@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/supply-chain/ecr-applicability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ecr-applicability.js","sourceRoot":"","sources":["../../../../../packages/nx/src/supply-chain/ecr-applicability.ts"],"names":[],"mappings":";;;AAqHA,gEAwCC;AAED,gEAcC;AA7KD,sEAAyD;AACzD,oDAA4C;AAC5C,2CAAwE;AACxE,2CAA+C;AAElC,QAAA,2BAA2B,GACtC,4BAAqC,CAAC;AAC3B,QAAA,qCAAqC,GAAG,CAAU,CAAC;AAyBhE,SAAS,OAAO,CAAC,IAAY,EAAE,OAAe;IAC5C,MAAM,IAAI,4BAAgB,CAAC,4BAA4B,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,IAAY;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,kCAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrE,OAAO,OAAO,CAAC,IAAI,EAAE,8CAA8C,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAc,EACd,KAAa;IAEb,IAAI,CAAC,IAAA,wBAAQ,EAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,OAAO,CACZ,qBAAqB,KAAK,GAAG,EAC7B,qCAAqC,CACtC,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,qBAAqB,KAAK,MAAM,CAAC,CAAC;IAC9E,MAAM,YAAY,GAAG,cAAc,CACjC,KAAK,CAAC,IAAI,EACV,qBAAqB,KAAK,QAAQ,CACnC,CAAC;IACF,MAAM,QAAQ,GAAG,cAAc,CAC7B,KAAK,CAAC,QAAQ,EACd,qBAAqB,KAAK,YAAY,CACvC,CAAC;IACF,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;IAC1C,IAAI,CAAC,IAAA,wBAAQ,EAAC,aAAa,CAAC,EAAE,CAAC;QAC7B,OAAO,OAAO,CACZ,qBAAqB,KAAK,iBAAiB,EAC3C,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,OAAO;YACL,UAAU;YACV,YAAY;YACZ,MAAM,EACJ,oEAAoE;YACtE,MAAM,EAAE,iBAAiB;YACzB,QAAQ;SACT,CAAC;IACJ,CAAC;IACD,IACE,aAAa,CAAC,OAAO,KAAK,WAAW;QACrC,aAAa,CAAC,MAAM,KAAK,WAAW;QACpC,aAAa,CAAC,gBAAgB,KAAK,kBAAkB,EACrD,CAAC;QACD,OAAO;YACL,UAAU;YACV,YAAY;YACZ,MAAM,EACJ,+FAA+F;YACjG,MAAM,EAAE,YAAY;YACpB,QAAQ;SACT,CAAC;IACJ,CAAC;IACD,IACE,aAAa,CAAC,OAAO,KAAK,aAAa;QACvC,aAAa,CAAC,MAAM,KAAK,uBAAuB,EAChD,CAAC;QACD,OAAO;YACL,UAAU;YACV,YAAY;YACZ,MAAM,EACJ,qHAAqH;YACvH,MAAM,EAAE,uCAAuC;YAC/C,QAAQ;SACT,CAAC;IACJ,CAAC;IACD,OAAO;QACL,UAAU;QACV,YAAY;QACZ,MAAM,EACJ,wFAAwF;QAC1F,MAAM,EAAE,gCAAgC;QACxC,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAgB,0BAA0B,CACxC,eAAwB,EACxB,KAAa;IAEb,IACE,CAAC,kCAAsB,CAAC,IAAI,CAAC,KAAK,CAAC;QACnC,CAAC,IAAA,wBAAQ,EAAC,eAAe,CAAC;QAC1B,eAAe,CAAC,aAAa,KAAK,CAAC;QACnC,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC;QACjD,eAAe,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAC9C,CAAC;QACD,OAAO,OAAO,CACZ,iBAAiB,EACjB,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,eAAe,CAAC,iBAAiB;SAChD,GAAG,CAAC,gBAAgB,CAAC;SACrB,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAA,qCAAY,EAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IAC1E,IACE,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;QAC3D,SAAS,CAAC,MAAM,EAChB,CAAC;QACD,OAAO,OAAO,CACZ,mCAAmC,EACnC,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG;QACf,SAAS;QACT,IAAI,EAAE,mCAA2B;QACjC,aAAa,EAAE,6CAAqC;QACpD,KAAK;QACL,eAAe,EAAE,SAAS,CAAC,IAAI,CAC7B,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,uCAAuC,CACnE;YACC,CAAC,CAAE,8DAAwE;YAC3E,CAAC,CAAE,cAAwB;KAC9B,CAAC;IACF,OAAO,EAAE,GAAG,QAAQ,EAAE,cAAc,EAAE,IAAA,6BAAiB,EAAC,QAAQ,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,SAAgB,0BAA0B,CACxC,KAAmC,EACnC,eAAwB,EACxB,KAAa;IAEb,MAAM,QAAQ,GAAG,0BAA0B,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IACpE,IAAI,IAAA,6BAAiB,EAAC,KAAK,CAAC,KAAK,IAAA,6BAAiB,EAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,4BAAgB,CACxB,gCAAgC,EAChC,sBAAsB,EACtB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/src/supply-chain/ecr-scanning.d.ts

@@ -0,0 +1,83 @@
+export interface EcrInspectorScanTargetV1 {
+    accountId: string;
+    artifactId: string;
+    candidateArtifactDigest: string;
+    collectorTranscriptDigest: string;
+    deploymentBindingDigest: string;
+    imageDigest: string;
+    region: string;
+    releaseId: string;
+    releaseManifestDigest: string;
+    releaseManifestMaterialDigest: string;
+    repositoryName: string;
+    sbomDigest: string;
+    sbomInventoryScope: 'final-oci-contents';
+    sbomSerialNumber: string;
+    sourceCommit: string;
+    stage: 'production' | 'staging';
+}
+export interface EcrInspectorCollectorProvenanceV1 {
+    runAttempt: string;
+    runId: string;
+    tool: 'aws-cli';
+    toolVersion: string;
+    workflow: string;
+}
+export interface EcrInspectorRawPageV1 {
+    request: {
+        imageId: {
+            imageDigest: string;
+        };
+        maxResults: 1000;
+        nextToken?: string;
+        region: string;
+        registryId: string;
+        repositoryName: string;
+    };
+    response: unknown;
+}
+export interface EcrInspectorRawCollectionV1 {
+    collectedAt: string;
+    configuration: {
+        request: {
+            region: string;
+        };
+        response: unknown;
+    };
+    pages: readonly EcrInspectorRawPageV1[];
+    provenance: EcrInspectorCollectorProvenanceV1;
+    target: EcrInspectorScanTargetV1;
+}
+export interface EcrInspectorScanEvidenceV1 {
+    collectedAt: string;
+    configuration: {
+        requestDigest: string;
+        responseDigest: string;
+        scanFrequency: 'CONTINUOUS_SCAN' | 'SCAN_ON_PUSH';
+        scanType: 'ENHANCED';
+    };
+    findings: readonly {
+        findingArn: string;
+        fixAvailable?: string;
+        packageNames: readonly string[];
+        severity: string;
+        status: string;
+        vulnerabilityId: string;
+    }[];
+    kind: 'ebk-ecr-inspector-scan-evidence';
+    materialDigest: string;
+    pages: readonly {
+        requestDigest: string;
+        responseDigest: string;
+    }[];
+    provenance: EcrInspectorCollectorProvenanceV1;
+    scanCompletedAt: string;
+    schemaVersion: 1;
+    status: 'complete';
+    target: EcrInspectorScanTargetV1;
+    vulnerabilitySourceUpdatedAt: string;
+}
+export declare function collectEcrInspectorScanEvidence(input: EcrInspectorRawCollectionV1, options?: {
+    maximumAgeSeconds?: number;
+}): EcrInspectorScanEvidenceV1;
+export declare function verifyEcrInspectorScanEvidence(value: EcrInspectorScanEvidenceV1, expected: EcrInspectorScanTargetV1): EcrInspectorScanEvidenceV1;

package/src/supply-chain/ecr-scanning.js

@@ -0,0 +1,321 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.collectEcrInspectorScanEvidence = collectEcrInspectorScanEvidence;
+exports.verifyEcrInspectorScanEvidence = verifyEcrInspectorScanEvidence;
+const deterministic_order_js_1 = require("../deterministic-order.js");
+const validation_js_1 = require("../validation.js");
+const common_js_1 = require("./common.js");
+const errors_js_1 = require("./errors.js");
+const ACCOUNT = /^\d{12}$/;
+const IMAGE_DIGEST = /^sha256:[a-f0-9]{64}$/;
+const REGION = /^[a-z]{2}(?:-gov)?-[a-z]+(?:-[a-z]+)*-\d$/;
+const REPOSITORY = /^[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*(?:\/[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*)*$/;
+const FULL_COMMIT = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
+const MAX_PAGES = 100;
+const MAX_FINDINGS = 25_000;
+function fail(path, message, classification = 'supply-chain-input-invalid') {
+    throw new errors_js_1.SupplyChainError(classification, path, message);
+}
+function exactKeys(value, keys, path) {
+    if (!(0, validation_js_1.isRecord)(value) ||
+        Object.keys(value).length !== keys.length ||
+        Object.keys(value).some((key) => !keys.includes(key))) {
+        fail(path, 'must match the exact v1 object shape');
+    }
+}
+function iso(value, path) {
+    if (typeof value !== 'string' ||
+        !Number.isFinite(Date.parse(value)) ||
+        new Date(value).toISOString() !== value) {
+        fail(path, 'must be a canonical ISO-8601 timestamp');
+    }
+    return value;
+}
+function reference(value, path, pattern = common_js_1.SUPPLY_CHAIN_REFERENCE) {
+    if (typeof value !== 'string' || value.length > 512 || !pattern.test(value)) {
+        fail(path, 'must be one bounded exact reference');
+    }
+    return value;
+}
+function validateTarget(value) {
+    exactKeys(value, [
+        'accountId',
+        'artifactId',
+        'candidateArtifactDigest',
+        'collectorTranscriptDigest',
+        'deploymentBindingDigest',
+        'imageDigest',
+        'region',
+        'releaseId',
+        'releaseManifestDigest',
+        'releaseManifestMaterialDigest',
+        'repositoryName',
+        'sbomDigest',
+        'sbomInventoryScope',
+        'sbomSerialNumber',
+        'sourceCommit',
+        'stage',
+    ], 'target');
+    return {
+        accountId: reference(value.accountId, 'target.accountId', ACCOUNT),
+        artifactId: reference(value.artifactId, 'target.artifactId'),
+        candidateArtifactDigest: reference(value.candidateArtifactDigest, 'target.candidateArtifactDigest', common_js_1.SUPPLY_CHAIN_SHA256),
+        collectorTranscriptDigest: reference(value.collectorTranscriptDigest, 'target.collectorTranscriptDigest', common_js_1.SUPPLY_CHAIN_SHA256),
+        deploymentBindingDigest: reference(value.deploymentBindingDigest, 'target.deploymentBindingDigest', common_js_1.SUPPLY_CHAIN_SHA256),
+        imageDigest: reference(value.imageDigest, 'target.imageDigest', IMAGE_DIGEST),
+        region: reference(value.region, 'target.region', REGION),
+        releaseId: reference(value.releaseId, 'target.releaseId'),
+        releaseManifestDigest: reference(value.releaseManifestDigest, 'target.releaseManifestDigest', common_js_1.SUPPLY_CHAIN_SHA256),
+        releaseManifestMaterialDigest: reference(value.releaseManifestMaterialDigest, 'target.releaseManifestMaterialDigest', common_js_1.SUPPLY_CHAIN_SHA256),
+        repositoryName: reference(value.repositoryName, 'target.repositoryName', REPOSITORY),
+        sbomDigest: reference(value.sbomDigest, 'target.sbomDigest', common_js_1.SUPPLY_CHAIN_SHA256),
+        sbomInventoryScope: value.sbomInventoryScope === 'final-oci-contents'
+            ? value.sbomInventoryScope
+            : fail('target.sbomInventoryScope', 'must identify a final OCI contents inventory', 'supply-chain-artifact-mismatch'),
+        sbomSerialNumber: reference(value.sbomSerialNumber, 'target.sbomSerialNumber', /^urn:uuid:[a-f0-9-]{36}$/),
+        sourceCommit: reference(value.sourceCommit, 'target.sourceCommit', FULL_COMMIT),
+        stage: value.stage === 'production' || value.stage === 'staging'
+            ? value.stage
+            : fail('target.stage', 'must identify one protected release stage'),
+    };
+}
+function validateProvenance(value) {
+    exactKeys(value, ['runAttempt', 'runId', 'tool', 'toolVersion', 'workflow'], 'provenance');
+    if (value.tool !== 'aws-cli') {
+        fail('provenance.tool', 'must identify the AWS CLI collector');
+    }
+    return {
+        runAttempt: reference(value.runAttempt, 'provenance.runAttempt', /^[1-9]\d*$/),
+        runId: reference(value.runId, 'provenance.runId', /^[1-9]\d*$/),
+        tool: 'aws-cli',
+        toolVersion: reference(value.toolVersion, 'provenance.toolVersion', /^aws-cli\/\d+\.\d+\.\d+(?:\s.*)?$/),
+        workflow: reference(value.workflow, 'provenance.workflow'),
+    };
+}
+function wildcardMatches(pattern, repositoryName) {
+    if (pattern.length === 0 ||
+        pattern.length > 255 ||
+        !/^[a-z0-9*][a-z0-9*._/-]*$/.test(pattern)) {
+        return false;
+    }
+    const expression = pattern
+        .split('*')
+        .map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'))
+        .join('.*');
+    return new RegExp(`^${expression}$`).test(repositoryName);
+}
+function scanConfiguration(response, target) {
+    if (!(0, validation_js_1.isRecord)(response) ||
+        response.registryId !== target.accountId ||
+        !(0, validation_js_1.isRecord)(response.scanningConfiguration) ||
+        response.scanningConfiguration.scanType !== 'ENHANCED' ||
+        !Array.isArray(response.scanningConfiguration.rules)) {
+        fail('configuration.response', 'must prove enhanced scanning in the exact target registry', 'supply-chain-scanner-unavailable');
+    }
+    const rules = response.scanningConfiguration.rules;
+    if (rules.length === 0)
+        return 'CONTINUOUS_SCAN';
+    const matches = [];
+    for (const rule of rules) {
+        if (!(0, validation_js_1.isRecord)(rule) ||
+            !['CONTINUOUS_SCAN', 'SCAN_ON_PUSH'].includes(String(rule.scanFrequency)) ||
+            !Array.isArray(rule.repositoryFilters)) {
+            fail('configuration.response.scanningConfiguration.rules', 'contains an invalid enhanced-scanning rule', 'supply-chain-scanner-unavailable');
+        }
+        if (rule.repositoryFilters.some((filter) => (0, validation_js_1.isRecord)(filter) &&
+            filter.filterType === 'WILDCARD' &&
+            typeof filter.filter === 'string' &&
+            wildcardMatches(filter.filter, target.repositoryName))) {
+            matches.push(rule.scanFrequency);
+        }
+    }
+    if (matches.length !== 1) {
+        fail('configuration.response.scanningConfiguration.rules', 'must select the target repository through exactly one enhanced-scanning rule', 'supply-chain-scanner-unavailable');
+    }
+    return matches[0];
+}
+function assertFresh(value, path, collectedAt, maximumAgeSeconds) {
+    if (typeof value !== 'string' || !Number.isFinite(Date.parse(value))) {
+        fail(path, 'must be an AWS timestamp');
+    }
+    const timestamp = new Date(value).toISOString();
+    const age = Date.parse(collectedAt) - Date.parse(timestamp);
+    if (age < 0 || age > maximumAgeSeconds * 1000) {
+        fail(path, 'is in the future or outside the permitted scan freshness window', 'supply-chain-scanner-unavailable');
+    }
+    return timestamp;
+}
+function findingResourceMatches(finding, target) {
+    if (!Array.isArray(finding.resources) || finding.resources.length !== 1) {
+        return false;
+    }
+    const resource = finding.resources[0];
+    if (!(0, validation_js_1.isRecord)(resource) ||
+        resource.type !== 'AWS_ECR_CONTAINER_IMAGE' ||
+        !(0, validation_js_1.isRecord)(resource.details) ||
+        !(0, validation_js_1.isRecord)(resource.details.awsEcrContainerImage)) {
+        return false;
+    }
+    const image = resource.details.awsEcrContainerImage;
+    return (image.imageHash === target.imageDigest &&
+        image.registry === target.accountId &&
+        image.repositoryName === target.repositoryName);
+}
+function collectEcrInspectorScanEvidence(input, options = {}) {
+    exactKeys(input, ['collectedAt', 'configuration', 'pages', 'provenance', 'target'], 'collection');
+    const target = validateTarget(input.target);
+    const provenance = validateProvenance(input.provenance);
+    const collectedAt = iso(input.collectedAt, 'collectedAt');
+    const maximumAgeSeconds = options.maximumAgeSeconds ?? 86_400;
+    if (!Number.isSafeInteger(maximumAgeSeconds) ||
+        maximumAgeSeconds < 60 ||
+        maximumAgeSeconds > 604_800) {
+        fail('maximumAgeSeconds', 'must be a safe integer from 60 through 604800');
+    }
+    exactKeys(input.configuration, ['request', 'response'], 'configuration');
+    exactKeys(input.configuration.request, ['region'], 'configuration.request');
+    if (input.configuration.request.region !== target.region) {
+        fail('configuration.request.region', 'does not match the release-bound Region', 'supply-chain-artifact-mismatch');
+    }
+    const frequency = scanConfiguration(input.configuration.response, target);
+    if (!Array.isArray(input.pages) ||
+        input.pages.length === 0 ||
+        input.pages.length > MAX_PAGES) {
+        fail('pages', `must contain between one and ${MAX_PAGES} complete response pages`, 'supply-chain-scanner-unavailable');
+    }
+    let expectedToken;
+    let scanCompletedAt;
+    let vulnerabilitySourceUpdatedAt;
+    const findings = new Map();
+    const pages = [];
+    for (const [index, page] of input.pages.entries()) {
+        exactKeys(page, ['request', 'response'], `pages[${index}]`);
+        exactKeys(page.request, [
+            'imageId',
+            'maxResults',
+            ...(expectedToken === undefined ? [] : ['nextToken']),
+            'region',
+            'registryId',
+            'repositoryName',
+        ], `pages[${index}].request`);
+        exactKeys(page.request.imageId, ['imageDigest'], `pages[${index}].request.imageId`);
+        if (page.request.imageId.imageDigest !== target.imageDigest ||
+            page.request.maxResults !== 1000 ||
+            page.request.nextToken !== expectedToken ||
+            page.request.region !== target.region ||
+            page.request.registryId !== target.accountId ||
+            page.request.repositoryName !== target.repositoryName) {
+            fail(`pages[${index}].request`, 'does not query the exact release-bound image or pagination token', 'supply-chain-artifact-mismatch');
+        }
+        const response = page.response;
+        if (!(0, validation_js_1.isRecord)(response) ||
+            response.registryId !== target.accountId ||
+            response.repositoryName !== target.repositoryName ||
+            !(0, validation_js_1.isRecord)(response.imageId) ||
+            response.imageId.imageDigest !== target.imageDigest ||
+            !(0, validation_js_1.isRecord)(response.imageScanStatus) ||
+            !['ACTIVE', 'COMPLETE'].includes(String(response.imageScanStatus.status)) ||
+            !(0, validation_js_1.isRecord)(response.imageScanFindings) ||
+            !Array.isArray(response.imageScanFindings.enhancedFindings)) {
+            fail(`pages[${index}].response`, 'does not contain complete enhanced findings for the exact image', 'supply-chain-scanner-unavailable');
+        }
+        const completed = assertFresh(response.imageScanFindings.imageScanCompletedAt, `pages[${index}].response.imageScanFindings.imageScanCompletedAt`, collectedAt, maximumAgeSeconds);
+        const updated = assertFresh(response.imageScanFindings.vulnerabilitySourceUpdatedAt, `pages[${index}].response.imageScanFindings.vulnerabilitySourceUpdatedAt`, collectedAt, maximumAgeSeconds);
+        scanCompletedAt ??= completed;
+        vulnerabilitySourceUpdatedAt ??= updated;
+        if (scanCompletedAt !== completed ||
+            vulnerabilitySourceUpdatedAt !== updated) {
+            fail(`pages[${index}].response.imageScanFindings`, 'pagination mixed results from different scan snapshots', 'supply-chain-artifact-mismatch');
+        }
+        for (const [findingIndex, value,] of response.imageScanFindings.enhancedFindings.entries()) {
+            if (!(0, validation_js_1.isRecord)(value) ||
+                value.awsAccountId !== target.accountId ||
+                typeof value.findingArn !== 'string' ||
+                !new RegExp(`^arn:aws(?:-us-gov|-iso(?:-[a-z]+)?)?:inspector2:${target.region}:${target.accountId}:finding/`).test(value.findingArn) ||
+                !findingResourceMatches(value, target) ||
+                !(0, validation_js_1.isRecord)(value.packageVulnerabilityDetails) ||
+                typeof value.packageVulnerabilityDetails.vulnerabilityId !== 'string' ||
+                !Array.isArray(value.packageVulnerabilityDetails.vulnerablePackages) ||
+                typeof value.severity !== 'string' ||
+                typeof value.status !== 'string') {
+                fail(`pages[${index}].response.imageScanFindings.enhancedFindings[${findingIndex}]`, 'does not retain exact Inspector identity and ECR image scope', 'supply-chain-artifact-mismatch');
+            }
+            const normalized = {
+                findingArn: value.findingArn,
+                ...(typeof value.fixAvailable === 'string'
+                    ? { fixAvailable: value.fixAvailable }
+                    : {}),
+                packageNames: [
+                    ...new Set(value.packageVulnerabilityDetails.vulnerablePackages.map((entry) => (0, validation_js_1.isRecord)(entry) && typeof entry.name === 'string'
+                        ? entry.name
+                        : '')),
+                ]
+                    .filter((entry) => common_js_1.SUPPLY_CHAIN_REFERENCE.test(entry))
+                    .sort(),
+                severity: reference(value.severity, `pages[${index}].findings[${findingIndex}].severity`, /^[A-Z_]+$/),
+                status: reference(value.status, `pages[${index}].findings[${findingIndex}].status`, /^[A-Z_]+$/),
+                vulnerabilityId: reference(value.packageVulnerabilityDetails.vulnerabilityId, `pages[${index}].findings[${findingIndex}].vulnerabilityId`),
+            };
+            const existing = findings.get(normalized.findingArn);
+            if (existing &&
+                (0, common_js_1.canonicalizeSupplyChainValue)(existing) !==
+                    (0, common_js_1.canonicalizeSupplyChainValue)(normalized)) {
+                fail(`pages[${index}].findings[${findingIndex}]`, 'duplicates a finding ARN with different material', 'supply-chain-artifact-mismatch');
+            }
+            findings.set(normalized.findingArn, normalized);
+            if (findings.size > MAX_FINDINGS) {
+                fail('findings', `exceeds the bounded ${MAX_FINDINGS}-finding evidence limit`);
+            }
+        }
+        pages.push({
+            requestDigest: (0, common_js_1.supplyChainDigest)(page.request),
+            responseDigest: (0, common_js_1.supplyChainDigest)(response),
+        });
+        expectedToken =
+            typeof response.nextToken === 'string' && response.nextToken.length > 0
+                ? response.nextToken
+                : undefined;
+        if (expectedToken === undefined && index !== input.pages.length - 1) {
+            fail(`pages[${index}].response.nextToken`, 'ended before the supplied page list', 'supply-chain-scanner-unavailable');
+        }
+    }
+    if (expectedToken !== undefined) {
+        fail('pages', 'did not exhaust ECR findings pagination', 'supply-chain-scanner-unavailable');
+    }
+    const unsigned = {
+        collectedAt,
+        configuration: {
+            requestDigest: (0, common_js_1.supplyChainDigest)(input.configuration.request),
+            responseDigest: (0, common_js_1.supplyChainDigest)(input.configuration.response),
+            scanFrequency: frequency,
+            scanType: 'ENHANCED',
+        },
+        findings: [...findings.values()].sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.findingArn, right.findingArn)),
+        kind: 'ebk-ecr-inspector-scan-evidence',
+        pages,
+        provenance,
+        scanCompletedAt: scanCompletedAt,
+        schemaVersion: 1,
+        status: 'complete',
+        target,
+        vulnerabilitySourceUpdatedAt: vulnerabilitySourceUpdatedAt,
+    };
+    return { ...unsigned, materialDigest: (0, common_js_1.supplyChainDigest)(unsigned) };
+}
+function verifyEcrInspectorScanEvidence(value, expected) {
+    const target = validateTarget(expected);
+    if ((0, common_js_1.canonicalizeSupplyChainValue)(value.target) !==
+        (0, common_js_1.canonicalizeSupplyChainValue)(target) ||
+        value.kind !== 'ebk-ecr-inspector-scan-evidence' ||
+        value.schemaVersion !== 1 ||
+        value.status !== 'complete') {
+        fail('ecrScanEvidence', 'does not bind the exact expected release image and SBOM', 'supply-chain-artifact-mismatch');
+    }
+    const { materialDigest, ...unsigned } = value;
+    if (!common_js_1.SUPPLY_CHAIN_SHA256.test(materialDigest) ||
+        (0, common_js_1.supplyChainDigest)(unsigned) !== materialDigest) {
+        fail('ecrScanEvidence.materialDigest', 'does not match the complete scan evidence', 'supply-chain-artifact-mismatch');
+    }
+    return value;
+}
+//# sourceMappingURL=ecr-scanning.js.map

package/src/supply-chain/ecr-scanning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ecr-scanning.js","sourceRoot":"","sources":["../../../../../packages/nx/src/supply-chain/ecr-scanning.ts"],"names":[],"mappings":";;AA6XA,0EAsPC;AAED,wEA8BC;AAnpBD,sEAAyD;AACzD,oDAA4C;AAC5C,2CAKqB;AACrB,2CAA+C;AAE/C,MAAM,OAAO,GAAG,UAAU,CAAC;AAC3B,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAC7C,MAAM,MAAM,GAAG,2CAA2C,CAAC;AAC3D,MAAM,UAAU,GACd,qFAAqF,CAAC;AACxF,MAAM,WAAW,GAAG,iCAAiC,CAAC;AACtD,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,MAAM,YAAY,GAAG,MAAM,CAAC;AAkF5B,SAAS,IAAI,CACX,IAAY,EACZ,OAAe,EACf,iBAGyC,4BAA4B;IAErE,MAAM,IAAI,4BAAgB,CAAC,cAAc,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,SAAS,CAChB,KAAc,EACd,IAAuB,EACvB,IAAY;IAEZ,IACE,CAAC,IAAA,wBAAQ,EAAC,KAAK,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QACzC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EACrD,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,sCAAsC,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED,SAAS,GAAG,CAAC,KAAc,EAAE,IAAY;IACvC,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,EACvC,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,wCAAwC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAChB,KAAc,EACd,IAAY,EACZ,UAAkB,kCAAsB;IAExC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5E,IAAI,CAAC,IAAI,EAAE,qCAAqC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,SAAS,CACP,KAAK,EACL;QACE,WAAW;QACX,YAAY;QACZ,yBAAyB;QACzB,2BAA2B;QAC3B,yBAAyB;QACzB,aAAa;QACb,QAAQ;QACR,WAAW;QACX,uBAAuB;QACvB,+BAA+B;QAC/B,gBAAgB;QAChB,YAAY;QACZ,oBAAoB;QACpB,kBAAkB;QAClB,cAAc;QACd,OAAO;KACR,EACD,QAAQ,CACT,CAAC;IACF,OAAO;QACL,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,kBAAkB,EAAE,OAAO,CAAC;QAClE,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE,mBAAmB,CAAC;QAC5D,uBAAuB,EAAE,SAAS,CAChC,KAAK,CAAC,uBAAuB,EAC7B,gCAAgC,EAChC,+BAAmB,CACpB;QACD,yBAAyB,EAAE,SAAS,CAClC,KAAK,CAAC,yBAAyB,EAC/B,kCAAkC,EAClC,+BAAmB,CACpB;QACD,uBAAuB,EAAE,SAAS,CAChC,KAAK,CAAC,uBAAuB,EAC7B,gCAAgC,EAChC,+BAAmB,CACpB;QACD,WAAW,EAAE,SAAS,CACpB,KAAK,CAAC,WAAW,EACjB,oBAAoB,EACpB,YAAY,CACb;QACD,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,CAAC;QACxD,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,kBAAkB,CAAC;QACzD,qBAAqB,EAAE,SAAS,CAC9B,KAAK,CAAC,qBAAqB,EAC3B,8BAA8B,EAC9B,+BAAmB,CACpB;QACD,6BAA6B,EAAE,SAAS,CACtC,KAAK,CAAC,6BAA6B,EACnC,sCAAsC,EACtC,+BAAmB,CACpB;QACD,cAAc,EAAE,SAAS,CACvB,KAAK,CAAC,cAAc,EACpB,uBAAuB,EACvB,UAAU,CACX;QACD,UAAU,EAAE,SAAS,CACnB,KAAK,CAAC,UAAU,EAChB,mBAAmB,EACnB,+BAAmB,CACpB;QACD,kBAAkB,EAChB,KAAK,CAAC,kBAAkB,KAAK,oBAAoB;YAC/C,CAAC,CAAC,KAAK,CAAC,kBAAkB;YAC1B,CAAC,CAAC,IAAI,CACF,2BAA2B,EAC3B,8CAA8C,EAC9C,gCAAgC,CACjC;QACP,gBAAgB,EAAE,SAAS,CACzB,KAAK,CAAC,gBAAgB,EACtB,yBAAyB,EACzB,0BAA0B,CAC3B;QACD,YAAY,EAAE,SAAS,CACrB,KAAK,CAAC,YAAY,EAClB,qBAAqB,EACrB,WAAW,CACZ;QACD,KAAK,EACH,KAAK,CAAC,KAAK,KAAK,YAAY,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;YACvD,CAAC,CAAC,KAAK,CAAC,KAAK;YACb,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,2CAA2C,CAAC;KACxE,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,SAAS,CACP,KAAK,EACL,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,CAAC,EAC1D,YAAY,CACb,CAAC;IACF,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,iBAAiB,EAAE,qCAAqC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO;QACL,UAAU,EAAE,SAAS,CACnB,KAAK,CAAC,UAAU,EAChB,uBAAuB,EACvB,YAAY,CACb;QACD,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,kBAAkB,EAAE,YAAY,CAAC;QAC/D,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,SAAS,CACpB,KAAK,CAAC,WAAW,EACjB,wBAAwB,EACxB,mCAAmC,CACpC;QACD,QAAQ,EAAE,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,qBAAqB,CAAC;KAC3D,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,OAAe,EAAE,cAAsB;IAC9D,IACE,OAAO,CAAC,MAAM,KAAK,CAAC;QACpB,OAAO,CAAC,MAAM,GAAG,GAAG;QACpB,CAAC,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,EAC1C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,UAAU,GAAG,OAAO;SACvB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;SAC1D,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,IAAI,MAAM,CAAC,IAAI,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,iBAAiB,CACxB,QAAiB,EACjB,MAAgC;IAEhC,IACE,CAAC,IAAA,wBAAQ,EAAC,QAAQ,CAAC;QACnB,QAAQ,CAAC,UAAU,KAAK,MAAM,CAAC,SAAS;QACxC,CAAC,IAAA,wBAAQ,EAAC,QAAQ,CAAC,qBAAqB,CAAC;QACzC,QAAQ,CAAC,qBAAqB,CAAC,QAAQ,KAAK,UAAU;QACtD,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,KAAK,CAAC,EACpD,CAAC;QACD,IAAI,CACF,wBAAwB,EACxB,2DAA2D,EAC3D,kCAAkC,CACnC,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,qBAAqB,CAAC,KAAK,CAAC;IACnD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,iBAAiB,CAAC;IACjD,MAAM,OAAO,GAA8C,EAAE,CAAC;IAC9D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IACE,CAAC,IAAA,wBAAQ,EAAC,IAAI,CAAC;YACf,CAAC,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC,QAAQ,CAC3C,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAC3B;YACD,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,EACtC,CAAC;YACD,IAAI,CACF,oDAAoD,EACpD,4CAA4C,EAC5C,kCAAkC,CACnC,CAAC;QACJ,CAAC;QACD,IACE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CACzB,CAAC,MAAM,EAAE,EAAE,CACT,IAAA,wBAAQ,EAAC,MAAM,CAAC;YAChB,MAAM,CAAC,UAAU,KAAK,UAAU;YAChC,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;YACjC,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,CACxD,EACD,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,aAAmD,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,CACF,oDAAoD,EACpD,8EAA8E,EAC9E,kCAAkC,CACnC,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAuC,CAAC;AAC1D,CAAC;AAED,SAAS,WAAW,CAClB,KAAc,EACd,IAAY,EACZ,WAAmB,EACnB,iBAAyB;IAEzB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACrE,IAAI,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5D,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,iBAAiB,GAAG,IAAI,EAAE,CAAC;QAC9C,IAAI,CACF,IAAI,EACJ,iEAAiE,EACjE,kCAAkC,CACnC,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAAgC,EAChC,MAAgC;IAEhC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACtC,IACE,CAAC,IAAA,wBAAQ,EAAC,QAAQ,CAAC;QACnB,QAAQ,CAAC,IAAI,KAAK,yBAAyB;QAC3C,CAAC,IAAA,wBAAQ,EAAC,QAAQ,CAAC,OAAO,CAAC;QAC3B,CAAC,IAAA,wBAAQ,EAAC,QAAQ,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAChD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACpD,OAAO,CACL,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,WAAW;QACtC,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS;QACnC,KAAK,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc,CAC/C,CAAC;AACJ,CAAC;AAED,SAAgB,+BAA+B,CAC7C,KAAkC,EAClC,UAA0C,EAAE;IAE5C,SAAS,CACP,KAAK,EACL,CAAC,aAAa,EAAE,eAAe,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,EACjE,YAAY,CACb,CAAC;IACF,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAC1D,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,MAAM,CAAC;IAC9D,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,iBAAiB,CAAC;QACxC,iBAAiB,GAAG,EAAE;QACtB,iBAAiB,GAAG,OAAO,EAC3B,CAAC;QACD,IAAI,CAAC,mBAAmB,EAAE,+CAA+C,CAAC,CAAC;IAC7E,CAAC;IACD,SAAS,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,eAAe,CAAC,CAAC;IACzE,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,uBAAuB,CAAC,CAAC;IAC5E,IAAI,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QACzD,IAAI,CACF,8BAA8B,EAC9B,yCAAyC,EACzC,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1E,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QAC3B,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QACxB,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,EAC9B,CAAC;QACD,IAAI,CACF,OAAO,EACP,gCAAgC,SAAS,0BAA0B,EACnE,kCAAkC,CACnC,CAAC;IACJ,CAAC;IAED,IAAI,aAAiC,CAAC;IACtC,IAAI,eAAmC,CAAC;IACxC,IAAI,4BAAgD,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAGrB,CAAC;IACJ,MAAM,KAAK,GAAuD,EAAE,CAAC;IACrE,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAClD,SAAS,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,SAAS,KAAK,GAAG,CAAC,CAAC;QAC5D,SAAS,CACP,IAAI,CAAC,OAAO,EACZ;YACE,SAAS;YACT,YAAY;YACZ,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YACrD,QAAQ;YACR,YAAY;YACZ,gBAAgB;SACjB,EACD,SAAS,KAAK,WAAW,CAC1B,CAAC;QACF,SAAS,CACP,IAAI,CAAC,OAAO,CAAC,OAAO,EACpB,CAAC,aAAa,CAAC,EACf,SAAS,KAAK,mBAAmB,CAClC,CAAC;QACF,IACE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;YACvD,IAAI,CAAC,OAAO,CAAC,UAAU,KAAK,IAAI;YAChC,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,aAAa;YACxC,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;YACrC,IAAI,CAAC,OAAO,CAAC,UAAU,KAAK,MAAM,CAAC,SAAS;YAC5C,IAAI,CAAC,OAAO,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc,EACrD,CAAC;YACD,IAAI,CACF,SAAS,KAAK,WAAW,EACzB,kEAAkE,EAClE,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,IACE,CAAC,IAAA,wBAAQ,EAAC,QAAQ,CAAC;YACnB,QAAQ,CAAC,UAAU,KAAK,MAAM,CAAC,SAAS;YACxC,QAAQ,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;YACjD,CAAC,IAAA,wBAAQ,EAAC,QAAQ,CAAC,OAAO,CAAC;YAC3B,QAAQ,CAAC,OAAO,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;YACnD,CAAC,IAAA,wBAAQ,EAAC,QAAQ,CAAC,eAAe,CAAC;YACnC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,QAAQ,CAC9B,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,CACxC;YACD,CAAC,IAAA,wBAAQ,EAAC,QAAQ,CAAC,iBAAiB,CAAC;YACrC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,EAC3D,CAAC;YACD,IAAI,CACF,SAAS,KAAK,YAAY,EAC1B,iEAAiE,EACjE,kCAAkC,CACnC,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,WAAW,CAC3B,QAAQ,CAAC,iBAAiB,CAAC,oBAAoB,EAC/C,SAAS,KAAK,mDAAmD,EACjE,WAAW,EACX,iBAAiB,CAClB,CAAC;QACF,MAAM,OAAO,GAAG,WAAW,CACzB,QAAQ,CAAC,iBAAiB,CAAC,4BAA4B,EACvD,SAAS,KAAK,2DAA2D,EACzE,WAAW,EACX,iBAAiB,CAClB,CAAC;QACF,eAAe,KAAK,SAAS,CAAC;QAC9B,4BAA4B,KAAK,OAAO,CAAC;QACzC,IACE,eAAe,KAAK,SAAS;YAC7B,4BAA4B,KAAK,OAAO,EACxC,CAAC;YACD,IAAI,CACF,SAAS,KAAK,8BAA8B,EAC5C,wDAAwD,EACxD,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,CACT,YAAY,EACZ,KAAK,EACN,IAAI,QAAQ,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,OAAO,EAAE,EAAE,CAAC;YAC3D,IACE,CAAC,IAAA,wBAAQ,EAAC,KAAK,CAAC;gBAChB,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC,SAAS;gBACvC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;gBACpC,CAAC,IAAI,MAAM,CACT,oDAAoD,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,WAAW,CACjG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;gBACxB,CAAC,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC;gBACtC,CAAC,IAAA,wBAAQ,EAAC,KAAK,CAAC,2BAA2B,CAAC;gBAC5C,OAAO,KAAK,CAAC,2BAA2B,CAAC,eAAe,KAAK,QAAQ;gBACrE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,kBAAkB,CAAC;gBACpE,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;gBAClC,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,EAChC,CAAC;gBACD,IAAI,CACF,SAAS,KAAK,iDAAiD,YAAY,GAAG,EAC9E,8DAA8D,EAC9D,gCAAgC,CACjC,CAAC;YACJ,CAAC;YACD,MAAM,UAAU,GAAG;gBACjB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,GAAG,CAAC,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;oBACxC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE;oBACtC,CAAC,CAAC,EAAE,CAAC;gBACP,YAAY,EAAE;oBACZ,GAAG,IAAI,GAAG,CACR,KAAK,CAAC,2BAA2B,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACjE,IAAA,wBAAQ,EAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;wBAC/C,CAAC,CAAC,KAAK,CAAC,IAAI;wBACZ,CAAC,CAAC,EAAE,CACP,CACF;iBACF;qBACE,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,kCAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;qBACrD,IAAI,EAAE;gBACT,QAAQ,EAAE,SAAS,CACjB,KAAK,CAAC,QAAQ,EACd,SAAS,KAAK,cAAc,YAAY,YAAY,EACpD,WAAW,CACZ;gBACD,MAAM,EAAE,SAAS,CACf,KAAK,CAAC,MAAM,EACZ,SAAS,KAAK,cAAc,YAAY,UAAU,EAClD,WAAW,CACZ;gBACD,eAAe,EAAE,SAAS,CACxB,KAAK,CAAC,2BAA2B,CAAC,eAAe,EACjD,SAAS,KAAK,cAAc,YAAY,mBAAmB,CAC5D;aACF,CAAC;YACF,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YACrD,IACE,QAAQ;gBACR,IAAA,wCAA4B,EAAC,QAAQ,CAAC;oBACpC,IAAA,wCAA4B,EAAC,UAAU,CAAC,EAC1C,CAAC;gBACD,IAAI,CACF,SAAS,KAAK,cAAc,YAAY,GAAG,EAC3C,kDAAkD,EAClD,gCAAgC,CACjC,CAAC;YACJ,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAChD,IAAI,QAAQ,CAAC,IAAI,GAAG,YAAY,EAAE,CAAC;gBACjC,IAAI,CACF,UAAU,EACV,uBAAuB,YAAY,yBAAyB,CAC7D,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC;YACT,aAAa,EAAE,IAAA,6BAAiB,EAAC,IAAI,CAAC,OAAO,CAAC;YAC9C,cAAc,EAAE,IAAA,6BAAiB,EAAC,QAAQ,CAAC;SAC5C,CAAC,CAAC;QACH,aAAa;YACX,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;gBACrE,CAAC,CAAC,QAAQ,CAAC,SAAS;gBACpB,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,aAAa,KAAK,SAAS,IAAI,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpE,IAAI,CACF,SAAS,KAAK,sBAAsB,EACpC,qCAAqC,EACrC,kCAAkC,CACnC,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,CACF,OAAO,EACP,yCAAyC,EACzC,kCAAkC,CACnC,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG;QACf,WAAW;QACX,aAAa,EAAE;YACb,aAAa,EAAE,IAAA,6BAAiB,EAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC;YAC7D,cAAc,EAAE,IAAA,6BAAiB,EAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC;YAC/D,aAAa,EAAE,SAAS;YACxB,QAAQ,EAAE,UAAmB;SAC9B;QACD,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpD,IAAA,qCAAY,EAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAChD;QACD,IAAI,EAAE,iCAA0C;QAChD,KAAK;QACL,UAAU;QACV,eAAe,EAAE,eAAyB;QAC1C,aAAa,EAAE,CAAU;QACzB,MAAM,EAAE,UAAmB;QAC3B,MAAM;QACN,4BAA4B,EAAE,4BAAsC;KACrE,CAAC;IACF,OAAO,EAAE,GAAG,QAAQ,EAAE,cAAc,EAAE,IAAA,6BAAiB,EAAC,QAAQ,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,SAAgB,8BAA8B,CAC5C,KAAiC,EACjC,QAAkC;IAElC,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxC,IACE,IAAA,wCAA4B,EAAC,KAAK,CAAC,MAAM,CAAC;QACxC,IAAA,wCAA4B,EAAC,MAAM,CAAC;QACtC,KAAK,CAAC,IAAI,KAAK,iCAAiC;QAChD,KAAK,CAAC,aAAa,KAAK,CAAC;QACzB,KAAK,CAAC,MAAM,KAAK,UAAU,EAC3B,CAAC;QACD,IAAI,CACF,iBAAiB,EACjB,yDAAyD,EACzD,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,cAAc,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC9C,IACE,CAAC,+BAAmB,CAAC,IAAI,CAAC,cAAc,CAAC;QACzC,IAAA,6BAAiB,EAAC,QAAQ,CAAC,KAAK,cAAc,EAC9C,CAAC;QACD,IAAI,CACF,gCAAgC,EAChC,2CAA2C,EAC3C,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/src/supply-chain/ecs-deployed-image.d.ts

@@ -0,0 +1,85 @@
+import type { EcrInspectorCollectorProvenanceV1 } from './ecr-scanning.js';
+export declare const ECS_DEPLOYED_IMAGE_BINDING_KIND: "ebk-ecs-deployed-image-binding";
+export declare const ECS_DEPLOYED_IMAGE_BINDING_SCHEMA_VERSION: 1;
+export interface EcsDeployedImageExpectedV1 {
+    accountId: string;
+    artifactId: string;
+    candidateArtifactDigest: string;
+    containerBindingDigest: string;
+    containerImageDigest: string;
+    deployment: EcsDeploymentSelectorV1;
+    imageReference: string;
+    region: string;
+    releaseId: string;
+    releaseManifestDigest: string;
+    releaseManifestMaterialDigest: string;
+    repositoryName: string;
+    sourceCommit: string;
+    stage: 'production' | 'staging';
+    taskDefinitionFamily: string;
+}
+export type EcsDeploymentSelectorV1 = {
+    clusterArn: string;
+    kind: 'service';
+    serviceArn: string;
+} | {
+    clusterArn: string;
+    kind: 'task';
+    taskArn: string;
+};
+export interface EcsDeploymentRawCallV1 {
+    request: EcsDeploymentSelectorV1 & {
+        region: string;
+    };
+    response: unknown;
+}
+export interface EcsTaskDefinitionRawCallV1 {
+    request: {
+        include: readonly ['TAGS'];
+        region: string;
+        taskDefinition: string;
+    };
+    response: unknown;
+}
+export interface EcsDeployedImageBindingV1 extends EcsDeployedImageExpectedV1 {
+    collectedAt: string;
+    containerName: string;
+    deploymentArn: string;
+    deploymentKind: EcsDeploymentSelectorV1['kind'];
+    imageDigest: string;
+    imageReference: string;
+    kind: typeof ECS_DEPLOYED_IMAGE_BINDING_KIND;
+    materialDigest: string;
+    provenance: EcrInspectorCollectorProvenanceV1;
+    rawCalls: readonly [
+        {
+            requestDigest: string;
+            responseDigest: string;
+        },
+        {
+            requestDigest: string;
+            responseDigest: string;
+        },
+        {
+            requestDigest: string;
+            responseDigest: string;
+        },
+        {
+            requestDigest: string;
+            responseDigest: string;
+        }
+    ];
+    repositoryName: string;
+    schemaVersion: typeof ECS_DEPLOYED_IMAGE_BINDING_SCHEMA_VERSION;
+    taskDefinitionArn: string;
+}
+export declare function collectEcsDeployedImageBinding(input: {
+    collectedAt: string;
+    deployment: EcsDeploymentRawCallV1;
+    expected: EcsDeployedImageExpectedV1;
+    first: EcsTaskDefinitionRawCallV1;
+    provenance: EcrInspectorCollectorProvenanceV1;
+    revalidatedDeployment: EcsDeploymentRawCallV1;
+    revalidated: EcsTaskDefinitionRawCallV1;
+}): EcsDeployedImageBindingV1;
+export declare function verifyEcsDeployedImageBinding(value: EcsDeployedImageBindingV1, expected: EcsDeployedImageExpectedV1): EcsDeployedImageBindingV1;