@homeflare/alchemy 0.21.0 → 0.23.0

package/src/release/openbao.test.ts

@@ -0,0 +1,120 @@
+/**
+ * The REAL OpenBao data set against the vendor's own files — no network: fixtures/openbao/ holds
+ * checksums.txt, its detached GPG signature and the signing key byte-for-byte as fetched
+ * 2026-09-23 (each one's SHA-256 equals GitHub's / openbao.org's digest for it that day).
+ *
+ * ★ THE CHAIN THIS PROVES: fixture bytes = the recorded digest → the strict parser reads exactly
+ *   its 83 lines → none of them names `bao` → the pin is filed under `computed`, never `members`.
+ *   The GPG check is NOT re-run here (gpgv needs a binary this repo does not vendor); it is a
+ *   recorded one-time measurement (docs/release-binary-openbao.md), same status as Victoria's
+ *   "consistency, not provenance" note.
+ */
+import { describe, expect, test } from 'bun:test';
+import { sha256Hex } from '../launchd/job-form.ts';
+import { releaseUrl } from './binary-form.ts';
+import { catalogBinary } from './catalog.ts';
+import { parseChecksums } from './checksums.ts';
+import { OPENBAO_RELEASES } from './openbao.ts';
+
+const fixture = (name: string) => Bun.file(new URL(`fixtures/openbao/${name}`, import.meta.url));
+const PLATFORM = 'darwin_arm64';
+const archive = OPENBAO_RELEASES.packages.openbao?.versions['2.6.2']?.[PLATFORM];
+if (archive === undefined)
+  throw new Error('fixture setup: OPENBAO_RELEASES has no darwin_arm64 pin');
+
+describe('the OpenBao data set is the vendor checksum file', () => {
+  test('one package, one version, one platform', () => {
+    expect(Object.keys(OPENBAO_RELEASES.packages)).toEqual(['openbao']);
+    expect(Object.keys(OPENBAO_RELEASES.packages.openbao?.versions ?? {})).toEqual(['2.6.2']);
+    expect(Object.keys(OPENBAO_RELEASES.packages.openbao?.versions['2.6.2'] ?? {})).toEqual([
+      PLATFORM,
+    ]);
+  });
+
+  test('archive pin: repo, tag, asset, URL', () => {
+    expect([archive.repo, archive.tag, archive.asset]).toEqual([
+      'openbao/openbao',
+      'v2.6.2',
+      'openbao_2.6.2_darwin_arm64.tar.gz',
+    ]);
+    expect(releaseUrl(archive.repo, archive.tag, archive.asset)).toBe(
+      `https://github.com/openbao/openbao/releases/download/v2.6.2/openbao_2.6.2_darwin_arm64.tar.gz`,
+    );
+  });
+
+  test('checksums.txt: 83 lines, byte-identical to the recorded digest, archive line equals the pin', async () => {
+    const bytes = new Uint8Array(await fixture('checksums.txt').arrayBuffer());
+    expect(sha256Hex(bytes)).toBe(archive.checksums.sha256);
+    expect(archive.checksums.url).toBe(
+      'https://github.com/openbao/openbao/releases/download/v2.6.2/checksums.txt',
+    );
+    const lines = parseChecksums(new TextDecoder().decode(bytes));
+    expect(lines.size).toBe(83);
+    expect(lines.get(archive.asset)).toBe(archive.sha256);
+  });
+
+  test('no line names the `bao` member — it is not a vendor fact', async () => {
+    const bytes = new Uint8Array(await fixture('checksums.txt').arrayBuffer());
+    const lines = parseChecksums(new TextDecoder().decode(bytes));
+    expect(lines.has('bao')).toBe(false);
+    expect(archive.members).toEqual({});
+  });
+
+  test('the member digest is filed under `computed`, dated, not under `members`', () => {
+    expect(archive.computed?.bao).toEqual({
+      recorded: '2026-09-23',
+      sha256: 'd476d17e81a35e6d70dd7e86a8ab2a3664313525118f1f1cfe0130e7a2b95f3a',
+    });
+  });
+
+  test('the checksums file is GPG-signed, and the signature and key are pinned', async () => {
+    const sigBytes = new Uint8Array(await fixture('checksums.txt.gpgsig').arrayBuffer());
+    const keyBytes = new Uint8Array(await fixture('openbao-gpg-pub-20240618.asc').arrayBuffer());
+    const sig = archive.checksums.signature;
+    if (sig === undefined) throw new Error('fixture setup: no checksums.signature pinned');
+    expect(sig.kind).toBe('openpgp');
+    expect(sha256Hex(sigBytes)).toBe(sig.sha256);
+    expect(sha256Hex(keyBytes)).toBe(sig.key.sha256);
+    expect(sig.key.fingerprint).toBe('66D15FDD87287219C8E15478D200CD702853E6D0');
+  });
+
+  test('the asset is in the committed darwin listing, and no sibling is pinned', async () => {
+    const assets = (await fixture('darwin-assets.txt').text()).trim().split('\n');
+    expect(assets).toContain(archive.asset);
+    // ★ Every OTHER darwin asset (the amd64 archive, and every .sbom.json / .gpgsig / .sigstore.json
+    //   next to both) is listed here so a reviewer can see what was excluded, but pinned nowhere.
+    const siblings = assets.filter((name) => name !== archive.asset);
+    expect(siblings).toEqual([
+      'openbao_2.6.2_darwin_amd64.tar.gz',
+      'openbao_2.6.2_darwin_amd64.tar.gz.gpgsig',
+      'openbao_2.6.2_darwin_amd64.tar.gz.sbom.json',
+      'openbao_2.6.2_darwin_amd64.tar.gz.sbom.json.gpgsig',
+      'openbao_2.6.2_darwin_amd64.tar.gz.sbom.json.sigstore.json',
+      'openbao_2.6.2_darwin_amd64.tar.gz.sigstore.json',
+      'openbao_2.6.2_darwin_arm64.tar.gz.gpgsig',
+      'openbao_2.6.2_darwin_arm64.tar.gz.sbom.json',
+      'openbao_2.6.2_darwin_arm64.tar.gz.sbom.json.gpgsig',
+      'openbao_2.6.2_darwin_arm64.tar.gz.sbom.json.sigstore.json',
+      'openbao_2.6.2_darwin_arm64.tar.gz.sigstore.json',
+    ]);
+    expect(siblings.some((name) => name.startsWith('openbao-hsm_'))).toBe(false);
+    const pinnedPlatforms = Object.keys(OPENBAO_RELEASES.packages.openbao?.versions['2.6.2'] ?? {});
+    expect(pinnedPlatforms).not.toContain('darwin_amd64');
+  });
+
+  test('bao out of the data set: the computed member of the one pinned archive', () => {
+    const request = { binary: 'bao', package: 'openbao', platform: PLATFORM, version: '2.6.2' };
+    expect(catalogBinary(OPENBAO_RELEASES, request)).toEqual({
+      archive: {
+        asset: 'openbao_2.6.2_darwin_arm64.tar.gz',
+        repo: 'openbao/openbao',
+        sha256: '4e495376174accc0e014d31e9901f518a974f966850c839f626347eaac05fd52',
+        size: 76_833_570,
+        tag: 'v2.6.2',
+      },
+      member: 'bao',
+      name: 'bao',
+      sha256: 'd476d17e81a35e6d70dd7e86a8ab2a3664313525118f1f1cfe0130e7a2b95f3a',
+    });
+  });
+});

package/src/release/openbao.ts

@@ -0,0 +1,86 @@
+/**
+ * OpenBao's release archives, pinned — the second data set for Release.Binary, walked down
+ * 2026-09-23 (packages/alchemy/docs/release-binary-openbao.md has every command).
+ *
+ * ★ THE MEMBER DIGEST IS OURS, NOT THE VENDOR'S. `checksums.txt` lists 83 lines: every archive and
+ *   every `.sbom.json`, never `bao` itself (measured 2026-09-23 — see checksums.ts's header on why
+ *   that is normal for this vendor). So `bao`'s SHA-256 sits under `computed`, hashed from the one
+ *   archive whose OWN SHA-256 already matched the checksums-file pin — never filed under `members`,
+ *   which is vendor lines only.
+ * ★ PLATFORM KEY IS THE VENDOR'S OWN SPELLING: `darwin_arm64`, underscore — OpenBao's asset names
+ *   read `openbao_2.6.2_darwin_arm64.tar.gz`. Victoria's catalog spells the same idea
+ *   `darwin-arm64`, hyphen, because THAT vendor's asset names use a hyphen. Nothing here picks one
+ *   estate-wide convention; a consumer names the platform its data set actually uses. If a reviewer
+ *   would rather the estate pick one spelling, that is a one-line change to this rule, not to any
+ *   consumer, made in the same PR that adds the second spelling.
+ * ★ GPG, MEASURED, TWO INDEPENDENT CHANNELS: `gpgv` against the dearmored key from openbao.org
+ *   returned "Good signature from OpenBao <openbao@lists.lfedge.org>" over `checksums.txt` using
+ *   subkey E617DCD4065C2AFC0B2CF7A7BA8BC08C0F691F94 of primary 66D15FDD87287219C8E15478D200CD702853E6D0
+ *   (both fingerprints published in OpenBao's own install.mdx at this tag). ⚠️ TRUST ON FIRST USE
+ *   ACROSS TWO CHANNELS ONE PROJECT RUNS: the release asset and openbao.org are both OpenBao's own
+ *   infrastructure, so this is not a third party attesting to the key — it raises the bar over no
+ *   check at all (a swap needs both channels, not one), it does not reach independent provenance.
+ * ⛔ SIGSTORE WAS NOT CHECKED: `cosign` is not installed on the mini (measured 2026-09-23). The
+ *   bundle's certificate SAN (read, not verified) names
+ *   `https://github.com/openbao/openbao/.github/workflows/release.yml@refs/heads/release/2.6.x`,
+ *   issuer `https://token.actions.githubusercontent.com` — recorded here as an UNVERIFIED identity,
+ *   never as a passing check. "GPG or Sigstore" is met by the GPG half alone.
+ * ⚠️ THE BUILD THIS PINS IS NOT THE ONE THE VAULT SERVER RUNS. Read from goreleaser.other.yaml at
+ *   v2.6.2: `CGO_ENABLED=0`, build tag `ui`. Expected to differ from the Nix build in nothing an
+ *   agent (approle auto-auth, templates, exec) depends on; nobody has run this binary to confirm —
+ *   docs/release-binary-openbao.md says so and stops there, by house rule (never execute `bao`).
+ */
+import type { ReleaseCatalog } from './catalog.ts';
+
+const RECORDED = '2026-09-23';
+const REPO = 'openbao/openbao';
+const TAG = 'v2.6.2';
+const DOWNLOAD = `https://github.com/${REPO}/releases/download/${TAG}`;
+
+export const OPENBAO_RELEASES: ReleaseCatalog = {
+  packages: {
+    openbao: {
+      // ★ The member is named `bao` itself — no `-prod`-style suffix; the vendor tarball unpacks
+      //   CHANGELOG.md, LICENSE, README.md and `bao` at its root (measured, full stream, 2026-09-23).
+      binaries: { bao: 'bao' },
+      versions: {
+        '2.6.2': {
+          darwin_arm64: {
+            asset: 'openbao_2.6.2_darwin_arm64.tar.gz',
+            checksums: {
+              recorded: RECORDED,
+              sha256: '3d4a19fdc54a86fd94ce59ea91316dbf4304180bb27ae818e78e85c7f2164645',
+              signature: {
+                kind: 'openpgp',
+                key: {
+                  fingerprint: '66D15FDD87287219C8E15478D200CD702853E6D0',
+                  sha256: '1862a196422947124282e026ea4e09d6f7c5d383b628d90c17906936e6e5a8e0',
+                  url: 'https://openbao.org/assets/openbao-gpg-pub-20240618.asc',
+                },
+                sha256: '40f294d642a2b4e9adac766ca6b8b2633e15b3dbfdf63969dedbf46d94df53e8',
+                url: `${DOWNLOAD}/checksums.txt.gpgsig`,
+                verified: RECORDED,
+              },
+              url: `${DOWNLOAD}/checksums.txt`,
+            },
+            // ★ NOT a vendor fact — see the header. Hashed from THIS archive after its own SHA-256
+            //   (below) already matched the checksums.txt pin; confirmed two ways
+            //   (extractMembers and `tar -xzOf … bao | shasum -a 256`) and against `tar -tvzf -`.
+            computed: {
+              bao: {
+                recorded: RECORDED,
+                sha256: 'd476d17e81a35e6d70dd7e86a8ab2a3664313525118f1f1cfe0130e7a2b95f3a',
+              },
+            },
+            members: {},
+            repo: REPO,
+            sha256: '4e495376174accc0e014d31e9901f518a974f966850c839f626347eaac05fd52',
+            size: 76_833_570,
+            tag: TAG,
+          },
+        },
+      },
+    },
+  },
+  vendor: 'OpenBao',
+};

package/src/release/providers.test.ts

@@ -158,6 +158,7 @@ describe('the subpath', () => {
       'ChecksumMismatch',
       'DownloadFailed',
       'HostRunnerService',
+      'OPENBAO_RELEASES',
       'ReleaseBinary',
       'ReleaseBinaryProvider',
       'VICTORIA_RELEASES',