@kungfu-tech/buildchain 2.14.17-alpha.9 → 2.14.17

package/packages/core/controller-evidence.js

@@ -22,23 +22,16 @@ const CONTROLLER_SPECS = [
     id: "build-lifecycle",
     workflowId: ".build",
     version: 1,
-    capabilities: [
-      "source-lock",
-      "lifecycle-build",
-      "credential-island",
-      "lifecycle-verify",
-      "artifact-admission",
-    ],
+    capabilities: ["source-lock", "lifecycle-build", "lifecycle-verify", "artifact-admission"],
     stages: [
       "resolve-runtime",
       "resolve-source",
       "anchored-release-preflight",
       "build",
-      "credential-island",
       "verify",
       "aggregate",
     ],
-    optionalStages: ["anchored-release-preflight", "credential-island"],
+    optionalStages: ["anchored-release-preflight"],
     evidence: [
       "platform-manifests",
       "build-summary",

package/packages/core/kfd3-surface-register.js

@@ -124,50 +124,6 @@ function normalizeRegistrySurface(entry) {
   };
 }
 
-function globPatternRegExp(pattern) {
-  const normalized = String(pattern || "").replaceAll("\\", "/");
-  let source = "";
-  for (let index = 0; index < normalized.length; index += 1) {
-    const character = normalized[index];
-    if (character === "*" && normalized[index + 1] === "*") {
-      source += ".*";
-      index += 1;
-    } else if (character === "*") {
-      source += "[^/]*";
-    } else if (character === "?") {
-      source += "[^/]";
-    } else {
-      source += character.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    }
-  }
-  return new RegExp(`^${source}$`);
-}
-
-function distributionBindings(registry, detectedSurfaces) {
-  return detectedSurfaces.flatMap((detected) =>
-    registry.surfaces.flatMap((declared) =>
-      (declared.distribution?.artifacts || [])
-        .filter(
-          (artifact) =>
-            normalizeKind(artifact.kind) === detected.kind &&
-            globPatternRegExp(artifact.pathGlob).test(
-              String(detected.artifactPath || "").replaceAll("\\", "/"),
-            ),
-        )
-        .map((artifact) => ({
-          detectedSurfaceId: detected.id,
-          declaredSurfaceId: declared.id,
-          artifact: {
-            kind: artifact.kind,
-            platform: artifact.platform,
-            pathGlob: artifact.pathGlob,
-            ...(artifact.sha256 ? { sha256: artifact.sha256 } : {}),
-          },
-        })),
-    ),
-  );
-}
-
 function stableId(value) {
   return String(value || "")
     .toLowerCase()
@@ -551,11 +507,7 @@ export function auditKfd3Surfaces({
   const registry = readKfd3SurfaceRegistry({ cwd, registryPath });
   const detectedIds = new Set(detection.surfaces.map((entry) => entry.id));
   const declaredIds = new Set(registry.surfaces.map((entry) => entry.id));
-  const bindings = distributionBindings(registry, detection.surfaces);
-  const distributedIds = new Set(bindings.map((entry) => entry.detectedSurfaceId));
-  const detectedButUnregistered = detection.surfaces.filter(
-    (entry) => !declaredIds.has(entry.id) && !distributedIds.has(entry.id),
-  );
+  const detectedButUnregistered = detection.surfaces.filter((entry) => !declaredIds.has(entry.id));
   const declaredButMissing = registry.surfaces.filter((entry) => !detectedIds.has(entry.id));
   const enforced = registry.surfaces.filter((entry) => entry.state === "enforced" || entry.enforcement === "enforced");
   const issues = [
@@ -591,12 +543,10 @@ export function auditKfd3Surfaces({
       detected: detection.surfaces,
       declared: registry.surfaces,
       enforced,
-      distributionBindings: bindings,
     },
     comparison: {
       detectedButUnregistered,
       declaredButMissing,
-      distributionBindings: bindings,
     },
     issues,
   };

package/scripts/aggregate-build-summary.mjs

@@ -13,18 +13,13 @@ export function aggregateBuildSummaryCli() {
   const outputPath = path.resolve(readEnv("BUILDCHAIN_SUMMARY_OUTPUT", ".buildchain/artifacts/build-summary.json"));
   const artifactName = readEnv("BUILDCHAIN_ARTIFACT_NAME", "buildchain-artifact");
   const expectedPlatformCount = Number(readEnv("BUILDCHAIN_PLATFORM_COUNT", "0"));
-  const additionalPlatformCount = Number(readEnv("BUILDCHAIN_ADDITIONAL_PLATFORM_COUNT", "0"));
-  if (!Number.isInteger(additionalPlatformCount) || additionalPlatformCount < 0) {
-    throw new Error("BUILDCHAIN_ADDITIONAL_PLATFORM_COUNT must be a non-negative integer");
-  }
-  const expectedManifestCount = expectedPlatformCount + additionalPlatformCount;
   const manifestFiles = findJsonFiles(inputRoot)
     .filter((file) => path.basename(file) === "manifest.json")
     .sort();
   const manifests = manifestFiles.map((file) => JSON.parse(fs.readFileSync(file, "utf8")));
-  if (expectedManifestCount > 0 && manifests.length !== expectedManifestCount) {
+  if (expectedPlatformCount > 0 && manifests.length !== expectedPlatformCount) {
     throw new Error(
-      `expected ${expectedManifestCount} platform manifests, found ${manifests.length} under ${inputRoot}`,
+      `expected ${expectedPlatformCount} platform manifests, found ${manifests.length} under ${inputRoot}`,
     );
   }
   const summary = {

package/scripts/check-inventory.mjs

@@ -59,7 +59,6 @@ const requiredPaths = [
   "scripts/generate-site-bundle.mjs",
   "scripts/generate-buildchain-kfd-witnesses.mjs",
   "scripts/generate-release-candidate-passport.mjs",
-  "scripts/seal-macos-credential-input.mjs",
   "scripts/shifu-gate-profile.mjs",
   "scripts/artifact-relay-s3.mjs",
   "scripts/anchored-version-material.mjs",

package/scripts/generate-channel-build-workflow.mjs

@@ -54,15 +54,7 @@ function routerOutputs(outputBlock) {
     .replace("value: ${{ jobs.build.outputs.controller-receipt-artifact }}", "value: ${{ jobs.controller-receipt.outputs.controller-receipt-artifact }}")
     .replace("value: ${{ jobs.build.outputs.controller-receipt-json }}", "value: ${{ jobs.controller-receipt.outputs.controller-receipt-json }}")
     .replace("value: ${{ jobs.build.outputs.controller-receipt-digest }}", "value: ${{ jobs.controller-receipt.outputs.controller-receipt-digest }}")
-    .replace("value: ${{ jobs.build.outputs.controller-receipt-status }}", "value: ${{ jobs.controller-receipt.outputs.controller-receipt-status }}")
-    .replace(
-      /(      credential-island-macos-artifact:\n(?:        .*\n)*?        value:) \$\{\{ jobs\.build\.outputs\.artifact-name \}\}/,
-      "$1 ${{ jobs.build.outputs.credential-island-macos-artifact }}",
-    )
-    .replace(
-      /(      credential-island-macos-manifest-artifact:\n(?:        .*\n)*?        value:) \$\{\{ jobs\.build\.outputs\.manifest-artifact-name \}\}/,
-      "$1 ${{ jobs.build.outputs.credential-island-macos-manifest-artifact }}",
-    );
+    .replace("value: ${{ jobs.build.outputs.controller-receipt-status }}", "value: ${{ jobs.controller-receipt.outputs.controller-receipt-status }}");
   return [
     "      buildchain-channel:",
     '        description: "Resolved Buildchain channel: alpha, stable, or override"',
@@ -295,10 +287,6 @@ function bindRouterCheckoutToWorkflowSha(workflow) {
 
 export function generateChannelBuildWorkflow(source) {
   const generated = bindRouterCheckoutToWorkflowSha(generateChannelBuildWorkflowBase(source))
-    .replace(
-      "\npermissions:\n  contents: read\n",
-      "\npermissions:\n  actions: read\n  contents: read\n",
-    )
     .replace(
       "      contract-lock-path: ${{ steps.lock.outputs.path }}\n",
       [
@@ -313,10 +301,6 @@ export function generateChannelBuildWorkflow(source) {
     .replace(
       "    needs: resolve-channel\n    uses: ./.github/workflows/.build.yml",
       "    needs:\n      - resolve-channel\n      - controller-plan\n    uses: ./.github/workflows/.build.yml",
-    )
-    .replace(
-      "    uses: ./.github/workflows/.build.yml\n    permissions:\n      contents: read\n",
-      "    uses: ./.github/workflows/.build.yml\n    permissions:\n      actions: read\n      contents: read\n",
     );
   return `${generated.trimEnd()}\n\n${routerControllerReceiptJob()}\n\n${routerAggregateJob()}\n`;
 }

package/actions/macos-credential-island/README.md

@@ -1,18 +0,0 @@
-# macOS Credential Island
-
-This action signs one sealed macOS application on an isolated macOS runner. It
-does not check out consumer source and does not execute files from the input
-artifact. Buildchain validates the source-bound input manifest, imports one
-exact Developer ID Application identity into a temporary keychain, signs the
-application, submits Apple notarization, staples the application and DMG,
-verifies Gatekeeper, and writes bounded JSON evidence.
-
-The reusable Buildchain workflow invokes this action from a job bound to the
-caller's protected GitHub Environment. The job downloads the exact sealed
-Buildchain input and immutable action runtime, then uploads the signed payload
-and its Buildchain platform manifest. It has no consumer checkout. Do not add a
-package manager, lifecycle, hook, or consumer-script execution to that job.
-
-The supported `electron-desktop-v1` entitlements profile is owned by
-Buildchain. Consumer-provided entitlement files are intentionally unsupported;
-otherwise pull-request bytes could expand the signing authority.

package/scripts/seal-macos-credential-input.mjs

@@ -1,135 +0,0 @@
-#!/usr/bin/env node
-import { spawnSync } from "node:child_process";
-import fs from "node:fs";
-import path from "node:path";
-import { pathToFileURL } from "node:url";
-
-import {
-  INPUT_CONTRACT,
-  assertContainedSymlinks,
-  assertRealPathInside,
-  requireRepository,
-  requireSha,
-  resolveInside,
-  sha256File,
-} from "../actions/macos-credential-island/lib.js";
-
-function env(name) {
-  const value = String(process.env[name] || "").trim();
-  if (!value) throw new Error(`${name} is required`);
-  return value;
-}
-
-function run(command, args) {
-  const result = spawnSync(command, args, {
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "pipe"],
-  });
-  if (result.error || result.status !== 0) {
-    throw (
-      result.error ||
-      new Error(
-        `${path.basename(command)} failed with status ${result.status}: ${(result.stderr || result.stdout || "").trim().slice(0, 1200)}`,
-      )
-    );
-  }
-  return `${result.stdout || ""}${result.stderr || ""}`.trim();
-}
-
-function plistValue(appPath, key) {
-  return run("/usr/bin/plutil", [
-    "-extract",
-    key,
-    "raw",
-    "-o",
-    "-",
-    path.join(appPath, "Contents", "Info.plist"),
-  ]);
-}
-
-export function sealMacosCredentialInput() {
-  if (process.platform !== "darwin")
-    throw new Error("credential input sealing requires macOS");
-  const workspace = path.resolve(process.cwd());
-  const appPath = resolveInside(
-    workspace,
-    env("BUILDCHAIN_CREDENTIAL_ISLAND_APP_PATH"),
-    "credential island app path",
-  );
-  if (!fs.statSync(appPath).isDirectory() || !appPath.endsWith(".app")) {
-    throw new Error("credential island app path must name one .app directory");
-  }
-  assertRealPathInside(workspace, appPath, "credential island app path");
-  assertContainedSymlinks(appPath);
-  const repository = requireRepository(env("BUILDCHAIN_SOURCE_REPOSITORY"));
-  const sourceSha = requireSha(env("BUILDCHAIN_SOURCE_SHA"), "source SHA");
-  const treeSha = requireSha(
-    env("BUILDCHAIN_SOURCE_TREE_SHA"),
-    "source tree SHA",
-  );
-  const platformId = env("BUILDCHAIN_PLATFORM_ID");
-  const arch = process.arch;
-  if (!["arm64", "x64"].includes(arch))
-    throw new Error(`unsupported macOS architecture: ${arch}`);
-  const outputRoot = path.resolve(env("BUILDCHAIN_CREDENTIAL_ISLAND_OUTPUT"));
-  const relativeOutput = path.relative(workspace, outputRoot);
-  if (
-    !relativeOutput ||
-    relativeOutput.startsWith("..") ||
-    path.isAbsolute(relativeOutput)
-  ) {
-    throw new Error(
-      "credential island output must stay inside the build workspace",
-    );
-  }
-  fs.mkdirSync(outputRoot, { recursive: true });
-  const archivePath = path.join(outputRoot, "unsigned-app.zip");
-  run("/usr/bin/ditto", [
-    "-c",
-    "-k",
-    "--sequesterRsrc",
-    "--keepParent",
-    appPath,
-    archivePath,
-  ]);
-  const archive = {
-    file: path.basename(archivePath),
-    format: "ditto-zip",
-    bytes: fs.statSync(archivePath).size,
-    sha256: sha256File(archivePath),
-  };
-  const manifest = {
-    schema: INPUT_CONTRACT,
-    sealedAt: new Date().toISOString(),
-    source: { repository, sha: sourceSha, treeSha },
-    platform: { id: platformId, os: "macos", arch },
-    app: {
-      archivePath: path.basename(appPath),
-      bundleId: plistValue(appPath, "CFBundleIdentifier"),
-      productName: plistValue(appPath, "CFBundleName"),
-      version: plistValue(appPath, "CFBundleShortVersionString"),
-      buildVersion: plistValue(appPath, "CFBundleVersion"),
-    },
-    archive,
-  };
-  const manifestPath = path.join(outputRoot, "credential-input.json");
-  fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
-  process.stdout.write(
-    `${JSON.stringify({ manifestPath, archivePath, archive })}\n`,
-  );
-  return manifest;
-}
-
-if (
-  process.argv[1] &&
-  import.meta.url === pathToFileURL(process.argv[1]).href
-) {
-  try {
-    sealMacosCredentialInput();
-  } catch (error) {
-    console.error(
-      `::error::${String(error?.message || error).replace(/\r?\n/gu, "%0A")}`,
-    );
-    process.exitCode = 1;
-  }
-}