@kungfu-tech/buildchain 3.0.2-alpha.1 → 3.0.2-alpha.10

package/scripts/merge-artifact-signing-results.mjs

@@ -0,0 +1,76 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+import { writeGitHubOutputs } from "./build-contract-core.mjs";
+
+function required(value, label) {
+  const normalized = String(value || "").trim();
+  if (!normalized) throw new Error(`${label} is required`);
+  return normalized;
+}
+
+function safeId(value) {
+  const normalized = String(value || "").replace(/[^A-Za-z0-9._-]+/gu, "-").replace(/^-+|-+$/gu, "");
+  if (!normalized || normalized === "." || normalized === "..") throw new Error("unsafe signing result id");
+  return normalized;
+}
+
+function walk(root, output = []) {
+  for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
+    const child = path.join(root, entry.name);
+    if (entry.isDirectory()) walk(child, output);
+    else if (entry.isFile() && entry.name === "index.json") output.push(child);
+  }
+  return output;
+}
+
+export function mergeArtifactSigningResults({
+  inputRoot = process.env.BUILDCHAIN_SIGNING_RESULT_INPUT_ROOT,
+  outputRoot = process.env.BUILDCHAIN_SIGNING_RESULT_ROOT,
+} = {}) {
+  const input = path.resolve(required(inputRoot, "signing result input root"));
+  const output = path.resolve(required(outputRoot, "signing result output root"));
+  fs.mkdirSync(output, { recursive: true });
+  const merged = [];
+  const seen = new Set();
+  for (const indexPath of walk(input)) {
+    const index = JSON.parse(fs.readFileSync(indexPath, "utf8"));
+    if (index.contract !== "kungfu-buildchain-artifact-signing-result-index/v1") continue;
+    for (const entry of index.results || []) {
+      if (seen.has(entry.id)) throw new Error(`duplicate signing result: ${entry.id}`);
+      seen.add(entry.id);
+      const sourceResult = path.resolve(path.dirname(indexPath), entry.result);
+      const sourceDirectory = path.dirname(sourceResult);
+      const relative = path.relative(path.dirname(indexPath), sourceDirectory);
+      if (relative.startsWith("..") || path.isAbsolute(relative)) throw new Error("signing result escapes provider root");
+      const destinationName = safeId(entry.id);
+      const destination = path.join(output, destinationName);
+      fs.cpSync(sourceDirectory, destination, { recursive: true, errorOnExist: true, force: false });
+      merged.push({
+        ...entry,
+        result: `${destinationName}/${path.basename(sourceResult)}`,
+        ...(entry.payload ? { payload: `${destinationName}/${path.relative(sourceDirectory, path.resolve(path.dirname(indexPath), entry.payload)).split(path.sep).join("/")}` } : {}),
+        ...(entry.envelope ? { envelope: `${destinationName}/${path.relative(sourceDirectory, path.resolve(path.dirname(indexPath), entry.envelope)).split(path.sep).join("/")}` } : {}),
+        ...(entry.receipt ? { receipt: `${destinationName}/${path.relative(sourceDirectory, path.resolve(path.dirname(indexPath), entry.receipt)).split(path.sep).join("/")}` } : {}),
+      });
+    }
+  }
+  if (merged.length === 0) throw new Error("no artifact signing results found");
+  merged.sort((a, b) => a.id.localeCompare(b.id));
+  const index = { schemaVersion: 1, contract: "kungfu-buildchain-artifact-signing-result-index/v1", results: merged };
+  const indexPath = path.join(output, "index.json");
+  fs.writeFileSync(indexPath, `${JSON.stringify(index, null, 2)}\n`);
+  writeGitHubOutputs({ "result-count": String(merged.length), "result-index": indexPath, "result-root": output });
+  return index;
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  try {
+    mergeArtifactSigningResults();
+  } catch (error) {
+    console.error(`::error::${String(error?.message || error).replace(/\r?\n/gu, "%0A")}`);
+    process.exitCode = 1;
+  }
+}

package/scripts/publish-github-artifact-attestation-evidence.mjs

@@ -0,0 +1,201 @@
+#!/usr/bin/env node
+
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { spawnSync } from "node:child_process";
+
+import {
+  createGitHubArtifactAttestationVerificationPlan,
+  verifyGitHubArtifactAttestationEvidence,
+} from "../packages/core/github-artifact-attestation.js";
+
+function parseArgs(argv) {
+  const result = {};
+  for (let index = 0; index < argv.length; index += 2) {
+    const key = argv[index];
+    const value = argv[index + 1];
+    if (!key?.startsWith("--") || value === undefined) throw new Error(`invalid argument near ${key || "<end>"}`);
+    result[key.slice(2)] = value;
+  }
+  return result;
+}
+
+function required(value, label) {
+  const normalized = String(value || "").trim();
+  if (!normalized) throw new Error(`${label} is required`);
+  return normalized;
+}
+
+function sha256(value) {
+  return crypto.createHash("sha256").update(value).digest("hex");
+}
+
+function sha256File(filePath) {
+  return `sha256:${sha256(fs.readFileSync(filePath))}`;
+}
+
+function readJson(filePath, label) {
+  try {
+    return JSON.parse(fs.readFileSync(filePath, "utf8"));
+  } catch (error) {
+    throw new Error(`${label} is not readable JSON: ${error.message}`);
+  }
+}
+
+function safeAssetStem(value) {
+  return path.basename(required(value, "subject name"))
+    .replace(/[^0-9A-Za-z._-]+/g, "-")
+    .replace(/^-+|-+$/g, "");
+}
+
+async function api({ token, apiUrl, route, method = "GET", headers = {}, body }) {
+  const response = await fetch(`${apiUrl}${route}`, {
+    method,
+    headers: {
+      accept: "application/vnd.github+json",
+      authorization: `Bearer ${token}`,
+      "x-github-api-version": "2022-11-28",
+      ...headers,
+    },
+    body,
+  });
+  if (!response.ok) {
+    const detail = (await response.text()).slice(0, 500);
+    throw new Error(`GitHub API ${method} ${route} failed with ${response.status}: ${detail}`);
+  }
+  return response;
+}
+
+async function remoteAssetDigest({ token, apiUrl, repository, asset }) {
+  const declared = String(asset.digest || "").match(/^sha256:([0-9a-f]{64})$/i);
+  if (declared) return `sha256:${declared[1].toLowerCase()}`;
+  const response = await api({
+    token,
+    apiUrl,
+    route: `/repos/${repository}/releases/assets/${asset.id}`,
+    headers: { accept: "application/octet-stream" },
+  });
+  return `sha256:${sha256(Buffer.from(await response.arrayBuffer()))}`;
+}
+
+async function uploadImmutable({ token, apiUrl, repository, release, filePath, assetName }) {
+  const localDigest = sha256File(filePath);
+  const existing = (release.assets || []).filter((asset) => asset.name === assetName);
+  if (existing.length > 1) throw new Error(`release asset ${assetName} exists more than once`);
+  if (existing.length === 1) {
+    const remoteDigest = await remoteAssetDigest({ token, apiUrl, repository, asset: existing[0] });
+    if (remoteDigest !== localDigest) {
+      throw new Error(`immutable release asset collision for ${assetName}: ${remoteDigest} != ${localDigest}`);
+    }
+    return { action: "preserved", name: assetName, digest: localDigest, url: existing[0].browser_download_url };
+  }
+  const uploadBase = required(release.upload_url, "release.upload_url").replace(/\{.*$/, "");
+  const response = await fetch(`${uploadBase}?name=${encodeURIComponent(assetName)}`, {
+    method: "POST",
+    headers: {
+      accept: "application/vnd.github+json",
+      authorization: `Bearer ${token}`,
+      "content-type": "application/octet-stream",
+      "x-github-api-version": "2022-11-28",
+    },
+    body: fs.readFileSync(filePath),
+  });
+  if (!response.ok) throw new Error(`GitHub release asset upload failed with ${response.status}: ${(await response.text()).slice(0, 500)}`);
+  const asset = await response.json();
+  release.assets = [...(release.assets || []), asset];
+  const remoteDigest = await remoteAssetDigest({ token, apiUrl, repository, asset });
+  if (remoteDigest !== localDigest) throw new Error(`release asset read-back mismatch for ${assetName}`);
+  return { action: "uploaded", name: assetName, digest: localDigest, url: asset.browser_download_url };
+}
+
+function appendOutput(name, value) {
+  if (process.env.GITHUB_OUTPUT) fs.appendFileSync(process.env.GITHUB_OUTPUT, `${name}=${String(value)}\n`);
+}
+
+async function main() {
+  const options = parseArgs(process.argv.slice(2));
+  const token = required(process.env.GITHUB_TOKEN || process.env.GH_TOKEN, "GITHUB_TOKEN");
+  const apiUrl = (process.env.GITHUB_API_URL || "https://api.github.com").replace(/\/$/, "");
+  const repository = required(options.repository || process.env.GITHUB_REPOSITORY, "repository");
+  const tag = required(options.tag, "tag");
+  const subjectPath = path.resolve(required(options.subject, "subject"));
+  const manifestPath = path.resolve(required(options.manifest, "manifest"));
+  const passportPath = path.resolve(required(options.passport, "passport"));
+  const bundlePath = path.resolve(required(options.bundle, "bundle"));
+  const evidencePath = path.resolve(required(options.evidence, "evidence"));
+  const predicatePath = path.resolve(required(options.predicate, "predicate"));
+  const providerVerificationPath = path.resolve(required(options["provider-verification"], "provider-verification"));
+  const receiptPath = path.resolve(required(options.receipt, "receipt"));
+  const evidence = readJson(evidencePath, "Buildchain attestation evidence");
+  const plan = createGitHubArtifactAttestationVerificationPlan({ artifactPath: subjectPath, bundlePath, evidence });
+  const provider = spawnSync(plan.command, plan.args, { encoding: "utf8", env: process.env });
+  if (provider.status !== 0) throw new Error(`gh attestation verify failed: ${String(provider.stderr || provider.stdout).slice(0, 1000)}`);
+  const verificationResults = JSON.parse(provider.stdout);
+  const local = verifyGitHubArtifactAttestationEvidence({
+    artifactPath: subjectPath,
+    platformManifestPath: manifestPath,
+    releasePassportPath: passportPath,
+    bundlePath,
+    evidence,
+    verificationResults,
+  });
+  if (!local.ok) throw new Error(`Buildchain evidence verification failed: ${local.issues.map((issue) => issue.message).join("; ")}`);
+  const retainedProvider = readJson(providerVerificationPath, "retained provider verification");
+  const retained = verifyGitHubArtifactAttestationEvidence({
+    artifactPath: subjectPath,
+    platformManifestPath: manifestPath,
+    releasePassportPath: passportPath,
+    bundlePath,
+    evidence,
+    verificationResults: retainedProvider,
+  });
+  if (!retained.ok) {
+    throw new Error(`retained provider verification failed: ${retained.issues.map((issue) => issue.message).join("; ")}`);
+  }
+  const releaseResponse = await api({ token, apiUrl, route: `/repos/${repository}/releases/tags/${encodeURIComponent(tag)}` });
+  const release = await releaseResponse.json();
+  const stem = safeAssetStem(evidence.subject?.name);
+  const declarations = [
+    [bundlePath, `${stem}.sigstore-bundle.json`],
+    [evidencePath, `${stem}.buildchain-attestation.json`],
+    [predicatePath, `${stem}.buildchain-predicate.json`],
+    [providerVerificationPath, `${stem}.github-verification.json`],
+  ];
+  const assets = [];
+  for (const [filePath, assetName] of declarations) {
+    assets.push(await uploadImmutable({ token, apiUrl, repository, release, filePath, assetName }));
+  }
+  const receipt = {
+    contract: "buildchain.github-artifact-attestation-publication/v1",
+    repository,
+    tag,
+    releaseUrl: release.html_url,
+    subject: evidence.subject,
+    evidenceRoot: evidence.evidenceRoot,
+    attestation: evidence.attestation,
+    assets,
+    verified: true,
+  };
+  fs.mkdirSync(path.dirname(receiptPath), { recursive: true });
+  fs.writeFileSync(receiptPath, `${JSON.stringify(receipt, null, 2)}\n`);
+  const receiptAsset = await uploadImmutable({
+    token,
+    apiUrl,
+    repository,
+    release,
+    filePath: receiptPath,
+    assetName: `${stem}.buildchain-attestation-publication.json`,
+  });
+  appendOutput("release-url", release.html_url);
+  appendOutput("evidence-root", evidence.evidenceRoot);
+  appendOutput("publication-receipt", receiptPath);
+  appendOutput("publication-receipt-digest", receiptAsset.digest);
+  process.stdout.write(`${JSON.stringify({ ...receipt, receiptAsset }, null, 2)}\n`);
+}
+
+main().catch((error) => {
+  console.error(error.message);
+  process.exitCode = 1;
+});

package/scripts/release-candidate-resolver.mjs

@@ -608,6 +608,10 @@ export async function resolveReleaseCandidateArtifacts({
   }
   const passport = JSON.parse(fs.readFileSync(passportPath, "utf8"));
   const platformManifestPaths = findDownloadedFiles(payloadDir, "manifest.json");
+  const githubArtifactAttestationPolicyPaths = findDownloadedFiles(
+    payloadDir,
+    "github-artifact-attestation-policy.json",
+  );
   const npmTarballPaths = publishArtifactKind === "npm"
     ? findDownloadedFilesByExtension(payloadDir, [".tgz"])
     : [];
@@ -639,6 +643,7 @@ export async function resolveReleaseCandidateArtifacts({
       buildSummary: outputPath(buildSummaryPath),
       payloads: outputPath(payloadDir),
       platformManifests: platformManifestPaths.map(outputPath),
+      githubArtifactAttestationPolicies: githubArtifactAttestationPolicyPaths.map(outputPath),
       npmTarballs: npmTarballPaths.map(outputPath),
       releaseAssets: releaseAssetPaths.map(outputPath),
       publishRequiredArtifacts: outputPath(requiredArtifactsPath),
@@ -647,6 +652,7 @@ export async function resolveReleaseCandidateArtifacts({
     candidateHash: passport.candidateHash || "",
     payloadCount: payloadArtifacts.length,
     platformManifestCount: platformManifestPaths.length,
+    githubArtifactAttestationPolicyCount: githubArtifactAttestationPolicyPaths.length,
     npmTarballCount: npmTarballPaths.length,
     publishRequiredArtifacts: generatedRequiredArtifacts,
   };
@@ -684,6 +690,12 @@ export async function resolveReleaseCandidateArtifactsCli() {
     "release-candidate-payload-dir": result.paths?.payloads || "",
     "release-candidate-platform-manifest-paths": (result.paths?.platformManifests || []).join(","),
     "release-candidate-platform-manifest-count": String(result.platformManifestCount || 0),
+    "release-candidate-github-artifact-attestation-policy-paths": (
+      result.paths?.githubArtifactAttestationPolicies || []
+    ).join(","),
+    "release-candidate-github-artifact-attestation-policy-count": String(
+      result.githubArtifactAttestationPolicyCount || 0,
+    ),
     "release-candidate-npm-tarball-paths": (result.paths?.npmTarballs || []).join(","),
     "release-candidate-npm-tarball-count": String(result.npmTarballCount || 0),
     "release-candidate-github-release-artifact-paths": (

package/scripts/release-line-policy.mjs

@@ -70,6 +70,18 @@ export function parsePublishGateChannelRef(ref) {
   };
 }
 
+export function parseAuthorityRef(ref) {
+  const normalizedRef = normalizeRef(ref);
+  const match = normalizedRef.match(/^authority\/v(\d+)\/v(\d+\.\d+)\/[A-Za-z0-9._/-]+$/);
+  if (!match) return undefined;
+  return {
+    major: Number(match[1]),
+    loose: Number(match[2]),
+    normalizedRef,
+    lineSuffix: `/v${match[1]}/v${match[2]}`,
+  };
+}
+
 export function getChannel(ref) {
   const versionStateTarget = parseVersionStateRef(ref);
   if (versionStateTarget) return versionStateTarget.channel;
@@ -116,6 +128,7 @@ export function getBumpKeyword({ cwd = process.cwd(), headRef, baseRef, loose =
   const versionStateTarget = parseVersionStateRef(headRef);
   const releaseLineRecoveryTarget = parseReleaseLineRecoveryRef(headRef);
   const publishGateTarget = parsePublishGateChannelRef(headRef);
+  const authorityTarget = parseAuthorityRef(baseRef);
   const headChannel = getChannel(headRef);
   const baseChannel = getChannel(baseRef);
   const key = `${headChannel}->${baseChannel}`;
@@ -130,6 +143,20 @@ export function getBumpKeyword({ cwd = process.cwd(), headRef, baseRef, loose =
   const preminor = headChannel === "release" && lts;
   const majorGate = headChannel === "release" && baseChannel === MAJOR_GATE_CHANNEL;
 
+  if (authorityTarget) {
+    const headMatch = normalizeRef(headRef).match(/^dev\/v(\d+)\/v(\d+\.\d+)$/);
+    if (
+      !headMatch ||
+      Number(headMatch[1]) !== authorityTarget.major ||
+      Number(headMatch[2]) !== authorityTarget.loose ||
+      version.major !== authorityTarget.major ||
+      looseVersionNumber !== authorityTarget.loose
+    ) {
+      throw new Error(`Versions not match for head/base refs: ${headRef} -> ${baseRef}`);
+    }
+    return "none";
+  }
+
   if (releaseLineRecoveryTarget) {
     if (baseChannel !== "release" || releaseLineRecoveryTarget.normalizedRef !== normalizeRef(baseRef)) {
       throw new Error(`Versions not match for head/base refs: ${headRef} -> ${baseRef}`);

package/scripts/runtime-ref-core.mjs

@@ -1,5 +1,6 @@
 const EXACT_SHA_RE = /^[0-9a-f]{40}$/i;
 const TRAIN_REF_RE = /^train\/v\d+\/v\d+\.\d+\/[A-Za-z0-9._/-]+$/;
+const AUTHORITY_REF_RE = /^authority\/v\d+\/v\d+\.\d+\/[A-Za-z0-9._/-]+$/;
 const OFFICIAL_CHANNEL_REF_RE = /^v\d+(?:\.\d+)?(?:-alpha)?$/;
 
 export function parseWorkflowShellRef(workflowRef = "", fallback = "v2", buildchainRepository = "kungfu-systems/buildchain") {
@@ -20,6 +21,9 @@ export function classifyBuildchainRuntimeRef(ref = "") {
   if (TRAIN_REF_RE.test(value)) {
     return "train";
   }
+  if (AUTHORITY_REF_RE.test(value)) {
+    return "authority";
+  }
   if (/^v\d+(?:\.\d+)?$/.test(value) || /^v\d+\.\d+\.\d+$/.test(value)) {
     return "stable";
   }
@@ -58,16 +62,16 @@ export function normalizeRequestedRuntimeRef(requestedRef = "") {
       officialChannel: false,
     };
   }
-  const trainRef = requested.replace(/^refs\/heads\//, "");
-  if (!TRAIN_REF_RE.test(trainRef)) {
+  const protectedRef = requested.replace(/^refs\/heads\//, "");
+  if (!TRAIN_REF_RE.test(protectedRef) && !AUTHORITY_REF_RE.test(protectedRef)) {
     throw new Error(
-      "buildchain-ref override must be train/vN/vN.M/<capability>, refs/heads/train/vN/vN.M/<capability>, or an exact 40-character SHA",
+      "buildchain-ref override must be train/vN/vN.M/<capability>, refs/heads/train/vN/vN.M/<capability>, authority/vN/vN.M/<capability>, refs/heads/authority/vN/vN.M/<capability>, or an exact 40-character SHA",
     );
   }
   return {
-    ref: trainRef,
-    fullRef: `refs/heads/${trainRef}`,
-    class: "train",
+    ref: protectedRef,
+    fullRef: `refs/heads/${protectedRef}`,
+    class: AUTHORITY_REF_RE.test(protectedRef) ? "authority" : "train",
     exactSha: false,
     officialChannel: false,
   };