@kungfu-tech/buildchain 3.0.2-alpha.4 → 3.0.2-alpha.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -0
- package/actions/github-artifact-attestation/README.md +10 -0
- package/actions/promote-buildchain-ref/README.md +7 -0
- package/bin/buildchain.mjs +5 -0
- package/bin/internal/trust-release-cli.mjs +74 -3
- package/dist/site/artifact-schemas.json +5 -1
- package/dist/site/buildchain-contract.json +79 -28
- package/dist/site/buildchain-site.json +108 -25
- package/dist/site/capability-registry.json +8 -7
- package/dist/site/cli-registry.json +12 -0
- package/dist/site/controller-registry.json +40 -4
- package/dist/site/kfd-claims.json +203 -18
- package/dist/site/kfd-upstream-aggregate.json +1 -1
- package/dist/site/manual-registry.json +19 -5
- package/dist/site/node-api-registry.json +22 -9
- package/dist/site/page-registry.json +89 -15
- package/dist/site/public-surface-audit.json +125 -15
- package/dist/site/publication-authority-registry.json +27 -2
- package/dist/site/publication-registry.json +4 -4
- package/dist/site/release-model.json +2 -1
- package/dist/site/release-passport-check-manifest.json +1 -0
- package/dist/site/release-provenance.json +1 -0
- package/dist/site/schemas/release-passport-v1.schema.json +6 -0
- package/dist/site/site-manifest.json +17 -9
- package/dist/site/workflow-registry.json +84 -7
- package/docs/MAP.md +3 -1
- package/docs/binary-distribution.md +7 -0
- package/docs/cli.md +9 -0
- package/docs/github-artifact-attestation.md +219 -0
- package/docs/release-passport.md +13 -0
- package/docs/reusable-build-surface.md +6 -0
- package/package.json +2 -1
- package/packages/core/buildchain-contract.js +6 -0
- package/packages/core/buildchain-kfd-claims.js +5 -0
- package/packages/core/buildchain-publication-authority.js +1 -0
- package/packages/core/github-artifact-attestation.js +642 -0
- package/packages/core/index.js +19 -0
- package/packages/core/publication-authority.js +1 -1
- package/packages/core/release-passport-contract.js +2 -0
- package/packages/core/release-passport.js +51 -0
- package/scripts/check-inventory.mjs +4 -0
- package/scripts/create-github-artifact-attestation-policy.mjs +62 -0
- package/scripts/generate-site-bundle.mjs +12 -0
- package/scripts/publish-github-artifact-attestation-evidence.mjs +201 -0
- package/scripts/release-candidate-resolver.mjs +12 -0
- package/scripts/stage-github-artifact-attestation-inputs.mjs +65 -0
|
@@ -8,7 +8,7 @@
|
|
|
8
8
|
"specifier": "@kungfu-tech/buildchain",
|
|
9
9
|
"export": ".",
|
|
10
10
|
"target": "./packages/core/index.js",
|
|
11
|
-
"digest": "sha256:
|
|
11
|
+
"digest": "sha256:204601094084ab5e9a6d6738d64bf3f89f97fc23567a79d2c5dcc718d281555a",
|
|
12
12
|
"summary": "Root toolkit export for Buildchain's public Node API.",
|
|
13
13
|
"capabilityGroup": "api-cli-reference",
|
|
14
14
|
"audience": [
|
|
@@ -47,7 +47,7 @@
|
|
|
47
47
|
"specifier": "@kungfu-tech/buildchain/core",
|
|
48
48
|
"export": "./core",
|
|
49
49
|
"target": "./packages/core/index.js",
|
|
50
|
-
"digest": "sha256:
|
|
50
|
+
"digest": "sha256:204601094084ab5e9a6d6738d64bf3f89f97fc23567a79d2c5dcc718d281555a",
|
|
51
51
|
"summary": "Alias for the root public toolkit export.",
|
|
52
52
|
"capabilityGroup": "api-cli-reference",
|
|
53
53
|
"audience": [
|
|
@@ -82,6 +82,19 @@
|
|
|
82
82
|
],
|
|
83
83
|
"maturity": "stable"
|
|
84
84
|
},
|
|
85
|
+
{
|
|
86
|
+
"specifier": "@kungfu-tech/buildchain/github-artifact-attestation",
|
|
87
|
+
"export": "./github-artifact-attestation",
|
|
88
|
+
"target": "./packages/core/github-artifact-attestation.js",
|
|
89
|
+
"digest": "sha256:f71887cd7d73e11a763153720c6242e700ce49e66a6e5ca01ea6cf488948e265",
|
|
90
|
+
"summary": "GitHub keyless artifact attestation policy, predicate, provider evidence, and fail-closed verification APIs.",
|
|
91
|
+
"capabilityGroup": "release-passport-trust",
|
|
92
|
+
"audience": [
|
|
93
|
+
"developer",
|
|
94
|
+
"agent"
|
|
95
|
+
],
|
|
96
|
+
"maturity": "stable"
|
|
97
|
+
},
|
|
85
98
|
{
|
|
86
99
|
"specifier": "@kungfu-tech/buildchain/anchored-version-material",
|
|
87
100
|
"export": "./anchored-version-material",
|
|
@@ -99,7 +112,7 @@
|
|
|
99
112
|
"specifier": "@kungfu-tech/buildchain/buildchain-contract",
|
|
100
113
|
"export": "./buildchain-contract",
|
|
101
114
|
"target": "./packages/core/buildchain-contract.js",
|
|
102
|
-
"digest": "sha256:
|
|
115
|
+
"digest": "sha256:415c04c33c1ba957420866943603f2b642751386cf55ac650d86884cad1842a1",
|
|
103
116
|
"summary": "Runtime contract world and compatibility digest APIs for floating-ref drift checks.",
|
|
104
117
|
"capabilityGroup": "governance-versioning",
|
|
105
118
|
"audience": [
|
|
@@ -346,7 +359,7 @@
|
|
|
346
359
|
"specifier": "@kungfu-tech/buildchain/publication-authority",
|
|
347
360
|
"export": "./publication-authority",
|
|
348
361
|
"target": "./packages/core/publication-authority.js",
|
|
349
|
-
"digest": "sha256:
|
|
362
|
+
"digest": "sha256:c1b9e696669d4e6ee661ec0528244509b6b0f832ec4fad16386344b90ad91367",
|
|
350
363
|
"summary": "Sealed publication authority registry, runner provenance, control-plane audit, admission, and independent verification APIs.",
|
|
351
364
|
"capabilityGroup": "release-passport-trust",
|
|
352
365
|
"audience": [
|
|
@@ -372,7 +385,7 @@
|
|
|
372
385
|
"specifier": "@kungfu-tech/buildchain/buildchain-publication-authority",
|
|
373
386
|
"export": "./buildchain-publication-authority",
|
|
374
387
|
"target": "./packages/core/buildchain-publication-authority.js",
|
|
375
|
-
"digest": "sha256:
|
|
388
|
+
"digest": "sha256:ae2d9310b0276c21715020d7cb43ea180e555740ac8ef1c073a88206d2f74b39",
|
|
376
389
|
"summary": "Buildchain-owned closed-world publication authority descriptor registry.",
|
|
377
390
|
"capabilityGroup": "release-passport-trust",
|
|
378
391
|
"audience": [
|
|
@@ -437,7 +450,7 @@
|
|
|
437
450
|
"specifier": "@kungfu-tech/buildchain/release-passport",
|
|
438
451
|
"export": "./release-passport",
|
|
439
452
|
"target": "./packages/core/release-passport.js",
|
|
440
|
-
"digest": "sha256:
|
|
453
|
+
"digest": "sha256:09b0794b6d0e4bc3638f52e8d58e2eb6d6ab7efd2a2f90247c48c8fa68beda16",
|
|
441
454
|
"summary": "Release passport collection, verification, explanation, and evidence APIs.",
|
|
442
455
|
"capabilityGroup": "release-passport-trust",
|
|
443
456
|
"audience": [
|
|
@@ -450,7 +463,7 @@
|
|
|
450
463
|
"specifier": "@kungfu-tech/buildchain/release-passport-contract",
|
|
451
464
|
"export": "./release-passport-contract",
|
|
452
465
|
"target": "./packages/core/release-passport-contract.js",
|
|
453
|
-
"digest": "sha256:
|
|
466
|
+
"digest": "sha256:d633f8037d43db2c72662186f797d0914471540077d7163368c22779aae7eee9",
|
|
454
467
|
"summary": "Standalone release passport JSON Schema, ownership/check manifest, and structural validation APIs.",
|
|
455
468
|
"capabilityGroup": "release-passport-trust",
|
|
456
469
|
"audience": [
|
|
@@ -502,7 +515,7 @@
|
|
|
502
515
|
"specifier": "@kungfu-tech/buildchain/buildchain-kfd-claims",
|
|
503
516
|
"export": "./buildchain-kfd-claims",
|
|
504
517
|
"target": "./packages/core/buildchain-kfd-claims.js",
|
|
505
|
-
"digest": "sha256:
|
|
518
|
+
"digest": "sha256:14c595f8ab51f64c2fcde3c46729fe3ba6e7b20fcd89159780aa55e341013f75",
|
|
506
519
|
"summary": "Buildchain self KFD claim registry, witnesses, and public claim APIs.",
|
|
507
520
|
"capabilityGroup": "kfd-trust",
|
|
508
521
|
"audience": [
|
|
@@ -516,7 +529,7 @@
|
|
|
516
529
|
{
|
|
517
530
|
"id": "cli-and-node-package",
|
|
518
531
|
"path": "docs/cli.md",
|
|
519
|
-
"digest": "sha256:
|
|
532
|
+
"digest": "sha256:49da688f9f8b726a9169a3e4b246cb6ef07c6c626ea15c22f0b26ba1a37a58b4"
|
|
520
533
|
},
|
|
521
534
|
{
|
|
522
535
|
"id": "build-facts",
|