@kungfu-tech/buildchain 3.0.2-alpha.7 → 3.0.2-alpha.9

package/packages/core/artifact-signing.js

@@ -0,0 +1,412 @@
+import crypto from "node:crypto";
+
+export const ARTIFACT_SIGNING_REQUEST_CONTRACT =
+  "kungfu-buildchain-artifact-signing-request/v1";
+export const ARTIFACT_SIGNING_RECEIPT_CONTRACT =
+  "kungfu-buildchain-artifact-signing-receipt/v1";
+export const ARTIFACT_SIGNING_AUTHORITY_CONTRACT =
+  "kungfu-buildchain-artifact-signing-authority/v1";
+
+const SHA256_PATTERN = /^sha256:[0-9a-f]{64}$/u;
+const SOURCE_SHA_PATTERN = /^[0-9a-f]{40}$/u;
+const FORBIDDEN_CREDENTIAL_KEYS =
+  /(?:certificate|password|private.?key|secret|token|notary|issuer|team.?id|environment)/iu;
+
+const PROFILE_REGISTRY = Object.freeze({
+  "apple-developer-id": Object.freeze({
+    id: "apple-developer-id",
+    provider: "apple",
+    semantics: "native-platform-signature",
+    platforms: ["macos"],
+    artifactKinds: [
+      "mach-o",
+      "app-bundle",
+      "framework-bundle",
+      "plugin-bundle",
+      "xpc-bundle",
+      "dylib",
+      "pkg",
+      "dmg",
+    ],
+  }),
+  "windows-authenticode": Object.freeze({
+    id: "windows-authenticode",
+    provider: "microsoft-authenticode",
+    semantics: "native-platform-signature",
+    platforms: ["windows"],
+    artifactKinds: ["pe", "binary"],
+  }),
+  "detached-signature-v1": Object.freeze({
+    id: "detached-signature-v1",
+    provider: "buildchain-detached",
+    semantics: "detached-cryptographic-signature",
+    platforms: ["any"],
+    artifactKinds: ["binary", "archive", "blob", "directory"],
+  }),
+});
+
+function stableJson(value) {
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.keys(value)
+      .sort()
+      .map((key) => `${JSON.stringify(key)}:${stableJson(value[key])}`)
+      .join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+
+export function artifactSigningDigest(value) {
+  return `sha256:${crypto.createHash("sha256").update(stableJson(value)).digest("hex")}`;
+}
+
+function documentDigest(value) {
+  const { digest: _digest, ...basis } = value;
+  return artifactSigningDigest(basis);
+}
+
+function nonEmptyString(value, label) {
+  const normalized = String(value || "").trim();
+  if (!normalized) throw new Error(`${label} must be a non-empty string`);
+  return normalized;
+}
+
+function exactDigest(value, label) {
+  const normalized = nonEmptyString(value, label).toLowerCase();
+  if (!SHA256_PATTERN.test(normalized)) {
+    throw new Error(`${label} must be a sha256 digest`);
+  }
+  return normalized;
+}
+
+function exactSourceSha(value, label) {
+  const normalized = nonEmptyString(value, label).toLowerCase();
+  if (!SOURCE_SHA_PATTERN.test(normalized)) {
+    throw new Error(`${label} must be a 40-character Git SHA`);
+  }
+  return normalized;
+}
+
+function assertNoCredentialMaterial(value, path = "request") {
+  if (!value || typeof value !== "object") return;
+  for (const [key, child] of Object.entries(value)) {
+    if (FORBIDDEN_CREDENTIAL_KEYS.test(key)) {
+      throw new Error(
+        `${path}.${key} is credential configuration; signing requests may only declare desired signature state`,
+      );
+    }
+    assertNoCredentialMaterial(child, `${path}.${key}`);
+  }
+}
+
+export function listArtifactSigningProfiles() {
+  return Object.values(PROFILE_REGISTRY).map((profile) => ({
+    ...profile,
+    platforms: [...profile.platforms],
+    artifactKinds: [...profile.artifactKinds],
+  }));
+}
+
+export function resolveArtifactSigningProfile({
+  profile = "auto",
+  platform = "",
+  artifactKind = "binary",
+} = {}) {
+  const normalizedPlatform = String(platform || "")
+    .trim()
+    .toLowerCase();
+  const normalizedKind = nonEmptyString(
+    artifactKind,
+    "artifact kind",
+  ).toLowerCase();
+  let profileId = String(profile || "auto")
+    .trim()
+    .toLowerCase();
+  if (profileId === "auto") {
+    const apple = PROFILE_REGISTRY["apple-developer-id"];
+    if (
+      normalizedPlatform === "macos" &&
+      apple.artifactKinds.includes(normalizedKind)
+    ) {
+      profileId = apple.id;
+    } else if (
+      normalizedPlatform === "windows" &&
+      PROFILE_REGISTRY["windows-authenticode"].artifactKinds.includes(
+        normalizedKind,
+      )
+    ) {
+      profileId = "windows-authenticode";
+    } else {
+      profileId = "detached-signature-v1";
+    }
+  }
+  const resolved = PROFILE_REGISTRY[profileId];
+  if (!resolved)
+    throw new Error(`unsupported artifact signing profile: ${profileId}`);
+  if (
+    !resolved.platforms.includes("any") &&
+    !resolved.platforms.includes(normalizedPlatform)
+  ) {
+    throw new Error(
+      `artifact signing profile ${profileId} does not support platform ${normalizedPlatform || "<empty>"}`,
+    );
+  }
+  if (!resolved.artifactKinds.includes(normalizedKind)) {
+    throw new Error(
+      `artifact signing profile ${profileId} does not support artifact kind ${normalizedKind}`,
+    );
+  }
+  return {
+    ...resolved,
+    platforms: [...resolved.platforms],
+    artifactKinds: [...resolved.artifactKinds],
+  };
+}
+
+export function createArtifactSigningRequest({
+  source = {},
+  runtime = {},
+  artifact = {},
+  signature = {},
+  delivery = {},
+} = {}) {
+  assertNoCredentialMaterial({
+    source,
+    runtime,
+    artifact,
+    signature,
+    delivery,
+  });
+  const platform = nonEmptyString(
+    artifact.platform || source.platform,
+    "artifact platform",
+  ).toLowerCase();
+  const kind = nonEmptyString(
+    artifact.kind || "binary",
+    "artifact kind",
+  ).toLowerCase();
+  const profile = resolveArtifactSigningProfile({
+    profile: signature.profile || "auto",
+    platform,
+    artifactKind: kind,
+  });
+  const request = {
+    schemaVersion: 1,
+    contract: ARTIFACT_SIGNING_REQUEST_CONTRACT,
+    authority: {
+      contract: ARTIFACT_SIGNING_AUTHORITY_CONTRACT,
+      id: "kungfu-systems/buildchain",
+    },
+    source: {
+      repository: nonEmptyString(source.repository, "source repository"),
+      sha: exactSourceSha(source.sha, "source SHA"),
+      treeSha: exactSourceSha(source.treeSha, "source tree SHA"),
+    },
+    runtime: {
+      repository: nonEmptyString(
+        runtime.repository || "kungfu-systems/buildchain",
+        "runtime repository",
+      ),
+      sha: exactSourceSha(runtime.sha, "runtime SHA"),
+    },
+    artifact: {
+      id: nonEmptyString(artifact.id || artifact.path, "artifact id"),
+      path: nonEmptyString(artifact.path, "artifact path"),
+      kind,
+      platform,
+      ...(artifact.arch
+        ? { arch: nonEmptyString(artifact.arch, "artifact architecture") }
+        : {}),
+      bytes: Number(artifact.bytes),
+      digest: exactDigest(artifact.digest, "artifact digest"),
+      ...(artifact.mediaType
+        ? {
+            mediaType: nonEmptyString(
+              artifact.mediaType,
+              "artifact media type",
+            ),
+          }
+        : {}),
+      ...(artifact.transport
+        ? {
+            transport: {
+              file: nonEmptyString(
+                artifact.transport.file,
+                "artifact transport file",
+              ),
+              format: nonEmptyString(
+                artifact.transport.format,
+                "artifact transport format",
+              ),
+              bytes: Number(artifact.transport.bytes),
+              digest: exactDigest(
+                artifact.transport.digest,
+                "artifact transport digest",
+              ),
+            },
+          }
+        : {}),
+    },
+    signature: {
+      required: signature.required !== false,
+      profile: profile.id,
+      provider: profile.provider,
+      semantics: profile.semantics,
+    },
+    delivery: {
+      mode: nonEmptyString(
+        delivery.mode || "buildchain-authority",
+        "delivery mode",
+      ),
+      ...(delivery.recipientKey
+        ? {
+            recipientKey: nonEmptyString(
+              delivery.recipientKey,
+              "delivery recipient key",
+            ),
+          }
+        : {}),
+    },
+  };
+  if (
+    !Number.isSafeInteger(request.artifact.bytes) ||
+    request.artifact.bytes < 0
+  ) {
+    throw new Error("artifact bytes must be a non-negative safe integer");
+  }
+  if (
+    request.artifact.transport &&
+    (!Number.isSafeInteger(request.artifact.transport.bytes) ||
+      request.artifact.transport.bytes < 0)
+  ) {
+    throw new Error(
+      "artifact transport bytes must be a non-negative safe integer",
+    );
+  }
+  request.digest = documentDigest(request);
+  return request;
+}
+
+export function validateArtifactSigningRequest(request) {
+  const issues = [];
+  try {
+    if (!request || typeof request !== "object" || Array.isArray(request)) {
+      throw new Error("artifact signing request must be an object");
+    }
+    if (request.contract !== ARTIFACT_SIGNING_REQUEST_CONTRACT) {
+      issues.push("request contract mismatch");
+    }
+    assertNoCredentialMaterial(request);
+    const rebuilt = createArtifactSigningRequest(request);
+    if (request.digest !== rebuilt.digest)
+      issues.push("request digest mismatch");
+    if (stableJson(request) !== stableJson(rebuilt)) {
+      issues.push("request contains non-canonical or unsupported fields");
+    }
+  } catch (error) {
+    issues.push(String(error?.message || error));
+  }
+  return { ok: issues.length === 0, issues };
+}
+
+export function createArtifactSigningReceipt({
+  request,
+  status = "passed",
+  authority = {},
+  result = {},
+  signatures = [],
+  reason = "",
+} = {}) {
+  const requestCheck = validateArtifactSigningRequest(request);
+  if (!requestCheck.ok) {
+    throw new Error(
+      `invalid artifact signing request: ${requestCheck.issues.join(", ")}`,
+    );
+  }
+  if (!["passed", "failed", "rejected"].includes(status)) {
+    throw new Error(
+      "artifact signing receipt status must be passed, failed, or rejected",
+    );
+  }
+  const receipt = {
+    schemaVersion: 1,
+    contract: ARTIFACT_SIGNING_RECEIPT_CONTRACT,
+    requestDigest: request.digest,
+    status,
+    authority: {
+      contract: ARTIFACT_SIGNING_AUTHORITY_CONTRACT,
+      id: nonEmptyString(authority.id || request.authority.id, "authority id"),
+      runtimeSha: exactSourceSha(
+        authority.runtimeSha || request.runtime.sha,
+        "authority runtime SHA",
+      ),
+    },
+    signature: { ...request.signature },
+    ...(status === "passed"
+      ? {
+          result: {
+            artifactDigest: exactDigest(
+              result.artifactDigest,
+              "result artifact digest",
+            ),
+            evidenceDigest: exactDigest(
+              result.evidenceDigest,
+              "result evidence digest",
+            ),
+          },
+          signatures: signatures.map((entry, index) => ({
+            kind: nonEmptyString(entry.kind, `signatures[${index}].kind`),
+            digest: exactDigest(entry.digest, `signatures[${index}].digest`),
+          })),
+        }
+      : { reason: nonEmptyString(reason, "receipt reason") }),
+  };
+  if (status === "passed" && receipt.signatures.length === 0) {
+    throw new Error(
+      "passed artifact signing receipt requires signature evidence",
+    );
+  }
+  receipt.digest = documentDigest(receipt);
+  return receipt;
+}
+
+export function validateArtifactSigningReceipt(receipt, { request } = {}) {
+  const issues = [];
+  try {
+    if (!receipt || typeof receipt !== "object" || Array.isArray(receipt)) {
+      throw new Error("artifact signing receipt must be an object");
+    }
+    if (receipt.contract !== ARTIFACT_SIGNING_RECEIPT_CONTRACT) {
+      issues.push("receipt contract mismatch");
+    }
+    if (receipt.digest !== documentDigest(receipt))
+      issues.push("receipt digest mismatch");
+    if (request) {
+      const requestCheck = validateArtifactSigningRequest(request);
+      if (!requestCheck.ok) issues.push(...requestCheck.issues);
+      if (receipt.requestDigest !== request.digest)
+        issues.push("receipt request digest mismatch");
+      if (stableJson(receipt.signature) !== stableJson(request.signature)) {
+        issues.push("receipt signature policy mismatch");
+      }
+      if (receipt.authority?.runtimeSha !== request.runtime.sha) {
+        issues.push("receipt authority runtime mismatch");
+      }
+    }
+    if (receipt.status === "passed") {
+      exactDigest(receipt.result?.artifactDigest, "result artifact digest");
+      exactDigest(receipt.result?.evidenceDigest, "result evidence digest");
+      if (
+        !Array.isArray(receipt.signatures) ||
+        receipt.signatures.length === 0
+      ) {
+        issues.push("passed receipt has no signature evidence");
+      }
+    } else if (!["failed", "rejected"].includes(receipt.status)) {
+      issues.push("receipt status is invalid");
+    }
+  } catch (error) {
+    issues.push(String(error?.message || error));
+  }
+  return { ok: issues.length === 0, issues };
+}

package/packages/core/buildchain-config.js

@@ -55,6 +55,17 @@ const SUPPORTED_INFRA_APPLY_MODES = new Set(["disabled", "manual-approval", "env
 const SUPPORTED_FACT_VERSION_SOURCE_TYPES = new Set(["static", "json", "toml", "regex", "command"]);
 const SUPPORTED_FACT_LEGACY_PROJECTIONS = new Set(["kungfu-buildinfo"]);
 const SUPPORTED_PUBLICATION_TOOLCHAINS = new Set(["custom-command", "latex-docker"]);
+const SUPPORTED_SIGNING_PROFILES = new Set([
+  "auto",
+  "apple-developer-id",
+  "windows-authenticode",
+  "detached-signature-v1",
+]);
+const SUPPORTED_SIGNING_ARTIFACT_KINDS = new Set([
+  "auto", "binary", "archive", "blob", "directory", "mach-o", "app-bundle",
+  "framework-bundle", "plugin-bundle", "xpc-bundle", "dylib", "pkg", "dmg",
+  "pe",
+]);
 
 function posixPath(value) {
   return String(value || "").split(path.sep).join("/");
@@ -218,6 +229,9 @@ export function normalizeBuildchainConfig(config) {
   if (normalized.facts !== undefined) {
     normalized.facts = normalizeFactsSection(normalized.facts);
   }
+  if (normalized.signing !== undefined) {
+    normalized.signing = normalizeSigningSection(normalized.signing);
+  }
   validateWebSurfaceConfig(normalized);
   validateInfraContractConfig(normalized);
   validateAnchoredDerivedVersionMaterialConfig(normalized);
@@ -335,6 +349,49 @@ function normalizeFactsSection(facts) {
   };
 }
 
+function normalizeSigningSection(signing) {
+  assertPlainObject(signing, "signing");
+  for (const key of Object.keys(signing)) {
+    if (key !== "artifacts") {
+      throw new Error(`signing.${key} is not supported; consumer signing declarations cannot configure credentials or authority infrastructure`);
+    }
+  }
+  if (!Array.isArray(signing.artifacts) || signing.artifacts.length === 0) {
+    throw new Error("signing.artifacts must declare at least one artifact");
+  }
+  const artifacts = signing.artifacts.map((artifact, index) => {
+    const label = `signing.artifacts[${index}]`;
+    assertPlainObject(artifact, label);
+    const allowedKeys = new Set(["id", "path", "profile", "kind", "platforms", "required"]);
+    for (const key of Object.keys(artifact)) {
+      if (!allowedKeys.has(key)) {
+        throw new Error(`${label}.${key} is not supported; declare desired signature state only`);
+      }
+    }
+    const artifactPath = posixPath(assertString(artifact.path, `${label}.path`));
+    const profile = artifact.profile === undefined ? "auto" : assertString(artifact.profile, `${label}.profile`);
+    if (!SUPPORTED_SIGNING_PROFILES.has(profile)) {
+      throw new Error(`${label}.profile must be one of auto, apple-developer-id, windows-authenticode, or detached-signature-v1`);
+    }
+    const kind = artifact.kind === undefined ? "auto" : assertString(artifact.kind, `${label}.kind`);
+    if (!SUPPORTED_SIGNING_ARTIFACT_KINDS.has(kind)) {
+      throw new Error(`${label}.kind is not a supported signing artifact kind`);
+    }
+    return {
+      id: artifact.id === undefined ? artifactPath : assertString(artifact.id, `${label}.id`),
+      path: artifactPath,
+      profile,
+      kind,
+      platforms: normalizeStringArray(artifact.platforms, `${label}.platforms`),
+      required: optionalBoolean(artifact.required, true),
+    };
+  });
+  if (new Set(artifacts.map((artifact) => artifact.id)).size !== artifacts.length) {
+    throw new Error("signing.artifacts must use unique ids");
+  }
+  return { artifacts };
+}
+
 function normalizeFactVersionSources(sources = []) {
   if (sources === undefined) {
     return [];
@@ -1615,6 +1672,7 @@ export function validateBuildchainConfig(
     release: loadedConfig.config.release,
     governance: loadedConfig.config.governance,
     facts: loadedConfig.config.facts,
+    signing: loadedConfig.config.signing,
     publication: loadedConfig.config.publication,
   };
 }

package/packages/core/buildchain-contract.js

@@ -329,10 +329,13 @@ export function createBuildchainContractWorld({
         "media-artifact-digest",
         "media-artifact-url",
         "media-root",
+        "media-profile",
+        "media-qualification-root",
       ],
       breakingDefaults: {
         trustedEventRequired: true,
         renderMediaDefault: false,
+        mediaProfileDefault: "archive-v1",
         artifactRetentionDaysDefault: 14,
         gatePolicy: "required-before-selective-render",
       },
@@ -340,6 +343,7 @@ export function createBuildchainContractWorld({
         "buildchain-repository",
         "source-ref",
         "render-media",
+        "media-profile",
         "artifact-retention-days",
         "require-trusted-event",
       ],
@@ -349,6 +353,10 @@ export function createBuildchainContractWorld({
         "every invocation runs an immutable network-disabled renderer smoke before emitting a qualified Gate bundle",
         "complete media rendering is optional and consumes only an exact passing Gate bundle",
         "Gate and media bundles expose both GitHub Artifact archive coordinates and deterministic member roots",
+        "explicit web-delivery profiles independently verify codec, container, audio, dimensions, duration, byte budgets, rendition roles, and MP4 fast-start evidence",
+        "media receipts expose content-addressed rendition facts without requiring consumers to infer roles from filenames",
+        "Build Images owns encoding, Buildchain owns qualification and receipts, and site repositories own browser loading and accessibility behavior",
+        "media qualification does not claim browser playback, responsive layout, reduced-motion behavior, accessibility, or production deployment",
       ],
     }),
     surface(root, {

package/packages/core/buildchain-publication-authority.js

@@ -18,6 +18,7 @@ const DESCRIPTORS = Object.freeze([
   [".github/workflows/.binary-release-assets.yml", "product-publication", true, ["github-release"], "github-token", "buildchain-release-assets"],
   [".github/workflows/binary-distribution.yml", "evidence-publication"],
   [".github/workflows/binary-release-assets.yml", "governance-write"],
+  [".github/workflows/artifact-signing-authority.yml", "evidence-publication"],
   [".github/workflows/build-surface-fixture.yml", "non-publication-oidc"],
   [".github/workflows/build.yml", "non-publication-oidc"],
   [".github/workflows/buildchain-alpha-self-dogfood.yml", "non-publication-oidc"],

package/packages/core/detached-artifact-signature.js

@@ -0,0 +1,121 @@
+import crypto from "node:crypto";
+
+import {
+  artifactSigningDigest,
+  createArtifactSigningReceipt,
+  validateArtifactSigningRequest,
+} from "./artifact-signing.js";
+import { artifactSigningEvidenceDigest } from "./artifact-signing-result.js";
+
+export const DETACHED_ARTIFACT_SIGNATURE_CONTRACT =
+  "kungfu-buildchain-detached-artifact-signature/v1";
+
+function required(value, label) {
+  const normalized = String(value || "").trim();
+  if (!normalized) throw new Error(`${label} must be a non-empty string`);
+  return normalized;
+}
+
+function signatureBasis(request, keyId) {
+  return {
+    schemaVersion: 1,
+    contract: DETACHED_ARTIFACT_SIGNATURE_CONTRACT,
+    algorithm: "ed25519",
+    keyId: required(keyId, "key id"),
+    requestDigest: request.digest,
+    artifactDigest: request.artifact.digest,
+    runtimeSha: request.runtime.sha,
+  };
+}
+
+function envelopeDigest(envelope) {
+  const { digest: _digest, ...basis } = envelope;
+  return artifactSigningDigest(basis);
+}
+
+export function signDetachedArtifactRequest({
+  request,
+  privateKey,
+  keyId,
+  authority = {},
+} = {}) {
+  const check = validateArtifactSigningRequest(request);
+  if (!check.ok) {
+    throw new Error(
+      `invalid artifact signing request: ${check.issues.join(", ")}`,
+    );
+  }
+  if (request.signature.profile !== "detached-signature-v1") {
+    throw new Error("detached signer requires detached-signature-v1 profile");
+  }
+  const basis = signatureBasis(request, keyId);
+  const payload = Buffer.from(JSON.stringify(basis), "utf8");
+  const signature = crypto.sign(null, payload, privateKey);
+  const envelope = {
+    ...basis,
+    signature: signature.toString("base64"),
+  };
+  envelope.digest = envelopeDigest(envelope);
+  const receipt = createArtifactSigningReceipt({
+    request,
+    authority,
+    result: {
+      artifactDigest: request.artifact.digest,
+      evidenceDigest: artifactSigningEvidenceDigest([
+        {
+          kind: "ed25519-detached",
+          path: "signature.json",
+          digest: envelope.digest,
+        },
+      ]),
+    },
+    signatures: [
+      {
+        kind: "ed25519-detached",
+        digest: `sha256:${crypto.createHash("sha256").update(signature).digest("hex")}`,
+      },
+    ],
+  });
+  return { envelope, receipt };
+}
+
+export function verifyDetachedArtifactSignature({
+  request,
+  envelope,
+  publicKey,
+} = {}) {
+  const issues = [];
+  try {
+    const check = validateArtifactSigningRequest(request);
+    if (!check.ok) issues.push(...check.issues);
+    if (envelope?.contract !== DETACHED_ARTIFACT_SIGNATURE_CONTRACT) {
+      issues.push("detached signature contract mismatch");
+    }
+    const basis = signatureBasis(request, envelope?.keyId);
+    for (const [key, expected] of Object.entries(basis)) {
+      if (envelope?.[key] !== expected) {
+        issues.push(`detached signature ${key} mismatch`);
+      }
+    }
+    const signature = Buffer.from(
+      required(envelope?.signature, "signature"),
+      "base64",
+    );
+    if (
+      !crypto.verify(
+        null,
+        Buffer.from(JSON.stringify(basis), "utf8"),
+        publicKey,
+        signature,
+      )
+    ) {
+      issues.push("detached signature verification failed");
+    }
+    if (envelope?.digest !== envelopeDigest(envelope)) {
+      issues.push("detached signature envelope digest mismatch");
+    }
+  } catch (error) {
+    issues.push(String(error?.message || error));
+  }
+  return { ok: issues.length === 0, issues };
+}

package/packages/core/github-governance-authority.js

@@ -49,6 +49,7 @@ const PUBLIC_REPOSITORY_TARGETS = Object.freeze({
     target("dev/v3/v3.0", [check("check")], false),
     target("alpha/v3/v3.0", [check("check"), check("verify")], false),
     target("release/v3/v3.0", [check("check")], true),
+    target("authority/v3/v3.0/artifact-signing", [check("check"), check("verify")], true),
     target("publish-gate/major", [check("check")], true),
   ],
   "homebrew-tap": [
@@ -65,6 +66,11 @@ const PUBLIC_REPOSITORY_TARGETS = Object.freeze({
       check("signoff"),
       check("validate"),
     ], true),
+    target("release/v4/v4.0", [
+      check("build", null),
+      check("signoff"),
+      check("validate"),
+    ], true),
   ],
   libnode: [
     target("dev/v22/v22.22", [check("build")], true),