@kungfu-tech/buildchain 3.0.5-alpha.5 → 3.0.5-alpha.7

package/scripts/aws-windows-jit-campaign.mjs

@@ -46,10 +46,14 @@ function armPlan() {
     armedAt: arg("armed-at", new Date().toISOString()),
     expiresAt: arg("expires-at"),
     phaseSpendBaselineUsd: arg("phase-spend-baseline-usd"),
+    maxAcceptedInstances: arg("max-accepted-instances"),
   });
 }
 
-function confirm(plan, { phaseSpendBaseline = true } = {}) {
+function confirm(
+  plan,
+  { phaseSpendBaseline = true, maxAcceptedInstances = true } = {},
+) {
   if (arg("confirm-campaign-id") !== plan.campaign.id) {
     throw new Error("--confirm-campaign-id must equal the campaign id");
   }
@@ -71,6 +75,16 @@ function confirm(plan, { phaseSpendBaseline = true } = {}) {
       "--confirm-phase-spend-baseline-usd must equal the phase spend baseline",
     );
   }
+  if (
+    maxAcceptedInstances &&
+    (!arg("confirm-max-accepted-instances").trim() ||
+      Number(arg("confirm-max-accepted-instances")) !==
+        plan.limits.maxAcceptedInstances)
+  ) {
+    throw new Error(
+      "--confirm-max-accepted-instances must equal the campaign slot ceiling",
+    );
+  }
 }
 
 function killSwitchTopic() {
@@ -132,7 +146,10 @@ export function main() {
       expiresAt: new Date(now.getTime() + 1000).toISOString(),
       phaseSpendBaselineUsd: 0,
     });
-    confirm(plan, { phaseSpendBaseline: false });
+    confirm(plan, {
+      phaseSpendBaseline: false,
+      maxAcceptedInstances: false,
+    });
     const topic = killSwitchTopic();
     aws(
       plan,

package/scripts/build-standalone-binary.mjs

@@ -352,7 +352,11 @@ export function buildStandaloneBinary({
     name,
     version,
     platform: triple,
+    platformId: process.platform === "linux" && process.arch === "x64" ? "linux-x64" : triple,
     binary: relativePath(cwd, binaryPath),
+    sha256: crypto.createHash("sha256").update(fs.readFileSync(binaryPath)).digest("hex"),
+    sourceSha: sourceSha(cwd),
+    runtimeDependencies: [],
     archive: relativePath(cwd, archivePath),
     node: process.version,
     observability: {

package/scripts/buildchain-cli-help.mjs

@@ -208,7 +208,7 @@ export const BUILDCHAIN_USAGE = `Usage:
                           [--execute] [--json]
   buildchain paper status [--cwd <dir>] [--json]
   buildchain paper resume [--cwd <dir>] [--buildchain-ref <ref>] [--execute] [--json]
-  buildchain release-propagation <plan|write-lock> ...
+  buildchain release-propagation <plan|write-lock|work|pickup> ...
   buildchain badges readme [--cwd <dir>] [--readme <path>] [--check] [--write] [--json]
   buildchain badges bundle [--cwd <dir>] [--readme <path>] [--claims <csv>] [--check] [--write] [--json]
   buildchain homebrew update-formula --package <name> --release-passport <file-or-url> [--write] [--json]
@@ -246,6 +246,7 @@ Examples:
   buildchain paper preflight --json
   buildchain paper status --json
   buildchain release-propagation plan --graph graph.json --upstream-release release.json --json
+  buildchain release-propagation pickup plan --config manual-upstreams.json --source-id buildchain --channel release --current-version 3.0.3 --json
   buildchain kfd status --json
   buildchain kfd schema list --json
   buildchain kfd 1 witness --json

package/scripts/check-inventory.mjs

@@ -73,6 +73,7 @@ const requiredPaths = [
   "docs/github-artifact-attestation.md",
   "docs/shifu-gate-profiles.md",
   "docs/auditable-demo.md",
+  "contracts/auditable-demo-scenario-v1.schema.json",
   "contracts/auditable-demo-media-profiles-v1.json",
   "contracts/evidence/auditable-demo-web-delivery-v1.json",
   "contracts/evidence/auditable-demo-responsive-web-delivery-v1.json",
@@ -103,6 +104,8 @@ const requiredPaths = [
   "scripts/seal-macos-credential-input.mjs",
   "scripts/shifu-gate-profile.mjs",
   "scripts/auditable-demo.mjs",
+  "scripts/auditable-demo-platform.mjs",
+  "scripts/auditable-demo-capture.py",
   "scripts/resolve-artifact-coordinates.mjs",
   "scripts/artifact-relay-s3.mjs",
   "scripts/anchored-version-material.mjs",
@@ -154,6 +157,8 @@ const requiredPaths = [
   ".github/workflows/.build.yml",
   ".github/workflows/.gate-profile.yml",
   ".github/workflows/.auditable-demo.yml",
+  ".github/workflows/.declarative-auditable-demo.yml",
+  ".github/workflows/auditable-demo.yml",
   ".github/workflows/build.yml",
   ".github/workflows/build-surface-fixture.yml",
   ".github/workflows/candidate-lab.yml",

package/scripts/finalize-native-artifact-signing-result.mjs

@@ -12,6 +12,7 @@ import {
   artifactSigningEvidenceDigest,
   createArtifactSigningResult,
 } from "../packages/core/artifact-signing-result.js";
+import { acceptedMacosCredentialEvidence } from "../actions/macos-credential-island/dmg-assembly.js";
 import { writeGitHubOutputs } from "./build-contract-core.mjs";
 
 function required(value, label) {
@@ -32,15 +33,39 @@ function resolveBelow(root, relative, label) {
   return target;
 }
 
+function expectedCredentialExecution(
+  appBundleResult,
+  expectedRunId,
+  expectedRunAttempt,
+) {
+  if (!appBundleResult) return null;
+  return {
+    runId: required(expectedRunId, "credential execution run id"),
+    runAttempt: required(
+      expectedRunAttempt,
+      "credential execution run attempt",
+    ),
+  };
+}
+
+function acceptedProviderEvidence(evidence, request, expectedExecution) {
+  return expectedExecution
+    ? acceptedMacosCredentialEvidence(evidence, request, expectedExecution)
+    : evidence.status === "passed" &&
+        evidence.provider === request.signature.provider;
+}
+
 export function finalizeNativeArtifactSigningResult({
   requestRoot = process.env.BUILDCHAIN_SIGNING_REQUEST_ROOT,
   requestPath = process.env.BUILDCHAIN_SIGNING_REQUEST_PATH,
   signedPayload = process.env.BUILDCHAIN_SIGNED_PAYLOAD,
   evidencePath = process.env.BUILDCHAIN_SIGNING_EVIDENCE,
-  credentialArtifactRoot =
-    process.env.BUILDCHAIN_SIGNING_CREDENTIAL_ARTIFACT_ROOT,
+  credentialArtifactRoot = process.env
+    .BUILDCHAIN_SIGNING_CREDENTIAL_ARTIFACT_ROOT,
   outputRoot = process.env.BUILDCHAIN_SIGNING_RESULT_ROOT,
   checks = process.env.BUILDCHAIN_SIGNING_VERIFICATION_CHECKS,
+  expectedRunId = process.env.GITHUB_RUN_ID,
+  expectedRunAttempt = process.env.GITHUB_RUN_ATTEMPT,
 } = {}) {
   const requests = path.resolve(required(requestRoot, "signing request root"));
   const request = JSON.parse(
@@ -77,19 +102,16 @@ export function finalizeNativeArtifactSigningResult({
   fs.copyFileSync(evidenceSource, evidenceOutput, fs.constants.COPYFILE_EXCL);
   const evidenceDocument = JSON.parse(fs.readFileSync(evidenceOutput, "utf8"));
   const appBundleResult = request.artifact.kind === "app-bundle";
-  const providerEvidencePassed = appBundleResult
-    ? evidenceDocument.schema ===
-        "buildchain.macos-credential-island-evidence/v1" &&
-      evidenceDocument.status === "accepted" &&
-      evidenceDocument.source?.repository === request.source.repository &&
-      evidenceDocument.source?.sha === request.source.sha &&
-      evidenceDocument.source?.treeSha === request.source.treeSha &&
-      evidenceDocument.buildchain?.runtimeSha === request.runtime.sha &&
-      evidenceDocument.app?.architecture === request.artifact.arch &&
-      evidenceDocument.notarization?.application?.status === "Accepted" &&
-      evidenceDocument.notarization?.diskImage?.status === "Accepted"
-    : evidenceDocument.status === "passed" &&
-      evidenceDocument.provider === request.signature.provider;
+  const expectedExecution = expectedCredentialExecution(
+    appBundleResult,
+    expectedRunId,
+    expectedRunAttempt,
+  );
+  const providerEvidencePassed = acceptedProviderEvidence(
+    evidenceDocument,
+    request,
+    expectedExecution,
+  );
   if (!providerEvidencePassed) {
     throw new Error(
       "provider evidence does not prove the requested native signature",

package/scripts/generate-site-bundle.mjs

@@ -767,6 +767,7 @@ function buildSiteBundle() {
         ["build", "channel-build-router"],
         [".build", "reusable-build"],
         [".auditable-demo", "auditable-demo"],
+        [".declarative-auditable-demo", "declarative-auditable-demo"],
         ["web-surface", "site-app-deployment"],
         ["buildchain-ref-promotion", "release-governance"],
         ["release-line-bootstrap", "release-governance"],
@@ -793,6 +794,7 @@ function buildSiteBundle() {
       ]);
       const statusById = new Map([
         [".auditable-demo", "preview"],
+        [".declarative-auditable-demo", "preview"],
         ["release-propagation", "preview"],
         ["candidate-lab", "repository-internal"],
         ["build-surface-fixture", "repository-internal"],

package/scripts/release-propagation.mjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import fs from "node:fs";
 import path from "node:path";
+import { execFileSync } from "node:child_process";
 import { pathToFileURL } from "node:url";
 import {
   claimReleasePropagationWork,
@@ -15,6 +16,10 @@ import {
   resumeReleasePropagationWork,
   verifyReleasePropagationWork,
   writeReleasePropagationLock,
+  createManualUpstreamPickupCapture,
+  createManualUpstreamPickupPlan,
+  normalizeManualUpstreamPickupConfig,
+  resolveNpmRegistryRelease,
 } from "../packages/core/release-propagation.js";
 
 function usage() {
@@ -61,6 +66,15 @@ function usage() {
                                               --completion-decision <json-or-path>
                                               --expected-work-root <sha256:...>
                                               [--output <file>] [--json]
+  buildchain release-propagation pickup plan --config <json-or-path>
+                                            --source-id <id> --channel <alpha|release>
+                                            --current-version <version>
+                                            [--output <file>] [--json]
+  buildchain release-propagation pickup create --config <json-or-path>
+                                              --source-id <id> --channel <alpha|release>
+                                              --current-version <version>
+                                              --expected-downstream-base-sha <git-sha>
+                                              [--output <file>] [--json]
 `;
 }
 
@@ -171,7 +185,61 @@ function runWorkCli(args) {
   throw new Error(`unsupported release-propagation work command: ${mode}`);
 }
 
-export function runReleasePropagationCli(argv = process.argv.slice(2)) {
+async function resolvePickupPlan(args) {
+  const config = normalizeManualUpstreamPickupConfig(readJsonFlag(args, "config"));
+  const sourceId = readFlag(args, "source-id");
+  const channel = readFlag(args, "channel");
+  const source = config.sources.find((entry) => entry.id === sourceId);
+  if (!source) throw new Error(`manual pickup source is not configured: ${sourceId}`);
+  const distTag = source.distTags[channel];
+  if (!distTag) throw new Error("manual pickup channel must be alpha or release");
+  const packageMetadata = args.includes("--package-metadata")
+    ? readJsonFlag(args, "package-metadata")
+    : JSON.parse(execFileSync("npm", ["view", `${source.package}@${distTag}`, "--json", "--registry=https://registry.npmjs.org/"], {
+        encoding: "utf8",
+        maxBuffer: 16 * 1024 * 1024,
+      }));
+  const attestationUrl = packageMetadata.dist?.attestations?.url;
+  if (!attestationUrl) throw new Error("published npm package does not expose an attestation URL");
+  let attestations;
+  if (args.includes("--attestations")) {
+    attestations = readJsonFlag(args, "attestations");
+  } else {
+    const response = await fetch(attestationUrl, { headers: { accept: "application/json" } });
+    if (!response.ok) throw new Error(`npm attestation lookup failed: HTTP ${response.status}`);
+    attestations = await response.json();
+  }
+  const upstreamRelease = resolveNpmRegistryRelease({ source, channel, packageMetadata, attestations });
+  return createManualUpstreamPickupPlan({
+    config,
+    sourceId,
+    channel,
+    currentVersion: readFlag(args, "current-version"),
+    upstreamRelease,
+  });
+}
+
+async function runPickupCli(args) {
+  const [mode = "", ...pickupArgs] = args;
+  if (!mode || mode === "--help" || mode === "-h") {
+    process.stdout.write(usage());
+    return;
+  }
+  if (mode !== "plan" && mode !== "create") throw new Error(`unsupported release-propagation pickup command: ${mode}`);
+  const plan = await resolvePickupPlan(pickupArgs);
+  const result = mode === "create"
+    ? createManualUpstreamPickupCapture({
+        plan,
+        expectedDownstreamBaseSha: readFlag(pickupArgs, "expected-downstream-base-sha"),
+      })
+    : plan;
+  writeOutput(readFlag(pickupArgs, "output", ""), result);
+  if (hasFlag(pickupArgs, "json")) printJson(result);
+  else if (mode === "plan") process.stdout.write(`manual upstream pickup: ${plan.source.id} ${plan.currentVersion} -> ${plan.resolvedVersion} (${plan.status})\n`);
+  else process.stdout.write(`manual upstream pickup next action: ${result.nextAction}\n`);
+}
+
+export async function runReleasePropagationCli(argv = process.argv.slice(2)) {
   const [mode = "", ...args] = argv;
   if (!mode || mode === "--help" || mode === "-h") {
     process.stdout.write(usage());
@@ -206,6 +274,10 @@ export function runReleasePropagationCli(argv = process.argv.slice(2)) {
     runWorkCli(args);
     return;
   }
+  if (mode === "pickup") {
+    await runPickupCli(args);
+    return;
+  }
   if (mode === "write-lock") {
     const plan = readReleasePropagationJson(readFlag(args, "plan"), {
       label: "--plan",
@@ -259,5 +331,8 @@ export function runReleasePropagationCli(argv = process.argv.slice(2)) {
 }
 
 if (!process.env.BUILDCHAIN_EMBEDDED_ENTRYPOINT && process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
-  runReleasePropagationCli();
+  runReleasePropagationCli().catch((error) => {
+    console.error(`buildchain release-propagation: ${error.message}`);
+    process.exitCode = 1;
+  });
 }