@kungfu-tech/buildchain 3.0.2-alpha.0 → 3.0.2-alpha.10

package/scripts/seal-artifact-signing-requests.mjs

@@ -0,0 +1,368 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+import {
+  createArtifactSigningRequest,
+  validateArtifactSigningRequest,
+} from "../packages/core/artifact-signing.js";
+import { loadBuildchainConfig } from "../packages/core/buildchain-config.js";
+import { writeGitHubOutputs } from "./build-contract-core.mjs";
+
+const INDEX_CONTRACT = "kungfu-buildchain-artifact-signing-request-index/v1";
+
+function required(value, label) {
+  const normalized = String(value || "").trim();
+  if (!normalized) throw new Error(`${label} is required`);
+  return normalized;
+}
+
+function toPosix(value) {
+  return String(value || "")
+    .split(path.sep)
+    .join("/");
+}
+
+function sha256File(filePath) {
+  const hash = crypto.createHash("sha256");
+  hash.update(fs.readFileSync(filePath));
+  return `sha256:${hash.digest("hex")}`;
+}
+
+function safeId(value) {
+  const normalized = String(value || "")
+    .trim()
+    .replace(/[^A-Za-z0-9._-]+/gu, "-")
+    .replace(/^-+|-+$/gu, "");
+  if (!normalized || normalized === "." || normalized === "..") {
+    throw new Error(`unsafe artifact signing id: ${value}`);
+  }
+  return normalized;
+}
+
+function assertInside(root, target, label) {
+  const relative = path.relative(root, target);
+  if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) {
+    if (path.resolve(root) !== path.resolve(target)) {
+      throw new Error(`${label} must stay inside the build workspace`);
+    }
+  }
+}
+
+function walkSubject(subjectRoot) {
+  const entries = [];
+  function visit(current) {
+    const stat = fs.lstatSync(current);
+    const relative = toPosix(path.relative(subjectRoot, current)) || ".";
+    if (stat.isSymbolicLink()) {
+      const target = fs.readlinkSync(current);
+      const resolved = path.resolve(path.dirname(current), target);
+      assertInside(subjectRoot, resolved, `artifact symlink ${relative}`);
+      entries.push({ path: relative, type: "symlink", target });
+      return;
+    }
+    if (stat.isDirectory()) {
+      if (relative !== ".") entries.push({ path: relative, type: "directory" });
+      for (const name of fs.readdirSync(current).sort())
+        visit(path.join(current, name));
+      return;
+    }
+    if (!stat.isFile())
+      throw new Error(`unsupported artifact filesystem entry: ${relative}`);
+    entries.push({
+      path: relative,
+      type: "file",
+      bytes: stat.size,
+      digest: sha256File(current),
+    });
+  }
+  visit(subjectRoot);
+  return entries;
+}
+
+function subjectDescriptor(subjectPath) {
+  const stat = fs.lstatSync(subjectPath);
+  if (stat.isSymbolicLink())
+    throw new Error("artifact root must not be a symlink");
+  if (stat.isFile()) {
+    return {
+      bytes: stat.size,
+      digest: sha256File(subjectPath),
+      entries: [
+        {
+          path: path.basename(subjectPath),
+          bytes: stat.size,
+          digest: sha256File(subjectPath),
+        },
+      ],
+    };
+  }
+  if (!stat.isDirectory())
+    throw new Error("artifact must be a regular file or directory");
+  const entries = walkSubject(subjectPath);
+  const bytes = entries.reduce((sum, entry) => sum + (entry.bytes || 0), 0);
+  const digest = `sha256:${crypto
+    .createHash("sha256")
+    .update(JSON.stringify(entries))
+    .digest("hex")}`;
+  return { bytes, digest, entries };
+}
+
+function normalizePlatform(value) {
+  const normalized = String(value || "")
+    .trim()
+    .toLowerCase();
+  if (["macos", "mac", "darwin"].includes(normalized)) return "macos";
+  if (["windows", "win32", "win"].includes(normalized)) return "windows";
+  if (normalized === "linux") return "linux";
+  return normalized;
+}
+
+function inferKind(subjectPath, declaredKind) {
+  if (declaredKind && declaredKind !== "auto") return declaredKind;
+  const lower = subjectPath.toLowerCase();
+  const stat = fs.statSync(subjectPath);
+  if (lower.endsWith(".app")) return "app-bundle";
+  if (lower.endsWith(".framework")) return "framework-bundle";
+  if (lower.endsWith(".xpc")) return "xpc-bundle";
+  if (lower.endsWith(".plugin")) return "plugin-bundle";
+  if (lower.endsWith(".dylib")) return "dylib";
+  if (lower.endsWith(".pkg")) return "pkg";
+  if (lower.endsWith(".dmg")) return "dmg";
+  if (stat.isDirectory()) return "directory";
+  if (/\.(?:zip|tar|tgz|gz|bz2|xz|7z)$/u.test(lower)) return "archive";
+  return "binary";
+}
+
+function run(command, args) {
+  const result = spawnSync(command, args, {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  if (result.error || result.status !== 0) {
+    throw (
+      result.error ||
+      new Error(
+        `${path.basename(command)} failed with status ${result.status}: ${(result.stderr || result.stdout || "").trim().slice(0, 1200)}`,
+      )
+    );
+  }
+}
+
+function archiveSubject({ subjectPath, outputRoot, id, kind, platform }) {
+  const artifactRoot = path.join(outputRoot, id);
+  fs.mkdirSync(artifactRoot, { recursive: true });
+  const stat = fs.statSync(subjectPath);
+  let archivePath;
+  let format;
+  if (stat.isFile()) {
+    archivePath = path.join(artifactRoot, path.basename(subjectPath));
+    fs.copyFileSync(subjectPath, archivePath, fs.constants.COPYFILE_EXCL);
+    format = "exact-file";
+  } else if (
+    platform === "macos" &&
+    ["app-bundle", "framework-bundle", "plugin-bundle", "xpc-bundle"].includes(
+      kind,
+    )
+  ) {
+    archivePath = path.join(artifactRoot, "subject.ditto.zip");
+    run("/usr/bin/ditto", [
+      "-c",
+      "-k",
+      "--sequesterRsrc",
+      "--keepParent",
+      subjectPath,
+      archivePath,
+    ]);
+    format = "ditto-zip";
+  } else {
+    archivePath = path.join(artifactRoot, "subject.tar");
+    run("tar", [
+      "-cf",
+      archivePath,
+      "-C",
+      path.dirname(subjectPath),
+      path.basename(subjectPath),
+    ]);
+    format = "tar";
+  }
+  return {
+    file: toPosix(path.relative(outputRoot, archivePath)),
+    format,
+    bytes: fs.statSync(archivePath).size,
+    digest: sha256File(archivePath),
+  };
+}
+
+function verifyLifecycleBinding({
+  manifest,
+  workspace,
+  subjectPath,
+  descriptor,
+}) {
+  const byPath = new Map(
+    (manifest.files || []).map((entry) => [toPosix(entry.path), entry]),
+  );
+  const relativeSubject = toPosix(path.relative(workspace, subjectPath));
+  const files = descriptor.entries.filter(
+    (entry) => entry.type !== "directory",
+  );
+  for (const entry of files) {
+    if (entry.type === "symlink") continue;
+    const manifestPath = fs.statSync(subjectPath).isFile()
+      ? relativeSubject
+      : `${relativeSubject}/${entry.path}`;
+    const observed = byPath.get(manifestPath);
+    if (!observed)
+      throw new Error(
+        `signed artifact file is absent from lifecycle manifest: ${manifestPath}`,
+      );
+    if (
+      `sha256:${observed.sha256}` !== entry.digest ||
+      Number(observed.size) !== entry.bytes
+    ) {
+      throw new Error(
+        `signed artifact file does not match lifecycle manifest: ${manifestPath}`,
+      );
+    }
+  }
+}
+
+export function sealArtifactSigningRequests({
+  workspace = process.env.GITHUB_WORKSPACE || process.cwd(),
+  cwd = process.env.BUILDCHAIN_SIGNING_CWD || ".",
+  manifestPath = process.env.BUILDCHAIN_SIGNING_ARTIFACT_MANIFEST,
+  outputRoot = process.env.BUILDCHAIN_SIGNING_OUTPUT_ROOT ||
+    ".buildchain/signing/requests",
+  repository = process.env.BUILDCHAIN_SOURCE_REPOSITORY ||
+    process.env.GITHUB_REPOSITORY,
+  sourceSha = process.env.BUILDCHAIN_SOURCE_SHA || process.env.GITHUB_SHA,
+  sourceTreeSha = process.env.BUILDCHAIN_SOURCE_TREE_SHA,
+  runtimeSha = process.env.BUILDCHAIN_RUNTIME_SHA,
+  platformId = process.env.BUILDCHAIN_PLATFORM_ID,
+} = {}) {
+  const resolvedWorkspace = path.resolve(workspace);
+  const resolvedCwd = path.resolve(resolvedWorkspace, cwd);
+  assertInside(resolvedWorkspace, resolvedCwd, "signing working directory");
+  const loaded = loadBuildchainConfig(resolvedCwd);
+  const declarations = loaded?.config?.signing?.artifacts || [];
+  const selected = declarations.filter(
+    (entry) =>
+      entry.platforms.length === 0 || entry.platforms.includes(platformId),
+  );
+  const resolvedOutputRoot = path.resolve(resolvedWorkspace, outputRoot);
+  assertInside(resolvedWorkspace, resolvedOutputRoot, "signing request output");
+  fs.mkdirSync(resolvedOutputRoot, { recursive: true });
+  if (selected.length === 0) {
+    const index = { schemaVersion: 1, contract: INDEX_CONTRACT, requests: [] };
+    const indexPath = path.join(resolvedOutputRoot, "index.json");
+    fs.writeFileSync(indexPath, `${JSON.stringify(index, null, 2)}\n`);
+    writeGitHubOutputs({
+      "request-count": "0",
+      "request-index": indexPath,
+      "request-root": resolvedOutputRoot,
+    });
+    return index;
+  }
+  const resolvedManifest = path.resolve(
+    resolvedWorkspace,
+    required(manifestPath, "artifact manifest path"),
+  );
+  assertInside(resolvedWorkspace, resolvedManifest, "artifact manifest");
+  const manifest = JSON.parse(fs.readFileSync(resolvedManifest, "utf8"));
+  const platform = normalizePlatform(manifest.platform?.os || process.platform);
+  const requests = [];
+  for (const declaration of selected) {
+    const subjectPath = path.resolve(resolvedCwd, declaration.path);
+    assertInside(
+      resolvedWorkspace,
+      subjectPath,
+      `signing artifact ${declaration.id}`,
+    );
+    if (!fs.existsSync(subjectPath))
+      throw new Error(
+        `declared signing artifact does not exist: ${declaration.path}`,
+      );
+    const realSubject = fs.realpathSync(subjectPath);
+    assertInside(
+      resolvedWorkspace,
+      realSubject,
+      `signing artifact ${declaration.id}`,
+    );
+    const descriptor = subjectDescriptor(subjectPath);
+    verifyLifecycleBinding({
+      manifest,
+      workspace: resolvedWorkspace,
+      subjectPath,
+      descriptor,
+    });
+    const id = safeId(declaration.id);
+    const kind = inferKind(subjectPath, declaration.kind);
+    const transport = archiveSubject({
+      subjectPath,
+      outputRoot: resolvedOutputRoot,
+      id,
+      kind,
+      platform,
+    });
+    const request = createArtifactSigningRequest({
+      source: { repository, sha: sourceSha, treeSha: sourceTreeSha },
+      runtime: { repository: "kungfu-systems/buildchain", sha: runtimeSha },
+      artifact: {
+        id: declaration.id,
+        path: toPosix(path.relative(resolvedWorkspace, subjectPath)),
+        kind,
+        platform,
+        arch: String(manifest.platform?.arch || process.arch).toLowerCase(),
+        bytes: descriptor.bytes,
+        digest: descriptor.digest,
+        transport,
+      },
+      signature: {
+        profile: declaration.profile,
+        required: declaration.required,
+      },
+    });
+    const check = validateArtifactSigningRequest(request);
+    if (!check.ok)
+      throw new Error(
+        `generated signing request is invalid: ${check.issues.join(", ")}`,
+      );
+    const requestPath = path.join(resolvedOutputRoot, id, "request.json");
+    fs.writeFileSync(requestPath, `${JSON.stringify(request, null, 2)}\n`);
+    requests.push({
+      id: declaration.id,
+      digest: request.digest,
+      path: toPosix(path.relative(resolvedOutputRoot, requestPath)),
+      required: request.signature.required,
+      profile: request.signature.profile,
+      platform: request.artifact.platform,
+    });
+  }
+  const index = { schemaVersion: 1, contract: INDEX_CONTRACT, requests };
+  const indexPath = path.join(resolvedOutputRoot, "index.json");
+  fs.writeFileSync(indexPath, `${JSON.stringify(index, null, 2)}\n`);
+  writeGitHubOutputs({
+    "request-count": String(requests.length),
+    "request-index": indexPath,
+    "request-root": resolvedOutputRoot,
+  });
+  return index;
+}
+
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(process.argv[1]).href
+) {
+  try {
+    sealArtifactSigningRequests();
+  } catch (error) {
+    console.error(
+      `::error::${String(error?.message || error).replace(/\r?\n/gu, "%0A")}`,
+    );
+    process.exitCode = 1;
+  }
+}

package/scripts/shifu-gate-profile.mjs

@@ -114,10 +114,24 @@ export function prepareGateExecutionFiles(files) {
   for (const file of files) fs.rmSync(file, { force: true });
 }
 
+export function commandSpawnOptions({
+  cwd,
+  env = process.env,
+  streamOutput = false,
+} = {}) {
+  if (streamOutput) return { cwd, env, stdio: "inherit" };
+  return {
+    cwd,
+    env,
+    encoding: "utf8",
+    maxBuffer: 16 * 1024 * 1024,
+  };
+}
+
 function runArgv(
   argv,
   args,
-  { cwd, env = process.env, allowFailure = false } = {},
+  { cwd, env = process.env, allowFailure = false, streamOutput = false } = {},
 ) {
   const command = argv[0];
   const commandArgs = [...argv.slice(1), ...args];
@@ -126,25 +140,12 @@ function runArgv(
   const batchInvocation = windowsBatch
     ? windowsBatchInvocation(command, commandArgs, { cwd })
     : null;
+  const spawnOptions = commandSpawnOptions({ cwd, env, streamOutput });
   const result = windowsBatch
-    ? spawnSync(
-        batchInvocation.command,
-        batchInvocation.args,
-        {
-          cwd,
-          env,
-          encoding: "utf8",
-          maxBuffer: 16 * 1024 * 1024,
-        },
-      )
-    : spawnSync(command, commandArgs, {
-        cwd,
-        env,
-        encoding: "utf8",
-        maxBuffer: 16 * 1024 * 1024,
-      });
-  if (result.stdout) process.stdout.write(result.stdout);
-  if (result.stderr) process.stderr.write(result.stderr);
+    ? spawnSync(batchInvocation.command, batchInvocation.args, spawnOptions)
+    : spawnSync(command, commandArgs, spawnOptions);
+  if (!streamOutput && result.stdout) process.stdout.write(result.stdout);
+  if (!streamOutput && result.stderr) process.stderr.write(result.stderr);
   if (result.error) throw result.error;
   const status = result.status ?? 1;
   if (!allowFailure && status !== 0)
@@ -257,7 +258,12 @@ function runMode() {
     ],
     registry,
   );
-  const runResult = runArgv(argv, runArgs, { cwd, env, allowFailure: true });
+  const runResult = runArgv(argv, runArgs, {
+    cwd,
+    env,
+    allowFailure: true,
+    streamOutput: true,
+  });
   let receipt = fs.existsSync(receiptPath)
     ? readJson(receiptPath, "Shifu gate receipt")
     : null;

package/scripts/sign-detached-artifact-requests.mjs

@@ -0,0 +1,237 @@
+#!/usr/bin/env node
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+import {
+  createArtifactSigningReceipt,
+  validateArtifactSigningRequest,
+} from "../packages/core/artifact-signing.js";
+import {
+  artifactSigningEvidenceDigest,
+  createArtifactSigningResult,
+} from "../packages/core/artifact-signing-result.js";
+import { signDetachedArtifactRequest } from "../packages/core/detached-artifact-signature.js";
+import { writeGitHubOutputs } from "./build-contract-core.mjs";
+
+function required(value, label) {
+  const normalized = String(value || "").trim();
+  if (!normalized) throw new Error(`${label} is required`);
+  return normalized;
+}
+
+function sha256File(filePath) {
+  const hash = crypto.createHash("sha256");
+  hash.update(fs.readFileSync(filePath));
+  return `sha256:${hash.digest("hex")}`;
+}
+
+function resolveInside(root, relative, label) {
+  const resolvedRoot = path.resolve(root);
+  const resolved = path.resolve(resolvedRoot, required(relative, label));
+  const rel = path.relative(resolvedRoot, resolved);
+  if (!rel || rel.startsWith("..") || path.isAbsolute(rel)) {
+    throw new Error(`${label} must resolve below its declared root`);
+  }
+  return resolved;
+}
+
+function decodePrivateKey(value) {
+  const compact = required(value, "detached signing private key").replace(
+    /\s+/gu,
+    "",
+  );
+  if (compact.length % 4 !== 0 || !/^[A-Za-z0-9+/]*={0,2}$/u.test(compact)) {
+    throw new Error("detached signing private key must be canonical base64");
+  }
+  const decoded = Buffer.from(compact, "base64");
+  if (decoded.length < 32 || decoded.length > 16 * 1024) {
+    throw new Error("detached signing private key has an invalid size");
+  }
+  return crypto.createPrivateKey({
+    key: decoded,
+    format: "der",
+    type: "pkcs8",
+  });
+}
+
+export function signDetachedArtifactRequests({
+  inputRoot = process.env.BUILDCHAIN_SIGNING_REQUEST_ROOT,
+  outputRoot = process.env.BUILDCHAIN_SIGNING_RESULT_ROOT,
+  privateKeyBase64 = process.env.BUILDCHAIN_DETACHED_PRIVATE_KEY_PKCS8_BASE64,
+  keyId = process.env.BUILDCHAIN_DETACHED_KEY_ID,
+  artifactId = process.env.BUILDCHAIN_SIGNING_ARTIFACT_ID,
+} = {}) {
+  const resolvedInput = path.resolve(
+    required(inputRoot, "signing request root"),
+  );
+  const resolvedOutput = path.resolve(
+    required(outputRoot, "signing result root"),
+  );
+  fs.mkdirSync(resolvedOutput, { recursive: true });
+  const index = JSON.parse(
+    fs.readFileSync(path.join(resolvedInput, "index.json"), "utf8"),
+  );
+  if (
+    index.contract !== "kungfu-buildchain-artifact-signing-request-index/v1"
+  ) {
+    throw new Error("artifact signing request index contract mismatch");
+  }
+  const privateKey = decodePrivateKey(privateKeyBase64);
+  const results = [];
+  for (const entry of index.requests || []) {
+    const requestPath = resolveInside(
+      resolvedInput,
+      entry.path,
+      "signing request path",
+    );
+    const request = JSON.parse(fs.readFileSync(requestPath, "utf8"));
+    const check = validateArtifactSigningRequest(request);
+    if (!check.ok)
+      throw new Error(
+        `invalid artifact signing request: ${check.issues.join(", ")}`,
+      );
+    if (request.digest !== entry.digest)
+      throw new Error("signing request index digest mismatch");
+    if (artifactId && request.artifact.id !== artifactId) continue;
+    if (request.signature.profile !== "detached-signature-v1") continue;
+    const transport = request.artifact.transport;
+    if (transport?.format !== "exact-file") {
+      throw new Error(
+        "detached signing currently requires an exact-file transport",
+      );
+    }
+    const payloadPath = resolveInside(
+      resolvedInput,
+      transport.file,
+      "signing payload path",
+    );
+    const bytes = fs.statSync(payloadPath).size;
+    const digest = sha256File(payloadPath);
+    if (
+      bytes !== transport.bytes ||
+      digest !== transport.digest ||
+      bytes !== request.artifact.bytes ||
+      digest !== request.artifact.digest
+    ) {
+      throw new Error(
+        "detached signing payload does not match the sealed request",
+      );
+    }
+    const signed = signDetachedArtifactRequest({ request, privateKey, keyId });
+    const resultDirectory = path.join(
+      resolvedOutput,
+      path.basename(path.dirname(requestPath)),
+    );
+    fs.mkdirSync(resultDirectory, { recursive: true });
+    const envelopePath = path.join(resultDirectory, "signature.json");
+    const receiptPath = path.join(resultDirectory, "receipt.json");
+    const envelopeText = `${JSON.stringify(signed.envelope, null, 2)}\n`;
+    fs.writeFileSync(envelopePath, envelopeText);
+    const evidence = [
+      {
+        kind: "ed25519-detached",
+        path: "signature.json",
+        digest: sha256File(envelopePath),
+      },
+    ];
+    const receipt = createArtifactSigningReceipt({
+      request,
+      authority: { runtimeSha: request.runtime.sha },
+      result: {
+        artifactDigest: request.artifact.digest,
+        evidenceDigest: artifactSigningEvidenceDigest(evidence),
+      },
+      signatures: [
+        {
+          kind: "ed25519-detached",
+          digest: signed.envelope.digest,
+        },
+      ],
+    });
+    fs.writeFileSync(
+      receiptPath,
+      `${JSON.stringify(receipt, null, 2)}\n`,
+    );
+    const payloadDirectory = path.join(resultDirectory, "payload");
+    fs.mkdirSync(payloadDirectory, { recursive: true });
+    const payloadOutputPath = path.join(
+      payloadDirectory,
+      path.basename(payloadPath),
+    );
+    fs.copyFileSync(payloadPath, payloadOutputPath, fs.constants.COPYFILE_EXCL);
+    const result = createArtifactSigningResult({
+      request,
+      receipt,
+      receiptPath: "receipt.json",
+      payload: {
+        path: `payload/${path.basename(payloadOutputPath)}`,
+        bytes,
+        digest,
+      },
+      evidence,
+      verification: {
+        status: "passed",
+        provider: request.signature.provider,
+        checks: ["sealed-payload-digest", "ed25519-signature-created"],
+      },
+    });
+    const resultPath = path.join(resultDirectory, "result.json");
+    fs.writeFileSync(resultPath, `${JSON.stringify(result, null, 2)}\n`);
+    results.push({
+      id: entry.id,
+      requestDigest: request.digest,
+      resultDigest: result.digest,
+      result: path
+        .relative(resolvedOutput, resultPath)
+        .split(path.sep)
+        .join("/"),
+      payload: path
+        .relative(resolvedOutput, payloadOutputPath)
+        .split(path.sep)
+        .join("/"),
+      envelope: path
+        .relative(resolvedOutput, envelopePath)
+        .split(path.sep)
+        .join("/"),
+      receipt: path
+        .relative(resolvedOutput, receiptPath)
+        .split(path.sep)
+        .join("/"),
+    });
+  }
+  const resultIndex = {
+    schemaVersion: 1,
+    contract: "kungfu-buildchain-artifact-signing-result-index/v1",
+    results,
+  };
+  if (artifactId && results.length !== 1) {
+    throw new Error(`expected one detached signing request for ${artifactId}`);
+  }
+  const resultIndexPath = path.join(resolvedOutput, "index.json");
+  fs.writeFileSync(
+    resultIndexPath,
+    `${JSON.stringify(resultIndex, null, 2)}\n`,
+  );
+  writeGitHubOutputs({
+    "result-count": String(results.length),
+    "result-index": resultIndexPath,
+    "result-root": resolvedOutput,
+  });
+  return resultIndex;
+}
+
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(process.argv[1]).href
+) {
+  try {
+    signDetachedArtifactRequests();
+  } catch (error) {
+    console.error(
+      `::error::${String(error?.message || error).replace(/\r?\n/gu, "%0A")}`,
+    );
+    process.exitCode = 1;
+  }
+}