@kungfu-tech/buildchain 3.0.3-alpha.0 → 3.0.3-alpha.2

package/scripts/dev-alpha-candidate-patrol.mjs

@@ -12,6 +12,8 @@ const STATE_MARKER_START = "<!-- buildchain-dev-alpha-candidate-state";
 const STATE_MARKER_END = "-->";
 const LEGACY_BODY_MARKER = "Buildchain exact-source channel candidate.";
 const EXACT_SHA = /^[0-9a-f]{40}$/u;
+const EVIDENCE_ROOT = /^sha256:[0-9a-f]{64}$/u;
+const ABSENT_STATE_ROOT = "absent";
 
 function text(value = "") {
   return String(value ?? "").trim();
@@ -72,6 +74,18 @@ function optionalExactSha(value, name) {
   return normalized;
 }
 
+function optionalStateRoot(value, name) {
+  const normalized = text(value);
+  if (
+    normalized &&
+    normalized !== ABSENT_STATE_ROOT &&
+    !EVIDENCE_ROOT.test(normalized)
+  ) {
+    throw new Error(`${name} must be absent or an exact sha256 root`);
+  }
+  return normalized;
+}
+
 function canonical(value) {
   if (Array.isArray(value)) return value.map(canonical);
   if (value && typeof value === "object") {
@@ -237,6 +251,31 @@ export function normalizeDevAlphaPatrolOptions(options = {}) {
         process.env.BUILDCHAIN_CHANNEL_PATROL_EXPECTED_SELECTED_SHA,
       "expectedSelectedSha",
     ),
+    expectedPriorStateRoot: optionalStateRoot(
+      options.expectedPriorStateRoot ??
+        process.env.BUILDCHAIN_CHANNEL_PATROL_EXPECTED_PRIOR_STATE_ROOT,
+      "expectedPriorStateRoot",
+    ),
+    reactivationAuthorized: bool(
+      options.reactivationAuthorized ??
+        process.env.BUILDCHAIN_CHANNEL_PATROL_REACTIVATION_AUTHORIZED,
+      false,
+    ),
+    transitionAuthority: {
+      actor: text(
+        options.transitionAuthority?.actor ?? process.env.GITHUB_ACTOR,
+      ),
+      workflow: text(
+        options.transitionAuthority?.workflow ?? process.env.GITHUB_WORKFLOW,
+      ),
+      runId: text(
+        options.transitionAuthority?.runId ?? process.env.GITHUB_RUN_ID,
+      ),
+      runAttempt: text(
+        options.transitionAuthority?.runAttempt ??
+          process.env.GITHUB_RUN_ATTEMPT,
+      ),
+    },
     createPullRequest,
     settlementAuthorized: bool(
       options.settlementAuthorized ??
@@ -396,6 +435,10 @@ function candidateFromDecision(decision) {
     sourceLockRef: decision.sourceLockRef,
     decisionRoot: decision.decisionRoot,
     workflowEvidence: decision.workflowEvidence,
+    qualificationRoot: evidenceRoot({
+      sourceSha: decision.source.sha,
+      workflowEvidence: decision.workflowEvidence,
+    }),
   };
 }
 
@@ -406,6 +449,9 @@ function candidateStateBody({
   activeCandidate,
   nextCandidate,
   supersededCandidate,
+  priorStateRoot = ABSENT_STATE_ROOT,
+  generation = 1,
+  tombstones = [],
 }) {
   const body = {
     schema: DEV_ALPHA_CANDIDATE_STATE_SCHEMA,
@@ -413,8 +459,11 @@ function candidateStateBody({
     sourceBranch: options.sourceBranch,
     targetBranch: options.targetBranch,
     targetSha,
+    generation,
+    priorStateRoot,
     activeCandidate,
     nextCandidate,
+    tombstones,
     observationDecisionRoot: decision.decisionRoot || null,
     observedAt: options.now,
     ...(supersededCandidate ? { supersededCandidate } : {}),
@@ -422,6 +471,50 @@ function candidateStateBody({
   return { ...body, stateRoot: evidenceRoot(body) };
 }
 
+function persistedStateRoot(candidate) {
+  return text(candidate?.state?.stateRoot) || ABSENT_STATE_ROOT;
+}
+
+function candidateTombstone({
+  options,
+  candidate,
+  generation,
+  priorStateRoot,
+  reason,
+  pullRequest,
+}) {
+  const body = {
+    schema: "kungfu-buildchain-dev-alpha-candidate-tombstone/v1",
+    repository: options.repository,
+    targetBranch: options.targetBranch,
+    candidateSha: candidate.sourceSha,
+    qualificationRoot:
+      candidate.qualificationRoot ||
+      evidenceRoot({
+        sourceSha: candidate.sourceSha,
+        workflowEvidence: candidate.workflowEvidence || [],
+      }),
+    generation,
+    priorStateRoot,
+    reason,
+    transitionAuthority: options.transitionAuthority,
+    pullRequest: pullRequest
+      ? {
+          number: Number(pullRequest.number),
+          url: text(pullRequest.url || pullRequest.html_url),
+        }
+      : null,
+    workflowRuns: (candidate.workflowEvidence || []).map((row) => ({
+      workflowPath: row.workflowPath,
+      runId: row.runId,
+      runAttempt: row.runAttempt,
+      url: row.url,
+    })),
+    recordedAt: options.now,
+  };
+  return { ...body, tombstoneRoot: evidenceRoot(body) };
+}
+
 function pullRequestBody({
   options,
   observedSourceHeadSha,
@@ -573,9 +666,24 @@ export async function runDevAlphaCandidatePatrol(
     );
   }
   let activeCandidate = managedCandidates[0] || null;
+  const priorStateRoot = persistedStateRoot(activeCandidate);
+  if (
+    options.expectedPriorStateRoot &&
+    options.expectedPriorStateRoot !== priorStateRoot
+  ) {
+    throw new Error(
+      `candidate controller compare-and-swap failed: expected prior state root ${options.expectedPriorStateRoot}, observed ${priorStateRoot}`,
+    );
+  }
+  const priorGeneration = Number(activeCandidate?.state?.generation || 0);
+  let generation = Math.max(priorGeneration, 1);
+  const priorTombstones = Array.isArray(activeCandidate?.state?.tombstones)
+    ? activeCandidate.state.tombstones
+    : [];
   const observedCandidate = candidateFromDecision(decision);
   let nextCandidate = null;
   let supersededCandidate = null;
+  let tombstones = [...priorTombstones];
   let controllerState = decision.eligible
     ? "eligible-for-settlement"
     : qualificationError
@@ -585,43 +693,100 @@ export async function runDevAlphaCandidatePatrol(
       : "observed";
   if (activeCandidate) {
     controllerState = "active";
+    nextCandidate = activeCandidate.nextCandidate || null;
     if (
       observedCandidate &&
       observedCandidate.sourceSha !== activeCandidate.sourceSha
     ) {
-      nextCandidate = observedCandidate;
-      controllerState = "retained-next";
-    }
-    if (
-      activeCandidate.nextCandidate &&
-      activeCandidate.nextCandidate.sourceSha !== nextCandidate?.sourceSha
+      const matchingTombstone = priorTombstones.find(
+        (row) => row.candidateSha === observedCandidate.sourceSha,
+      );
+      if (matchingTombstone && !options.reactivationAuthorized) {
+        controllerState = "tombstone-blocked";
+      } else {
+        if (
+          nextCandidate &&
+          nextCandidate.sourceSha !== observedCandidate.sourceSha
+        ) {
+          supersededCandidate = nextCandidate;
+          generation = priorGeneration + 1;
+          tombstones.push(
+            candidateTombstone({
+              options,
+              candidate: supersededCandidate,
+              generation,
+              priorStateRoot,
+              reason: "newer-qualified-next-candidate",
+              pullRequest: activeCandidate,
+            }),
+          );
+        }
+        nextCandidate = observedCandidate;
+        controllerState = "retained-next";
+      }
+    } else if (
+      !decision.eligible &&
+      nextCandidate &&
+      decision.source.sha === nextCandidate.sourceSha
     ) {
-      supersededCandidate = activeCandidate.nextCandidate;
+      supersededCandidate = nextCandidate;
+      nextCandidate = null;
+      generation = priorGeneration + 1;
+      tombstones.push(
+        candidateTombstone({
+          options,
+          candidate: supersededCandidate,
+          generation,
+          priorStateRoot,
+          reason: "qualification-evidence-rejected",
+          pullRequest: activeCandidate,
+        }),
+      );
+      controllerState = "rejected-next";
     }
   }
-  let state = candidateStateBody({
-    options,
-    targetSha,
-    decision,
-    activeCandidate: activeCandidate
-      ? {
-          sourceSha: activeCandidate.sourceSha,
-          sourceLockRef: activeCandidate.sourceLockRef,
-          decisionRoot: activeCandidate.decisionRoot || null,
-          pullRequestNumber: activeCandidate.number,
-          pullRequestUrl: activeCandidate.url,
-        }
-      : null,
-    nextCandidate,
-    supersededCandidate,
-  });
+  const persistedNextSha = text(activeCandidate?.nextCandidate?.sourceSha);
+  const desiredNextSha = text(nextCandidate?.sourceSha);
+  const transitionNeeded =
+    !activeCandidate?.state ||
+    persistedNextSha !== desiredNextSha ||
+    tombstones.length !== priorTombstones.length;
+  if (transitionNeeded && activeCandidate && generation === priorGeneration) {
+    generation = priorGeneration + 1;
+  }
+  let state =
+    activeCandidate?.state && !transitionNeeded
+      ? activeCandidate.state
+      : candidateStateBody({
+          options,
+          targetSha,
+          decision,
+          activeCandidate: activeCandidate
+            ? {
+                sourceSha: activeCandidate.sourceSha,
+                sourceLockRef: activeCandidate.sourceLockRef,
+                decisionRoot: activeCandidate.decisionRoot || null,
+                pullRequestNumber: activeCandidate.number,
+                pullRequestUrl: activeCandidate.url,
+              }
+            : null,
+          nextCandidate,
+          supersededCandidate,
+          priorStateRoot,
+          generation,
+          tombstones,
+        });
   let pullRequest;
   let settlementAction = "none";
   if (options.settlementAuthorized && !options.dryRun) {
     if (activeCandidate) {
       const nextBody = replaceCandidateStateMarker(activeCandidate.body, state);
       if (nextBody !== activeCandidate.body) {
-        await client.updatePullRequestBody(activeCandidate.number, nextBody);
+        await client.updatePullRequestBody(
+          activeCandidate.number,
+          nextBody,
+          priorStateRoot,
+        );
         settlementAction = nextCandidate
           ? supersededCandidate
             ? "supersede-next-candidate"
@@ -656,15 +821,53 @@ export async function runDevAlphaCandidatePatrol(
           state,
         }),
       });
-      settlementAction = "create-active-candidate";
-      controllerState = "active";
-      activeCandidate = {
-        number: Number(pullRequest.number || 0),
-        url: text(pullRequest.html_url),
-        sourceSha,
-        sourceLockRef: decision.sourceLockRef,
-        decisionRoot: decision.decisionRoot,
-      };
+      if (pullRequest.state && pullRequest.state !== "open") {
+        const tombstone = candidateTombstone({
+          options,
+          candidate: observedCandidate,
+          generation,
+          priorStateRoot,
+          reason: pullRequest.merged_at
+            ? "candidate-pr-merged"
+            : "candidate-pr-closed",
+          pullRequest,
+        });
+        tombstones = [...priorTombstones, tombstone];
+        state = candidateStateBody({
+          options,
+          targetSha,
+          decision,
+          activeCandidate: null,
+          nextCandidate: null,
+          supersededCandidate: null,
+          priorStateRoot,
+          generation,
+          tombstones,
+        });
+        const nextBody = replaceCandidateStateMarker(pullRequest.body, state);
+        await client.updatePullRequestBody(
+          pullRequest.number,
+          nextBody,
+          persistedStateRoot({
+            state: parseCandidateStateMarker(pullRequest.body),
+          }),
+        );
+        settlementAction = "reuse-known-candidate-tombstone";
+        controllerState = "tombstoned";
+        activeCandidate = null;
+      } else {
+        settlementAction = pullRequest.reused
+          ? "reuse-active-candidate"
+          : "create-active-candidate";
+        controllerState = "active";
+        activeCandidate = {
+          number: Number(pullRequest.number || 0),
+          url: text(pullRequest.html_url),
+          sourceSha,
+          sourceLockRef: decision.sourceLockRef,
+          decisionRoot: decision.decisionRoot,
+        };
+      }
     }
   }
   return {
@@ -681,6 +884,9 @@ export async function runDevAlphaCandidatePatrol(
       supersededCandidate,
       settlementAction,
       stateRoot: state.stateRoot,
+      priorStateRoot,
+      generation: state.generation,
+      tombstones: state.tombstones || [],
     },
     pullRequest: pullRequest || null,
   };
@@ -809,18 +1015,36 @@ export function createGitHubChannelCandidateClient({
       });
     },
     async ensurePullRequest({ head, base, title, body }) {
-      const open = await api(
-        `/repos/${owner}/${repo}/pulls?state=open&head=${encodeURIComponent(`${owner}:${head}`)}&base=${encodeURIComponent(base)}&per_page=20`,
-      );
-      return (
-        open[0] ||
-        api(`/repos/${owner}/${repo}/pulls`, {
-          method: "POST",
-          body: { head, base, title, body },
-        })
+      const known = await api(
+        `/repos/${owner}/${repo}/pulls?state=all&head=${encodeURIComponent(`${owner}:${head}`)}&base=${encodeURIComponent(base)}&per_page=20`,
       );
+      if (known.length > 1) {
+        throw new Error(
+          `multiple known candidate pull requests bind ${head}: ${known
+            .map((row) => `#${row.number}`)
+            .join(", ")}`,
+        );
+      }
+      if (known[0]) return { ...known[0], reused: true };
+      return api(`/repos/${owner}/${repo}/pulls`, {
+        method: "POST",
+        body: { head, base, title, body },
+      });
     },
-    async updatePullRequestBody(number, body) {
+    async updatePullRequestBody(
+      number,
+      body,
+      expectedPriorStateRoot = ABSENT_STATE_ROOT,
+    ) {
+      const current = await api(`/repos/${owner}/${repo}/pulls/${number}`);
+      const observedPriorStateRoot = persistedStateRoot({
+        state: parseCandidateStateMarker(current.body),
+      });
+      if (observedPriorStateRoot !== expectedPriorStateRoot) {
+        throw new Error(
+          `candidate controller compare-and-swap failed: expected prior state root ${expectedPriorStateRoot}, observed ${observedPriorStateRoot}`,
+        );
+      }
       return api(`/repos/${owner}/${repo}/pulls/${number}`, {
         method: "PATCH",
         body: { body },
@@ -866,6 +1090,7 @@ async function main() {
       "active-candidate-pr": result.controller.activeCandidate?.url || "",
       "next-candidate-sha": result.controller.nextCandidate?.sourceSha || "",
       "settlement-action": result.controller.settlementAction,
+      "prior-state-root": result.controller.priorStateRoot,
     };
     fs.appendFileSync(
       process.env.GITHUB_OUTPUT,

package/scripts/finalize-native-artifact-signing-result.mjs

@@ -37,6 +37,8 @@ export function finalizeNativeArtifactSigningResult({
   requestPath = process.env.BUILDCHAIN_SIGNING_REQUEST_PATH,
   signedPayload = process.env.BUILDCHAIN_SIGNED_PAYLOAD,
   evidencePath = process.env.BUILDCHAIN_SIGNING_EVIDENCE,
+  credentialArtifactRoot =
+    process.env.BUILDCHAIN_SIGNING_CREDENTIAL_ARTIFACT_ROOT,
   outputRoot = process.env.BUILDCHAIN_SIGNING_RESULT_ROOT,
   checks = process.env.BUILDCHAIN_SIGNING_VERIFICATION_CHECKS,
 } = {}) {
@@ -74,20 +76,79 @@ export function finalizeNativeArtifactSigningResult({
   const evidenceOutput = path.join(resultDirectory, "provider-evidence.json");
   fs.copyFileSync(evidenceSource, evidenceOutput, fs.constants.COPYFILE_EXCL);
   const evidenceDocument = JSON.parse(fs.readFileSync(evidenceOutput, "utf8"));
-  if (
-    evidenceDocument.status !== "passed" ||
-    evidenceDocument.provider !== request.signature.provider
-  ) {
+  const appBundleResult = request.artifact.kind === "app-bundle";
+  const providerEvidencePassed = appBundleResult
+    ? evidenceDocument.schema ===
+        "buildchain.macos-credential-island-evidence/v1" &&
+      evidenceDocument.status === "accepted" &&
+      evidenceDocument.source?.repository === request.source.repository &&
+      evidenceDocument.source?.sha === request.source.sha &&
+      evidenceDocument.source?.treeSha === request.source.treeSha &&
+      evidenceDocument.buildchain?.runtimeSha === request.runtime.sha &&
+      evidenceDocument.app?.architecture === request.artifact.arch &&
+      evidenceDocument.notarization?.application?.status === "Accepted" &&
+      evidenceDocument.notarization?.diskImage?.status === "Accepted"
+    : evidenceDocument.status === "passed" &&
+      evidenceDocument.provider === request.signature.provider;
+  if (!providerEvidencePassed) {
     throw new Error(
       "provider evidence does not prove the requested native signature",
     );
   }
+  let credentialOutput = "";
+  let credentialEvidence = [];
+  if (appBundleResult) {
+    const credentialSource = path.resolve(
+      required(
+        credentialArtifactRoot,
+        "credential artifact root for app-bundle result",
+      ),
+    );
+    const credentialManifest = path.join(credentialSource, "manifest.json");
+    if (!fs.statSync(credentialManifest).isFile())
+      throw new Error("credential artifact manifest is missing");
+    credentialOutput = path.join(resultDirectory, "credential-artifact");
+    fs.cpSync(credentialSource, credentialOutput, {
+      recursive: true,
+      force: false,
+      errorOnExist: true,
+    });
+    const manifestOutput = path.join(credentialOutput, "manifest.json");
+    const manifest = JSON.parse(fs.readFileSync(manifestOutput, "utf8"));
+    if (!Array.isArray(manifest.files) || manifest.files.length === 0)
+      throw new Error("credential artifact manifest contains no files");
+    credentialEvidence = [
+      {
+        kind: "credential-artifact-manifest",
+        path: "credential-artifact/manifest.json",
+        digest: sha256File(manifestOutput),
+      },
+      ...manifest.files.map((file, index) => {
+        const filePath = resolveBelow(
+          credentialOutput,
+          file.path,
+          `credential artifact file ${index}`,
+        );
+        const observed = sha256File(filePath);
+        if (observed !== `sha256:${String(file.sha256 || "").toLowerCase()}`)
+          throw new Error(
+            `credential artifact file digest mismatch: ${file.path}`,
+          );
+        return {
+          kind: `credential-artifact-${index}`,
+          path: `credential-artifact/${String(file.path).replaceAll("\\", "/")}`,
+          digest: observed,
+        };
+      }),
+    ];
+  }
   const evidence = [
     {
       kind: `${request.signature.profile}-verification`,
       path: "provider-evidence.json",
       digest: sha256File(evidenceOutput),
     },
+    ...credentialEvidence,
   ];
   const payloadDigest = sha256File(payloadPath);
   const receipt = createArtifactSigningReceipt({
@@ -118,6 +179,15 @@ export function finalizeNativeArtifactSigningResult({
         .filter(Boolean),
     );
   }
+  if (verificationChecks.length === 0 && appBundleResult) {
+    verificationChecks.push(
+      ...Object.entries(evidenceDocument.verification || {})
+        .filter(([, passed]) => passed === true)
+        .map(([name]) => name),
+      "application-notarytool-accepted",
+      "disk-image-notarytool-accepted",
+    );
+  }
   if (verificationChecks.length === 0)
     throw new Error("provider evidence contains no verification checks");
   const result = createArtifactSigningResult({
@@ -160,6 +230,7 @@ export function finalizeNativeArtifactSigningResult({
   writeGitHubOutputs({
     "result-root": resultDirectory,
     "result-index": path.join(resultDirectory, "index.json"),
+    "credential-artifact-root": credentialOutput,
   });
   return index;
 }

package/scripts/generate-channel-promotion-workflow.mjs

@@ -284,24 +284,15 @@ jobs:
           --publication-channel "\${{ inputs.channel }}"
           --target-ref "\${{ inputs.target-ref || github.ref_name }}"
           --router-ref "\${{ steps.router.outputs.ref }}"
+          --router-sha "\${{ steps.router.outputs.sha }}"
 
       - name: Authorize trusted runtime override
         if: \${{ steps.route.outputs.override-used == 'true' }}
         uses: actions/github-script@v8
         with:
           script: |
-            if (context.eventName !== "workflow_dispatch") {
-              throw new Error("promotion runtime override is only allowed for trusted workflow_dispatch runs");
-            }
-            const permission = await github.rest.repos.getCollaboratorPermissionLevel({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              username: context.actor,
-            });
-            const level = permission.data.user?.permissions || permission.data.permission || "none";
-            if (!["write", "maintain", "admin"].includes(level)) {
-              throw new Error(\`promotion runtime override requires write, maintain, or admin permission; actor has \${level}\`);
-            }
+            const script = require(process.env.GITHUB_WORKSPACE + "/.buildchain/router/scripts/authorize-promotion-runtime-override.cjs");
+            await script.authorizePromotionRuntimeOverride({ github, context });
 
       - name: Resolve immutable promotion identities
         id: identities

package/scripts/generate-release-candidate-passport.mjs

@@ -29,6 +29,8 @@ export function generateReleaseCandidatePassportCli() {
   const gateAggregate = gateAggregateJson ? JSON.parse(gateAggregateJson) : undefined;
   const controllerReceiptJson = env("BUILDCHAIN_CONTROLLER_RECEIPT_JSON");
   const controllerReceipts = controllerReceiptJson ? [JSON.parse(controllerReceiptJson)] : [];
+  const familyEvidenceJson = env("BUILDCHAIN_RC_FAMILY_EVIDENCE_JSON");
+  const familyEvidence = familyEvidenceJson ? JSON.parse(familyEvidenceJson) : undefined;
   const passport = createReleaseCandidatePassport({
     repository: env("GITHUB_REPOSITORY", buildSummary.git?.repository || ""),
     pullRequest: {
@@ -51,6 +53,7 @@ export function generateReleaseCandidatePassportCli() {
       workflowShellRef: env("BUILDCHAIN_WORKFLOW_SHELL_REF", buildSummary.runtime?.workflowShellRef || ""),
     },
     gateAggregate,
+    familyEvidence,
     controllerReceipts,
     workflow: {
       name: env("GITHUB_WORKFLOW"),
@@ -80,6 +83,7 @@ export function generateReleaseCandidatePassportCli() {
       candidateHash: passport.candidateHash,
       platformCount: passport.platformMatrix.length,
       gateProfileEvidence: passport.gateProfileEvidence,
+      familyEvidence: passport.familyEvidence,
       controllerReceipts: passport.controllerReceipts || [],
     }),
   });