@kungfu-tech/buildchain 2.12.7-alpha.6 → 2.12.7-alpha.8

package/packages/core/publication-control-plane-audit.js

@@ -16,6 +16,7 @@ export function evaluatePublicationControlPlaneSnapshot({
   branch,
   packageName,
   publisherMode = "npm-trusted-publisher",
+  requiredStatusCheck = "check",
   snapshot,
   observedAt,
   expiresAt,
@@ -72,7 +73,8 @@ export function evaluatePublicationControlPlaneSnapshot({
     branchPolicy.protected === true &&
     branchPolicy.enforcementLevel === "everyone" &&
     Array.isArray(branchPolicy.requiredStatusChecks) &&
-    branchPolicy.requiredStatusChecks.includes("check") &&
+    branchPolicy.requiredStatusCheck === requiredStatusCheck &&
+    branchPolicy.requiredStatusChecks.includes(requiredStatusCheck) &&
     branchPolicy.requiredCheckPassed === true &&
     branchPolicy.sourceSha === branchPolicy.headSha &&
     branchPolicy.mergedPullRequest === true &&

package/scripts/assemble-publication-artifact-admission.mjs

@@ -0,0 +1,190 @@
+#!/usr/bin/env node
+import crypto from "node:crypto";
+import fs from "node:fs";
+import { execFileSync } from "node:child_process";
+import path from "node:path";
+
+import {
+  createPublicationAdmission,
+  createPublicationGateDecision,
+  createRunnerProvenance,
+} from "../packages/core/publication-authority.js";
+import { buildPublicationArtifactCandidate } from "./publication-artifact-candidate.mjs";
+
+function required(name) {
+  const value = String(process.env[name] || "").trim();
+  if (!value) throw new Error(`${name} is required`);
+  return value;
+}
+
+function sha256(value) {
+  return crypto.createHash("sha256").update(String(value)).digest("hex");
+}
+
+async function sourceTree(repository, sourceSha, token) {
+  const response = await fetch(
+    `${required("GITHUB_API_URL")}/repos/${repository}/git/commits/${sourceSha}`,
+    {
+      headers: {
+        accept: "application/vnd.github+json",
+        authorization: `Bearer ${token}`,
+        "x-github-api-version": "2022-11-28",
+      },
+    },
+  );
+  if (!response.ok)
+    throw new Error(
+      `could not resolve admitted source tree: GitHub API ${response.status}`,
+    );
+  const commit = await response.json();
+  return String(commit.tree?.sha || "").toLowerCase();
+}
+
+function writeBundle(outputDir, values) {
+  fs.mkdirSync(outputDir, { recursive: true });
+  for (const [name, value] of Object.entries(values)) {
+    fs.writeFileSync(
+      path.join(outputDir, `${name}.json`),
+      `${JSON.stringify(value, null, 2)}\n`,
+    );
+  }
+  if (process.env.GITHUB_OUTPUT) {
+    const output = fs.createWriteStream(process.env.GITHUB_OUTPUT, {
+      flags: "a",
+    });
+    for (const [name, value] of Object.entries(values)) {
+      if (name === "candidate") continue;
+      output.write(
+        `${name.replaceAll("_", "-")}-json=${JSON.stringify(value)}\n`,
+      );
+    }
+    output.end();
+  }
+}
+
+async function main() {
+  const repository = required("BUILDCHAIN_REPOSITORY");
+  const sourceSha = required("BUILDCHAIN_SOURCE_SHA").toLowerCase();
+  const runtimeRoot =
+    process.env.BUILDCHAIN_RUNTIME_ROOT || ".buildchain/authority-runtime";
+  const runtimeSha = execFileSync(
+    "git",
+    ["-C", runtimeRoot, "rev-parse", "HEAD"],
+    { encoding: "utf8" },
+  )
+    .trim()
+    .toLowerCase();
+  const token = required("GITHUB_TOKEN");
+  const treeSha = await sourceTree(repository, sourceSha, token);
+  const candidateBundle = buildPublicationArtifactCandidate({
+    artifactRoot:
+      process.env.BUILDCHAIN_ARTIFACT_ROOT ||
+      ".buildchain/publication-evidence/artifact",
+    controllerRoot:
+      process.env.BUILDCHAIN_CONTROLLER_ROOT ||
+      ".buildchain/publication-evidence/controller",
+    repository,
+    sourceSha,
+    sourceTreeSha: treeSha,
+    runtimeSha,
+  });
+  const controllerReceipt = candidateBundle.evidence.controllerReceipt;
+  const controlPlaneAudit = JSON.parse(
+    fs.readFileSync(required("BUILDCHAIN_CONTROL_PLANE_AUDIT_PATH"), "utf8"),
+  );
+  const registry = JSON.parse(
+    fs.readFileSync(
+      path.join(runtimeRoot, "dist/site/publication-authority-registry.json"),
+      "utf8",
+    ),
+  );
+  const gateAggregate = createPublicationGateDecision({
+    sourceSha,
+    profile: process.env.BUILDCHAIN_GATE_PROFILE || "managed-paper-publication",
+    required: false,
+    rationale:
+      process.env.BUILDCHAIN_GATE_RATIONALE ||
+      "The managed paper repository declares no project-specific Shifu Gate registry.",
+    policy: { scope: "managed-paper-publication", repository },
+  });
+  const runnerProvenance = createRunnerProvenance({
+    runnerClass: "ephemeral",
+    os: required("RUNNER_OS"),
+    architecture: required("RUNNER_ARCH"),
+    imageDigest: sha256(
+      `${process.env.ImageOS || "unknown"}|${process.env.ImageVersion || "unknown"}`,
+    ),
+    measurementDigest: sha256(
+      [
+        process.env.GITHUB_WORKFLOW,
+        process.env.GITHUB_JOB,
+        process.env.GITHUB_RUN_ID,
+        process.env.GITHUB_RUN_ATTEMPT,
+        process.env.RUNNER_ENVIRONMENT,
+      ].join("|"),
+    ),
+    isolation: "github-hosted-single-job",
+  });
+  const issuedAt = new Date();
+  const admission = createPublicationAdmission({
+    registryDigest: registry.registryDigest,
+    workflowPath:
+      process.env.BUILDCHAIN_AUTHORITY_WORKFLOW_PATH ||
+      ".github/workflows/paper-release-sealed.yml",
+    publisherWorkflowPath: required("BUILDCHAIN_PUBLISHER_WORKFLOW_PATH"),
+    repository,
+    sourceSha,
+    runtimeSha,
+    contractDigest: controllerReceipt.runtime?.contractDigest,
+    policyDigest: gateAggregate.policyDigest,
+    controllerReceiptDigest: controllerReceipt.digest,
+    runnerProvenanceDigest: runnerProvenance.receiptDigest,
+    controlPlaneAuditDigest: controlPlaneAudit.receiptDigest,
+    gateAggregateDigest: gateAggregate.digest,
+    environment: "none",
+    product: required("BUILDCHAIN_PUBLICATION_PRODUCT"),
+    target: required("BUILDCHAIN_PUBLICATION_TARGET"),
+    version: required("BUILDCHAIN_PUBLICATION_VERSION"),
+    channel: required("BUILDCHAIN_PUBLICATION_CHANNEL"),
+    artifactDigest: candidateBundle.candidate.candidateDigest,
+    nonce: `${required("GITHUB_RUN_ID")}:${required("GITHUB_RUN_ATTEMPT")}:${sourceSha}:paper`,
+    issuedAt: issuedAt.toISOString(),
+    expiresAt: new Date(issuedAt.getTime() + 10 * 60 * 1000).toISOString(),
+  });
+  const bindingNames = [
+    "repository",
+    "publisherWorkflowPath",
+    "sourceSha",
+    "runtimeSha",
+    "contractDigest",
+    "policyDigest",
+    "controllerReceiptDigest",
+    "gateAggregateDigest",
+    "environment",
+    "product",
+    "target",
+    "version",
+    "channel",
+    "artifactDigest",
+  ];
+  const expected = Object.fromEntries(
+    bindingNames.map((name) => [name, admission[name]]),
+  );
+  writeBundle(
+    process.env.BUILDCHAIN_OUTPUT_DIR ||
+      ".buildchain/publication-authority/auto",
+    {
+      admission,
+      runner_provenance: runnerProvenance,
+      control_plane_audit: controlPlaneAudit,
+      gate_aggregate: gateAggregate,
+      expected,
+      candidate: candidateBundle.candidate,
+    },
+  );
+}
+
+main().catch((error) => {
+  console.error(`assemble publication artifact admission: ${error.message}`);
+  process.exitCode = 1;
+});

package/scripts/audit-publication-control-plane.mjs

@@ -191,6 +191,7 @@ function main() {
   const workflowPath = flag("workflow", ".github/workflows/release-candidate-promote.yml");
   const workflowRef = flag("workflow-ref");
   const publisherWorkflowPath = flag("publisher-workflow", workflowPath);
+  const requiredStatusCheck = flag("required-status-check", "check");
   const jobId = flag("job", "promote");
   const environment = flag("environment", "none");
   const providerEnvironment = environment === "none" ? "" : environment;
@@ -280,15 +281,16 @@ function main() {
     const checkRuns = githubJson(`repos/${repository}/commits/${sourceSha}/check-runs?per_page=100`, "source check runs");
     const requiredStatusCheckPolicy = branchState.protection?.required_status_checks || {};
     const requiredStatusChecks = requiredStatusCheckPolicy.contexts || [];
-    const requiredCheckSource = (requiredStatusCheckPolicy.checks || []).find((entry) => entry.context === "check");
+    const requiredCheckSource = (requiredStatusCheckPolicy.checks || []).find((entry) => entry.context === requiredStatusCheck);
     branchPolicy = {
       ref: branch,
       policyMode: "provider-enforced-transaction",
       protected: branchState.protected === true,
       enforcementLevel: branchState.protection?.required_status_checks?.enforcement_level || "",
       requiredStatusChecks,
+      requiredStatusCheck,
       requiredCheckPassed: (checkRuns.check_runs || []).some((entry) =>
-        entry.name === "check" &&
+        entry.name === requiredStatusCheck &&
         entry.conclusion === "success" &&
         (!requiredCheckSource?.app_id || entry.app?.id === requiredCheckSource.app_id)
       ),
@@ -350,6 +352,7 @@ function main() {
     branch,
     packageName,
     publisherMode,
+    requiredStatusCheck,
     observedAt: observedAt.toISOString(),
     expiresAt: expiresAt.toISOString(),
     snapshot: {

package/scripts/publication-artifact-candidate.mjs

@@ -0,0 +1,125 @@
+#!/usr/bin/env node
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+import { createPublicationArtifactCandidate } from "../packages/core/publication-artifact-candidate.js";
+
+function flag(name, fallback = "") {
+  const index = process.argv.indexOf(`--${name}`);
+  return index === -1 ? fallback : String(process.argv[index + 1] || "");
+}
+
+function requiredFlag(name) {
+  const value = flag(name).trim();
+  if (!value) throw new Error(`--${name} is required`);
+  return value;
+}
+
+function filesNamed(root, name) {
+  const matches = [];
+  const pending = [path.resolve(root)];
+  while (pending.length > 0) {
+    const current = pending.pop();
+    for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+      const full = path.join(current, entry.name);
+      if (entry.isDirectory()) pending.push(full);
+      else if (entry.isFile() && entry.name === name) matches.push(full);
+    }
+  }
+  return matches.sort();
+}
+
+function oneJson(root, name) {
+  const matches = filesNamed(root, name);
+  if (matches.length !== 1)
+    throw new Error(
+      `expected exactly one ${name} under ${root}, found ${matches.length}`,
+    );
+  return JSON.parse(fs.readFileSync(matches[0], "utf8"));
+}
+
+function collectFiles(root) {
+  const absoluteRoot = path.resolve(root);
+  const files = [];
+  const pending = [absoluteRoot];
+  while (pending.length > 0) {
+    const current = pending.pop();
+    for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+      const full = path.join(current, entry.name);
+      if (entry.isDirectory()) pending.push(full);
+      else if (entry.isFile()) {
+        files.push({
+          path: path.relative(absoluteRoot, full).split(path.sep).join("/"),
+          size: fs.statSync(full).size,
+          sha256: crypto
+            .createHash("sha256")
+            .update(fs.readFileSync(full))
+            .digest("hex"),
+        });
+      }
+    }
+  }
+  return files.sort((left, right) => left.path.localeCompare(right.path));
+}
+
+export function buildPublicationArtifactCandidate({
+  artifactRoot,
+  controllerRoot,
+  repository,
+  sourceSha,
+  sourceTreeSha,
+  runtimeSha,
+} = {}) {
+  const resolvedArtifactRoot = path.resolve(artifactRoot);
+  const resolvedControllerRoot = path.resolve(controllerRoot);
+  const evidence = {
+    repository,
+    sourceSha,
+    sourceTreeSha,
+    runtimeSha,
+    manifest: oneJson(resolvedArtifactRoot, "publication-artifact.json"),
+    passport: oneJson(
+      resolvedArtifactRoot,
+      "publication-artifact-passport.json",
+    ),
+    controllerReceipt: oneJson(resolvedControllerRoot, "receipt.json"),
+    files: collectFiles(resolvedArtifactRoot),
+  };
+  const candidate = createPublicationArtifactCandidate(evidence);
+  return { schemaVersion: 1, candidate, evidence };
+}
+
+function main() {
+  const result = buildPublicationArtifactCandidate({
+    artifactRoot: requiredFlag("artifact-root"),
+    controllerRoot: requiredFlag("controller-root"),
+    repository: requiredFlag("repository"),
+    sourceSha: requiredFlag("source-sha"),
+    sourceTreeSha: requiredFlag("source-tree-sha"),
+    runtimeSha: requiredFlag("runtime-sha"),
+  });
+  const output = flag("output");
+  if (output) {
+    fs.mkdirSync(path.dirname(path.resolve(output)), { recursive: true });
+    fs.writeFileSync(
+      path.resolve(output),
+      `${JSON.stringify(result, null, 2)}\n`,
+    );
+  }
+  if (process.argv.includes("--json") || !output)
+    process.stdout.write(`${JSON.stringify(result)}\n`);
+}
+
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(process.argv[1]).href
+) {
+  try {
+    main();
+  } catch (error) {
+    console.error(`publication artifact candidate: ${error.message}`);
+    process.exitCode = 1;
+  }
+}