@kungfu-tech/buildchain 3.0.2-alpha.1 → 3.0.2-alpha.10

package/README.md

@@ -225,8 +225,9 @@ The active reusable workflow surfaces are:
   planning, capability-aware runner dispatch, receipt validation, and one
   stable aggregate check;
 - `.github/workflows/.auditable-demo.yml` for exact-artifact demo
-  qualification, transcript-bound renderer smoke, and optional media rendering
-  from the exact passing Gate bundle;
+  qualification, transcript-bound renderer smoke, optional media rendering
+  from the exact passing Gate bundle, and opt-in content-addressed web-delivery
+  profiles with independently verified rendition roles;
 - `.github/workflows/.build.yml` for deterministic multi-platform build and
   artifact contracts;
 - `.github/workflows/build.yml` for the single-config channel router that uses
@@ -366,6 +367,7 @@ npm pack --dry-run --json --registry=https://registry.npmjs.org/
 - [Product mechanism](docs/product-mechanism.md)
 - [Release Passport and binary distribution](docs/release-passport.md)
 - [GitHub governance authority](docs/github-governance-authority.md)
+- [GitHub-native Linux artifact attestation](docs/github-artifact-attestation.md)
 - [Binary distribution details](docs/binary-distribution.md)
 - [Toolkit observability](docs/toolkit-observability.md)
 - [Site bundle contract](docs/site-bundle-contract.md)

package/actions/github-artifact-attestation/README.md

@@ -0,0 +1,10 @@
+# GitHub Artifact Attestation Evidence
+
+This internal Buildchain action validates one downloaded Linux release artifact
+against its platform manifest and Release Passport, writes the custom predicate
+consumed by `actions/attest`, and finalizes the retained v1 evidence document.
+
+Consumers should call
+`.github/workflows/github-artifact-attestation.yml`; they should not call this
+action directly. The action parses data files only. It never checks out or
+executes consumer source or the downloaded subject.

package/actions/promote-buildchain-ref/README.md

@@ -357,6 +357,13 @@ inside the final version-state workspace, after the release transaction has
 materialized generated files such as `package.json` and `dist/site/*`. This
 keeps self-hosted KFD witness hashes bound to the exact published package
 instead of to a pre-promotion checkout.
+Set `release-passport-github-artifact-attestation-policy-jsons` to one or more
+newline-separated `buildchain.github-artifact-attestation-policy/v1` paths when
+the Release Passport must require GitHub keyless provenance for Linux release
+artifacts. The higher-level v3 promotion workflow exposes the single-artifact
+`github-artifact-attestation-policy-json` input and owns staging, signing,
+provider verification, immutable GitHub Release evidence upload, and read-back;
+direct action callers own those post-Passport steps themselves.
 When present, the passport includes the aggregate build summary, platform
 artifact manifests, npm publish evidence, dist-tag promotion evidence, the
 release-state ref, trusted publishing metadata, and the Buildchain transaction

package/bin/buildchain.mjs

@@ -164,13 +164,18 @@ function usage() {
                                     [--kfd-product-gate-json <json-or-path>]...
                                     [--invariant-passport-json <json-or-path>]...
                                     [--invariant-passport-cmd <command>]
+                                    [--github-artifact-attestation-policy-json <json-or-path>]...
                                     [--kfd-agent-hub-evidence-json <json-or-path>]
                                     [--base-passport-json <json-or-path>] [--require-base-kfd]
                                     [--release-extra-json <json-or-path>]
                                     [--publish-json <json-or-path>] [--output-dir <dir>] [--json]
   buildchain create publication-admission --input-json <file-or-json> [--output <file>] [--json]
   buildchain create runner-provenance --input-json <file-or-json> [--output <file>] [--json]
+  buildchain create github-artifact-attestation-policy --input-json <file-or-json> [--output <file>] [--json]
   buildchain verify release-passport <file-or-url> [--json]
+  buildchain verify github-artifact-attestation <artifact>
+                          --evidence <file> --bundle <file>
+                          --platform-manifest <file> --release-passport <file> [--json]
   buildchain verify publication-admission <file-or-json>
                           --registry-json <file-or-json>
                           --runner-json <file-or-json>

package/bin/internal/trust-release-cli.mjs

@@ -1,5 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
+import { spawnSync } from "node:child_process";
 import { verifyInfraContractEvidenceBundle } from "../../scripts/infra-contract-core.mjs";
 import { verifyBuildchainLogEvents } from "../../packages/core/logging.js";
 import {
@@ -20,6 +21,11 @@ import {
   createRunnerProvenance,
   verifyPublicationAdmission,
 } from "../../packages/core/publication-authority.js";
+import {
+  createGitHubArtifactAttestationPolicy,
+  createGitHubArtifactAttestationVerificationPlan,
+  verifyGitHubArtifactAttestationEvidence,
+} from "../../packages/core/github-artifact-attestation.js";
 import {
   explainArtifactPassport,
   verifyArtifactPassport,
@@ -127,13 +133,19 @@ async function dispatchTrustReleaseCommand({ command, args, runScript, packageVe
   if (command === "create") {
     const [subcommand = "", ...createArgs] = args;
     const inputValue = readFlag(createArgs, "input-json", "");
-    if (!inputValue || !["publication-admission", "runner-provenance"].includes(subcommand)) {
-      throw new Error("usage: buildchain create <publication-admission|runner-provenance> --input-json <file-or-json> [--output <file>]");
+    if (!inputValue || ![
+      "publication-admission",
+      "runner-provenance",
+      "github-artifact-attestation-policy",
+    ].includes(subcommand)) {
+      throw new Error("usage: buildchain create <publication-admission|runner-provenance|github-artifact-attestation-policy> --input-json <file-or-json> [--output <file>]");
     }
     const input = readJsonInput(inputValue, { label: "input-json" });
     const value = subcommand === "publication-admission"
       ? createPublicationAdmission(input)
-      : createRunnerProvenance(input);
+      : subcommand === "runner-provenance"
+        ? createRunnerProvenance(input)
+        : createGitHubArtifactAttestationPolicy(input);
     const output = readFlag(createArgs, "output", "");
     if (output) writeJsonFile(path.resolve(output), value);
     if (!output || readBooleanFlag(createArgs, "json")) printJson(value);
@@ -190,6 +202,10 @@ async function dispatchTrustReleaseCommand({ command, args, runScript, packageVe
       kfdProductGateJsons: readRepeatedFlag(collectArgs, "kfd-product-gate-json"),
       invariantPassportJsons: readRepeatedFlag(collectArgs, "invariant-passport-json"),
       invariantPassportCommand: readFlag(collectArgs, "invariant-passport-cmd", ""),
+      githubArtifactAttestationPolicyJsons: readRepeatedFlag(
+        collectArgs,
+        "github-artifact-attestation-policy-json",
+      ),
       kfdAgentHubEvidenceJson: readFlag(collectArgs, "kfd-agent-hub-evidence-json", ""),
       basePassportJson: readFlag(collectArgs, "base-passport-json", ""),
       requireBaseKfd: readBooleanFlag(collectArgs, "require-base-kfd"),
@@ -225,6 +241,61 @@ async function dispatchTrustReleaseCommand({ command, args, runScript, packageVe
 
   if (command === "verify") {
     const [subcommand = "", location = "", ...verifyArgs] = args;
+    if (subcommand === "github-artifact-attestation") {
+      if (!location) {
+        throw new Error("usage: buildchain verify github-artifact-attestation <artifact> --evidence <file> --bundle <file> --platform-manifest <file> --release-passport <file>");
+      }
+      const requiredPath = (name) => {
+        const value = readFlag(verifyArgs, name, "");
+        if (!value) {
+          throw new Error(`buildchain verify github-artifact-attestation requires --${name} <file>`);
+        }
+        return path.resolve(value);
+      };
+      const evidencePath = requiredPath("evidence");
+      const bundlePath = requiredPath("bundle");
+      const platformManifestPath = requiredPath("platform-manifest");
+      const releasePassportPath = requiredPath("release-passport");
+      const evidence = readJsonInput(evidencePath, { label: "evidence" });
+      const plan = createGitHubArtifactAttestationVerificationPlan({
+        artifactPath: location,
+        bundlePath,
+        evidence,
+      });
+      const verified = spawnSync(plan.command, plan.args, {
+        cwd: process.cwd(),
+        encoding: "utf8",
+        maxBuffer: 32 * 1024 * 1024,
+      });
+      if (verified.error) throw verified.error;
+      if (verified.status !== 0) {
+        throw new Error(`gh attestation verify failed: ${(verified.stderr || verified.stdout || "unknown error").trim()}`);
+      }
+      let verificationResults;
+      try {
+        verificationResults = JSON.parse(verified.stdout);
+      } catch (error) {
+        throw new Error(`gh attestation verify returned invalid JSON: ${error.message}`);
+      }
+      const report = verifyGitHubArtifactAttestationEvidence({
+        artifactPath: path.resolve(location),
+        platformManifestPath,
+        releasePassportPath,
+        bundlePath,
+        evidence,
+        verificationResults,
+      });
+      if (readBooleanFlag(verifyArgs, "json")) {
+        printJson(report);
+      } else {
+        process.stdout.write(`GitHub artifact attestation: ${report.outcome}\n`);
+        for (const entry of report.issues) {
+          process.stdout.write(`- ${entry.code}: ${entry.message}\n`);
+        }
+      }
+      process.exitCode = report.ok ? 0 : 1;
+      return;
+    }
     if (subcommand === "publication-admission") {
       if (!location) {
         throw new Error("usage: buildchain verify publication-admission <file-or-json> --registry-json <file-or-json> --runner-json <file-or-json> --control-plane-audit-json <file-or-json> --publication-evidence-json <file-or-json>");

package/contracts/auditable-demo-media-profiles-v1.json

@@ -0,0 +1,168 @@
+{
+  "schema": "buildchain.auditable-demo-media-profiles/v1",
+  "profiles": {
+    "archive-v1": {
+      "mode": "archive",
+      "renditions": [
+        {
+          "path": "demo.gif",
+          "role": "readme-compatibility",
+          "mimeType": "image/gif"
+        },
+        {
+          "path": "demo.mp4",
+          "role": "archive-video",
+          "mimeType": "video/mp4"
+        },
+        {
+          "path": "demo.webm",
+          "role": "archive-video-alternate",
+          "mimeType": "video/webm"
+        },
+        {
+          "path": "poster.png",
+          "role": "evidence-poster",
+          "mimeType": "image/png"
+        }
+      ],
+      "singletonRoles": [
+        "evidence-poster",
+        "readme-compatibility"
+      ]
+    },
+    "web-delivery-v1": {
+      "extends": "archive-v1",
+      "mode": "web-delivery",
+      "renditions": [
+        {
+          "path": "demo.gif",
+          "role": "readme-compatibility",
+          "mimeType": "image/gif",
+          "container": "gif",
+          "videoCodec": "gif",
+          "audioStreams": 0,
+          "maximumBytes": 1048576,
+          "budgetBasis": {
+            "evidence": "contracts/evidence/auditable-demo-web-delivery-v1.json",
+            "observedPath": "demo.gif",
+            "observedBytes": 40826,
+            "multiplier": 16,
+            "rounding": "next-power-of-two"
+          }
+        },
+        {
+          "path": "demo.mp4",
+          "role": "primary-video",
+          "mimeType": "video/mp4",
+          "container": "mp4",
+          "videoCodec": "h264",
+          "pixelFormat": "yuv420p",
+          "audioStreams": 0,
+          "maximumBytes": 524288,
+          "budgetBasis": {
+            "evidence": "contracts/evidence/auditable-demo-web-delivery-v1.json",
+            "observedPath": "demo.mp4",
+            "observedBytes": 27038,
+            "multiplier": 16,
+            "rounding": "next-power-of-two"
+          },
+          "progressiveDownload": "moov-before-mdat",
+          "frameRatePolicy": "scene-exact"
+        },
+        {
+          "path": "demo.webm",
+          "role": "alternate-video",
+          "mimeType": "video/webm",
+          "container": "webm",
+          "videoCodec": "vp9",
+          "pixelFormat": "yuv420p",
+          "audioStreams": 0,
+          "maximumBytes": 524288,
+          "budgetBasis": {
+            "evidence": "contracts/evidence/auditable-demo-web-delivery-v1.json",
+            "observedPath": "demo.webm",
+            "observedBytes": 23383,
+            "multiplier": 16,
+            "rounding": "next-power-of-two"
+          },
+          "frameRatePolicy": "scene-exact"
+        },
+        {
+          "path": "poster.png",
+          "role": "evidence-poster",
+          "mimeType": "image/png",
+          "container": "png",
+          "videoCodec": "png",
+          "audioStreams": 0,
+          "maximumBytes": 1048576,
+          "budgetBasis": {
+            "evidence": "contracts/evidence/auditable-demo-web-delivery-v1.json",
+            "observedPath": "poster.png",
+            "observedBytes": 34769,
+            "multiplier": 16,
+            "rounding": "next-power-of-two"
+          }
+        }
+      ],
+      "singletonRoles": [
+        "primary-video",
+        "alternate-video",
+        "evidence-poster",
+        "readme-compatibility",
+        "browser-poster"
+      ],
+      "additionalRenditions": {
+        "allowedRoles": [
+          "primary-video",
+          "responsive-video",
+          "browser-poster"
+        ],
+        "allowedMimeTypes": [
+          "video/mp4",
+          "video/webm",
+          "image/webp",
+          "image/avif"
+        ],
+        "maximumBytesByMimeType": {
+          "video/mp4": 524288,
+          "video/webm": 524288,
+          "image/webp": 524288,
+          "image/avif": 524288
+        }
+      }
+    },
+    "site-hero-v1": {
+      "extends": "web-delivery-v1",
+      "mode": "web-delivery",
+      "renditions": [
+        {
+          "path": "poster.webp",
+          "role": "browser-poster",
+          "mimeType": "image/webp",
+          "container": "webp",
+          "videoCodec": "webp",
+          "audioStreams": 0,
+          "maximumBytes": 524288,
+          "budgetBasis": {
+            "evidence": "contracts/evidence/auditable-demo-web-delivery-v1.json",
+            "observedPath": "poster.png",
+            "observedBytes": 34769,
+            "multiplier": 8,
+            "rounding": "next-power-of-two"
+          }
+        }
+      ]
+    }
+  },
+  "qualification": {
+    "dimensions": "exact-scene",
+    "durationToleranceMs": 600,
+    "memberRootAlgorithm": "sha256",
+    "nonClaims": [
+      "browser-playback-success",
+      "responsive-layout",
+      "reduced-motion-behavior",
+      "production-site-deployment"
+    ]
+  }
+}

package/contracts/evidence/auditable-demo-web-delivery-v1.json

@@ -0,0 +1,103 @@
+{
+  "evidenceRoot": "sha256:451adc20c423fbf680caeb14dcc4850990a3317dd5a77f94ee451a7a26edf3fb",
+  "inputs": {
+    "complete-transcript.txt": "sha256:f3723a3eda614134ab724ce9fbe1e0e5f916d809a8a3096f5e37c1458cb3656c",
+    "public-projection.json": "sha256:127f9877f9750a85eada4338f088bee5460c5c71a83302652d3321667002c3c7",
+    "scene.json": "sha256:ea65ec39177aac7e5341d330d61e81fcd523c9f2c7a7d4dd5ac43fb457a51977"
+  },
+  "qualification": {
+    "inspectionRoot": "sha256:3cf9f7c710f4fcbd307b116cf279675a37210905d6d0fc7459d11933e98e6ea4",
+    "nonClaims": [
+      "browser-playback-success",
+      "responsive-layout",
+      "reduced-motion-behavior",
+      "production-site-deployment"
+    ],
+    "profile": {
+      "catalogRoot": "sha256:b2cf52c7b087be73ea852bbbe574e1a50bb7d64d26b8bc211a2c7d53e2ff9cae",
+      "id": "web-delivery-v1",
+      "mode": "web-delivery",
+      "profileRoot": "sha256:b6fb0a83414d03a7222fc50429e60ed68b6d47758b86ceaa316ecc659a01ae2b"
+    },
+    "qualificationRoot": "sha256:f2133bab4a3a5937ec3863972049d0a7247a8e108681d4bd247f47d766c461ae",
+    "renditions": [
+      {
+        "audioStreams": 0,
+        "bytes": 40826,
+        "container": "gif",
+        "durationMs": 2500,
+        "frameRate": 12.5,
+        "height": 720,
+        "maximumBytes": 1048576,
+        "mimeType": "image/gif",
+        "path": "demo.gif",
+        "pixelFormat": "bgra",
+        "progressiveDownload": "not-applicable",
+        "role": "readme-compatibility",
+        "root": "sha256:d835fbd3068f672b3aaffc904d1488540f661c48e0429c8887397d1ae531880f",
+        "videoCodec": "gif",
+        "width": 1280
+      },
+      {
+        "audioStreams": 0,
+        "bytes": 27038,
+        "container": "mp4",
+        "durationMs": 2533,
+        "frameRate": 15,
+        "height": 720,
+        "maximumBytes": 524288,
+        "mimeType": "video/mp4",
+        "path": "demo.mp4",
+        "pixelFormat": "yuv420p",
+        "progressiveDownload": "moov-before-mdat",
+        "role": "primary-video",
+        "root": "sha256:a82c3ed61b101528a07689227dc8af65e8c809aa6de2b749fd53915d97c99ac9",
+        "videoCodec": "h264",
+        "width": 1280
+      },
+      {
+        "audioStreams": 0,
+        "bytes": 23383,
+        "container": "webm",
+        "durationMs": 2534,
+        "frameRate": 15,
+        "height": 720,
+        "maximumBytes": 524288,
+        "mimeType": "video/webm",
+        "path": "demo.webm",
+        "pixelFormat": "yuv420p",
+        "progressiveDownload": "not-applicable",
+        "role": "alternate-video",
+        "root": "sha256:935deb66eb4734371b21c2fc8c55acd596e79c832a9a7963ab0922b3925564c3",
+        "videoCodec": "vp9",
+        "width": 1280
+      },
+      {
+        "audioStreams": 0,
+        "bytes": 34769,
+        "container": "png",
+        "durationMs": 0,
+        "frameRate": 25,
+        "height": 720,
+        "maximumBytes": 1048576,
+        "mimeType": "image/png",
+        "path": "poster.png",
+        "pixelFormat": "rgb24",
+        "progressiveDownload": "not-applicable",
+        "role": "evidence-poster",
+        "root": "sha256:7141a41c2b84d074477844d9c8d12e6f44173074829796cefdf8119b21be2de9",
+        "videoCodec": "png",
+        "width": 1280
+      }
+    ],
+    "schema": "buildchain.auditable-demo-media-qualification/v1"
+  },
+  "renderer": {
+    "image": "ghcr.io/kungfu-systems/build-images/demo-renderer@sha256:cb5e1dec368d21c7d4e8baded99ac75f12f7eff0d19505751888cf974086efa6",
+    "sourceRef": "refs/tags/v1.3.0-alpha.16",
+    "sourceRepository": "kungfu-systems/build-images",
+    "sourceSha": "999b370743f3e64e4f0b634d5131bd1d3d6b83ba"
+  },
+  "rendererManifestRoot": "sha256:2d3e4e2fcdfd17419e866e99d5e29cef65166b594cc5a5bdf2e5d9454cfb3a49",
+  "schema": "buildchain.auditable-demo-media-profile-fixture/v1"
+}

package/contracts/fixtures/auditable-demo-web-delivery-v1/complete-transcript.txt

@@ -0,0 +1,2 @@
+buildchain auditable demo media profile qualification
+immutable renderer fixture completed

package/contracts/fixtures/auditable-demo-web-delivery-v1/public-projection.json

@@ -0,0 +1,16 @@
+{
+  "schema": "build-images.demo-projection/v1",
+  "evidenceClass": "qualified-build-output",
+  "claimBoundary": "Fixture media qualifies delivery properties only; it does not prove a production deployment.",
+  "cues": [
+    {
+      "startMs": 0,
+      "endMs": 2500,
+      "transcriptLines": [
+        1,
+        2
+      ],
+      "annotation": "fixed qualification fixture"
+    }
+  ]
+}

package/contracts/fixtures/auditable-demo-web-delivery-v1/scene.json

@@ -0,0 +1,12 @@
+{
+  "schema": "build-images.demo-scene/v1",
+  "id": "buildchain-web-delivery-qualification",
+  "width": 1280,
+  "height": 720,
+  "fps": 15,
+  "durationMs": 2500,
+  "title": "Buildchain web delivery qualification",
+  "commandLabel": "buildchain qualify-media-fixture",
+  "background": "#0B1020",
+  "accent": "#67E8A5"
+}

package/dist/site/artifact-schemas.json

@@ -16,7 +16,11 @@
     "check-report.json",
     "llms.txt",
     "buildchain-release-bundle.json",
-    "buildchain-release-bundle.tar.gz"
+    "buildchain-release-bundle.tar.gz",
+    "github-artifact-attestation.policy.json",
+    "github-artifact-attestation.predicate.json",
+    "github-artifact-attestation.evidence.json",
+    "attestation.sigstore.json"
   ],
   "site": [
     "buildchain-site.json",