@git.zone/tsrust 1.7.0 → 1.9.0

package/ts/mod_provenance/classes.gitstate.ts

@@ -0,0 +1,49 @@
+import * as childProcess from 'child_process';
+import * as util from 'util';
+
+const execFile = util.promisify(childProcess.execFile);
+
+export interface IGitSnapshot {
+  available: boolean;
+  commit: string;
+  status: string;
+}
+
+export async function captureGitSnapshot(cwdArg: string): Promise<IGitSnapshot> {
+  let commit: string;
+  try {
+    const result = await execFile('git', ['-C', cwdArg, 'rev-parse', 'HEAD'], {
+      encoding: 'utf8',
+    });
+    commit = result.stdout.trim();
+  } catch {
+    return { available: false, commit: 'unknown', status: '' };
+  }
+  try {
+    const status = await execFile(
+      'git',
+      ['-C', cwdArg, 'status', '--porcelain=v1', '--untracked-files=all'],
+      { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 },
+    );
+    return {
+      available: true,
+      commit,
+      status: status.stdout,
+    };
+  } catch {
+    throw new Error('Failed to inspect Git worktree state');
+  }
+}
+
+export function assertGitSnapshotUnchanged(
+  beforeArg: IGitSnapshot,
+  afterArg: IGitSnapshot,
+): void {
+  if (
+    beforeArg.available !== afterArg.available ||
+    beforeArg.commit !== afterArg.commit ||
+    beforeArg.status !== afterArg.status
+  ) {
+    throw new Error('Git source state changed while Cargo was building');
+  }
+}

package/ts/mod_provenance/classes.provenancestore.ts

@@ -0,0 +1,194 @@
+import * as crypto from 'crypto';
+import * as fs from 'fs';
+import * as path from 'path';
+import type { ITsrustBuildInfo } from '../mod_elf/index.js';
+import { ProvenanceStamper } from '../mod_elf/index.js';
+import { getHostIdentity, isLocalProcessRunning } from './helpers.owneridentity.js';
+
+const SIDECAR_FORMAT = 'tsrust.build-provenance.v2';
+export const PROVENANCE_SIDECAR_SUFFIX = '.tsrust-build.json';
+
+interface IProvenanceSidecar {
+  format: typeof SIDECAR_FORMAT;
+  binarySha256: string;
+  buildInfo: ITsrustBuildInfo;
+}
+
+function isBuildInfo(valueArg: unknown): valueArg is ITsrustBuildInfo {
+  if (!valueArg || typeof valueArg !== 'object' || Array.isArray(valueArg)) return false;
+  const value = valueArg as Record<string, unknown>;
+  return (
+    typeof value.binary === 'string' &&
+    typeof value.target === 'string' &&
+    typeof value.projectName === 'string' &&
+    typeof value.projectVersion === 'string' &&
+    typeof value.gitCommit === 'string' &&
+    typeof value.builtAt === 'string' &&
+    typeof value.tsrustVersion === 'string' &&
+    (value.gitDirty === undefined || typeof value.gitDirty === 'boolean')
+  );
+}
+
+export class ProvenanceStore {
+  public static sidecarPath(binaryPathArg: string): string {
+    return `${binaryPathArg}${PROVENANCE_SIDECAR_SUFFIX}`;
+  }
+
+  public static async sha256(binaryPathArg: string): Promise<string> {
+    const binary = await fs.promises.lstat(binaryPathArg);
+    if (!binary.isFile() || binary.isSymbolicLink()) {
+      throw new Error(`Provenance binary is not a regular file: ${binaryPathArg}`);
+    }
+    const digest = crypto.createHash('sha256');
+    await new Promise<void>((resolve, reject) => {
+      const stream = fs.createReadStream(binaryPathArg);
+      stream.on('data', (chunk) => digest.update(chunk));
+      stream.on('error', reject);
+      stream.on('end', resolve);
+    });
+    return digest.digest('hex');
+  }
+
+  public static async write(binaryPathArg: string, infoArg: ITsrustBuildInfo): Promise<string> {
+    if (!isBuildInfo(infoArg)) {
+      throw new Error('Provenance build information has an invalid shape');
+    }
+    const binary = await fs.promises.lstat(binaryPathArg);
+    if (!binary.isFile() || binary.isSymbolicLink()) {
+      throw new Error(`Provenance binary is not a regular file: ${binaryPathArg}`);
+    }
+    const sidecarPath = ProvenanceStore.sidecarPath(binaryPathArg);
+    await ProvenanceStore.recoverTemporaryFiles(sidecarPath);
+    const existing = await ProvenanceStore.readExistingSidecar(binaryPathArg);
+    if (existing) {
+      if (JSON.stringify(existing) === JSON.stringify(infoArg)) return sidecarPath;
+      throw new Error(`Provenance sidecar already exists with different build information: ${sidecarPath}`);
+    }
+    const record: IProvenanceSidecar = {
+      format: SIDECAR_FORMAT,
+      binarySha256: await ProvenanceStore.sha256(binaryPathArg),
+      buildInfo: infoArg,
+    };
+    const temporaryPath = `${sidecarPath}.${getHostIdentity()}.${process.pid}.${crypto.randomUUID()}.tmp`;
+    let temporary: fs.promises.FileHandle | undefined;
+    try {
+      temporary = await fs.promises.open(temporaryPath, 'wx', 0o600);
+      await temporary.writeFile(`${JSON.stringify(record, null, 2)}\n`, 'utf8');
+      await temporary.chmod(0o644);
+      await temporary.sync();
+      await temporary.close();
+      temporary = undefined;
+      try {
+        await fs.promises.link(temporaryPath, sidecarPath);
+      } catch (error) {
+        if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error;
+        const concurrentlyWritten = await ProvenanceStore.readSidecar(binaryPathArg);
+        if (JSON.stringify(concurrentlyWritten) !== JSON.stringify(infoArg)) {
+          throw new Error(`Concurrent provenance write disagreed for ${binaryPathArg}`);
+        }
+      }
+      await fs.promises.unlink(temporaryPath);
+      const directory = await fs.promises.open(path.dirname(sidecarPath), 'r');
+      try {
+        await directory.sync();
+      } finally {
+        await directory.close();
+      }
+      return sidecarPath;
+    } finally {
+      await Promise.allSettled([
+        temporary?.close() || Promise.resolve(),
+        fs.promises.rm(temporaryPath, { force: true }),
+      ]);
+    }
+  }
+
+  private static async readExistingSidecar(
+    binaryPathArg: string,
+  ): Promise<ITsrustBuildInfo | undefined> {
+    try {
+      return await ProvenanceStore.readSidecar(binaryPathArg);
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') return undefined;
+      throw error;
+    }
+  }
+
+  private static async recoverTemporaryFiles(sidecarPathArg: string): Promise<void> {
+    const directoryPath = path.dirname(sidecarPathArg);
+    const temporaryPrefix = `${path.basename(sidecarPathArg)}.`;
+    const entries = await fs.promises.readdir(directoryPath, { withFileTypes: true });
+    for (const entry of entries) {
+      if (!entry.name.startsWith(temporaryPrefix) || !entry.name.endsWith('.tmp')) {
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      const suffix = entry.name.slice(temporaryPrefix.length, -'.tmp'.length);
+      const [hostIdentity, pidText, identifier, ...unexpected] = suffix.split('.');
+      const pid = Number(pidText);
+      if (
+        unexpected.length > 0 ||
+        !/^[a-f0-9]{64}$/.test(hostIdentity || '') ||
+        !Number.isSafeInteger(pid) ||
+        !/^[a-f0-9-]{36}$/.test(identifier || '') ||
+        hostIdentity !== getHostIdentity() ||
+        isLocalProcessRunning(pid)
+      ) {
+        continue;
+      }
+      const temporaryPath = path.join(directoryPath, entry.name);
+      try {
+        const temporary = await fs.promises.lstat(temporaryPath);
+        if (temporary.isFile() && !temporary.isSymbolicLink()) {
+          await fs.promises.rm(temporaryPath, { force: true });
+        }
+      } catch (error) {
+        if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+      }
+    }
+  }
+
+  public static async readSidecar(binaryPathArg: string): Promise<ITsrustBuildInfo> {
+    const sidecarPath = ProvenanceStore.sidecarPath(binaryPathArg);
+    const sidecar = await fs.promises.lstat(sidecarPath);
+    if (!sidecar.isFile() || sidecar.isSymbolicLink()) {
+      throw new Error(`Provenance sidecar is not a regular file: ${sidecarPath}`);
+    }
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(await fs.promises.readFile(sidecarPath, 'utf8'));
+    } catch {
+      throw new Error(`Provenance sidecar is invalid JSON: ${sidecarPath}`);
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+      throw new Error(`Provenance sidecar has an invalid shape: ${sidecarPath}`);
+    }
+    const record = parsed as Partial<IProvenanceSidecar>;
+    if (
+      record.format !== SIDECAR_FORMAT ||
+      typeof record.binarySha256 !== 'string' ||
+      !/^[a-f0-9]{64}$/.test(record.binarySha256) ||
+      !isBuildInfo(record.buildInfo)
+    ) {
+      throw new Error(`Provenance sidecar has an unsupported shape: ${sidecarPath}`);
+    }
+    const actualSha256 = await ProvenanceStore.sha256(binaryPathArg);
+    if (actualSha256 !== record.binarySha256) {
+      throw new Error(`Provenance sidecar hash does not match ${binaryPathArg}`);
+    }
+    return record.buildInfo;
+  }
+
+  public static async read(binaryPathArg: string): Promise<ITsrustBuildInfo | undefined> {
+    const sidecarPath = ProvenanceStore.sidecarPath(binaryPathArg);
+    try {
+      await fs.promises.lstat(sidecarPath);
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
+        return ProvenanceStamper.read(binaryPathArg);
+      }
+      throw error;
+    }
+    return ProvenanceStore.readSidecar(binaryPathArg);
+  }
+}

package/ts/mod_provenance/helpers.owneridentity.ts

@@ -0,0 +1,57 @@
+import * as childProcess from 'child_process';
+import * as crypto from 'crypto';
+import * as fs from 'fs';
+import * as os from 'os';
+
+let cachedHostIdentity: string | undefined;
+
+function readBootIdentity(): string {
+  if (process.platform === 'linux') {
+    try {
+      return fs.readFileSync('/proc/sys/kernel/random/boot_id', 'utf8').trim();
+    } catch {
+      // Fall through to the portable host fingerprint.
+    }
+  }
+  if (process.platform === 'darwin') {
+    try {
+      return childProcess.execFileSync('/usr/sbin/sysctl', ['-n', 'kern.boottime'], {
+        encoding: 'utf8',
+      }).trim();
+    } catch {
+      // Fall through to the portable host fingerprint.
+    }
+  }
+  return String(Math.round((Date.now() - os.uptime() * 1000) / 60_000));
+}
+
+export function getHostIdentity(): string {
+  if (cachedHostIdentity) return cachedHostIdentity;
+  const macAddresses = Object.values(os.networkInterfaces())
+    .flat()
+    .map((address) => address?.mac.toLowerCase())
+    .filter((address): address is string => !!address && address !== '00:00:00:00:00:00')
+    .sort();
+  cachedHostIdentity = crypto
+    .createHash('sha256')
+    .update(
+      JSON.stringify({
+        platform: process.platform,
+        hostname: os.hostname(),
+        bootIdentity: readBootIdentity(),
+        macAddresses,
+      }),
+    )
+    .digest('hex');
+  return cachedHostIdentity;
+}
+
+export function isLocalProcessRunning(pidArg: number): boolean {
+  if (!Number.isSafeInteger(pidArg) || pidArg <= 0) return false;
+  try {
+    process.kill(pidArg, 0);
+    return true;
+  } catch (error) {
+    return (error as NodeJS.ErrnoException).code !== 'ESRCH';
+  }
+}

package/ts/mod_provenance/index.ts

@@ -0,0 +1,10 @@
+export {
+  captureGitSnapshot,
+  assertGitSnapshotUnchanged,
+  type IGitSnapshot,
+} from './classes.gitstate.js';
+export {
+  ProvenanceStore,
+  PROVENANCE_SIDECAR_SUFFIX,
+} from './classes.provenancestore.js';
+export { getHostIdentity, isLocalProcessRunning } from './helpers.owneridentity.js';