@kungfu-tech/buildchain 3.0.2-alpha.0 → 3.0.2-alpha.10

package/scripts/locked-source-checkout.mjs

@@ -177,6 +177,21 @@ function gitObjectDirectory(referencePath) {
   return candidates.find((candidate) => fs.existsSync(candidate) && fs.statSync(candidate).isDirectory()) || "";
 }
 
+function directoryBytes(directory) {
+  if (!fs.existsSync(directory)) return 0;
+  let bytes = 0;
+  const pending = [directory];
+  while (pending.length) {
+    const current = pending.pop();
+    for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+      const child = path.join(current, entry.name);
+      if (entry.isDirectory()) pending.push(child);
+      else if (entry.isFile()) bytes += fs.statSync(child).size;
+    }
+  }
+  return bytes;
+}
+
 function writeAlternates(targetPath, referencePath) {
   const objectDirectory = gitObjectDirectory(referencePath);
   if (!objectDirectory) {
@@ -413,6 +428,13 @@ export function lockedSourceCheckout({
       fallbackUsed: normalizedMode === "off",
       fallbackReason: normalizedMode === "off" ? "cache disabled" : "",
       githubFetchAttempts: 0,
+      lookupDurationMs: 0,
+      restoreDurationMs: 0,
+      githubFetchDurationMs: 0,
+      restoredBytes: null,
+      restoredBytesStatus:
+        normalizedMode === "off" ? "not-applicable" : "unavailable",
+      restoredBytesMethod: "",
     },
     verification: {
       head: "",
@@ -425,8 +447,13 @@ export function lockedSourceCheckout({
   let checkoutError;
   let checkoutSha = sha;
   if (normalizedMode !== "off") {
+    const cacheAttemptStartedAt = Date.now();
+    const objectBytesBefore = directoryBytes(
+      path.join(targetPath, ".git", "objects"),
+    );
     try {
       if (renderedReferenceRepository) {
+        const lookupStartedAt = Date.now();
         const alternates = writeAlternates(targetPath, renderedReferenceRepository);
         evidence.cache.transport = "reference-repository";
         evidence.cache.referenceAvailable = alternates;
@@ -436,9 +463,13 @@ export function lockedSourceCheckout({
         if (!hasCommit(targetPath, sha, timeoutMs)) {
           throw new Error("reference repository does not contain source commit");
         }
+        evidence.cache.lookupDurationMs = Date.now() - lookupStartedAt;
+        const restoreStartedAt = Date.now();
         checkoutFetchedCommit(targetPath, sha, timeoutMs);
+        evidence.cache.restoreDurationMs = Date.now() - restoreStartedAt;
       } else if (renderedMirrorUrl) {
         evidence.cache.transport = "mirror-url";
+        const restoreStartedAt = Date.now();
         const fetchResult = fetchSourceCommit({
           targetPath,
           remoteName: "buildchain-cache",
@@ -452,15 +483,29 @@ export function lockedSourceCheckout({
         evidence.cache.fetchMode = fetchResult.fetchMode;
         checkoutSha = fetchResult.checkoutSha || sha;
         checkoutFetchedCommit(targetPath, checkoutSha, timeoutMs);
+        evidence.cache.restoreDurationMs = Date.now() - restoreStartedAt;
       } else {
         throw new Error("checkout cache is enabled but no mirror URL or reference repository template was provided");
       }
       evidence.cache.hit = true;
       evidence.cache.fallbackUsed = false;
+      evidence.cache.restoredBytes = Math.max(
+        0,
+        directoryBytes(path.join(targetPath, ".git", "objects")) -
+          objectBytesBefore,
+      );
+      evidence.cache.restoredBytesStatus = "observed";
+      evidence.cache.restoredBytesMethod = "git-object-store-delta";
     } catch (error) {
       checkoutError = error;
       evidence.cache.hit = false;
       evidence.cache.fallbackReason = error.message;
+      if (
+        evidence.cache.lookupDurationMs === 0 &&
+        evidence.cache.restoreDurationMs === 0
+      ) {
+        evidence.cache.lookupDurationMs = Date.now() - cacheAttemptStartedAt;
+      }
       if (normalizedMode === "require" || normalizedFallback === "fail") {
         evidence.durationMs = Date.now() - startedAt;
         writeEvidence(path.resolve(workspace, diagnosticsPath), evidence);
@@ -477,6 +522,7 @@ export function lockedSourceCheckout({
       evidence.cache.fallbackReason = checkoutError.message;
     }
     try {
+      const githubFetchStartedAt = Date.now();
       const fetchResult = runBoundedFetch({
         attempts: normalizedFetchAttempts,
         fetch: () => fetchSourceCommit({
@@ -496,6 +542,8 @@ export function lockedSourceCheckout({
       evidence.cache.githubFetchAttempts = fetchResult.attempts;
       evidence.cache.fetchMode = fetchResult.value.fetchMode;
       checkoutSha = fetchResult.value.checkoutSha || sha;
+      evidence.cache.githubFetchDurationMs =
+        Date.now() - githubFetchStartedAt;
     } catch (error) {
       evidence.durationMs = Date.now() - startedAt;
       writeEvidence(path.resolve(workspace, diagnosticsPath), evidence);

package/scripts/materialize-artifact-signing-request.mjs

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+import { validateArtifactSigningRequest } from "../packages/core/artifact-signing.js";
+import { writeGitHubOutputs } from "./build-contract-core.mjs";
+
+function required(value, label) {
+  const normalized = String(value || "").trim();
+  if (!normalized) throw new Error(`${label} is required`);
+  return normalized;
+}
+
+function resolveBelow(root, relative, label) {
+  const target = path.resolve(root, required(relative, label));
+  const rel = path.relative(path.resolve(root), target);
+  if (!rel || rel.startsWith("..") || path.isAbsolute(rel)) throw new Error(`${label} must resolve below its root`);
+  return target;
+}
+
+function sha256File(filePath) {
+  return `sha256:${crypto.createHash("sha256").update(fs.readFileSync(filePath)).digest("hex")}`;
+}
+
+export function materializeArtifactSigningRequest({
+  requestRoot = process.env.BUILDCHAIN_SIGNING_REQUEST_ROOT,
+  requestPath = process.env.BUILDCHAIN_SIGNING_REQUEST_PATH,
+  expectedProfile = process.env.BUILDCHAIN_SIGNING_EXPECTED_PROFILE,
+  outputPath = process.env.BUILDCHAIN_UNSIGNED_OUTPUT,
+} = {}) {
+  const root = path.resolve(required(requestRoot, "signing request root"));
+  const requestFile = resolveBelow(root, requestPath, "request path");
+  const request = JSON.parse(fs.readFileSync(requestFile, "utf8"));
+  const check = validateArtifactSigningRequest(request);
+  if (!check.ok) throw new Error(`invalid artifact signing request: ${check.issues.join(", ")}`);
+  if (expectedProfile && request.signature.profile !== expectedProfile) throw new Error("artifact signing profile mismatch");
+  if (request.artifact.transport?.format !== "exact-file") throw new Error("native executable signing requires exact-file transport");
+  const requestIndexRoot = path.dirname(path.dirname(requestFile));
+  const payload = resolveBelow(requestIndexRoot, request.artifact.transport.file, "transport payload");
+  const stat = fs.statSync(payload);
+  const payloadDigest = sha256File(payload);
+  if (!stat.isFile() || stat.size !== request.artifact.transport.bytes || stat.size !== request.artifact.bytes || payloadDigest !== request.artifact.transport.digest || payloadDigest !== request.artifact.digest) {
+    throw new Error("signing payload does not match its sealed request");
+  }
+  const output = path.resolve(required(outputPath, "unsigned output path"));
+  fs.mkdirSync(path.dirname(output), { recursive: true });
+  fs.copyFileSync(payload, output, fs.constants.COPYFILE_EXCL);
+  writeGitHubOutputs({
+    "artifact-id": request.artifact.id,
+    "payload-path": output,
+    "request-digest": request.digest,
+    "signature-provider": request.signature.provider,
+  });
+  return { request, output };
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  try {
+    materializeArtifactSigningRequest();
+  } catch (error) {
+    console.error(`::error::${String(error?.message || error).replace(/\r?\n/gu, "%0A")}`);
+    process.exitCode = 1;
+  }
+}

package/scripts/merge-artifact-signing-results.mjs

@@ -0,0 +1,76 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+import { writeGitHubOutputs } from "./build-contract-core.mjs";
+
+function required(value, label) {
+  const normalized = String(value || "").trim();
+  if (!normalized) throw new Error(`${label} is required`);
+  return normalized;
+}
+
+function safeId(value) {
+  const normalized = String(value || "").replace(/[^A-Za-z0-9._-]+/gu, "-").replace(/^-+|-+$/gu, "");
+  if (!normalized || normalized === "." || normalized === "..") throw new Error("unsafe signing result id");
+  return normalized;
+}
+
+function walk(root, output = []) {
+  for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
+    const child = path.join(root, entry.name);
+    if (entry.isDirectory()) walk(child, output);
+    else if (entry.isFile() && entry.name === "index.json") output.push(child);
+  }
+  return output;
+}
+
+export function mergeArtifactSigningResults({
+  inputRoot = process.env.BUILDCHAIN_SIGNING_RESULT_INPUT_ROOT,
+  outputRoot = process.env.BUILDCHAIN_SIGNING_RESULT_ROOT,
+} = {}) {
+  const input = path.resolve(required(inputRoot, "signing result input root"));
+  const output = path.resolve(required(outputRoot, "signing result output root"));
+  fs.mkdirSync(output, { recursive: true });
+  const merged = [];
+  const seen = new Set();
+  for (const indexPath of walk(input)) {
+    const index = JSON.parse(fs.readFileSync(indexPath, "utf8"));
+    if (index.contract !== "kungfu-buildchain-artifact-signing-result-index/v1") continue;
+    for (const entry of index.results || []) {
+      if (seen.has(entry.id)) throw new Error(`duplicate signing result: ${entry.id}`);
+      seen.add(entry.id);
+      const sourceResult = path.resolve(path.dirname(indexPath), entry.result);
+      const sourceDirectory = path.dirname(sourceResult);
+      const relative = path.relative(path.dirname(indexPath), sourceDirectory);
+      if (relative.startsWith("..") || path.isAbsolute(relative)) throw new Error("signing result escapes provider root");
+      const destinationName = safeId(entry.id);
+      const destination = path.join(output, destinationName);
+      fs.cpSync(sourceDirectory, destination, { recursive: true, errorOnExist: true, force: false });
+      merged.push({
+        ...entry,
+        result: `${destinationName}/${path.basename(sourceResult)}`,
+        ...(entry.payload ? { payload: `${destinationName}/${path.relative(sourceDirectory, path.resolve(path.dirname(indexPath), entry.payload)).split(path.sep).join("/")}` } : {}),
+        ...(entry.envelope ? { envelope: `${destinationName}/${path.relative(sourceDirectory, path.resolve(path.dirname(indexPath), entry.envelope)).split(path.sep).join("/")}` } : {}),
+        ...(entry.receipt ? { receipt: `${destinationName}/${path.relative(sourceDirectory, path.resolve(path.dirname(indexPath), entry.receipt)).split(path.sep).join("/")}` } : {}),
+      });
+    }
+  }
+  if (merged.length === 0) throw new Error("no artifact signing results found");
+  merged.sort((a, b) => a.id.localeCompare(b.id));
+  const index = { schemaVersion: 1, contract: "kungfu-buildchain-artifact-signing-result-index/v1", results: merged };
+  const indexPath = path.join(output, "index.json");
+  fs.writeFileSync(indexPath, `${JSON.stringify(index, null, 2)}\n`);
+  writeGitHubOutputs({ "result-count": String(merged.length), "result-index": indexPath, "result-root": output });
+  return index;
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  try {
+    mergeArtifactSigningResults();
+  } catch (error) {
+    console.error(`::error::${String(error?.message || error).replace(/\r?\n/gu, "%0A")}`);
+    process.exitCode = 1;
+  }
+}

package/scripts/publish-github-artifact-attestation-evidence.mjs

@@ -0,0 +1,201 @@
+#!/usr/bin/env node
+
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { spawnSync } from "node:child_process";
+
+import {
+  createGitHubArtifactAttestationVerificationPlan,
+  verifyGitHubArtifactAttestationEvidence,
+} from "../packages/core/github-artifact-attestation.js";
+
+function parseArgs(argv) {
+  const result = {};
+  for (let index = 0; index < argv.length; index += 2) {
+    const key = argv[index];
+    const value = argv[index + 1];
+    if (!key?.startsWith("--") || value === undefined) throw new Error(`invalid argument near ${key || "<end>"}`);
+    result[key.slice(2)] = value;
+  }
+  return result;
+}
+
+function required(value, label) {
+  const normalized = String(value || "").trim();
+  if (!normalized) throw new Error(`${label} is required`);
+  return normalized;
+}
+
+function sha256(value) {
+  return crypto.createHash("sha256").update(value).digest("hex");
+}
+
+function sha256File(filePath) {
+  return `sha256:${sha256(fs.readFileSync(filePath))}`;
+}
+
+function readJson(filePath, label) {
+  try {
+    return JSON.parse(fs.readFileSync(filePath, "utf8"));
+  } catch (error) {
+    throw new Error(`${label} is not readable JSON: ${error.message}`);
+  }
+}
+
+function safeAssetStem(value) {
+  return path.basename(required(value, "subject name"))
+    .replace(/[^0-9A-Za-z._-]+/g, "-")
+    .replace(/^-+|-+$/g, "");
+}
+
+async function api({ token, apiUrl, route, method = "GET", headers = {}, body }) {
+  const response = await fetch(`${apiUrl}${route}`, {
+    method,
+    headers: {
+      accept: "application/vnd.github+json",
+      authorization: `Bearer ${token}`,
+      "x-github-api-version": "2022-11-28",
+      ...headers,
+    },
+    body,
+  });
+  if (!response.ok) {
+    const detail = (await response.text()).slice(0, 500);
+    throw new Error(`GitHub API ${method} ${route} failed with ${response.status}: ${detail}`);
+  }
+  return response;
+}
+
+async function remoteAssetDigest({ token, apiUrl, repository, asset }) {
+  const declared = String(asset.digest || "").match(/^sha256:([0-9a-f]{64})$/i);
+  if (declared) return `sha256:${declared[1].toLowerCase()}`;
+  const response = await api({
+    token,
+    apiUrl,
+    route: `/repos/${repository}/releases/assets/${asset.id}`,
+    headers: { accept: "application/octet-stream" },
+  });
+  return `sha256:${sha256(Buffer.from(await response.arrayBuffer()))}`;
+}
+
+async function uploadImmutable({ token, apiUrl, repository, release, filePath, assetName }) {
+  const localDigest = sha256File(filePath);
+  const existing = (release.assets || []).filter((asset) => asset.name === assetName);
+  if (existing.length > 1) throw new Error(`release asset ${assetName} exists more than once`);
+  if (existing.length === 1) {
+    const remoteDigest = await remoteAssetDigest({ token, apiUrl, repository, asset: existing[0] });
+    if (remoteDigest !== localDigest) {
+      throw new Error(`immutable release asset collision for ${assetName}: ${remoteDigest} != ${localDigest}`);
+    }
+    return { action: "preserved", name: assetName, digest: localDigest, url: existing[0].browser_download_url };
+  }
+  const uploadBase = required(release.upload_url, "release.upload_url").replace(/\{.*$/, "");
+  const response = await fetch(`${uploadBase}?name=${encodeURIComponent(assetName)}`, {
+    method: "POST",
+    headers: {
+      accept: "application/vnd.github+json",
+      authorization: `Bearer ${token}`,
+      "content-type": "application/octet-stream",
+      "x-github-api-version": "2022-11-28",
+    },
+    body: fs.readFileSync(filePath),
+  });
+  if (!response.ok) throw new Error(`GitHub release asset upload failed with ${response.status}: ${(await response.text()).slice(0, 500)}`);
+  const asset = await response.json();
+  release.assets = [...(release.assets || []), asset];
+  const remoteDigest = await remoteAssetDigest({ token, apiUrl, repository, asset });
+  if (remoteDigest !== localDigest) throw new Error(`release asset read-back mismatch for ${assetName}`);
+  return { action: "uploaded", name: assetName, digest: localDigest, url: asset.browser_download_url };
+}
+
+function appendOutput(name, value) {
+  if (process.env.GITHUB_OUTPUT) fs.appendFileSync(process.env.GITHUB_OUTPUT, `${name}=${String(value)}\n`);
+}
+
+async function main() {
+  const options = parseArgs(process.argv.slice(2));
+  const token = required(process.env.GITHUB_TOKEN || process.env.GH_TOKEN, "GITHUB_TOKEN");
+  const apiUrl = (process.env.GITHUB_API_URL || "https://api.github.com").replace(/\/$/, "");
+  const repository = required(options.repository || process.env.GITHUB_REPOSITORY, "repository");
+  const tag = required(options.tag, "tag");
+  const subjectPath = path.resolve(required(options.subject, "subject"));
+  const manifestPath = path.resolve(required(options.manifest, "manifest"));
+  const passportPath = path.resolve(required(options.passport, "passport"));
+  const bundlePath = path.resolve(required(options.bundle, "bundle"));
+  const evidencePath = path.resolve(required(options.evidence, "evidence"));
+  const predicatePath = path.resolve(required(options.predicate, "predicate"));
+  const providerVerificationPath = path.resolve(required(options["provider-verification"], "provider-verification"));
+  const receiptPath = path.resolve(required(options.receipt, "receipt"));
+  const evidence = readJson(evidencePath, "Buildchain attestation evidence");
+  const plan = createGitHubArtifactAttestationVerificationPlan({ artifactPath: subjectPath, bundlePath, evidence });
+  const provider = spawnSync(plan.command, plan.args, { encoding: "utf8", env: process.env });
+  if (provider.status !== 0) throw new Error(`gh attestation verify failed: ${String(provider.stderr || provider.stdout).slice(0, 1000)}`);
+  const verificationResults = JSON.parse(provider.stdout);
+  const local = verifyGitHubArtifactAttestationEvidence({
+    artifactPath: subjectPath,
+    platformManifestPath: manifestPath,
+    releasePassportPath: passportPath,
+    bundlePath,
+    evidence,
+    verificationResults,
+  });
+  if (!local.ok) throw new Error(`Buildchain evidence verification failed: ${local.issues.map((issue) => issue.message).join("; ")}`);
+  const retainedProvider = readJson(providerVerificationPath, "retained provider verification");
+  const retained = verifyGitHubArtifactAttestationEvidence({
+    artifactPath: subjectPath,
+    platformManifestPath: manifestPath,
+    releasePassportPath: passportPath,
+    bundlePath,
+    evidence,
+    verificationResults: retainedProvider,
+  });
+  if (!retained.ok) {
+    throw new Error(`retained provider verification failed: ${retained.issues.map((issue) => issue.message).join("; ")}`);
+  }
+  const releaseResponse = await api({ token, apiUrl, route: `/repos/${repository}/releases/tags/${encodeURIComponent(tag)}` });
+  const release = await releaseResponse.json();
+  const stem = safeAssetStem(evidence.subject?.name);
+  const declarations = [
+    [bundlePath, `${stem}.sigstore-bundle.json`],
+    [evidencePath, `${stem}.buildchain-attestation.json`],
+    [predicatePath, `${stem}.buildchain-predicate.json`],
+    [providerVerificationPath, `${stem}.github-verification.json`],
+  ];
+  const assets = [];
+  for (const [filePath, assetName] of declarations) {
+    assets.push(await uploadImmutable({ token, apiUrl, repository, release, filePath, assetName }));
+  }
+  const receipt = {
+    contract: "buildchain.github-artifact-attestation-publication/v1",
+    repository,
+    tag,
+    releaseUrl: release.html_url,
+    subject: evidence.subject,
+    evidenceRoot: evidence.evidenceRoot,
+    attestation: evidence.attestation,
+    assets,
+    verified: true,
+  };
+  fs.mkdirSync(path.dirname(receiptPath), { recursive: true });
+  fs.writeFileSync(receiptPath, `${JSON.stringify(receipt, null, 2)}\n`);
+  const receiptAsset = await uploadImmutable({
+    token,
+    apiUrl,
+    repository,
+    release,
+    filePath: receiptPath,
+    assetName: `${stem}.buildchain-attestation-publication.json`,
+  });
+  appendOutput("release-url", release.html_url);
+  appendOutput("evidence-root", evidence.evidenceRoot);
+  appendOutput("publication-receipt", receiptPath);
+  appendOutput("publication-receipt-digest", receiptAsset.digest);
+  process.stdout.write(`${JSON.stringify({ ...receipt, receiptAsset }, null, 2)}\n`);
+}
+
+main().catch((error) => {
+  console.error(error.message);
+  process.exitCode = 1;
+});