@kungfu-tech/buildchain 3.0.9-alpha.10 → 3.0.9-alpha.12

package/packages/core/published-delivery-authority.js

@@ -0,0 +1,247 @@
+import { createHash } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { mkdir, mkdtemp, readFile, realpath, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { promisify } from "node:util";
+import { pathToFileURL } from "node:url";
+import { execFile } from "node:child_process";
+
+import { adopterDeliveryGateDigest } from "./adopter-delivery-gate.js";
+
+export const PUBLISHED_DELIVERY_AUTHORITY_CONTRACT =
+  "kungfu-buildchain-published-delivery-authority/v1";
+
+const execFileAsync = promisify(execFile);
+const ROOT_PATTERN = /^sha256:[0-9a-f]{64}$/;
+const PACKAGES = [
+  {
+    key: "buildchain",
+    name: "@kungfu-tech/buildchain",
+    packageRoot: "archive",
+    modules: {
+      adopterDeliveryGate: "packages/core/adopter-delivery-gate.js",
+      bootstrap: "packages/core/buildchain-delivery-bootstrap.js",
+      infrastructure: "packages/core/buildchain-delivery-infrastructure.js",
+      kfdCategoryDriver: "packages/core/kfd-adopter-category-driver.js",
+    },
+  },
+  {
+    key: "kfd",
+    name: "@kungfu-tech/kfd",
+    packageRoot: "profiles/adopter-conformance/adopters/kfd/manifest.json",
+    modules: {},
+  },
+];
+
+async function sha256File(file) {
+  const hash = createHash("sha256");
+  for await (const chunk of createReadStream(file)) hash.update(chunk);
+  return `sha256:${hash.digest("hex")}`;
+}
+
+function exactDeclaration(value, expectedName, label) {
+  if (
+    value?.name !== expectedName ||
+    typeof value.version !== "string" ||
+    value.version.length === 0 ||
+    typeof value.archivePath !== "string" ||
+    value.archivePath.length === 0 ||
+    !ROOT_PATTERN.test(value.archiveRoot ?? "") ||
+    !ROOT_PATTERN.test(value.artifactRoot ?? "")
+  ) {
+    throw new TypeError(`${label} package declaration is incomplete`);
+  }
+  return structuredClone(value);
+}
+
+function safeArchiveEntries(listing, verboseListing, label) {
+  const entries = listing.split("\n").filter(Boolean);
+  const types = verboseListing.split("\n").filter(Boolean);
+  if (entries.length === 0 || entries.length !== types.length) {
+    throw new Error(`${label} archive listing is incomplete`);
+  }
+  for (let index = 0; index < entries.length; index += 1) {
+    const entry = entries[index];
+    const parts = entry.split("/");
+    if (
+      parts[0] !== "package" ||
+      parts.some((part, partIndex) =>
+        partIndex === parts.length - 1 && part === ""
+          ? false
+          : part === "" || part === "." || part === "..",
+      )
+    ) {
+      throw new Error(`${label} archive contains an unsafe path`);
+    }
+    if (!["-", "d"].includes(types[index][0])) {
+      throw new Error(`${label} archive contains a non-file entry`);
+    }
+  }
+}
+
+async function extractPackage(declaration, destination, definition, label) {
+  const observedRoot = await sha256File(declaration.archivePath);
+  if (observedRoot !== declaration.archiveRoot) {
+    throw new Error(`${label} archive bytes do not match archiveRoot`);
+  }
+  const [{ stdout: listing }, { stdout: verboseListing }] = await Promise.all([
+    execFileAsync("tar", ["-tzf", declaration.archivePath], {
+      maxBuffer: 16 * 1024 * 1024,
+    }),
+    execFileAsync("tar", ["-tvzf", declaration.archivePath], {
+      maxBuffer: 16 * 1024 * 1024,
+    }),
+  ]);
+  safeArchiveEntries(listing, verboseListing, label);
+  await mkdir(destination, { recursive: true });
+  await execFileAsync(
+    "tar",
+    [
+      "-xzf",
+      declaration.archivePath,
+      "--strip-components",
+      "1",
+      "-C",
+      destination,
+    ],
+    { maxBuffer: 16 * 1024 * 1024 },
+  );
+  const packageJsonPath = path.join(destination, "package.json");
+  const packageJson = JSON.parse(await readFile(packageJsonPath, "utf8"));
+  if (
+    packageJson.name !== declaration.name ||
+    packageJson.version !== declaration.version
+  ) {
+    throw new Error(`${label} extracted package identity does not match`);
+  }
+  if (definition.packageRoot === "archive") {
+    if (declaration.artifactRoot !== declaration.archiveRoot) {
+      throw new Error(`${label} package artifactRoot must match archiveRoot`);
+    }
+  } else {
+    const packageManifest = JSON.parse(
+      await readFile(path.join(destination, definition.packageRoot), "utf8"),
+    );
+    const packageCut = packageManifest?.kfdCut?.package;
+    if (
+      packageCut?.name !== declaration.name ||
+      packageCut?.version !== declaration.version ||
+      packageCut?.artifactRoot !== declaration.artifactRoot
+    ) {
+      throw new Error(`${label} semantic package identity does not match`);
+    }
+  }
+  const destinationRoot = await realpath(destination);
+  if (!destinationRoot.endsWith(path.join(...declaration.name.split("/")))) {
+    throw new Error(`${label} extraction escaped its package coordinate`);
+  }
+  return {
+    name: declaration.name,
+    version: declaration.version,
+    archiveRoot: declaration.archiveRoot,
+    artifactRoot: declaration.artifactRoot,
+  };
+}
+
+async function importAuthorityRuntime(buildchainRoot) {
+  const definition = PACKAGES[0];
+  const imported = {};
+  for (const [key, relativePath] of Object.entries(definition.modules)) {
+    imported[key] = await import(
+      pathToFileURL(path.join(buildchainRoot, relativePath)).href
+    );
+  }
+  const runtime = {
+    createAdopterDeliveryGate:
+      imported.adopterDeliveryGate.createAdopterDeliveryGate,
+    createPackageArtifactProfile:
+      imported.adopterDeliveryGate.createPackageArtifactProfile,
+    qualifyBuildchainDeliveryInfrastructureBootstrap:
+      imported.bootstrap.qualifyBuildchainDeliveryInfrastructureBootstrap,
+    createBuildchainDeliveryInfrastructureInstanceManifest:
+      imported.infrastructure
+        .createBuildchainDeliveryInfrastructureInstanceManifest,
+    verifyBuildchainDeliveryInfrastructureInstance:
+      imported.infrastructure.verifyBuildchainDeliveryInfrastructureInstance,
+    createKfdAdopterCategoryProtocolDriver:
+      imported.kfdCategoryDriver.createKfdAdopterCategoryProtocolDriver,
+  };
+  for (const [name, implementation] of Object.entries(runtime)) {
+    if (typeof implementation !== "function") {
+      throw new Error(`published Buildchain authority is missing ${name}`);
+    }
+  }
+  return runtime;
+}
+
+export async function loadPublishedBuildchainDeliveryAuthority({
+  buildchain,
+  kfd,
+} = {}) {
+  const declarations = {
+    buildchain: exactDeclaration(
+      buildchain,
+      "@kungfu-tech/buildchain",
+      "Buildchain authority",
+    ),
+    kfd: exactDeclaration(kfd, "@kungfu-tech/kfd", "KFD authority"),
+  };
+  const temporaryRoot = await mkdtemp(
+    path.join(tmpdir(), "buildchain-published-delivery-authority-"),
+  );
+  let retained = false;
+  try {
+    const identities = {};
+    for (const definition of PACKAGES) {
+      identities[definition.key] = await extractPackage(
+        declarations[definition.key],
+        path.join(temporaryRoot, "node_modules", ...definition.name.split("/")),
+        definition,
+        `${definition.key} authority`,
+      );
+    }
+    const authorityRuntime = await importAuthorityRuntime(
+      path.join(temporaryRoot, "node_modules", ...PACKAGES[0].name.split("/")),
+    );
+    const authority = {
+      schemaVersion: 1,
+      contract: PUBLISHED_DELIVERY_AUTHORITY_CONTRACT,
+      packages: identities,
+      moduleCoordinates: structuredClone(PACKAGES[0].modules),
+      qualifying: false,
+      selfCertified: false,
+      releaseAuthorized: false,
+      finalAuthority:
+        "caller-bound-public-npm-archive-bytes-and-package-identity",
+    };
+    authority.authorityRoot = adopterDeliveryGateDigest(authority);
+    retained = true;
+    return {
+      ...authority,
+      authorityRuntime,
+      temporaryRoot,
+      async dispose() {
+        await rm(temporaryRoot, { recursive: true, force: true });
+      },
+    };
+  } finally {
+    if (!retained) await rm(temporaryRoot, { recursive: true, force: true });
+  }
+}
+
+export async function withPublishedBuildchainDeliveryAuthority(
+  declarations,
+  operation,
+) {
+  if (typeof operation !== "function") {
+    throw new TypeError("published authority operation must be a function");
+  }
+  const authority =
+    await loadPublishedBuildchainDeliveryAuthority(declarations);
+  try {
+    return await operation(authority);
+  } finally {
+    await authority.dispose();
+  }
+}

package/packages/core/release-passport.js

@@ -1533,7 +1533,7 @@ export function collectGitHubReleasePassport({
   kfd2ClaimJsons = [],
   kfd3PrebuildWitnessJsons = [],
   kfd3ArtifactWitnessJsons = [],
-  kfd3ArtifactVerifyCommand = "",
+  kfd3ArtifactVerifyCommand = "", adopterDeliveryJson = "",
   kfdAdopterManifestJson = "",
   kfdSupportMatrixJson = "",
   kfdProductGateJsons = [],
@@ -1594,6 +1594,11 @@ export function collectGitHubReleasePassport({
     cwd,
     label: "KFD-3 artifact verify command",
   });
+  const adopterDelivery = parseJsonInput(
+    adopterDeliveryJson,
+    undefined,
+    { cwd, label: "adopterDeliveryJson" },
+  );
   const basePassportMeta = parseJsonInputWithMeta(basePassportJson, undefined, { cwd, label: "basePassportJson" });
   const invariantPassportMetas = (invariantPassportJsons || [])
     .filter(Boolean)
@@ -1684,6 +1689,7 @@ export function collectGitHubReleasePassport({
     tag: resolvedTag,
     sourceSha,
     workflow,
+    adopterDelivery,
     kfdAdopter,
   });
   const bundledPublishEvidencePath = publishEvidenceMeta.value ? "evidence.json" : "";
@@ -1750,6 +1756,7 @@ export function collectGitHubReleasePassport({
     kfd1,
     kfd2Claims: kfd2ClaimMetas.map((meta) => meta.value),
     kfd3,
+    adopterDelivery,
     kfdAdopter,
     kfdAdopterManifestEvidencePath: kfdAdopter ? "kfd-adopter-manifest.json" : "",
     kfdAdopterGateEvidencePath: kfdAdopter ? "kfd-adopter-manifest-gate.json" : "",

package/scripts/buildchain-cli-help.mjs

@@ -67,6 +67,7 @@ export const BUILDCHAIN_USAGE = `Usage:
                                     [--kfd-3-prebuild-witness-json <json-or-path>]...
                                     [--kfd-3-artifact-witness-json <json-or-path>]...
                                     [--kfd-3-artifact-verify-cmd <command>]
+                                    [--adopter-delivery-json <json-or-path>]
                                     [--kfd-adopter-manifest-json <json-or-path>]
                                     [--kfd-support-matrix-json <json-or-path>]
                                     [--kfd-product-gate-json <json-or-path>]...

package/scripts/check-inventory.mjs

@@ -1003,7 +1003,7 @@ for (const forbiddenSnippet of [
 for (const requiredSnippet of [
   "id-token: write",
   "actions: write",
-  "uses: kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@cc6c32845ab5779009aeb48cc34efe65e229fe30\n",
+  "uses: kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@15db8a9d7c39f7a649a0e3971af68490356dd9ac\n",
   "github.event.workflow_run.event == 'push'",
   "!startsWith(github.event.workflow_run.display_title, 'chore(release): prepare v')",
   "!startsWith(github.event.workflow_run.display_title, 'chore(release): release v')",

package/scripts/dev-delivery-warrant.mjs

@@ -423,7 +423,7 @@ export function devDeliveryCliOptions(args = [], environment = process.env) {
     initiativeRoot: flag(rest, "initiative-root", environment.BUILDCHAIN_DEV_DELIVERY_INITIATIVE_ROOT),
     sourceIdentityRoot: flag(rest, "source-identity-root", environment.BUILDCHAIN_DEV_DELIVERY_SOURCE_IDENTITY_ROOT),
     sourcePatchRoot: flag(rest, "source-patch-root", environment.BUILDCHAIN_DEV_DELIVERY_SOURCE_PATCH_ROOT),
-    sourceProofRoot: flag(rest, "source-proof-root", environment.BUILDCHAIN_DEV_DELIVERY_SOURCE_PROOF_ROOT),
+    sourceProofRoot: flag(rest, "source-proof-root", environment.BUILDCHAIN_DEV_DELIVERY_SOURCE_PROOF_ROOT), sourceWorkflowRunId: flag(rest, "source-workflow-run-id", environment.BUILDCHAIN_DEV_DELIVERY_SOURCE_WORKFLOW_RUN_ID),
     affectedPaths: flag(rest, "affected-paths-json", environment.BUILDCHAIN_DEV_DELIVERY_AFFECTED_PATHS || "[]"),
     nativeProofPath: flag(rest, "native-proof", environment.BUILDCHAIN_DEV_DELIVERY_NATIVE_PROOF),
     nativeReuseDecisionPath: flag(rest, "native-reuse-decision", environment.BUILDCHAIN_DEV_DELIVERY_NATIVE_REUSE_DECISION),

package/scripts/site-capability-metadata.mjs

@@ -238,6 +238,8 @@ export function nodeApiMeta(exportName) {
     "./kfd-adopter-category-driver": { group: "kfd-trust", summary: "Thin delivery driver over exact published KFD category profiles and instance verification." },
     "./buildchain-delivery-infrastructure": { group: "kfd-trust", summary: "Buildchain-owned delivery-infrastructure category instance construction and published-KFD verification APIs." },
     "./buildchain-delivery-bootstrap": { group: "release-passport-trust", summary: "Anti-circular protected N-1 bootstrap evidence verification for one exact Buildchain delivery-infrastructure candidate." },
+    "./buildchain-delivery-self-dogfood": { group: "release-passport-trust", summary: "Pure exact-package self-dogfood assembly through injected published N-1 Buildchain and KFD abilities." },
+    "./published-delivery-authority": { group: "release-passport-trust", summary: "Exact npm archive-byte loading and constrained N-1 delivery authority imports with guaranteed cleanup." },
     "./legacy-kfd-adopter-driver": { group: "kfd-trust", summary: "Explicit one-way legacy standard adopter manifest and support-matrix delivery adapter." },
     "./adopter-delivery-passport": { group: "release-passport-trust", summary: "Exact adopter delivery gate binding and Release Passport evidence verification APIs." },
     "./adopter-delivery-vectors": { group: "release-passport-trust", summary: "Rooted golden, negative, fault, and offline replay vector suite APIs." },

package/scripts/workflow-call-contract.mjs

@@ -6,7 +6,7 @@ import { pathToFileURL } from "node:url";
 import { evaluateWorkflowCallContract } from "../packages/core/workflow-call-contract.js";
 import { parseWorkflowDocument } from "../packages/core/workflow-yaml-contract.js";
 
-export const SELF_RELEASE_REF = "cc6c32845ab5779009aeb48cc34efe65e229fe30";
+export const SELF_RELEASE_REF = "15db8a9d7c39f7a649a0e3971af68490356dd9ac";
 export const SELF_RELEASE_PUBLIC_WORKFLOW = `kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@${SELF_RELEASE_REF}`;
 
 function parityFailure(message) {