@intentius/chant 0.124.27 → 0.124.28

package/dist/workspace/trust/ci-tag-statement.js

@@ -0,0 +1,123 @@
+/**
+ * The statement a ci tag carries (#4031): a runner's signed word that a
+ * commit went green, or went red after it was green.
+ *
+ * `ci/green/<sha>` and `ci/revoked/<sha>` are plain git tags (ws-103), so
+ * anyone who may push a tag could make one by hand and go around CI. When the
+ * declaration sets `ci.green.signedSince` to a commit, a tag on any commit
+ * that is not a strict first-parent ancestor of it counts only when its
+ * annotation holds a statement signed by a runner key, and readers ignore
+ * and report a tag without a valid one.
+ *
+ * The statement reuses what runner evidence (#2553, ws-069) and the agent-run
+ * statement (#3192, ws-090) already use: an in-toto Statement v1 in a DSSE
+ * envelope (./dsse.ts), signed with an Ed25519 key that `.chant/trust.json`
+ * at base lists under `runners`. The key's principal must also hold the
+ * `runner` role there, since a tag says CI ran. A key the signers file lists
+ * is never a runner key (./policy.ts).
+ *
+ * - `subject`: the tagged commit, by `digest.gitCommit`.
+ * - `predicate`: the signer's principal and the tag's JSON record as the
+ *   annotation holds it (`tag`, `commit`, `branch`, `at`, and the phases'
+ *   runs for a green tag or the failed phase and run for a revoked one).
+ *
+ * The envelope sits in the annotation's JSON record as `statement`, beside
+ * the fields it signs, so a reader that does not know it reads the record as
+ * before. Verifying needs the tag, the envelope and the runner keys at base,
+ * so it works offline, and every read verifies again.
+ */
+import { z } from "zod";
+import { canonicalJson } from "../../effect-receipt.js";
+import { IN_TOTO_PAYLOAD_TYPE, signEnvelope, verifyEnvelope } from "./dsse.js";
+import { STATEMENT_TYPE } from "./evidence.js";
+export const CI_TAG_PREDICATE = "https://intentius.io/chant/ci-tag/v1";
+/** The role a tag's signer must hold in `.chant/trust.json` (#4031): the core class `runner`. */
+export const CI_TAG_SIGNER_ROLE = "runner";
+const fullCommit = z.string().regex(/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/);
+const text = z.string().min(1);
+/** The statement a ci tag carries. Strict at the top, so a verifier never acts on a field it does not know. */
+export const ciTagStatementSchema = z
+    .object({
+    _type: z.literal(STATEMENT_TYPE),
+    subject: z
+        .array(z
+        .object({ name: fullCommit, digest: z.object({ gitCommit: fullCommit }).strict() })
+        .strict()
+        .refine((s) => s.name === s.digest.gitCommit, "a commit subject is named by its own id"))
+        .length(1),
+    predicateType: z.literal(CI_TAG_PREDICATE),
+    predicate: z
+        .object({
+        signer: text,
+        record: z
+            .object({ schema: z.literal(1), tag: z.enum(["green", "revoked"]), commit: fullCommit, branch: text, at: text })
+            .passthrough(),
+    })
+        .strict(),
+})
+    .strict();
+export function buildCiTagStatement(record, signer) {
+    return {
+        _type: STATEMENT_TYPE,
+        subject: [{ name: record.commit, digest: { gitCommit: record.commit } }],
+        predicateType: CI_TAG_PREDICATE,
+        predicate: { signer, record: record },
+    };
+}
+/** The envelope a tag's record carries as `statement`, signed by `signer`. */
+export function signCiTagRecord(record, signer) {
+    const statement = buildCiTagStatement(record, signer.principal);
+    return signEnvelope(IN_TOTO_PAYLOAD_TYPE, Buffer.from(canonicalJson(statement), "utf8"), signer.key, signer.publicKey);
+}
+const normalise = (name) => name.normalize("NFKC").trim().toLowerCase();
+/**
+ * Verify the statement in a tag's record. `expect` is what the tag itself
+ * says: the commit its name gives, its kind and the declared branch. The
+ * signer's key must be a runner key at base and its principal must hold the
+ * `runner` role in `roles`. Never throws.
+ */
+export function verifyCiTagStatement(record, expect, runners, roles) {
+    const tag = `ci/${expect.kind}/${expect.sha}`;
+    if (record === null)
+        return { status: "unsigned", reason: `${tag} has no JSON record in its annotation, so it carries no statement (a lightweight tag, or one made by hand)` };
+    const { statement: envelope, ...fields } = record;
+    if (envelope === undefined)
+        return { status: "unsigned", reason: `${tag} carries no statement signed by a runner key` };
+    const v = verifyEnvelope(envelope, runners);
+    if (!v.ok)
+        return { status: v.code === "envelope-untrusted" ? "untrusted" : "invalid", reason: `${tag}: ${v.reason}` };
+    if (!(roles[CI_TAG_SIGNER_ROLE] ?? []).some((p) => normalise(p) === normalise(v.principal))) {
+        return { status: "untrusted", reason: `${tag} is signed by ${v.principal}'s runner key, and ${v.principal} holds no ${CI_TAG_SIGNER_ROLE} role in .chant/trust.json at base` };
+    }
+    if (v.payloadType !== IN_TOTO_PAYLOAD_TYPE)
+        return { status: "invalid", reason: `${tag}: payload type ${v.payloadType} is not ${IN_TOTO_PAYLOAD_TYPE}` };
+    let raw;
+    try {
+        raw = JSON.parse(v.payload.toString("utf8"));
+    }
+    catch {
+        return { status: "invalid", reason: `${tag}: the statement's payload is not JSON` };
+    }
+    const parsed = ciTagStatementSchema.safeParse(raw);
+    if (!parsed.success) {
+        const detail = parsed.error.issues.map((i) => `${i.path.join(".") || "/"}: ${i.message}`).join("; ");
+        return { status: "invalid", reason: `${tag}: the payload is not a ${CI_TAG_PREDICATE} statement: ${detail}` };
+    }
+    const p = parsed.data.predicate;
+    if (p.signer !== v.principal)
+        return { status: "invalid", reason: `${tag}: the statement names signer ${JSON.stringify(p.signer)}, but ${v.principal}'s key signed it` };
+    const differs = [];
+    if (parsed.data.subject[0].name !== expect.sha)
+        differs.push(`it is for commit ${parsed.data.subject[0].name.slice(0, 12)}`);
+    if (p.record.commit !== expect.sha)
+        differs.push(`its record names commit ${p.record.commit.slice(0, 12)}`);
+    if (p.record.tag !== expect.kind)
+        differs.push(`it signs a ${p.record.tag} tag`);
+    if (p.record.branch !== expect.branch)
+        differs.push(`it is for branch ${p.record.branch}, and ci.green names ${expect.branch}`);
+    if (canonicalJson(p.record) !== canonicalJson(fields))
+        differs.push("the annotation's record is not the one signed");
+    if (differs.length > 0)
+        return { status: "mismatch", reason: `${tag} is signed by ${v.principal}, but the statement does not match the tag: ${differs.join("; ")}` };
+    return { status: "signed", signer: v.principal, keyid: v.keyid, reason: `signed by ${v.principal} (${CI_TAG_SIGNER_ROLE})` };
+}

package/dist/workspace/trust/op-run-statement.d.ts

@@ -0,0 +1,91 @@
+/**
+ * The Op-run statement (#4044): a runner's signed word that an Op ran on a
+ * commit and settled as its run record says.
+ *
+ * `chant ci tick` can take chant's own Op runs as its status source in place
+ * of a forge's check runs (`ci.green.source: "runs"`), so a project whose
+ * pipelines run as chant Ops gets green and revoked tags with no forge check
+ * runs. The run ledger on `chant/lifecycle` is written by whatever ran the
+ * Op, so the tick counts a run only when its record carries a statement
+ * signed by a runner key, the same keys and role a ci tag needs (#4031):
+ * `.chant/trust.json` at base lists the key under `runners`, and its
+ * principal holds the `runner` role there. A key the signers file lists is
+ * never a runner key (./policy.ts).
+ *
+ * The statement is an in-toto Statement v1 in a DSSE envelope (./dsse.ts),
+ * as runner evidence (#2553), the agent-run statement (#3192) and the ci tag
+ * statement (#4031) are:
+ *
+ * - `subject`: the commit the run built from (`gitSha`), by `digest.gitCommit`.
+ * - `predicate`: the signer's principal, and the run's id, Op, env, status
+ *   and the SHA-256 of its record without the statement.
+ *
+ * The runner signs at the end of the run when it is given a key
+ * (`chant run <op> --key <file>` or `CHANT_RUNNER_KEY`), and the envelope is
+ * stored on the record itself as `statement`, so the record and its
+ * signature are one ledger line. Verifying needs the record and the runner
+ * keys at base, so it works offline, and every read verifies again.
+ */
+import { z } from "zod";
+import type { OpRunRecord } from "../../op/runtime.js";
+import { type DsseEnvelope } from "./dsse.js";
+import { type CiTagFailure, type CiTagSigner } from "./ci-tag-statement.js";
+import type { RunnerKey } from "./policy.js";
+export declare const OP_RUN_PREDICATE = "https://intentius.io/chant/op-run/v1";
+/** The statement a runner signs for an Op run. Strict, so a verifier never acts on a field it does not know. */
+export declare const opRunStatementSchema: z.ZodObject<{
+    _type: z.ZodLiteral<"https://in-toto.io/Statement/v1">;
+    subject: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        digest: z.ZodObject<{
+            gitCommit: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>>;
+    predicateType: z.ZodLiteral<"https://intentius.io/chant/op-run/v1">;
+    predicate: z.ZodObject<{
+        signer: z.ZodString;
+        run: z.ZodObject<{
+            id: z.ZodString;
+            op: z.ZodString;
+            env: z.ZodString;
+            status: z.ZodEnum<{
+                fail: "fail";
+                gated: "gated";
+                ok: "ok";
+                waiting: "waiting";
+            }>;
+            record: z.ZodObject<{
+                sha256: z.ZodString;
+            }, z.core.$strict>;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type OpRunStatement = z.infer<typeof opRunStatementSchema>;
+/**
+ * The SHA-256 of a run record: the canonical JSON (keys sorted, no
+ * whitespace) of the record without its `statement`, so storing the
+ * statement never changes the hash it signs.
+ */
+export declare function opRunRecordDigest(record: OpRunRecord): string;
+/** The statement for a settled run, as `signer` would sign it. Throws for a run that knew no commit. */
+export declare function buildOpRunStatement(record: OpRunRecord, signer: string): OpRunStatement;
+/** The envelope a run record carries as `statement`, signed by `signer`. */
+export declare function signOpRunRecord(record: OpRunRecord, signer: CiTagSigner): DsseEnvelope;
+/** One run record judged: signed by a runner holding the `runner` role, or why not, in the words a ci tag uses. */
+export type OpRunVerdict = {
+    status: "signed";
+    signer: string;
+    keyid: string;
+    reason: string;
+} | {
+    status: CiTagFailure;
+    reason: string;
+};
+/**
+ * Verify the statement a run record carries against the runner keys and
+ * roles at base: a signature by a runner key whose principal holds the
+ * `runner` role, over a statement for this run, its commit and its record as
+ * the ledger holds it. Never throws.
+ */
+export declare function verifyOpRunStatement(record: OpRunRecord, runners: readonly RunnerKey[], roles: Readonly<Record<string, readonly string[]>>): OpRunVerdict;
+//# sourceMappingURL=op-run-statement.d.ts.map

package/dist/workspace/trust/op-run-statement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"op-run-statement.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/op-run-statement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAsD,KAAK,YAAY,EAAE,MAAM,QAAQ,CAAC;AAE/F,OAAO,EAAsB,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC7F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE1C,eAAO,MAAM,gBAAgB,yCAAyC,CAAC;AAKvE,gHAAgH;AAChH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;kBA2BtB,CAAC;AACZ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAG7D;AAED,wGAAwG;AACxG,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,cAAc,CAWvF;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,GAAG,YAAY,CAGtF;AAED,mHAAmH;AACnH,MAAM,MAAM,YAAY,GAAG;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAI1I;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,SAAS,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,GAAG,YAAY,CAgCzJ"}

package/dist/workspace/trust/op-run-statement.js

@@ -0,0 +1,143 @@
+/**
+ * The Op-run statement (#4044): a runner's signed word that an Op ran on a
+ * commit and settled as its run record says.
+ *
+ * `chant ci tick` can take chant's own Op runs as its status source in place
+ * of a forge's check runs (`ci.green.source: "runs"`), so a project whose
+ * pipelines run as chant Ops gets green and revoked tags with no forge check
+ * runs. The run ledger on `chant/lifecycle` is written by whatever ran the
+ * Op, so the tick counts a run only when its record carries a statement
+ * signed by a runner key, the same keys and role a ci tag needs (#4031):
+ * `.chant/trust.json` at base lists the key under `runners`, and its
+ * principal holds the `runner` role there. A key the signers file lists is
+ * never a runner key (./policy.ts).
+ *
+ * The statement is an in-toto Statement v1 in a DSSE envelope (./dsse.ts),
+ * as runner evidence (#2553), the agent-run statement (#3192) and the ci tag
+ * statement (#4031) are:
+ *
+ * - `subject`: the commit the run built from (`gitSha`), by `digest.gitCommit`.
+ * - `predicate`: the signer's principal, and the run's id, Op, env, status
+ *   and the SHA-256 of its record without the statement.
+ *
+ * The runner signs at the end of the run when it is given a key
+ * (`chant run <op> --key <file>` or `CHANT_RUNNER_KEY`), and the envelope is
+ * stored on the record itself as `statement`, so the record and its
+ * signature are one ledger line. Verifying needs the record and the runner
+ * keys at base, so it works offline, and every read verifies again.
+ */
+import { createHash } from "node:crypto";
+import { z } from "zod";
+import { canonicalJson } from "../../effect-receipt.js";
+import { IN_TOTO_PAYLOAD_TYPE, signEnvelope, verifyEnvelope } from "./dsse.js";
+import { STATEMENT_TYPE } from "./evidence.js";
+import { CI_TAG_SIGNER_ROLE } from "./ci-tag-statement.js";
+export const OP_RUN_PREDICATE = "https://intentius.io/chant/op-run/v1";
+const fullCommit = z.string().regex(/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/);
+const text = z.string().min(1);
+/** The statement a runner signs for an Op run. Strict, so a verifier never acts on a field it does not know. */
+export const opRunStatementSchema = z
+    .object({
+    _type: z.literal(STATEMENT_TYPE),
+    subject: z
+        .array(z
+        .object({ name: fullCommit, digest: z.object({ gitCommit: fullCommit }).strict() })
+        .strict()
+        .refine((s) => s.name === s.digest.gitCommit, "a commit subject is named by its own id"))
+        .length(1),
+    predicateType: z.literal(OP_RUN_PREDICATE),
+    predicate: z
+        .object({
+        signer: text,
+        run: z
+            .object({
+            id: text,
+            op: text,
+            env: text,
+            status: z.enum(["ok", "fail", "gated", "waiting"]),
+            record: z.object({ sha256: z.string().regex(/^[0-9a-f]{64}$/) }).strict(),
+        })
+            .strict(),
+    })
+        .strict(),
+})
+    .strict();
+/**
+ * The SHA-256 of a run record: the canonical JSON (keys sorted, no
+ * whitespace) of the record without its `statement`, so storing the
+ * statement never changes the hash it signs.
+ */
+export function opRunRecordDigest(record) {
+    const { statement: _statement, ...rest } = record;
+    return createHash("sha256").update(canonicalJson(rest), "utf8").digest("hex");
+}
+/** The statement for a settled run, as `signer` would sign it. Throws for a run that knew no commit. */
+export function buildOpRunStatement(record, signer) {
+    const sha = record.gitSha;
+    if (!sha || !/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/.test(sha)) {
+        throw new Error(`run ${record.id} of ${record.op} names no full commit sha, so there is no commit for its statement to sign`);
+    }
+    return {
+        _type: STATEMENT_TYPE,
+        subject: [{ name: sha, digest: { gitCommit: sha } }],
+        predicateType: OP_RUN_PREDICATE,
+        predicate: { signer, run: { id: record.id, op: record.op, env: record.env, status: record.status, record: { sha256: opRunRecordDigest(record) } } },
+    };
+}
+/** The envelope a run record carries as `statement`, signed by `signer`. */
+export function signOpRunRecord(record, signer) {
+    const statement = buildOpRunStatement(record, signer.principal);
+    return signEnvelope(IN_TOTO_PAYLOAD_TYPE, Buffer.from(canonicalJson(statement), "utf8"), signer.key, signer.publicKey);
+}
+const normalise = (name) => name.normalize("NFKC").trim().toLowerCase();
+/**
+ * Verify the statement a run record carries against the runner keys and
+ * roles at base: a signature by a runner key whose principal holds the
+ * `runner` role, over a statement for this run, its commit and its record as
+ * the ledger holds it. Never throws.
+ */
+export function verifyOpRunStatement(record, runners, roles) {
+    const run = `run ${record.id} of ${record.op}`;
+    if (record.statement === undefined)
+        return { status: "unsigned", reason: `${run} carries no statement signed by a runner key` };
+    const v = verifyEnvelope(record.statement, runners);
+    if (!v.ok)
+        return { status: v.code === "envelope-untrusted" ? "untrusted" : "invalid", reason: `${run}: ${v.reason}` };
+    if (!(roles[CI_TAG_SIGNER_ROLE] ?? []).some((p) => normalise(p) === normalise(v.principal))) {
+        return { status: "untrusted", reason: `${run} is signed by ${v.principal}'s runner key, and ${v.principal} holds no ${CI_TAG_SIGNER_ROLE} role in .chant/trust.json at base` };
+    }
+    if (v.payloadType !== IN_TOTO_PAYLOAD_TYPE)
+        return { status: "invalid", reason: `${run}: payload type ${v.payloadType} is not ${IN_TOTO_PAYLOAD_TYPE}` };
+    let raw;
+    try {
+        raw = JSON.parse(v.payload.toString("utf8"));
+    }
+    catch {
+        return { status: "invalid", reason: `${run}: the statement's payload is not JSON` };
+    }
+    const parsed = opRunStatementSchema.safeParse(raw);
+    if (!parsed.success) {
+        const detail = parsed.error.issues.map((i) => `${i.path.join(".") || "/"}: ${i.message}`).join("; ");
+        return { status: "invalid", reason: `${run}: the payload is not a ${OP_RUN_PREDICATE} statement: ${detail}` };
+    }
+    const p = parsed.data.predicate;
+    if (p.signer !== v.principal)
+        return { status: "invalid", reason: `${run}: the statement names signer ${JSON.stringify(p.signer)}, but ${v.principal}'s key signed it` };
+    const differs = [];
+    if (parsed.data.subject[0].name !== record.gitSha)
+        differs.push(`it is for commit ${parsed.data.subject[0].name.slice(0, 12)}, and the record names ${record.gitSha ? record.gitSha.slice(0, 12) : "none"}`);
+    if (p.run.id !== record.id)
+        differs.push(`it is for run ${p.run.id}`);
+    if (p.run.op !== record.op)
+        differs.push(`it is for Op ${p.run.op}`);
+    if (p.run.env !== record.env)
+        differs.push(`it is for env ${p.run.env}`);
+    if (p.run.status !== record.status)
+        differs.push(`it says ${p.run.status}, and the record says ${record.status}`);
+    const digest = opRunRecordDigest(record);
+    if (p.run.record.sha256 !== digest)
+        differs.push(`the record hashed ${p.run.record.sha256.slice(0, 12)} when signed and ${digest.slice(0, 12)} now`);
+    if (differs.length > 0)
+        return { status: "mismatch", reason: `${run} is signed by ${v.principal}, but the statement does not match its record: ${differs.join("; ")}` };
+    return { status: "signed", signer: v.principal, keyid: v.keyid, reason: `signed by ${v.principal} (${CI_TAG_SIGNER_ROLE})` };
+}

package/dist/workspace/trust/rotation.d.ts

@@ -108,8 +108,13 @@ export declare function fileAt(repo: string, commit: string, path: string): stri
 export declare function signerHistory(repo: string, base: string, signersPath: string): SignerHistory;
 /**
  * Finds the signer set in effect for a commit, by its position in the base's
- * history. Built once per base; the first-parent line is read once and
- * each lookup is a binary search.
+ * history. Built once per base. The first-parent line and the parents of
+ * every commit the base reaches are read once, in two `git rev-list` walks,
+ * and each lookup of a full commit id is then a map read (#4032). Before,
+ * each lookup ran `git merge-base --is-ancestor` about log2(n) times, and a
+ * trace over a busy file spent most of its time starting those processes. A
+ * commit named any other way (a ref, an abbreviated id) is still looked up
+ * with `git merge-base`, as before.
  */
 export declare class SignerPositions {
     private readonly repo;
@@ -118,10 +123,21 @@ export declare class SignerPositions {
     private line;
     private index;
     private memo;
+    private entries;
     constructor(repo: string, base: string, history: SignerHistory);
     private isAncestor;
     /** The base's first-parent line, newest first. */
     private firstParents;
+    /**
+     * For every commit the base reaches, the index on the first-parent line
+     * (newest first) of the oldest first-parent commit that contains it: where
+     * it came in. The line is walked oldest first, and each first-parent commit
+     * marks what it reaches that nothing older reached. A marked commit's
+     * ancestors are all marked, so the walk stops at one.
+     */
+    private entryIndex;
+    /** Where `commit` came in on the first-parent line, or null when the base doesn't reach it. */
+    private entryOf;
     /**
      * The version that judges `commit`, or null when no signer set was in
      * effect there (before the first one, or the chain is broken).

package/dist/workspace/trust/rotation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rotation.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/rotation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAKH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAuB,KAAK,cAAc,EAAE,KAAK,MAAM,EAAE,MAAM,UAAU,CAAC;AAGjF,uHAAuH;AACvH,eAAO,MAAM,sBAAsB,iPAUO,CAAC;AAC3C,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,6EAA6E;AAC7E,eAAO,MAAM,kBAAkB,kBAAkB,CAAC;AAElD,4CAA4C;AAC5C,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,eAAO,MAAM,kBAAkB;;;;;;;;;kBAQpB,CAAC;AACZ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,gDAAgD;AAChD,wBAAgB,iBAAiB,CAAC,CAAC,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAK7H;AAED,gEAAgE;AAChE,MAAM,WAAW,aAAa;IAC5B,sFAAsF;IACtF,OAAO,EAAE,MAAM,CAAC;IAChB,wFAAwF;IACxF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,4FAA4F;IAC5F,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,iEAAiE;IACjE,MAAM,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,eAAe,CAAC;CACtD;AAED,2DAA2D;AAC3D,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,aAAa,GAAG,eAAe,CA6DtI;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAuBlE;AAMD,oEAAoE;AACpE,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMrF;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,aAAa,CAqB5F;AAED;;;;GAIG;AACH,qBAAa,eAAe;IAMxB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAP1B,OAAO,CAAC,IAAI,CAAuB;IACnC,OAAO,CAAC,KAAK,CAA6B;IAC1C,OAAO,CAAC,IAAI,CAA2C;IAEvD,YACmB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,aAAa,EACrC;IAEJ,OAAO,CAAC,UAAU;IASlB,kDAAkD;IAClD,OAAO,CAAC,YAAY;IAQpB;;;OAGG;IACH,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAM/C;IAED,OAAO,CAAC,MAAM;CA+Bf"}
+{"version":3,"file":"rotation.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/rotation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAKH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAuB,KAAK,cAAc,EAAE,KAAK,MAAM,EAAE,MAAM,UAAU,CAAC;AAGjF,uHAAuH;AACvH,eAAO,MAAM,sBAAsB,iPAUO,CAAC;AAC3C,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,6EAA6E;AAC7E,eAAO,MAAM,kBAAkB,kBAAkB,CAAC;AAElD,4CAA4C;AAC5C,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,eAAO,MAAM,kBAAkB;;;;;;;;;kBAQpB,CAAC;AACZ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,gDAAgD;AAChD,wBAAgB,iBAAiB,CAAC,CAAC,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAK7H;AAED,gEAAgE;AAChE,MAAM,WAAW,aAAa;IAC5B,sFAAsF;IACtF,OAAO,EAAE,MAAM,CAAC;IAChB,wFAAwF;IACxF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,4FAA4F;IAC5F,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,iEAAiE;IACjE,MAAM,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,eAAe,CAAC;CACtD;AAED,2DAA2D;AAC3D,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,aAAa,GAAG,eAAe,CA6DtI;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAuBlE;AAMD,oEAAoE;AACpE,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMrF;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,aAAa,CAqB5F;AAKD;;;;;;;;;GASG;AACH,qBAAa,eAAe;IAOxB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAR1B,OAAO,CAAC,IAAI,CAAuB;IACnC,OAAO,CAAC,KAAK,CAA6B;IAC1C,OAAO,CAAC,IAAI,CAA2C;IACvD,OAAO,CAAC,OAAO,CAAkC;IAEjD,YACmB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,aAAa,EACrC;IAEJ,OAAO,CAAC,UAAU;IASlB,kDAAkD;IAClD,OAAO,CAAC,YAAY;IAQpB;;;;;;OAMG;IACH,OAAO,CAAC,UAAU;IAuBlB,+FAA+F;IAC/F,OAAO,CAAC,OAAO;IAoBf;;;OAGG;IACH,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAM/C;IAED,OAAO,CAAC,MAAM;CAkBf"}

package/dist/workspace/trust/rotation.js

@@ -218,10 +218,17 @@ export function signerHistory(repo, base, signersPath) {
     }
     return { versions };
 }
+/** A full commit id, as git prints it: lowercase hex, sha1 or sha256. */
+const FULL_ID = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
 /**
  * Finds the signer set in effect for a commit, by its position in the base's
- * history. Built once per base; the first-parent line is read once and
- * each lookup is a binary search.
+ * history. Built once per base. The first-parent line and the parents of
+ * every commit the base reaches are read once, in two `git rev-list` walks,
+ * and each lookup of a full commit id is then a map read (#4032). Before,
+ * each lookup ran `git merge-base --is-ancestor` about log2(n) times, and a
+ * trace over a busy file spent most of its time starting those processes. A
+ * commit named any other way (a ref, an abbreviated id) is still looked up
+ * with `git merge-base`, as before.
  */
 export class SignerPositions {
     constructor(repo, base, history) {
@@ -249,23 +256,44 @@ export class SignerPositions {
         return this.line;
     }
     /**
-     * The version that judges `commit`, or null when no signer set was in
-     * effect there (before the first one, or the chain is broken).
+     * For every commit the base reaches, the index on the first-parent line
+     * (newest first) of the oldest first-parent commit that contains it: where
+     * it came in. The line is walked oldest first, and each first-parent commit
+     * marks what it reaches that nothing older reached. A marked commit's
+     * ancestors are all marked, so the walk stops at one.
      */
-    versionFor(commit) {
-        const hit = this.memo.get(commit);
-        if (hit !== undefined)
-            return hit;
-        const answer = this.lookup(commit);
-        this.memo.set(commit, answer);
-        return answer;
+    entryIndex() {
+        if (!this.entries) {
+            const line = this.firstParents();
+            const parents = new Map();
+            for (const row of git(this.repo, ["rev-list", "--parents", this.base]).split("\n")) {
+                const [commit, ...ps] = row.trim().split(" ");
+                if (commit)
+                    parents.set(commit, ps);
+            }
+            const entries = new Map();
+            for (let i = line.length - 1; i >= 0; i--) {
+                const stack = [line[i]];
+                while (stack.length > 0) {
+                    const c = stack.pop();
+                    if (entries.has(c))
+                        continue;
+                    entries.set(c, i);
+                    for (const p of parents.get(c) ?? [])
+                        if (!entries.has(p))
+                            stack.push(p);
+                }
+            }
+            this.entries = entries;
+        }
+        return this.entries;
     }
-    lookup(commit) {
-        if (this.history.broken)
-            return null;
-        const latest = this.history.versions.at(-1) ?? null;
+    /** Where `commit` came in on the first-parent line, or null when the base doesn't reach it. */
+    entryOf(commit) {
+        if (FULL_ID.test(commit))
+            return this.entryIndex().get(commit) ?? null;
         if (!this.isAncestor(commit, this.base))
-            return latest;
+            return null;
         const line = this.firstParents();
         // The oldest first-parent commit that contains `commit` is where it came in.
         let lo = 0;
@@ -281,6 +309,27 @@ export class SignerPositions {
                 hi = mid - 1;
             }
         }
+        return at;
+    }
+    /**
+     * The version that judges `commit`, or null when no signer set was in
+     * effect there (before the first one, or the chain is broken).
+     */
+    versionFor(commit) {
+        const hit = this.memo.get(commit);
+        if (hit !== undefined)
+            return hit;
+        const answer = this.lookup(commit);
+        this.memo.set(commit, answer);
+        return answer;
+    }
+    lookup(commit) {
+        if (this.history.broken)
+            return null;
+        const latest = this.history.versions.at(-1) ?? null;
+        const at = this.entryOf(commit);
+        if (at === null)
+            return latest;
         // The newest version made strictly before that commit.
         let best = null;
         let bestIndex = Infinity;

package/dist/workspace/trust/seal.d.ts

@@ -137,4 +137,15 @@ export declare function sealRecord(keyFile: string, r: {
  * {@link gateSealPayload}. Throws a {@link SealError}.
  */
 export declare function sealGateApproval(keyFile: string, a: SealedGateApproval): VerdictSeal;
+/**
+ * Sign a release cut (#4031) with the key in `keyFile`, over
+ * `releaseSealPayload` in the `chant-release` namespace. The cut line keeps
+ * the armored signature; its actor is the signer. Throws a {@link SealError}.
+ */
+export declare function sealReleaseCut(keyFile: string, cut: {
+    releaseDigest: string;
+    label: string | null;
+    actor: string;
+    timestamp: string;
+}): VerdictSeal;
 //# sourceMappingURL=seal.d.ts.map

package/dist/workspace/trust/seal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"seal.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/seal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AAG5C,OAAO,EAAmG,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEvJ,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAE7H,qDAAqD;AACrD,eAAO,MAAM,qBAAqB,iBAAiB,CAAC;AAEpD,qEAAqE;AACrE,eAAO,MAAM,qBAAqB,iBAAiB,CAAC;AAEpD,yCAAyC;AACzC,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,gHAAgH;IAChH,GAAG,EAAE,MAAM,CAAC;IACZ,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,yCAAyC;AACzC,MAAM,WAAW,SAAS;IACxB,kKAAkK;IAClK,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAC;IACzB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,sCAAsC;AACtC,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAEvH;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAE9G;AAED,gDAAgD;AAChD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,OAAO,CAAC;CACf;AAoBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,GAAG,SAAS,CAYjF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,GAAG,SAAS,CAgB/E;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,kBAAkB,GAAG,SAAS,CASnF;AAgFD,oCAAoC;AACpC,qBAAa,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,IAAI,CAAA;CAAE,CAuBzG;AAMD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAE9I;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,WAAW,CAEpI;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,kBAAkB,GAAG,WAAW,CAEpF"}
+{"version":3,"file":"seal.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/seal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AAG5C,OAAO,EAAmG,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGvJ,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAE7H,qDAAqD;AACrD,eAAO,MAAM,qBAAqB,iBAAiB,CAAC;AAEpD,qEAAqE;AACrE,eAAO,MAAM,qBAAqB,iBAAiB,CAAC;AAEpD,yCAAyC;AACzC,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,gHAAgH;IAChH,GAAG,EAAE,MAAM,CAAC;IACZ,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,yCAAyC;AACzC,MAAM,WAAW,SAAS;IACxB,kKAAkK;IAClK,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAC;IACzB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,sCAAsC;AACtC,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAEvH;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAE9G;AAED,gDAAgD;AAChD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,OAAO,CAAC;CACf;AAoBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,GAAG,SAAS,CAYjF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,GAAG,SAAS,CAgB/E;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,kBAAkB,GAAG,SAAS,CASnF;AAgFD,oCAAoC;AACpC,qBAAa,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,IAAI,CAAA;CAAE,CAuBzG;AAMD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAE9I;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,WAAW,CAEpI;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,kBAAkB,GAAG,WAAW,CAEpF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAEnJ"}

package/dist/workspace/trust/seal.js

@@ -27,6 +27,7 @@ import { homedir, tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { sshKeygen, verifySshSignature } from "./ssh-commit.js";
 import { GATE_SEAL_NAMESPACE, gateSealPayload, namespaceAllowed, sshSignatureKey, verifySshSignatureWith } from "./gate-seal.js";
+import { RELEASE_SEAL_NAMESPACE, releaseSealPayload } from "../identity-gate-rule.js";
 export { GATE_SEAL_NAMESPACE, gateSealPayload, gateSealVersion, sealedFieldsOf } from "./gate-seal.js";
 /** The ssh signature namespace of a verdict seal. */
 export const REVIEW_SEAL_NAMESPACE = "chant-review";
@@ -248,6 +249,14 @@ export function sealRecord(keyFile, r) {
 export function sealGateApproval(keyFile, a) {
     return sign(keyFile, gateSealPayload(a), GATE_SEAL_NAMESPACE, a.resolvedBy);
 }
+/**
+ * Sign a release cut (#4031) with the key in `keyFile`, over
+ * `releaseSealPayload` in the `chant-release` namespace. The cut line keeps
+ * the armored signature; its actor is the signer. Throws a {@link SealError}.
+ */
+export function sealReleaseCut(keyFile, cut) {
+    return sign(keyFile, releaseSealPayload(cut), RELEASE_SEAL_NAMESPACE, cut.actor);
+}
 function sign(keyFile, payload, namespace, signer) {
     const signed = sshKeygen(["-q", "-Y", "sign", "-n", namespace, "-f", keyFile], payload);
     if (signed.missing)

package/dist/workspace/trust/ssh-commit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssh-commit.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/ssh-commit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,KAAK,EAAsC,cAAc,EAAE,MAAM,YAAY,CAAC;AACrF,OAAO,EAAwB,KAAK,MAAM,EAAE,MAAM,UAAU,CAAC;AAI7D,uEAAuE;AACvE,MAAM,WAAW,YAAY;IAC3B,sFAAsF;IACtF,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,SAAW,GAAG,YAAY,CAsB9E;AAUD,6GAA6G;AAC7G,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAIrI;AAID;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAuBjG;AAED,eAAO,MAAM,iBAAiB,EAAE,cAiB/B,CAAC;AAeF;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAmBrE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,IAAI,CAY/G"}
+{"version":3,"file":"ssh-commit.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/ssh-commit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,KAAK,EAAsC,cAAc,EAAE,MAAM,YAAY,CAAC;AACrF,OAAO,EAAwB,KAAK,MAAM,EAAE,MAAM,UAAU,CAAC;AAI7D,uEAAuE;AACvE,MAAM,WAAW,YAAY;IAC3B,sFAAsF;IACtF,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,SAAW,GAAG,YAAY,CAsB9E;AAYD,6GAA6G;AAC7G,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAIrI;AAID;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAuBjG;AAED,eAAO,MAAM,iBAAiB,EAAE,cAgB/B,CAAC;AAeF;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAmBrE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,IAAI,CAY/G"}

package/dist/workspace/trust/ssh-commit.js

@@ -44,13 +44,14 @@ export function splitSignedCommit(raw, header = "gpgsig") {
     const payload = Buffer.concat([Buffer.from(kept.join("\n"), "latin1"), raw.subarray(headEnd)]);
     return { payload, signature: sig.length > 0 ? sig.join("\n") + "\n" : undefined };
 }
-function objectFormat(repo) {
-    try {
-        return execFileSync("git", ["rev-parse", "--show-object-format"], { cwd: repo, encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }).trim();
-    }
-    catch {
-        return "sha1";
-    }
+/**
+ * The signature header of a raw commit object, by its object format, which
+ * shows in the length of its tree id. Read from the object itself, so judging
+ * a commit starts no `git rev-parse` (#4032).
+ */
+function signatureHeader(raw) {
+    const tree = /^tree ([0-9a-f]+)$/m.exec(raw.subarray(0, 200).toString("latin1"))?.[1];
+    return tree?.length === 64 ? "gpgsig-sha256" : "gpgsig";
 }
 /** Run ssh-keygen; `missing` is true when it is not installed. Shared with the verdict seals (./seal.ts). */
 export function sshKeygen(args, input) {
@@ -101,14 +102,13 @@ export const sshCommitAttestor = {
         if (hit)
             return hit;
         const raw = execFileSync("git", ["cat-file", "commit", commit], { cwd: ctx.repo, maxBuffer: 64 * 1024 * 1024 });
-        const answer = judgeRaw(raw, objectFormat(ctx.repo) === "sha256" ? "gpgsig-sha256" : "gpgsig", signers);
+        const answer = judgeRaw(raw, signatureHeader(raw), signers);
         cache.set(memo, answer);
         return answer;
     },
     attestRaw(ctx, raw) {
         // A commit from another repository: its object format shows in its tree line.
-        const tree = /^tree ([0-9a-f]+)$/m.exec(raw.subarray(0, 200).toString("latin1"))?.[1];
-        return judgeRaw(raw, tree?.length === 64 ? "gpgsig-sha256" : "gpgsig", ctx.policy.signers);
+        return judgeRaw(raw, signatureHeader(raw), ctx.policy.signers);
     },
 };
 function judgeRaw(raw, header, signers) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.124.27",
+  "version": "0.124.28",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",