@kungfu-tech/buildchain 2.14.17 → 2.14.18-alpha.1

package/packages/core/buildchain-kfd-claims.js

@@ -87,6 +87,8 @@ const WORKFLOW_AND_ACTION_FILES = Object.freeze([
   ".github/workflows/release-candidate-promote.yml",
   ".github/workflows/buildchain-ref-promotion.yml",
   ".github/workflows/release-propagation.yml",
+  "actions/macos-credential-island/action.yml",
+  "actions/macos-credential-island/index.js",
   "actions/promote-buildchain-ref/action.yml",
   "actions/promote-buildchain-ref/index.js",
 ]);

package/packages/core/controller-evidence.js

@@ -22,16 +22,23 @@ const CONTROLLER_SPECS = [
     id: "build-lifecycle",
     workflowId: ".build",
     version: 1,
-    capabilities: ["source-lock", "lifecycle-build", "lifecycle-verify", "artifact-admission"],
+    capabilities: [
+      "source-lock",
+      "lifecycle-build",
+      "credential-island",
+      "lifecycle-verify",
+      "artifact-admission",
+    ],
     stages: [
       "resolve-runtime",
       "resolve-source",
       "anchored-release-preflight",
       "build",
+      "credential-island",
       "verify",
       "aggregate",
     ],
-    optionalStages: ["anchored-release-preflight"],
+    optionalStages: ["anchored-release-preflight", "credential-island"],
     evidence: [
       "platform-manifests",
       "build-summary",

package/packages/core/kfd3-surface-register.js

@@ -124,6 +124,50 @@ function normalizeRegistrySurface(entry) {
   };
 }
 
+function globPatternRegExp(pattern) {
+  const normalized = String(pattern || "").replaceAll("\\", "/");
+  let source = "";
+  for (let index = 0; index < normalized.length; index += 1) {
+    const character = normalized[index];
+    if (character === "*" && normalized[index + 1] === "*") {
+      source += ".*";
+      index += 1;
+    } else if (character === "*") {
+      source += "[^/]*";
+    } else if (character === "?") {
+      source += "[^/]";
+    } else {
+      source += character.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    }
+  }
+  return new RegExp(`^${source}$`);
+}
+
+function distributionBindings(registry, detectedSurfaces) {
+  return detectedSurfaces.flatMap((detected) =>
+    registry.surfaces.flatMap((declared) =>
+      (declared.distribution?.artifacts || [])
+        .filter(
+          (artifact) =>
+            normalizeKind(artifact.kind) === detected.kind &&
+            globPatternRegExp(artifact.pathGlob).test(
+              String(detected.artifactPath || "").replaceAll("\\", "/"),
+            ),
+        )
+        .map((artifact) => ({
+          detectedSurfaceId: detected.id,
+          declaredSurfaceId: declared.id,
+          artifact: {
+            kind: artifact.kind,
+            platform: artifact.platform,
+            pathGlob: artifact.pathGlob,
+            ...(artifact.sha256 ? { sha256: artifact.sha256 } : {}),
+          },
+        })),
+    ),
+  );
+}
+
 function stableId(value) {
   return String(value || "")
     .toLowerCase()
@@ -507,7 +551,11 @@ export function auditKfd3Surfaces({
   const registry = readKfd3SurfaceRegistry({ cwd, registryPath });
   const detectedIds = new Set(detection.surfaces.map((entry) => entry.id));
   const declaredIds = new Set(registry.surfaces.map((entry) => entry.id));
-  const detectedButUnregistered = detection.surfaces.filter((entry) => !declaredIds.has(entry.id));
+  const bindings = distributionBindings(registry, detection.surfaces);
+  const distributedIds = new Set(bindings.map((entry) => entry.detectedSurfaceId));
+  const detectedButUnregistered = detection.surfaces.filter(
+    (entry) => !declaredIds.has(entry.id) && !distributedIds.has(entry.id),
+  );
   const declaredButMissing = registry.surfaces.filter((entry) => !detectedIds.has(entry.id));
   const enforced = registry.surfaces.filter((entry) => entry.state === "enforced" || entry.enforcement === "enforced");
   const issues = [
@@ -543,10 +591,12 @@ export function auditKfd3Surfaces({
       detected: detection.surfaces,
       declared: registry.surfaces,
       enforced,
+      distributionBindings: bindings,
     },
     comparison: {
       detectedButUnregistered,
       declaredButMissing,
+      distributionBindings: bindings,
     },
     issues,
   };

package/scripts/aggregate-build-summary.mjs

@@ -13,13 +13,18 @@ export function aggregateBuildSummaryCli() {
   const outputPath = path.resolve(readEnv("BUILDCHAIN_SUMMARY_OUTPUT", ".buildchain/artifacts/build-summary.json"));
   const artifactName = readEnv("BUILDCHAIN_ARTIFACT_NAME", "buildchain-artifact");
   const expectedPlatformCount = Number(readEnv("BUILDCHAIN_PLATFORM_COUNT", "0"));
+  const additionalPlatformCount = Number(readEnv("BUILDCHAIN_ADDITIONAL_PLATFORM_COUNT", "0"));
+  if (!Number.isInteger(additionalPlatformCount) || additionalPlatformCount < 0) {
+    throw new Error("BUILDCHAIN_ADDITIONAL_PLATFORM_COUNT must be a non-negative integer");
+  }
+  const expectedManifestCount = expectedPlatformCount + additionalPlatformCount;
   const manifestFiles = findJsonFiles(inputRoot)
     .filter((file) => path.basename(file) === "manifest.json")
     .sort();
   const manifests = manifestFiles.map((file) => JSON.parse(fs.readFileSync(file, "utf8")));
-  if (expectedPlatformCount > 0 && manifests.length !== expectedPlatformCount) {
+  if (expectedManifestCount > 0 && manifests.length !== expectedManifestCount) {
     throw new Error(
-      `expected ${expectedPlatformCount} platform manifests, found ${manifests.length} under ${inputRoot}`,
+      `expected ${expectedManifestCount} platform manifests, found ${manifests.length} under ${inputRoot}`,
     );
   }
   const summary = {

package/scripts/artifact-relay-s3.mjs

@@ -291,7 +291,7 @@ function writeManifest(manifestPath, manifest) {
 }
 
 function resolveUploadGroups() {
-  return [
+  const groups = [
     {
       role: "payload",
       artifactName: env("BUILDCHAIN_ARTIFACT_RELAY_PAYLOAD_ARTIFACT_NAME"),
@@ -311,6 +311,16 @@ function resolveUploadGroups() {
       required: true,
     },
   ];
+  const credentialInputPaths = splitLines(env("BUILDCHAIN_ARTIFACT_RELAY_CREDENTIAL_INPUT_PATHS"));
+  if (credentialInputPaths.length > 0) {
+    groups.push({
+      role: "credential-input",
+      artifactName: env("BUILDCHAIN_ARTIFACT_RELAY_CREDENTIAL_INPUT_ARTIFACT_NAME"),
+      paths: credentialInputPaths,
+      required: true,
+    });
+  }
+  return groups;
 }
 
 export async function uploadRelayArtifacts({

package/scripts/check-inventory.mjs

@@ -59,6 +59,7 @@ const requiredPaths = [
   "scripts/generate-site-bundle.mjs",
   "scripts/generate-buildchain-kfd-witnesses.mjs",
   "scripts/generate-release-candidate-passport.mjs",
+  "scripts/seal-macos-credential-input.mjs",
   "scripts/shifu-gate-profile.mjs",
   "scripts/artifact-relay-s3.mjs",
   "scripts/anchored-version-material.mjs",

package/scripts/generate-channel-build-workflow.mjs

@@ -54,7 +54,15 @@ function routerOutputs(outputBlock) {
     .replace("value: ${{ jobs.build.outputs.controller-receipt-artifact }}", "value: ${{ jobs.controller-receipt.outputs.controller-receipt-artifact }}")
     .replace("value: ${{ jobs.build.outputs.controller-receipt-json }}", "value: ${{ jobs.controller-receipt.outputs.controller-receipt-json }}")
     .replace("value: ${{ jobs.build.outputs.controller-receipt-digest }}", "value: ${{ jobs.controller-receipt.outputs.controller-receipt-digest }}")
-    .replace("value: ${{ jobs.build.outputs.controller-receipt-status }}", "value: ${{ jobs.controller-receipt.outputs.controller-receipt-status }}");
+    .replace("value: ${{ jobs.build.outputs.controller-receipt-status }}", "value: ${{ jobs.controller-receipt.outputs.controller-receipt-status }}")
+    .replace(
+      /(      credential-island-macos-artifact:\n(?:        .*\n)*?        value:) \$\{\{ jobs\.build\.outputs\.artifact-name \}\}/,
+      "$1 ${{ jobs.build.outputs.credential-island-macos-artifact }}",
+    )
+    .replace(
+      /(      credential-island-macos-manifest-artifact:\n(?:        .*\n)*?        value:) \$\{\{ jobs\.build\.outputs\.manifest-artifact-name \}\}/,
+      "$1 ${{ jobs.build.outputs.credential-island-macos-manifest-artifact }}",
+    );
   return [
     "      buildchain-channel:",
     '        description: "Resolved Buildchain channel: alpha, stable, or override"',
@@ -287,6 +295,10 @@ function bindRouterCheckoutToWorkflowSha(workflow) {
 
 export function generateChannelBuildWorkflow(source) {
   const generated = bindRouterCheckoutToWorkflowSha(generateChannelBuildWorkflowBase(source))
+    .replace(
+      "\npermissions:\n  contents: read\n",
+      "\npermissions:\n  actions: read\n  contents: read\n",
+    )
     .replace(
       "      contract-lock-path: ${{ steps.lock.outputs.path }}\n",
       [
@@ -301,6 +313,10 @@ export function generateChannelBuildWorkflow(source) {
     .replace(
       "    needs: resolve-channel\n    uses: ./.github/workflows/.build.yml",
       "    needs:\n      - resolve-channel\n      - controller-plan\n    uses: ./.github/workflows/.build.yml",
+    )
+    .replace(
+      "    uses: ./.github/workflows/.build.yml\n    permissions:\n      contents: read\n",
+      "    uses: ./.github/workflows/.build.yml\n    permissions:\n      actions: read\n      contents: read\n",
     );
   return `${generated.trimEnd()}\n\n${routerControllerReceiptJob()}\n\n${routerAggregateJob()}\n`;
 }

package/scripts/seal-macos-credential-input.mjs

@@ -0,0 +1,135 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+import {
+  INPUT_CONTRACT,
+  assertContainedSymlinks,
+  assertRealPathInside,
+  requireRepository,
+  requireSha,
+  resolveInside,
+  sha256File,
+} from "../actions/macos-credential-island/lib.js";
+
+function env(name) {
+  const value = String(process.env[name] || "").trim();
+  if (!value) throw new Error(`${name} is required`);
+  return value;
+}
+
+function run(command, args) {
+  const result = spawnSync(command, args, {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  if (result.error || result.status !== 0) {
+    throw (
+      result.error ||
+      new Error(
+        `${path.basename(command)} failed with status ${result.status}: ${(result.stderr || result.stdout || "").trim().slice(0, 1200)}`,
+      )
+    );
+  }
+  return `${result.stdout || ""}${result.stderr || ""}`.trim();
+}
+
+function plistValue(appPath, key) {
+  return run("/usr/bin/plutil", [
+    "-extract",
+    key,
+    "raw",
+    "-o",
+    "-",
+    path.join(appPath, "Contents", "Info.plist"),
+  ]);
+}
+
+export function sealMacosCredentialInput() {
+  if (process.platform !== "darwin")
+    throw new Error("credential input sealing requires macOS");
+  const workspace = path.resolve(process.cwd());
+  const appPath = resolveInside(
+    workspace,
+    env("BUILDCHAIN_CREDENTIAL_ISLAND_APP_PATH"),
+    "credential island app path",
+  );
+  if (!fs.statSync(appPath).isDirectory() || !appPath.endsWith(".app")) {
+    throw new Error("credential island app path must name one .app directory");
+  }
+  assertRealPathInside(workspace, appPath, "credential island app path");
+  assertContainedSymlinks(appPath);
+  const repository = requireRepository(env("BUILDCHAIN_SOURCE_REPOSITORY"));
+  const sourceSha = requireSha(env("BUILDCHAIN_SOURCE_SHA"), "source SHA");
+  const treeSha = requireSha(
+    env("BUILDCHAIN_SOURCE_TREE_SHA"),
+    "source tree SHA",
+  );
+  const platformId = env("BUILDCHAIN_PLATFORM_ID");
+  const arch = process.arch;
+  if (!["arm64", "x64"].includes(arch))
+    throw new Error(`unsupported macOS architecture: ${arch}`);
+  const outputRoot = path.resolve(env("BUILDCHAIN_CREDENTIAL_ISLAND_OUTPUT"));
+  const relativeOutput = path.relative(workspace, outputRoot);
+  if (
+    !relativeOutput ||
+    relativeOutput.startsWith("..") ||
+    path.isAbsolute(relativeOutput)
+  ) {
+    throw new Error(
+      "credential island output must stay inside the build workspace",
+    );
+  }
+  fs.mkdirSync(outputRoot, { recursive: true });
+  const archivePath = path.join(outputRoot, "unsigned-app.zip");
+  run("/usr/bin/ditto", [
+    "-c",
+    "-k",
+    "--sequesterRsrc",
+    "--keepParent",
+    appPath,
+    archivePath,
+  ]);
+  const archive = {
+    file: path.basename(archivePath),
+    format: "ditto-zip",
+    bytes: fs.statSync(archivePath).size,
+    sha256: sha256File(archivePath),
+  };
+  const manifest = {
+    schema: INPUT_CONTRACT,
+    sealedAt: new Date().toISOString(),
+    source: { repository, sha: sourceSha, treeSha },
+    platform: { id: platformId, os: "macos", arch },
+    app: {
+      archivePath: path.basename(appPath),
+      bundleId: plistValue(appPath, "CFBundleIdentifier"),
+      productName: plistValue(appPath, "CFBundleName"),
+      version: plistValue(appPath, "CFBundleShortVersionString"),
+      buildVersion: plistValue(appPath, "CFBundleVersion"),
+    },
+    archive,
+  };
+  const manifestPath = path.join(outputRoot, "credential-input.json");
+  fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
+  process.stdout.write(
+    `${JSON.stringify({ manifestPath, archivePath, archive })}\n`,
+  );
+  return manifest;
+}
+
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(process.argv[1]).href
+) {
+  try {
+    sealMacosCredentialInput();
+  } catch (error) {
+    console.error(
+      `::error::${String(error?.message || error).replace(/\r?\n/gu, "%0A")}`,
+    );
+    process.exitCode = 1;
+  }
+}