.sha256,
+  })),
+  workspacePolicy,
+});
+const containerInventoryDigest = digest({
+  recipes: inventory.containers,
+  workflowExecutables: workflowContainers,
+});
+const requiredCoverage = [
+  'npm',
+  ...(inventory.containers.length > 0 || workflowContainers.length > 0
+    ? ['container']
+    : []),
+  ...(vendoredRegistry.records.length > 0 ? ['vendored-source'] : []),
+];
+if (requiredCoverage.length === 0) {
+  throw new Error('No applicable supply-chain scanner coverage was discovered.');
+}
+const osv = await resolveOsvBinary();
+const resultDigests = [];
+const vulnerabilities = [];
+
+if (requiredCoverage.includes('npm')) {
+  const lockfileResult = runOsv(osv.path, [
+    'scan',
+    'source',
+    '--format=json',
+    '--lockfile=pnpm-lock.yaml',
+  ]);
+  const packageManager =
+    /^pnpm@(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)\+sha512\.[a-f0-9]{128}$/.exec(
+      inventory.packageManager,
+    );
+  if (!packageManager?.[1]) {
+    throw new Error(
+      'Supply-chain inventory package manager is not one exact pnpm authority.',
+    );
+  }
+  const packageManagerInputPath =
+    '.ebk/evidence/supply-chain/osv-package-manager-input.json';
+  const packageManagerInput = {
+    results: [
+      {
+        packages: [
+          {
+            package: {
+              ecosystem: 'npm',
+              name: 'pnpm',
+              version: packageManager[1],
+            },
+          },
+        ],
+      },
+    ],
+  };
+  const packageManagerInputBytes =
+    JSON.stringify(packageManagerInput, null, 2) + '\n';
+  atomicWrite(packageManagerInputPath, packageManagerInputBytes);
+  const packageManagerResult = runOsv(osv.path, [
+    'scan',
+    'source',
+    '--format=json',
+    '--all-packages',
+    '--lockfile=osv-scanner:' + packageManagerInputPath,
+  ]);
+  const path = '.ebk/evidence/supply-chain/osv-npm.json';
+  const report = {
+    kind: 'ebk-osv-npm-results',
+    lockfile: lockfileResult,
+    packageManager: {
+      authority: inventory.packageManager,
+      input: packageManagerInput,
+      inputSha256: digest(packageManagerInputBytes),
+      result: packageManagerResult,
+    },
+    schemaVersion: 1,
+  };
+  const bytes = JSON.stringify(report, null, 2) + '\n';
+  atomicWrite(path, bytes);
+  resultDigests.push({ coverage: 'npm', path, sha256: digest(bytes) });
+  vulnerabilities.push(
+    ...normalizeOsvScannerResults({
+      coverage: 'npm',
+      detectedAt: generatedAt,
+      inventory,
+      resultGroups: [
+        {
+          context: { releases: [], scope: 'unknown', slices: [] },
+          document: lockfileResult,
+        },
+        {
+          context: { releases: [], scope: 'unknown', slices: [] },
+          document: packageManagerResult,
+        },
+      ],
+    }),
+  );
+}
+
+if (requiredCoverage.includes('container')) {
+  const images = [
+    ...new Set([
+      ...inventory.containers.flatMap(({ bases }) => bases),
+      ...workflowContainers,
+    ]),
+  ].sort();
+  if (images.length === 0 || images.length > 20) {
+    throw new Error('Container scanner requires between one and 20 exact bases.');
+  }
+  const documents = images.map((image) => ({
+    image,
+    result: runOsv(osv.path, ['scan', 'image', '--format=json', image]),
+  }));
+  const path = '.ebk/evidence/supply-chain/osv-containers.json';
+  const report = {
+    images: documents,
+    kind: 'ebk-osv-container-results',
+    schemaVersion: 1,
+  };
+  const bytes = JSON.stringify(report, null, 2) + '\n';
+  atomicWrite(path, bytes);
+  resultDigests.push({ coverage: 'container', path, sha256: digest(bytes) });
+  vulnerabilities.push(
+    ...normalizeOsvScannerResults({
+      coverage: 'container',
+      detectedAt: generatedAt,
+      resultGroups: documents.map(({ result }) => ({
+        context: { releases: [], scope: 'build', slices: [] },
+        document: result,
+      })),
+    }),
+  );
+}
+
+if (requiredCoverage.includes('vendored-source')) {
+  const path = '.ebk/evidence/supply-chain/vendored-source-scan.json';
+  const report = {
+    kind: 'ebk-vendored-source-scan',
+    records: vendoredRegistry.records.map((record) => ({
+      identity:
+        record.identity.registry +
+        '/' +
+        record.identity.publisher +
+        '/' +
+        record.identity.item,
+      revision: record.identity.revision,
+      sha256: record.retrieval.sha256,
+      status: record.revocation.status,
+    })),
+    registryDigest: vendoredSourceRegistryDigest(vendoredRegistry),
+    schemaVersion: 1,
+  };
+  const bytes = JSON.stringify(report, null, 2) + '\n';
+  atomicWrite(path, bytes);
+  resultDigests.push({ coverage: 'vendored-source', path, sha256: digest(bytes) });
+}
+
+const canonicalResultDigests = [...resultDigests].sort((left, right) =>
+  left.coverage < right.coverage ? -1 : left.coverage > right.coverage ? 1 : 0,
+);
+const scannerInput = createSupplyChainScannerInput({
+  kind: 'ebk-supply-chain-scanner-input',
+  licenses: createInstalledLicenseFindings({
+    inventory,
+    packageMetadata: metadata,
+  }),
+  requiredCoverage,
+  scanner: {
+    coverage: requiredCoverage,
+    resultSetDigest: digest({
+      binary: osv.release.sha256,
+      results: canonicalResultDigests.map(({ coverage, sha256 }) => ({
+        coverage,
+        sha256,
+      })),
+      version: OSV_SCANNER_VERSION,
+    }),
+    scannedAt: generatedAt,
+    schemaVersion: 2,
+    status: 'complete',
+    tool: OSV_SCANNER_TOOL,
+    version: OSV_SCANNER_VERSION,
+  },
+  schemaVersion: 2,
+  subject: {
+    containerInventoryDigest,
+    lockfileDigest: inventory.lockfileDigest,
+    repositoryCommit: gitCommit(),
+    resultDigests: canonicalResultDigests,
+    vendoredRegistryDigest: vendoredSourceRegistryDigest(vendoredRegistry),
+  },
+  vulnerabilities,
+});
+atomicWrite(options.output, JSON.stringify(scannerInput, null, 2) + '\n');
+process.stdout.write(
+  JSON.stringify(
+    {
+      coverage: scannerInput.scanner.coverage,
+      resultSetDigest: scannerInput.scanner.resultSetDigest,
+      installedLicenseFindings: scannerInput.licenses.length,
+      kind: 'ebk-supply-chain-scanner-result',
+      output: options.output,
+      resolvedLockPackages: inventory.resolvedPackages.length,
+      schemaVersion: 2,
+      subject: scannerInput.subject,
+    },
+    null,
+    2,
+  ) + '\n',
+);
+`;
+}
+//# sourceMappingURL=generated-scanner-command.js.map