@intentius/chant 0.79.0 → 0.81.0

package/src/workspace/trust/policy.ts

@@ -0,0 +1,306 @@
+/**
+ * Trust policy, always read from the base revision (#2524 D5, Threat model;
+ * ws-001, ws-002).
+ *
+ * A check reads who may sign, and who holds which role, from the target
+ * branch tip or `--base <rev>`, never from the change under review. A change
+ * can edit its own copy of these files, and those edits have no effect until
+ * they are merged: the change is still judged by the policy at base. Editing
+ * the policy is itself a protected write (see ./verify.ts).
+ *
+ * Two files, both optional:
+ *
+ * - `.chant/allowed_signers` holds the signers, in ssh-keygen's
+ *   allowed_signers format, so `git log --show-signature` can use the same
+ *   file. `trust.json` may name another path.
+ * - `.chant/trust.json` holds the override for the signers path, the role
+ *   grants and the adopted commit ranges. Role grants move into
+ *   `chant.workspace.json` once the declaration exists (#2534).
+ *
+ * Attestation is opt-in (#2525 rule 6). Without a signers file at base,
+ * nothing is verified and every record is `unattested`.
+ */
+
+import { posix } from "node:path";
+import { z } from "zod";
+import type { RecordSource } from "../record-source";
+
+/** The trust config, relative to the repository root. Fixed: it is how the signers path is overridden. */
+export const TRUST_CONFIG_PATH = ".chant/trust.json";
+
+/** Where the signers are when `trust.json` names no other path. */
+export const DEFAULT_SIGNERS_PATH = ".chant/allowed_signers";
+
+// ── allowed_signers ──────────────────────────────────────────────────────────
+
+/** Key types ssh-keygen accepts in an allowed_signers line. */
+const KEY_TYPES = new Set([
+  "ssh-ed25519",
+  "ssh-rsa",
+  "ecdsa-sha2-nistp256",
+  "ecdsa-sha2-nistp384",
+  "ecdsa-sha2-nistp521",
+  "sk-ssh-ed25519@openssh.com",
+  "sk-ecdsa-sha2-nistp256@openssh.com",
+]);
+
+/** One usable signer: a principal and the public key it signs with. */
+export interface Signer {
+  principal: string;
+  /** `<type> <base64>`, with no comment. */
+  key: string;
+  /** The `namespaces="..."` option as written, or undefined when the key may sign any namespace. */
+  namespaces?: string;
+  /** 1-based line in the signers file. */
+  line: number;
+}
+
+/** A line of the signers file that is not used, and why. */
+export interface ExcludedSigner {
+  line: number;
+  reason: string;
+}
+
+export interface SignerSet {
+  signers: Signer[];
+  excluded: ExcludedSigner[];
+}
+
+/**
+ * Split one line into fields. Double quotes group, so an option such as
+ * `namespaces="git,file"` stays one field.
+ */
+function fields(line: string): string[] {
+  const out: string[] = [];
+  let cur = "";
+  let quoted = false;
+  let any = false;
+  for (const ch of line) {
+    if (ch === '"') {
+      quoted = !quoted;
+      cur += ch;
+      any = true;
+    } else if (!quoted && (ch === " " || ch === "\t")) {
+      if (any) out.push(cur);
+      cur = "";
+      any = false;
+    } else {
+      cur += ch;
+      any = true;
+    }
+  }
+  if (any) out.push(cur);
+  return out;
+}
+
+/** `a="x,y",b` as `{ a: "x,y", b: "" }`. */
+function options(field: string): Map<string, string> {
+  const opts = new Map<string, string>();
+  let cur = "";
+  let quoted = false;
+  const flush = () => {
+    if (!cur) return;
+    const eq = cur.indexOf("=");
+    const name = (eq < 0 ? cur : cur.slice(0, eq)).toLowerCase();
+    const value = eq < 0 ? "" : cur.slice(eq + 1).replace(/^"|"$/g, "");
+    opts.set(name, value);
+    cur = "";
+  };
+  for (const ch of field) {
+    if (ch === '"') quoted = !quoted;
+    if (ch === "," && !quoted) flush();
+    else cur += ch;
+  }
+  flush();
+  return opts;
+}
+
+/**
+ * Parse an allowed_signers file, keeping only lines whose meaning does not
+ * depend on anything the signer controls.
+ *
+ * Refused, each with a reason, rather than passed to ssh-keygen:
+ *
+ * - `valid-after` and `valid-before`. git checks them against the commit's own
+ *   date, which whoever makes the commit sets. A backdated commit would pass a
+ *   window its key has left. Revocation is by position in history (#2553),
+ *   never by date.
+ * - `cert-authority`. A certificate's validity is also a date, and a CA key
+ *   vouches for keys this file never names.
+ * - Principal patterns (`*`, `?`, `!`). A signer is named by one exact
+ *   principal, so role grants can name it.
+ */
+export function parseAllowedSigners(text: string): SignerSet {
+  const signers: Signer[] = [];
+  const excluded: ExcludedSigner[] = [];
+  const lines = text.replace(/\r\n?/g, "\n").split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = i + 1;
+    const raw = lines[i].trim();
+    if (!raw || raw.startsWith("#")) continue;
+    const f = fields(raw);
+    if (f.length < 3) {
+      excluded.push({ line, reason: "expected principals, optional options, a key type and a key" });
+      continue;
+    }
+    const [principals, second] = f;
+    const hasOptions = !KEY_TYPES.has(second);
+    const type = hasOptions ? f[2] : second;
+    const blob = hasOptions ? f[3] : f[2];
+    if (!KEY_TYPES.has(type) || !blob || !/^[A-Za-z0-9+/]+={0,2}$/.test(blob)) {
+      excluded.push({ line, reason: `no supported public key (${type ?? "none"})` });
+      continue;
+    }
+    const opts = hasOptions ? options(second) : new Map<string, string>();
+    const timed = ["valid-after", "valid-before"].filter((o) => opts.has(o));
+    if (timed.length > 0) {
+      excluded.push({
+        line,
+        reason: `${timed.join(" and ")} is checked against the commit's own date, which its author sets; revoke a key by removing it`,
+      });
+      continue;
+    }
+    if (opts.has("cert-authority")) {
+      excluded.push({ line, reason: "cert-authority keys are not supported: a certificate's validity is a date the signer controls" });
+      continue;
+    }
+    const unknown = [...opts.keys()].filter((o) => o !== "namespaces");
+    if (unknown.length > 0) {
+      excluded.push({ line, reason: `unknown option ${unknown.join(", ")}` });
+      continue;
+    }
+    const names = principals.replace(/^"|"$/g, "").split(",").filter(Boolean);
+    const pattern = names.find((p) => /[*?!]/.test(p));
+    if (pattern !== undefined || names.length === 0) {
+      excluded.push({ line, reason: `principal ${JSON.stringify(pattern ?? principals)} is a pattern; name one signer exactly` });
+      continue;
+    }
+    for (const principal of names) {
+      signers.push({ principal, key: `${type} ${blob}`, namespaces: opts.get("namespaces"), line });
+    }
+  }
+  return { signers, excluded };
+}
+
+/** The signers as an allowed_signers file ssh-keygen reads, holding only the usable lines. */
+export function renderAllowedSigners(signers: Signer[]): string {
+  return (
+    signers
+      .map((s) => `${JSON.stringify(s.principal)}${s.namespaces !== undefined ? ` namespaces=${JSON.stringify(s.namespaces)}` : ""} ${s.key}`)
+      .join("\n") + "\n"
+  );
+}
+
+// ── trust.json ───────────────────────────────────────────────────────────────
+
+const fullCommit = z.string().regex(/^[0-9a-f]{40}([0-9a-f]{24})?$/, "a full commit id");
+
+/** A repository-relative path: no `..`, not absolute, `/` separators. */
+const repoPath = z
+  .string()
+  .min(1)
+  .refine((p) => !p.startsWith("/") && !p.includes("\\") && posix.normalize(p) === p && !p.split("/").includes(".."), {
+    message: "a path inside the repository, with / separators and no ..",
+  });
+
+export const trustConfigSchema = z
+  .object({
+    schema: z.literal(1),
+    /** Where the signers file is, instead of `.chant/allowed_signers`. */
+    signers: repoPath.optional(),
+    /**
+     * Role name to the principals holding it. Until #2534 these live here;
+     * then they move into the declaration.
+     */
+    roles: z.record(z.string().regex(/^[a-z][a-z0-9-]*$/), z.array(z.string().min(1))).optional(),
+    /**
+     * Commit ranges admitted without signatures (#2524 D5, adoption). Each is
+     * exact: `to` and, when given, `from` are full commit ids, and the range is
+     * the commits `from..to`.
+     */
+    adopted: z.array(z.object({ from: fullCommit.optional(), to: fullCommit, note: z.string().optional() }).strict()).optional(),
+  })
+  .strict();
+
+export type TrustConfig = z.infer<typeof trustConfigSchema>;
+
+/** The role whose holders may change the policy. Without any grant of it, every signer may. */
+export const ADMIN_ROLE = "admin";
+
+/** The policy a check applies, as read at base. */
+export interface TrustPolicy {
+  /** The full commit id the policy was read at, or null when there is no base. */
+  base: string | null;
+  /** The signers path used. */
+  signersPath: string;
+  /** Whether a signers file exists at base. False means attestation is off. */
+  active: boolean;
+  signers: Signer[];
+  excluded: ExcludedSigner[];
+  roles: Record<string, string[]>;
+  adopted: Array<{ from?: string; to: string }>;
+  /** Why the policy could not be read, when it could not. Nothing verifies then. */
+  problems: string[];
+}
+
+/** Paths whose change is a protected write under `policy`. */
+export function protectedPaths(policy: TrustPolicy): string[] {
+  return [...new Set([TRUST_CONFIG_PATH, policy.signersPath])].sort();
+}
+
+/** Principals allowed to change the policy: the admins when any are granted, otherwise every signer. */
+export function policyWriters(policy: TrustPolicy): Set<string> {
+  const admins = policy.roles[ADMIN_ROLE];
+  if (admins && admins.length > 0) return new Set(admins);
+  return new Set(policy.signers.map((s) => s.principal));
+}
+
+/** A policy with nothing in it: attestation off. */
+export function emptyPolicy(base: string | null, problems: string[] = []): TrustPolicy {
+  return { base, signersPath: DEFAULT_SIGNERS_PATH, active: false, signers: [], excluded: [], roles: {}, adopted: [], problems };
+}
+
+/**
+ * Read the policy through `source`, which must read the base revision.
+ * Never throws: a policy that cannot be read yields an inactive policy with
+ * its problems listed, so nothing is attested (fail closed).
+ */
+export function readTrustPolicy(source: RecordSource, base: string | null): TrustPolicy {
+  let config: TrustConfig = { schema: 1 };
+  const configText = readOptional(source, TRUST_CONFIG_PATH);
+  if (configText !== undefined) {
+    let raw: unknown;
+    try {
+      raw = JSON.parse(configText);
+    } catch (err) {
+      return emptyPolicy(base, [`${TRUST_CONFIG_PATH} is not JSON: ${err instanceof Error ? err.message : String(err)}`]);
+    }
+    const parsed = trustConfigSchema.safeParse(raw);
+    if (!parsed.success) {
+      const detail = parsed.error.issues.map((i) => `${i.path.join(".") || "/"}: ${i.message}`).join("; ");
+      return emptyPolicy(base, [`${TRUST_CONFIG_PATH} is invalid: ${detail}`]);
+    }
+    config = parsed.data;
+  }
+  const signersPath = config.signers ?? DEFAULT_SIGNERS_PATH;
+  const text = readOptional(source, signersPath);
+  const set = text === undefined ? { signers: [], excluded: [] } : parseAllowedSigners(text);
+  return {
+    base,
+    signersPath,
+    active: text !== undefined,
+    signers: set.signers,
+    excluded: set.excluded,
+    roles: config.roles ?? {},
+    adopted: config.adopted ?? [],
+    problems: [],
+  };
+}
+
+/** A file's text through `source`, or undefined when it is not there. */
+export function readOptional(source: RecordSource, path: string): string | undefined {
+  const dir = posix.dirname(path);
+  const names = source.list(dir);
+  if (!names || !names.includes(posix.basename(path))) return undefined;
+  return source.read(path);
+}

package/src/workspace/trust/provenance.ts

@@ -0,0 +1,181 @@
+/**
+ * The provenance level of each record (#2524 D5, Threat model).
+ *
+ * A record's content comes from the last commit that changed its file. That
+ * commit is asked of each attestor, with the policy read at base. A file with
+ * uncommitted changes is `unattested`: its bytes are in no commit, so nothing
+ * vouches for them.
+ *
+ * On a developer machine this detects; it does not enforce (ws-002). An agent
+ * running as the developer can use an unlocked signing agent or skip the check.
+ * Enforcement is CI running the same check against base.
+ */
+
+import { execFileSync } from "node:child_process";
+import { gitRevisionSource } from "../record-source";
+import { attestCommit, type CommitAttestor, type ProvenanceLevel } from "./attestor";
+import { emptyPolicy, readTrustPolicy, type TrustPolicy } from "./policy";
+
+/** What `records` reports for one record. */
+export interface RecordProvenance {
+  level: ProvenanceLevel;
+  /** The commit the record's content comes from, or null for uncommitted content. */
+  commit: string | null;
+  attestor?: string;
+  principal?: string;
+  key?: string;
+  reason: string;
+}
+
+/** Where the base revision came from. */
+export type BaseSource = "flag" | "origin/HEAD" | "main" | "master";
+
+export interface ResolvedBase {
+  commit: string | null;
+  from: BaseSource | null;
+  /** Why there is no base, when there is none. */
+  problem?: string;
+}
+
+function git(repo: string, args: string[]): string {
+  return execFileSync("git", args, { cwd: repo, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], maxBuffer: 256 * 1024 * 1024 });
+}
+
+function tryCommit(repo: string, rev: string): string | undefined {
+  try {
+    return git(repo, ["rev-parse", "--verify", "--quiet", `${rev}^{commit}`]).trim() || undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * The base revision: `--base <rev>` when given, otherwise the target branch
+ * tip, taken as `origin/HEAD`, then a local `main`, then `master`. Never
+ * `HEAD`, which is the change under review.
+ */
+export function resolveBase(repo: string, explicit?: string): ResolvedBase {
+  if (explicit !== undefined) {
+    const c = explicit.startsWith("-") ? undefined : tryCommit(repo, explicit);
+    return c ? { commit: c, from: "flag" } : { commit: null, from: null, problem: `--base ${explicit} names no commit in this repository` };
+  }
+  for (const [rev, from] of [
+    ["refs/remotes/origin/HEAD", "origin/HEAD"],
+    ["refs/heads/main", "main"],
+    ["refs/heads/master", "master"],
+  ] as const) {
+    const c = tryCommit(repo, rev);
+    if (c) return { commit: c, from };
+  }
+  return { commit: null, from: null, problem: "no base revision: pass --base <rev> (there is no origin/HEAD, main or master)" };
+}
+
+/** The policy at `base`, or an inactive one when there is no base. */
+export function policyAtBase(repo: string, base: ResolvedBase): TrustPolicy {
+  if (!base.commit) return emptyPolicy(null, base.problem ? [base.problem] : []);
+  return readTrustPolicy(gitRevisionSource(repo, base.commit), base.commit);
+}
+
+/**
+ * The last commit reachable from `rev` that changed each path. Merges are
+ * diffed against all their parents (`-c`), so a merge that changes a file
+ * beyond what either side brought is the commit that file comes from, and a
+ * merge that only takes one side's version is passed through to that side.
+ */
+export function lastCommits(repo: string, rev: string, paths: string[]): Map<string, string> {
+  const out = new Map<string, string>();
+  if (paths.length === 0) return out;
+  const log = git(repo, ["--literal-pathspecs", "log", "-c", "--name-only", "--no-renames", "--format=%x00%H", rev, "--", ...paths]);
+  const wanted = new Set(paths);
+  let commit = "";
+  for (const line of log.split("\n")) {
+    if (line.startsWith("\0")) commit = line.slice(1).trim();
+    else if (line && wanted.has(line) && !out.has(line)) out.set(line, commit);
+  }
+  return out;
+}
+
+/** Paths with staged, unstaged or untracked changes in the working tree. */
+export function dirtyPaths(repo: string, paths: string[]): Set<string> {
+  if (paths.length === 0) return new Set();
+  const status = git(repo, ["--literal-pathspecs", "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ...paths]);
+  const dirty = new Set<string>();
+  const parts = status.split("\0");
+  for (let i = 0; i < parts.length; i++) {
+    const p = parts[i];
+    if (p.length < 4) continue;
+    dirty.add(p.slice(3));
+    if (p[0] === "R" || p[0] === "C") i++;
+  }
+  return dirty;
+}
+
+function isAncestor(repo: string, a: string, b: string): boolean {
+  try {
+    execFileSync("git", ["merge-base", "--is-ancestor", a, b], { cwd: repo, stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** Whether `commit` lies in a range the policy adopts (`from..to`, exact). */
+export function isAdopted(repo: string, policy: TrustPolicy, commit: string): boolean {
+  return policy.adopted.some((r) => isAncestor(repo, commit, r.to) && (r.from === undefined || !isAncestor(repo, commit, r.from)));
+}
+
+/** A commit's provenance level under `policy`. */
+export function commitProvenance(repo: string, policy: TrustPolicy, commit: string, attestors: readonly CommitAttestor[]): RecordProvenance {
+  const a = attestCommit({ repo, policy }, commit, attestors);
+  if (a.level === "unattested" && isAdopted(repo, policy, commit)) {
+    return { level: "adopted", commit, attestor: a.attestor, reason: `in a commit range the policy at base adopts; ${a.reason}` };
+  }
+  return {
+    level: a.level,
+    commit,
+    attestor: a.attestor,
+    ...(a.principal ? { principal: a.principal } : {}),
+    ...(a.key ? { key: a.key } : {}),
+    reason: a.reason,
+  };
+}
+
+export interface ProvenanceQuery {
+  repo: string | undefined;
+  policy: TrustPolicy;
+  /** The commit records were read at, or null for the working tree. */
+  at: string | null;
+  paths: string[];
+  attestors: readonly CommitAttestor[];
+}
+
+/**
+ * The provenance of each path. With attestation off (no signers file at
+ * base) nothing is checked and every path is `unattested`.
+ */
+export function recordProvenance(q: ProvenanceQuery): Map<string, RecordProvenance> {
+  const out = new Map<string, RecordProvenance>();
+  const all = (reason: string) => {
+    for (const p of q.paths) out.set(p, { level: "unattested", commit: null, reason });
+    return out;
+  };
+  if (!q.repo) return all("not in a git repository");
+  if (q.policy.problems.length > 0) return all(q.policy.problems.join("; "));
+  if (!q.policy.active) return all(`no signers file (${q.policy.signersPath}) at base ${q.policy.base?.slice(0, 8)}; attestation is off`);
+
+  const dirty = q.at === null ? dirtyPaths(q.repo, q.paths) : new Set<string>();
+  const commits = lastCommits(q.repo, q.at ?? "HEAD", q.paths.filter((p) => !dirty.has(p)));
+  for (const p of q.paths) {
+    if (dirty.has(p)) {
+      out.set(p, { level: "unattested", commit: null, reason: "the working tree has uncommitted changes to this file" });
+      continue;
+    }
+    const c = commits.get(p);
+    if (!c) {
+      out.set(p, { level: "unattested", commit: null, reason: "no commit holds this file" });
+      continue;
+    }
+    out.set(p, commitProvenance(q.repo, q.policy, c, q.attestors));
+  }
+  return out;
+}

package/src/workspace/trust/ssh-commit.ts

@@ -0,0 +1,138 @@
+/**
+ * The first attestor: ssh-signed commits, checked against the signers the
+ * base policy lists (#2524 D5, ws-001).
+ *
+ * It does not ask `git verify-commit`. That would read `gpg.ssh.program`,
+ * `gpg.ssh.allowedSignersFile` and the rest from git config, which whoever
+ * controls the machine can set, and it passes the commit's own date to
+ * ssh-keygen as the verification time. Instead it takes the signature and the
+ * signed payload out of the commit object itself and hands them to
+ * `ssh-keygen -Y verify` with a signers file built from the base policy, in
+ * the `git` namespace.
+ */
+
+import { execFileSync, spawnSync } from "node:child_process";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { AttestorContext, CommitAttestation, CommitAttestor } from "./attestor";
+import { renderAllowedSigners, type Signer } from "./policy";
+
+const NAME = "ssh-commit";
+
+/** A commit object split into its signed payload and its signature. */
+export interface SignedCommit {
+  /** The bytes the signature covers: the commit object without its signature header. */
+  payload: Buffer;
+  /** The armored signature, or undefined when the commit is unsigned. */
+  signature?: string;
+}
+
+/**
+ * Split a raw commit object. `header` is `gpgsig` in a SHA-1 repository and
+ * `gpgsig-sha256` in a SHA-256 one; git removes exactly that header, with its
+ * continuation lines, to get the bytes it signed.
+ */
+export function splitSignedCommit(raw: Buffer, header = "gpgsig"): SignedCommit {
+  const end = raw.indexOf("\n\n");
+  const headEnd = end < 0 ? raw.length : end;
+  const head = raw.subarray(0, headEnd).toString("latin1").split("\n");
+  const kept: string[] = [];
+  const sig: string[] = [];
+  let inSig = false;
+  for (const line of head) {
+    if (inSig && line.startsWith(" ")) {
+      sig.push(line.slice(1));
+      continue;
+    }
+    inSig = false;
+    if (sig.length === 0 && line.startsWith(`${header} `)) {
+      inSig = true;
+      sig.push(line.slice(header.length + 1));
+      continue;
+    }
+    kept.push(line);
+  }
+  const payload = Buffer.concat([Buffer.from(kept.join("\n"), "latin1"), raw.subarray(headEnd)]);
+  return { payload, signature: sig.length > 0 ? sig.join("\n") + "\n" : undefined };
+}
+
+function objectFormat(repo: string): string {
+  try {
+    return execFileSync("git", ["rev-parse", "--show-object-format"], { cwd: repo, encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+  } catch {
+    return "sha1";
+  }
+}
+
+/** Run ssh-keygen; `missing` is true when it is not installed. */
+function sshKeygen(args: string[], input?: Buffer): { status: number | null; stdout: string; stderr: string; missing: boolean } {
+  const r = spawnSync("ssh-keygen", args, { input, encoding: "buffer", timeout: 30_000 });
+  const missing = (r.error as NodeJS.ErrnoException | undefined)?.code === "ENOENT";
+  return { status: r.status, stdout: r.stdout?.toString("utf-8") ?? "", stderr: r.stderr?.toString("utf-8") ?? "", missing };
+}
+
+const cache = new Map<string, CommitAttestation>();
+
+/**
+ * Check a detached ssh signature over `payload` in `namespace` against
+ * `signers`. Shared with the rotation check (#2553), which signs signer sets
+ * in their own namespace so a commit signature can never stand in for one.
+ */
+export function verifySshSignature(
+  signers: Signer[],
+  payload: Buffer,
+  signature: string,
+  namespace: string,
+): { ok: true; principal: string; key?: string } | { ok: false; missing: boolean; reason: string } {
+  if (signers.length === 0) return { ok: false, missing: false, reason: "the policy lists no usable signer" };
+  const dir = mkdtempSync(join(tmpdir(), "chant-trust-"));
+  try {
+    const allowed = join(dir, "allowed_signers");
+    const sigFile = join(dir, "signature");
+    writeFileSync(allowed, renderAllowedSigners(signers));
+    writeFileSync(sigFile, signature);
+    const found = sshKeygen(["-Y", "find-principals", "-f", allowed, "-s", sigFile]);
+    if (found.missing) return { ok: false, missing: true, reason: "ssh-keygen is not installed here" };
+    const principals = found.status === 0 ? found.stdout.split("\n").map((l) => l.trim()).filter(Boolean) : [];
+    if (principals.length === 0) return { ok: false, missing: false, reason: "signed by a key the policy at base does not list" };
+    for (const principal of principals) {
+      const v = sshKeygen(["-Y", "verify", "-f", allowed, "-I", principal, "-n", namespace, "-s", sigFile], payload);
+      if (v.status === 0) {
+        const key = /key (SHA256:[A-Za-z0-9+/=]+)/.exec(v.stdout + v.stderr)?.[1];
+        return { ok: true, principal, ...(key ? { key } : {}) };
+      }
+    }
+    return { ok: false, missing: false, reason: `the signature does not verify in the ${namespace} namespace for a key the policy lists` };
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+export const sshCommitAttestor: CommitAttestor = {
+  name: NAME,
+  attestCommit(ctx: AttestorContext, commit: string): CommitAttestation {
+    const signers = ctx.policy.signers;
+    const memo = `${ctx.repo}\0${commit}\0${renderAllowedSigners(signers)}`;
+    const hit = cache.get(memo);
+    if (hit) return hit;
+    const answer = attest(ctx.repo, commit, signers);
+    cache.set(memo, answer);
+    return answer;
+  },
+};
+
+function attest(repo: string, commit: string, signers: Signer[]): CommitAttestation {
+  const raw = execFileSync("git", ["cat-file", "commit", commit], { cwd: repo, maxBuffer: 64 * 1024 * 1024 });
+  const header = objectFormat(repo) === "sha256" ? "gpgsig-sha256" : "gpgsig";
+  const { payload, signature } = splitSignedCommit(raw, header);
+  if (!signature) return { level: "unattested", attestor: NAME, reason: "the commit is not signed" };
+  if (!signature.startsWith("-----BEGIN SSH SIGNATURE-----")) {
+    const format = signature.startsWith("-----BEGIN PGP SIGNATURE-----") ? "an OpenPGP" : "a non-ssh";
+    return { level: "attested-unverifiable-here", attestor: NAME, reason: `the commit carries ${format} signature, which this attestor does not check` };
+  }
+  const r = verifySshSignature(signers, payload, signature, "git");
+  if (r.ok) return { level: "attested", attestor: NAME, principal: r.principal, ...(r.key ? { key: r.key } : {}), reason: `signed by ${r.principal}` };
+  if (r.missing) return { level: "attested-unverifiable-here", attestor: NAME, reason: r.reason };
+  return { level: "unattested", attestor: NAME, reason: r.reason };
+}