@kungfu-tech/buildchain 3.0.2-alpha.0 → 3.0.2-alpha.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (83) hide show
  1. package/README.md +4 -2
  2. package/actions/github-artifact-attestation/README.md +10 -0
  3. package/actions/promote-buildchain-ref/README.md +7 -0
  4. package/bin/buildchain.mjs +5 -0
  5. package/bin/internal/trust-release-cli.mjs +74 -3
  6. package/contracts/auditable-demo-media-profiles-v1.json +168 -0
  7. package/contracts/evidence/auditable-demo-web-delivery-v1.json +103 -0
  8. package/contracts/fixtures/auditable-demo-web-delivery-v1/complete-transcript.txt +2 -0
  9. package/contracts/fixtures/auditable-demo-web-delivery-v1/public-projection.json +16 -0
  10. package/contracts/fixtures/auditable-demo-web-delivery-v1/scene.json +12 -0
  11. package/dist/site/artifact-schemas.json +5 -1
  12. package/dist/site/buildchain-contract.json +133 -34
  13. package/dist/site/buildchain-site.json +159 -40
  14. package/dist/site/capability-registry.json +14 -13
  15. package/dist/site/cli-registry.json +12 -0
  16. package/dist/site/controller-registry.json +72 -4
  17. package/dist/site/kfd-claims.json +338 -20
  18. package/dist/site/kfd-upstream-aggregate.json +1 -1
  19. package/dist/site/manual-registry.json +24 -9
  20. package/dist/site/node-api-registry.json +89 -11
  21. package/dist/site/page-registry.json +135 -25
  22. package/dist/site/public-surface-audit.json +203 -21
  23. package/dist/site/publication-authority-registry.json +72 -2
  24. package/dist/site/publication-registry.json +4 -4
  25. package/dist/site/release-model.json +2 -1
  26. package/dist/site/release-passport-check-manifest.json +1 -0
  27. package/dist/site/release-provenance.json +6 -0
  28. package/dist/site/schemas/release-passport-v1.schema.json +6 -0
  29. package/dist/site/site-manifest.json +21 -13
  30. package/dist/site/workflow-registry.json +167 -13
  31. package/docs/MAP.md +5 -1
  32. package/docs/auditable-demo.md +55 -3
  33. package/docs/binary-distribution.md +7 -0
  34. package/docs/cli.md +9 -0
  35. package/docs/dev-alpha-candidate-patrol.md +111 -0
  36. package/docs/github-artifact-attestation.md +219 -0
  37. package/docs/release-governance.md +32 -0
  38. package/docs/release-passport.md +13 -0
  39. package/docs/reusable-build-surface.md +83 -61
  40. package/docs/runtime-train-validation.md +21 -0
  41. package/docs/versioning.md +1 -0
  42. package/package.json +8 -1
  43. package/packages/core/artifact-signing-result.js +228 -0
  44. package/packages/core/artifact-signing.js +412 -0
  45. package/packages/core/buildchain-config.js +58 -0
  46. package/packages/core/buildchain-contract.js +14 -0
  47. package/packages/core/buildchain-kfd-claims.js +5 -0
  48. package/packages/core/buildchain-publication-authority.js +3 -0
  49. package/packages/core/cache-evidence.js +288 -0
  50. package/packages/core/channel-candidate.js +186 -0
  51. package/packages/core/detached-artifact-signature.js +121 -0
  52. package/packages/core/diagnostics.js +276 -10
  53. package/packages/core/github-artifact-attestation.js +642 -0
  54. package/packages/core/github-governance-authority.js +77 -16
  55. package/packages/core/index.js +62 -0
  56. package/packages/core/publication-authority.js +1 -1
  57. package/packages/core/release-passport-contract.js +2 -0
  58. package/packages/core/release-passport.js +60 -3
  59. package/scripts/auditable-demo.mjs +520 -28
  60. package/scripts/build-contract-core.mjs +31 -0
  61. package/scripts/buildchain-channel-router.mjs +8 -2
  62. package/scripts/check-inventory.mjs +9 -0
  63. package/scripts/create-github-artifact-attestation-policy.mjs +62 -0
  64. package/scripts/dev-alpha-candidate-patrol.mjs +864 -0
  65. package/scripts/dispatch-artifact-signing-authority.mjs +152 -0
  66. package/scripts/finalize-native-artifact-signing-result.mjs +96 -0
  67. package/scripts/generate-channel-promotion-workflow.mjs +6 -0
  68. package/scripts/generate-site-bundle.mjs +20 -0
  69. package/scripts/import-artifact-signing-results.mjs +76 -0
  70. package/scripts/inspect-artifact-signing-requests.mjs +101 -0
  71. package/scripts/locked-source-checkout.mjs +48 -0
  72. package/scripts/materialize-artifact-signing-request.mjs +66 -0
  73. package/scripts/merge-artifact-signing-results.mjs +76 -0
  74. package/scripts/publish-github-artifact-attestation-evidence.mjs +201 -0
  75. package/scripts/reconcile-github-governance.mjs +158 -25
  76. package/scripts/release-candidate-resolver.mjs +12 -0
  77. package/scripts/release-line-policy.mjs +27 -0
  78. package/scripts/runtime-ref-core.mjs +10 -6
  79. package/scripts/seal-artifact-signing-requests.mjs +368 -0
  80. package/scripts/shifu-gate-profile.mjs +26 -20
  81. package/scripts/sign-detached-artifact-requests.mjs +237 -0
  82. package/scripts/stage-github-artifact-attestation-inputs.mjs +65 -0
  83. package/scripts/verify-artifact-signing-results.mjs +99 -0
package/dist/site/capability-registry.json CHANGED
@@ -15,7 +15,7 @@
15
15
  "maturity": "stable",
16
16
  "counts": {
17
17
  "manualCount": 3,
18
- "pageCount": 10,
18
+ "pageCount": 11,
19
19
  "cliCommandCount": 5,
20
20
  "nodeApiCount": 0,
21
21
  "workflowCount": 0,
@@ -47,15 +47,16 @@
47
47
  ],
48
48
  "maturity": "stable",
49
49
  "counts": {
50
- "manualCount": 4,
51
- "pageCount": 4,
52
- "cliCommandCount": 21,
53
- "nodeApiCount": 8,
54
- "workflowCount": 2,
55
- "actionCount": 1
50
+ "manualCount": 5,
51
+ "pageCount": 5,
52
+ "cliCommandCount": 22,
53
+ "nodeApiCount": 11,
54
+ "workflowCount": 3,
55
+ "actionCount": 2
56
56
  },
57
57
  "manuals": [
58
58
  "docs/release-passport.md",
59
+ "docs/github-artifact-attestation.md",
59
60
  "docs/publication-authority.md",
60
61
  "docs/binary-distribution.md",
61
62
  "docs/publish-transaction.md"
@@ -84,7 +85,7 @@
84
85
  "manualCount": 5,
85
86
  "pageCount": 17,
86
87
  "cliCommandCount": 4,
87
- "nodeApiCount": 5,
88
+ "nodeApiCount": 6,
88
89
  "workflowCount": 4,
89
90
  "actionCount": 2
90
91
  },
@@ -218,7 +219,7 @@
218
219
  "manualCount": 3,
219
220
  "pageCount": 3,
220
221
  "cliCommandCount": 13,
221
- "nodeApiCount": 6,
222
+ "nodeApiCount": 7,
222
223
  "workflowCount": 0,
223
224
  "actionCount": 1
224
225
  },
@@ -251,8 +252,8 @@
251
252
  "manualCount": 8,
252
253
  "pageCount": 8,
253
254
  "cliCommandCount": 8,
254
- "nodeApiCount": 4,
255
- "workflowCount": 11,
255
+ "nodeApiCount": 5,
256
+ "workflowCount": 12,
256
257
  "actionCount": 0
257
258
  },
258
259
  "manuals": [
@@ -287,10 +288,10 @@
287
288
  "maturity": "stable",
288
289
  "counts": {
289
290
  "manualCount": 1,
290
- "pageCount": 7,
291
+ "pageCount": 8,
291
292
  "cliCommandCount": 0,
292
293
  "nodeApiCount": 2,
293
- "workflowCount": 35,
294
+ "workflowCount": 37,
294
295
  "actionCount": 1
295
296
  },
296
297
  "manuals": [
package/dist/site/cli-registry.json CHANGED
@@ -1085,6 +1085,18 @@
1085
1085
  ],
1086
1086
  "maturity": "stable"
1087
1087
  },
1088
+ {
1089
+ "id": "verify-github-artifact-attestation",
1090
+ "source": "bin/buildchain.mjs",
1091
+ "usage": "buildchain verify github-artifact-attestation <artifact>",
1092
+ "purpose": "Verify GitHub keyless attestation identity plus local artifact, manifest, Passport, predicate, bundle, and evidence bindings.",
1093
+ "capabilityGroup": "release-passport-trust",
1094
+ "audience": [
1095
+ "agent",
1096
+ "operator"
1097
+ ],
1098
+ "maturity": "stable"
1099
+ },
1088
1100
  {
1089
1101
  "id": "verify-infra-contract-evidence-bundle",
1090
1102
  "source": "bin/buildchain.mjs",
package/dist/site/controller-registry.json CHANGED
@@ -118,6 +118,10 @@
118
118
  "classification": "redacted",
119
119
  "source": "workflow-call-secret"
120
120
  },
121
+ "BUILDCHAIN_PROMOTION_TOKEN": {
122
+ "classification": "redacted",
123
+ "source": "workflow-call-secret"
124
+ },
121
125
  "artifact-name": {
122
126
  "classification": "included",
123
127
  "source": "workflow-call-input"
@@ -190,6 +194,18 @@
190
194
  "classification": "included",
191
195
  "source": "workflow-call-input"
192
196
  },
197
+ "cache-dependency-lock-root": {
198
+ "classification": "included",
199
+ "source": "workflow-call-input"
200
+ },
201
+ "cache-policy-root": {
202
+ "classification": "included",
203
+ "source": "workflow-call-input"
204
+ },
205
+ "cache-toolchain-root": {
206
+ "classification": "included",
207
+ "source": "workflow-call-input"
208
+ },
193
209
  "cargo-registry-index": {
194
210
  "classification": "digest-only",
195
211
  "source": "workflow-call-input"
@@ -254,6 +270,18 @@
254
270
  "classification": "digest-only",
255
271
  "source": "workflow-call-input"
256
272
  },
273
+ "github-artifact-attestation-platform-id": {
274
+ "classification": "included",
275
+ "source": "workflow-call-input"
276
+ },
277
+ "github-artifact-attestation-signer-sha": {
278
+ "classification": "included",
279
+ "source": "workflow-call-input"
280
+ },
281
+ "github-artifact-attestation-subject-path": {
282
+ "classification": "digest-only",
283
+ "source": "workflow-call-input"
284
+ },
257
285
  "install-command": {
258
286
  "classification": "digest-only",
259
287
  "source": "workflow-call-input"
@@ -427,7 +455,7 @@
427
455
  "controller-receipt"
428
456
  ]
429
457
  },
430
- "digest": "sha256:79920272446ddef3cc1e28c23f9efc4192e51d603fb5bf3ab1060b15342980c8"
458
+ "digest": "sha256:146718143cc50e48ac57154aade4a4b06a8df4e036708a150233098d3c1cb6f7"
431
459
  },
432
460
  {
433
461
  "schemaVersion": 1,
@@ -471,6 +499,10 @@
471
499
  "classification": "redacted",
472
500
  "source": "workflow-call-secret"
473
501
  },
502
+ "BUILDCHAIN_PROMOTION_TOKEN": {
503
+ "classification": "redacted",
504
+ "source": "workflow-call-secret"
505
+ },
474
506
  "artifact-name": {
475
507
  "classification": "included",
476
508
  "source": "workflow-call-input"
@@ -555,6 +587,18 @@
555
587
  "classification": "digest-only",
556
588
  "source": "workflow-call-input"
557
589
  },
590
+ "cache-dependency-lock-root": {
591
+ "classification": "included",
592
+ "source": "workflow-call-input"
593
+ },
594
+ "cache-policy-root": {
595
+ "classification": "included",
596
+ "source": "workflow-call-input"
597
+ },
598
+ "cache-toolchain-root": {
599
+ "classification": "included",
600
+ "source": "workflow-call-input"
601
+ },
558
602
  "cargo-registry-index": {
559
603
  "classification": "digest-only",
560
604
  "source": "workflow-call-input"
@@ -619,6 +663,18 @@
619
663
  "classification": "digest-only",
620
664
  "source": "workflow-call-input"
621
665
  },
666
+ "github-artifact-attestation-platform-id": {
667
+ "classification": "included",
668
+ "source": "workflow-call-input"
669
+ },
670
+ "github-artifact-attestation-signer-sha": {
671
+ "classification": "included",
672
+ "source": "workflow-call-input"
673
+ },
674
+ "github-artifact-attestation-subject-path": {
675
+ "classification": "digest-only",
676
+ "source": "workflow-call-input"
677
+ },
622
678
  "install-command": {
623
679
  "classification": "digest-only",
624
680
  "source": "workflow-call-input"
@@ -773,7 +829,7 @@
773
829
  "controller-receipt"
774
830
  ]
775
831
  },
776
- "digest": "sha256:af7d22d385b6993a2039de602ce1f9d27efdad62bb2b37998a89cbaf7257c127"
832
+ "digest": "sha256:55b3189412e7da7769a8de60bd1ba4cf52d726d8b79c0a720598e49742aa72a0"
777
833
  },
778
834
  {
779
835
  "schemaVersion": 1,
@@ -1602,6 +1658,18 @@
1602
1658
  "classification": "included",
1603
1659
  "source": "workflow-call-input"
1604
1660
  },
1661
+ "github-artifact-attestation-environment": {
1662
+ "classification": "digest-only",
1663
+ "source": "workflow-call-input"
1664
+ },
1665
+ "github-artifact-attestation-policy-json": {
1666
+ "classification": "digest-only",
1667
+ "source": "workflow-call-input"
1668
+ },
1669
+ "github-artifact-attestation-retention-days": {
1670
+ "classification": "included",
1671
+ "source": "workflow-call-input"
1672
+ },
1605
1673
  "github-governance-receipt-json": {
1606
1674
  "classification": "digest-only",
1607
1675
  "source": "workflow-call-input"
@@ -1932,7 +2000,7 @@
1932
2000
  "controller-receipt"
1933
2001
  ]
1934
2002
  },
1935
- "digest": "sha256:4bd94f0bb1790c87af758b71aa592a3e22fdcd84a9851931d252e3f60cba8d40"
2003
+ "digest": "sha256:00baae93d9ed75129fdaed6fcc33285e515b8c7de84816831a39e660941dd7ae"
1936
2004
  },
1937
2005
  {
1938
2006
  "schemaVersion": 1,
@@ -2108,5 +2176,5 @@
2108
2176
  "digest": "sha256:b6f53563c0adc859bc586c05fce560a5094d7d9666438d63c5fd3e1fc4774555"
2109
2177
  }
2110
2178
  ],
2111
- "digest": "sha256:fd3dc839a88bc9b31761e241251a485c96d51ac9c010c4810422cb0425021b2d"
2179
+ "digest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4"
2112
2180
  }