@kungfu-tech/buildchain 2.14.17-alpha.5 → 2.14.17-alpha.6

package/packages/core/controller-evidence.js

@@ -22,16 +22,23 @@ const CONTROLLER_SPECS = [
     id: "build-lifecycle",
     workflowId: ".build",
     version: 1,
-    capabilities: ["source-lock", "lifecycle-build", "lifecycle-verify", "artifact-admission"],
+    capabilities: [
+      "source-lock",
+      "lifecycle-build",
+      "credential-island",
+      "lifecycle-verify",
+      "artifact-admission",
+    ],
     stages: [
       "resolve-runtime",
       "resolve-source",
       "anchored-release-preflight",
       "build",
+      "credential-island",
       "verify",
       "aggregate",
     ],
-    optionalStages: ["anchored-release-preflight"],
+    optionalStages: ["anchored-release-preflight", "credential-island"],
     evidence: [
       "platform-manifests",
       "build-summary",

package/scripts/aggregate-build-summary.mjs

@@ -13,13 +13,18 @@ export function aggregateBuildSummaryCli() {
   const outputPath = path.resolve(readEnv("BUILDCHAIN_SUMMARY_OUTPUT", ".buildchain/artifacts/build-summary.json"));
   const artifactName = readEnv("BUILDCHAIN_ARTIFACT_NAME", "buildchain-artifact");
   const expectedPlatformCount = Number(readEnv("BUILDCHAIN_PLATFORM_COUNT", "0"));
+  const additionalPlatformCount = Number(readEnv("BUILDCHAIN_ADDITIONAL_PLATFORM_COUNT", "0"));
+  if (!Number.isInteger(additionalPlatformCount) || additionalPlatformCount < 0) {
+    throw new Error("BUILDCHAIN_ADDITIONAL_PLATFORM_COUNT must be a non-negative integer");
+  }
+  const expectedManifestCount = expectedPlatformCount + additionalPlatformCount;
   const manifestFiles = findJsonFiles(inputRoot)
     .filter((file) => path.basename(file) === "manifest.json")
     .sort();
   const manifests = manifestFiles.map((file) => JSON.parse(fs.readFileSync(file, "utf8")));
-  if (expectedPlatformCount > 0 && manifests.length !== expectedPlatformCount) {
+  if (expectedManifestCount > 0 && manifests.length !== expectedManifestCount) {
     throw new Error(
-      `expected ${expectedPlatformCount} platform manifests, found ${manifests.length} under ${inputRoot}`,
+      `expected ${expectedManifestCount} platform manifests, found ${manifests.length} under ${inputRoot}`,
     );
   }
   const summary = {

package/scripts/check-inventory.mjs

@@ -59,6 +59,7 @@ const requiredPaths = [
   "scripts/generate-site-bundle.mjs",
   "scripts/generate-buildchain-kfd-witnesses.mjs",
   "scripts/generate-release-candidate-passport.mjs",
+  "scripts/seal-macos-credential-input.mjs",
   "scripts/shifu-gate-profile.mjs",
   "scripts/artifact-relay-s3.mjs",
   "scripts/anchored-version-material.mjs",

package/scripts/generate-channel-build-workflow.mjs

@@ -54,7 +54,15 @@ function routerOutputs(outputBlock) {
     .replace("value: ${{ jobs.build.outputs.controller-receipt-artifact }}", "value: ${{ jobs.controller-receipt.outputs.controller-receipt-artifact }}")
     .replace("value: ${{ jobs.build.outputs.controller-receipt-json }}", "value: ${{ jobs.controller-receipt.outputs.controller-receipt-json }}")
     .replace("value: ${{ jobs.build.outputs.controller-receipt-digest }}", "value: ${{ jobs.controller-receipt.outputs.controller-receipt-digest }}")
-    .replace("value: ${{ jobs.build.outputs.controller-receipt-status }}", "value: ${{ jobs.controller-receipt.outputs.controller-receipt-status }}");
+    .replace("value: ${{ jobs.build.outputs.controller-receipt-status }}", "value: ${{ jobs.controller-receipt.outputs.controller-receipt-status }}")
+    .replace(
+      /(      credential-island-macos-artifact:\n(?:        .*\n)*?        value:) \$\{\{ jobs\.build\.outputs\.artifact-name \}\}/,
+      "$1 ${{ jobs.build.outputs.credential-island-macos-artifact }}",
+    )
+    .replace(
+      /(      credential-island-macos-manifest-artifact:\n(?:        .*\n)*?        value:) \$\{\{ jobs\.build\.outputs\.manifest-artifact-name \}\}/,
+      "$1 ${{ jobs.build.outputs.credential-island-macos-manifest-artifact }}",
+    );
   return [
     "      buildchain-channel:",
     '        description: "Resolved Buildchain channel: alpha, stable, or override"',
@@ -287,6 +295,10 @@ function bindRouterCheckoutToWorkflowSha(workflow) {
 
 export function generateChannelBuildWorkflow(source) {
   const generated = bindRouterCheckoutToWorkflowSha(generateChannelBuildWorkflowBase(source))
+    .replace(
+      "\npermissions:\n  contents: read\n",
+      "\npermissions:\n  actions: read\n  contents: read\n",
+    )
     .replace(
       "      contract-lock-path: ${{ steps.lock.outputs.path }}\n",
       [
@@ -301,6 +313,10 @@ export function generateChannelBuildWorkflow(source) {
     .replace(
       "    needs: resolve-channel\n    uses: ./.github/workflows/.build.yml",
       "    needs:\n      - resolve-channel\n      - controller-plan\n    uses: ./.github/workflows/.build.yml",
+    )
+    .replace(
+      "    uses: ./.github/workflows/.build.yml\n    permissions:\n      contents: read\n",
+      "    uses: ./.github/workflows/.build.yml\n    permissions:\n      actions: read\n      contents: read\n",
     );
   return `${generated.trimEnd()}\n\n${routerControllerReceiptJob()}\n\n${routerAggregateJob()}\n`;
 }

package/scripts/seal-macos-credential-input.mjs

@@ -0,0 +1,135 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+import {
+  INPUT_CONTRACT,
+  assertContainedSymlinks,
+  assertRealPathInside,
+  requireRepository,
+  requireSha,
+  resolveInside,
+  sha256File,
+} from "../actions/macos-credential-island/lib.js";
+
+function env(name) {
+  const value = String(process.env[name] || "").trim();
+  if (!value) throw new Error(`${name} is required`);
+  return value;
+}
+
+function run(command, args) {
+  const result = spawnSync(command, args, {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  if (result.error || result.status !== 0) {
+    throw (
+      result.error ||
+      new Error(
+        `${path.basename(command)} failed with status ${result.status}: ${(result.stderr || result.stdout || "").trim().slice(0, 1200)}`,
+      )
+    );
+  }
+  return `${result.stdout || ""}${result.stderr || ""}`.trim();
+}
+
+function plistValue(appPath, key) {
+  return run("/usr/bin/plutil", [
+    "-extract",
+    key,
+    "raw",
+    "-o",
+    "-",
+    path.join(appPath, "Contents", "Info.plist"),
+  ]);
+}
+
+export function sealMacosCredentialInput() {
+  if (process.platform !== "darwin")
+    throw new Error("credential input sealing requires macOS");
+  const workspace = path.resolve(process.cwd());
+  const appPath = resolveInside(
+    workspace,
+    env("BUILDCHAIN_CREDENTIAL_ISLAND_APP_PATH"),
+    "credential island app path",
+  );
+  if (!fs.statSync(appPath).isDirectory() || !appPath.endsWith(".app")) {
+    throw new Error("credential island app path must name one .app directory");
+  }
+  assertRealPathInside(workspace, appPath, "credential island app path");
+  assertContainedSymlinks(appPath);
+  const repository = requireRepository(env("BUILDCHAIN_SOURCE_REPOSITORY"));
+  const sourceSha = requireSha(env("BUILDCHAIN_SOURCE_SHA"), "source SHA");
+  const treeSha = requireSha(
+    env("BUILDCHAIN_SOURCE_TREE_SHA"),
+    "source tree SHA",
+  );
+  const platformId = env("BUILDCHAIN_PLATFORM_ID");
+  const arch = process.arch;
+  if (!["arm64", "x64"].includes(arch))
+    throw new Error(`unsupported macOS architecture: ${arch}`);
+  const outputRoot = path.resolve(env("BUILDCHAIN_CREDENTIAL_ISLAND_OUTPUT"));
+  const relativeOutput = path.relative(workspace, outputRoot);
+  if (
+    !relativeOutput ||
+    relativeOutput.startsWith("..") ||
+    path.isAbsolute(relativeOutput)
+  ) {
+    throw new Error(
+      "credential island output must stay inside the build workspace",
+    );
+  }
+  fs.mkdirSync(outputRoot, { recursive: true });
+  const archivePath = path.join(outputRoot, "unsigned-app.zip");
+  run("/usr/bin/ditto", [
+    "-c",
+    "-k",
+    "--sequesterRsrc",
+    "--keepParent",
+    appPath,
+    archivePath,
+  ]);
+  const archive = {
+    file: path.basename(archivePath),
+    format: "ditto-zip",
+    bytes: fs.statSync(archivePath).size,
+    sha256: sha256File(archivePath),
+  };
+  const manifest = {
+    schema: INPUT_CONTRACT,
+    sealedAt: new Date().toISOString(),
+    source: { repository, sha: sourceSha, treeSha },
+    platform: { id: platformId, os: "macos", arch },
+    app: {
+      archivePath: path.basename(appPath),
+      bundleId: plistValue(appPath, "CFBundleIdentifier"),
+      productName: plistValue(appPath, "CFBundleName"),
+      version: plistValue(appPath, "CFBundleShortVersionString"),
+      buildVersion: plistValue(appPath, "CFBundleVersion"),
+    },
+    archive,
+  };
+  const manifestPath = path.join(outputRoot, "credential-input.json");
+  fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
+  process.stdout.write(
+    `${JSON.stringify({ manifestPath, archivePath, archive })}\n`,
+  );
+  return manifest;
+}
+
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(process.argv[1]).href
+) {
+  try {
+    sealMacosCredentialInput();
+  } catch (error) {
+    console.error(
+      `::error::${String(error?.message || error).replace(/\r?\n/gu, "%0A")}`,
+    );
+    process.exitCode = 1;
+  }
+}