@kungfu-tech/buildchain 3.0.9-alpha.9 → 4.0.0-alpha.1

package/packages/core/v4-stage-capsule.js

@@ -0,0 +1,319 @@
+import {
+  V4ContractFault,
+  v4ContentRoot,
+  validateV4Clock,
+  validateV4Root,
+} from "./v4-canonical-contracts.js";
+
+export const V4_STAGE_CAPSULE_CONTRACT = "buildchain-v4-stage-capsule/v1";
+export const V4_STAGE_CAPSULE_IDENTITY_CONTRACT =
+  "buildchain-v4-stage-capsule-identity/v1";
+export const V4_STAGE_CAPSULE_AVAILABILITY_CONTRACT =
+  "buildchain-v4-stage-capsule-availability/v1";
+export const V4_STAGE_CAPSULE_REUSE_CONTRACT =
+  "buildchain-v4-stage-capsule-reuse/v1";
+
+const TOKEN = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/u;
+const AVAILABILITY = new Set([
+  "available",
+  "missing",
+  "expired",
+  "partial",
+  "corrupt",
+  "quarantined",
+  "root-mismatch",
+]);
+
+function fault(code, path, message) {
+  throw new V4ContractFault(code, path, message);
+}
+
+function exactKeys(value, keys, path) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    fault("invalid-stage-capsule-shape", path, `${path} must be an object`);
+  const actual = Object.keys(value).sort();
+  const expected = [...keys].sort();
+  if (
+    actual.length !== expected.length ||
+    actual.some((key, index) => key !== expected[index])
+  )
+    fault(
+      "invalid-stage-capsule-shape",
+      path,
+      `${path} keys are not canonical`,
+    );
+}
+
+function validateToken(value, path) {
+  if (typeof value !== "string" || !TOKEN.test(value))
+    fault(
+      "invalid-stage-capsule-token",
+      path,
+      `${path} must be an ASCII token`,
+    );
+}
+
+function validateNamedRoots(value, path) {
+  if (!Array.isArray(value))
+    fault("invalid-stage-capsule-shape", path, `${path} must be an array`);
+  let prior = null;
+  for (const [index, entry] of value.entries()) {
+    const entryPath = `${path}/${index}`;
+    exactKeys(entry, ["name", "root"], entryPath);
+    validateToken(entry.name, `${entryPath}/name`);
+    validateV4Root(entry.root, `${entryPath}/root`);
+    if (prior !== null && entry.name <= prior)
+      fault(
+        "unordered-stage-capsule-roots",
+        `${entryPath}/name`,
+        `${path} names must be unique and byte-sorted`,
+      );
+    prior = entry.name;
+  }
+}
+
+export function validateV4StageCapsuleIdentity(value) {
+  exactKeys(
+    value,
+    [
+      "schema",
+      "sourceRoot",
+      "platform",
+      "platformRoot",
+      "stage",
+      "toolchainRoots",
+      "runtimeRoot",
+      "policyRoot",
+      "declaredInputs",
+      "transformationRoot",
+      "outputManifestRoot",
+      "qualificationRoot",
+      "observationRoots",
+    ],
+    "$/identity",
+  );
+  if (value.schema !== V4_STAGE_CAPSULE_IDENTITY_CONTRACT)
+    fault(
+      "unsupported-stage-capsule-version",
+      "$/identity/schema",
+      "unsupported Stage Capsule identity schema",
+    );
+  for (const name of ["platform", "stage"])
+    validateToken(value[name], `$/identity/${name}`);
+  for (const name of [
+    "sourceRoot",
+    "platformRoot",
+    "runtimeRoot",
+    "policyRoot",
+    "transformationRoot",
+    "outputManifestRoot",
+    "qualificationRoot",
+  ])
+    validateV4Root(value[name], `$/identity/${name}`);
+  validateNamedRoots(value.toolchainRoots, "$/identity/toolchainRoots");
+  validateNamedRoots(value.declaredInputs, "$/identity/declaredInputs");
+  validateNamedRoots(value.observationRoots, "$/identity/observationRoots");
+  return value;
+}
+
+export function v4StageCapsuleIdentityRoot(identity) {
+  validateV4StageCapsuleIdentity(identity);
+  return v4ContentRoot("stage-capsule-identity", identity);
+}
+
+function validateRetentionPromise(value) {
+  exactKeys(value, ["class", "retainUntil"], "$/retentionPromise");
+  validateToken(value.class, "$/retentionPromise/class");
+  validateV4Clock(value.retainUntil, "$/retentionPromise/retainUntil");
+}
+
+function capsulePayload(value) {
+  return {
+    schema: value.schema,
+    writerAuthority: value.writerAuthority,
+    rustAuthority: value.rustAuthority,
+    identity: value.identity,
+    identityRoot: value.identityRoot,
+    retentionPromise: value.retentionPromise,
+  };
+}
+
+export function validateV4StageCapsule(value) {
+  exactKeys(
+    value,
+    [
+      "schema",
+      "writerAuthority",
+      "rustAuthority",
+      "identity",
+      "identityRoot",
+      "retentionPromise",
+      "capsuleRoot",
+    ],
+    "$",
+  );
+  if (value.schema !== V4_STAGE_CAPSULE_CONTRACT)
+    fault(
+      "unsupported-stage-capsule-version",
+      "$/schema",
+      "unsupported Stage Capsule schema",
+    );
+  if (
+    value.writerAuthority !== "typescript-v3" ||
+    value.rustAuthority !== "validation-only"
+  )
+    fault(
+      "invalid-stage-capsule-authority",
+      "$/writerAuthority",
+      "Stage Capsule authority must remain TypeScript v3 with validation-only Rust",
+    );
+  const identityRoot = v4StageCapsuleIdentityRoot(value.identity);
+  validateV4Root(value.identityRoot, "$/identityRoot");
+  if (value.identityRoot !== identityRoot)
+    fault(
+      "stage-capsule-identity-root-mismatch",
+      "$/identityRoot",
+      "identityRoot does not bind the canonical Stage Capsule identity",
+    );
+  validateRetentionPromise(value.retentionPromise);
+  validateV4Root(value.capsuleRoot, "$/capsuleRoot");
+  const capsuleRoot = v4ContentRoot("stage-capsule", capsulePayload(value));
+  if (value.capsuleRoot !== capsuleRoot)
+    fault(
+      "stage-capsule-root-mismatch",
+      "$/capsuleRoot",
+      "capsuleRoot does not bind the canonical Stage Capsule",
+    );
+  return value;
+}
+
+export function v4StageCapsuleRoot(value) {
+  validateV4StageCapsuleIdentity(value.identity);
+  validateRetentionPromise(value.retentionPromise);
+  return v4ContentRoot("stage-capsule", capsulePayload(value));
+}
+
+export function validateV4StageCapsuleAvailability(value) {
+  exactKeys(
+    value,
+    [
+      "schema",
+      "capsuleRoot",
+      "observedAt",
+      "status",
+      "contentRoot",
+      "qualificationRoot",
+      "transports",
+      "faultCode",
+    ],
+    "$/availability",
+  );
+  if (value.schema !== V4_STAGE_CAPSULE_AVAILABILITY_CONTRACT)
+    fault(
+      "unsupported-stage-capsule-version",
+      "$/availability/schema",
+      "unsupported Stage Capsule availability schema",
+    );
+  validateV4Root(value.capsuleRoot, "$/availability/capsuleRoot");
+  validateV4Clock(value.observedAt, "$/availability/observedAt");
+  if (!AVAILABILITY.has(value.status))
+    fault(
+      "invalid-stage-capsule-availability",
+      "$/availability/status",
+      "unsupported Stage Capsule availability status",
+    );
+  for (const name of ["contentRoot", "qualificationRoot"])
+    if (value[name] !== null)
+      validateV4Root(value[name], `$/availability/${name}`);
+  validateNamedRoots(value.transports, "$/availability/transports");
+  if (value.faultCode !== null)
+    validateToken(value.faultCode, "$/availability/faultCode");
+  if (
+    value.status === "available" &&
+    (value.contentRoot === null ||
+      value.qualificationRoot === null ||
+      value.faultCode !== null)
+  )
+    fault(
+      "invalid-stage-capsule-availability",
+      "$/availability",
+      "available content requires content and qualification roots without a fault",
+    );
+  if (value.status !== "available" && value.faultCode === null)
+    fault(
+      "invalid-stage-capsule-availability",
+      "$/availability/faultCode",
+      "unavailable content requires a typed fault code",
+    );
+  return value;
+}
+
+export function v4StageCapsuleAvailabilityRoot(value) {
+  validateV4StageCapsuleAvailability(value);
+  return v4ContentRoot("stage-capsule-availability", value);
+}
+
+export function evaluateV4StageCapsuleReuse(request) {
+  exactKeys(
+    request,
+    [
+      "schema",
+      "capsule",
+      "availability",
+      "evaluatedAt",
+      "expectedCapsuleRoot",
+      "expectedOutputManifestRoot",
+      "expectedQualificationRoot",
+    ],
+    "$",
+  );
+  if (request.schema !== V4_STAGE_CAPSULE_REUSE_CONTRACT)
+    fault(
+      "unsupported-stage-capsule-version",
+      "$/schema",
+      "unsupported Stage Capsule reuse schema",
+    );
+  validateV4StageCapsule(request.capsule);
+  validateV4StageCapsuleAvailability(request.availability);
+  validateV4Clock(request.evaluatedAt, "$/evaluatedAt");
+  for (const name of [
+    "expectedCapsuleRoot",
+    "expectedOutputManifestRoot",
+    "expectedQualificationRoot",
+  ])
+    validateV4Root(request[name], `$/${name}`);
+  const fail = (reason) => ({
+    schema: V4_STAGE_CAPSULE_REUSE_CONTRACT,
+    eligible: false,
+    capsuleRoot: request.capsule.capsuleRoot,
+    availabilityRoot: v4StageCapsuleAvailabilityRoot(request.availability),
+    reason,
+  });
+  if (
+    request.expectedCapsuleRoot !== request.capsule.capsuleRoot ||
+    request.availability.capsuleRoot !== request.capsule.capsuleRoot
+  )
+    return fail("root-mismatch");
+  if (request.availability.status !== "available")
+    return fail(request.availability.status);
+  if (request.evaluatedAt > request.capsule.retentionPromise.retainUntil)
+    return fail("expired");
+  if (
+    request.expectedOutputManifestRoot !==
+      request.capsule.identity.outputManifestRoot ||
+    request.availability.contentRoot !==
+      request.capsule.identity.outputManifestRoot ||
+    request.expectedQualificationRoot !==
+      request.capsule.identity.qualificationRoot ||
+    request.availability.qualificationRoot !==
+      request.capsule.identity.qualificationRoot
+  )
+    return fail("root-mismatch");
+  return {
+    schema: V4_STAGE_CAPSULE_REUSE_CONTRACT,
+    eligible: true,
+    capsuleRoot: request.capsule.capsuleRoot,
+    availabilityRoot: v4StageCapsuleAvailabilityRoot(request.availability),
+    reason: "eligible",
+  };
+}

package/scripts/assemble-self-publication-admission.mjs

@@ -173,7 +173,7 @@ async function main() {
     artifactDigest: artifactSet.manifestSetDigest,
     nonce: `${required("GITHUB_RUN_ID")}:${required("GITHUB_RUN_ATTEMPT")}:${sourceSha}`,
     issuedAt: issuedAt.toISOString(),
-    expiresAt: new Date(issuedAt.getTime() + 15 * 60 * 1000).toISOString(),
+    expiresAt: new Date(issuedAt.getTime() + 10 * 60 * 1000).toISOString(),
     qualification: {
       required: qualificationRequired,
       predicateId: process.env.BUILDCHAIN_CONSUMER_PREDICATE_ID || "",

package/scripts/audit-publication-control-plane.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { spawnSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
+import { spawnSyncCommand } from "../packages/core/spawn-command.js";
 
 import {
   evaluateBuildchainReleaseReconciliation,
@@ -17,7 +17,7 @@ function flag(name, fallback = "") {
 }
 
 function commandJson(command, args, label) {
-  const result = spawnSync(command, args, {
+  const result = spawnSyncCommand(command, args, {
     encoding: "utf8",
     timeout: 60_000,
     maxBuffer: GITHUB_JSON_MAX_BUFFER,
@@ -38,7 +38,7 @@ function githubJson(apiPath, label) {
 }
 
 function githubJsonOptional(apiPath, label, fallback) {
-  const result = spawnSync("gh", ["api", apiPath, "-H", "Accept: application/vnd.github+json"], {
+  const result = spawnSyncCommand("gh", ["api", apiPath, "-H", "Accept: application/vnd.github+json"], {
     encoding: "utf8",
     timeout: 60_000,
     maxBuffer: GITHUB_JSON_MAX_BUFFER,
@@ -56,7 +56,7 @@ function githubJsonOptional(apiPath, label, fallback) {
 }
 
 function githubJsonReadLimited(apiPath, label, fallback) {
-  const result = spawnSync("gh", ["api", apiPath, "-H", "Accept: application/vnd.github+json"], {
+  const result = spawnSyncCommand("gh", ["api", apiPath, "-H", "Accept: application/vnd.github+json"], {
     encoding: "utf8",
     timeout: 60_000,
     maxBuffer: GITHUB_JSON_MAX_BUFFER,
@@ -453,7 +453,7 @@ function main() {
   const reviewRules = (environmentState.protection_rules || []).filter((rule) => rule.type === "required_reviewers");
   const runsOn = (block.match(/^\s{4}runs-on:\s*([^\n#]+)/m)?.[1] || "").trim().replace(/["']/g, "");
   const observedAt = new Date();
-  const expiresAt = new Date(observedAt.getTime() + 15 * 60 * 1000);
+  const expiresAt = new Date(observedAt.getTime() + 10 * 60 * 1000);
   const receipt = evaluatePublicationControlPlaneSnapshot({
     repository,
     workflowPath,

package/scripts/auditable-demo-bundle-verification.mjs

@@ -4,10 +4,11 @@
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
-import { MAX_LONG_FORM_RENDERER_MANIFEST_BYTES, readRendererManifest } from "./auditable-demo-renditions.mjs";
+import { readRendererManifest } from "./auditable-demo-renditions.mjs";
 
 const DIGEST = /^sha256:[0-9a-f]{64}$/u;
 const MAX_METADATA_MEMBER_BYTES = 8 * 1024 * 1024;
+const MAX_LONG_FORM_MANIFEST_BYTES = 32 * 1024 * 1024;
 const MAX_TERMINAL_CAPTURE_BYTES = 4 * 1024 * 1024;
 const MAX_TERMINAL_CAPTURE_EVENTS = 10_000;
 const DIGEST_BUFFER_BYTES = 64 * 1024;
@@ -112,7 +113,7 @@ export function verifyBundleChecksums(root, label, options = {}) {
     declared.add(match[2]);
     const metadataMember = match[2].endsWith(".json") || match[2].endsWith(".sha256");
     const maximum = options.allowLongFormRendererManifest && match[2] === "manifest.json"
-      ? MAX_LONG_FORM_RENDERER_MANIFEST_BYTES
+      ? MAX_LONG_FORM_MANIFEST_BYTES
       : metadataMember
         ? MAX_METADATA_MEMBER_BYTES
         : (options.maximumMemberBytes || MAX_METADATA_MEMBER_BYTES);

package/scripts/auditable-demo-platform.mjs

@@ -23,10 +23,10 @@ const NON_AUTHORITIES = [
 ];
 const RENDITIONS = [
   { id: "1080p", role: "primary", columns: 150, rows: 36, width: 1920, height: 1080 },
-  { id: "720p", role: "responsive", columns: 150, rows: 28, width: 1280, height: 720 },
+  { id: "720p", role: "responsive", columns: 100, rows: 28, width: 1280, height: 720 },
 ];
 const STANDARD_MAX_SECONDS = 60;
-const LONG_FORM_MAX_SECONDS = 360;
+const LONG_FORM_MAX_SECONDS = 180;
 const PRESENTATION_FRAMED = "presentation-framed";
 const TERMINAL_FILL = "terminal-fill";
 const MAX_EXECUTABLE_FILES = 32;

package/scripts/auditable-demo-renditions.mjs

@@ -17,7 +17,7 @@ const RENDITION_SET_NON_AUTHORITIES = [
   ...TERMINAL_CAPTURE_NON_AUTHORITIES,
 ];
 const MAX_BUNDLE_MEMBER_BYTES = 8 * 1024 * 1024;
-export const MAX_LONG_FORM_RENDERER_MANIFEST_BYTES = 64 * 1024 * 1024;
+const MAX_LONG_FORM_RENDERER_MANIFEST_BYTES = 32 * 1024 * 1024;
 const PRESENTATION_FRAMED = "presentation-framed";
 const TERMINAL_FILL = "terminal-fill";
 const GEOMETRY_TOLERANCE = 0.001;

package/scripts/auditable-demo.mjs

@@ -7,7 +7,7 @@ import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
-import { MAX_LONG_FORM_RENDERER_MANIFEST_BYTES, readRendererManifest, validateRendererCompositionInputs, validateRenditionSet, validateTerminalCapture } from "./auditable-demo-renditions.mjs";
+import { readRendererManifest, validateRendererCompositionInputs, validateRenditionSet, validateTerminalCapture } from "./auditable-demo-renditions.mjs";
 
 const UTF8 = new TextDecoder("utf-8", { fatal: true });
 const IMAGE_PATTERN = /^[a-z0-9][a-z0-9./_-]*@sha256:[0-9a-f]{64}$/;
@@ -141,7 +141,7 @@ function verifyChecksums(root, checksumName = "checksums.sha256", options = {})
     invariant(!declared.has(member), `duplicate checksum member: ${member}`);
     declared.add(member);
     const maximumBytes = options.allowLongFormRendererManifest && member === "manifest.json"
-      ? MAX_LONG_FORM_RENDERER_MANIFEST_BYTES
+      ? 32 * 1024 * 1024
       : MAX_BUNDLE_MEMBER_BYTES;
     invariant(
       sha256(readRegular(target, member, maximumBytes)).slice(7) === match[1],