@kungfu-tech/buildchain 4.0.1-alpha.5 → 4.0.1-alpha.55

package/packages/core/v4-floating-consumer-release-passport.js

@@ -4,9 +4,11 @@ import {
   v4FloatingConsumerDocumentRoot,
   verifyV4FloatingConsumerPolicyCertification,
 } from "./v4-floating-consumer-evidence.js";
-
+import {
+  verifyV4RuntimeAuthorizationReceipt,
+  verifyV4RuntimeResumeLineage,
+} from "./v4-runtime-ref-resume-authority.js";
 const SHA256_ROOT = /^sha256:[0-9a-f]{64}$/u;
-
 export function isV4PromotionRouting(value = undefined) {
   return [
     value?.router?.ref,
@@ -14,7 +16,6 @@ export function isV4PromotionRouting(value = undefined) {
     value?.runtime?.requestedRef,
   ].some((ref) => /^v4(?:-alpha)?$/u.test(String(ref || "")));
 }
-
 function resolveInside(root, relative, label) {
   const resolvedRoot = path.resolve(root);
   const file = path.resolve(resolvedRoot, relative);
@@ -23,7 +24,6 @@ function resolveInside(root, relative, label) {
   }
   return file;
 }
-
 function resolveCallerLock(root, relative, label) {
   const file = resolveInside(root, relative, `${label} contract lock`);
   if (!fs.existsSync(file)) {
@@ -76,11 +76,36 @@ function normalizeCertification(value, expected) {
   }
   return { certificationRoot: verification.certificationRoot, certification };
 }
-
+export function resolveV4ConsumerPolicyCertificationIdentity({
+  release = {},
+  routing = {},
+  runtimeResume = undefined,
+  sourceSha = "",
+} = {}) {
+  const certification =
+    release?.certification?.certification || release?.certification;
+  const certifiedSourceSha = certification?.caller?.sourceSha || "";
+  const treeEquivalentSources = [
+    release?.builtSourceSha || release?.built_source_sha,
+    release?.promotionChannelSha || release?.promotion_channel_sha,
+  ];
+  const buildSha = runtimeResume?.lineage?.attempts?.build?.runtimeSha;
+  const certifiedSha = certification?.invocation?.resolvedRuntimeSha || "";
+  return {
+    sourceSha:
+      certifiedSourceSha === sourceSha ||
+      (release?.treeEquivalent === true &&
+        treeEquivalentSources.includes(certifiedSourceSha))
+        ? certifiedSourceSha
+        : sourceSha,
+    runtimeSha: buildSha || certifiedSha || routing?.runtime?.resolvedSha || "",
+  };
+}
 export function requireV4ConsumerPolicyCertification({
   value,
   repository,
   sourceSha,
+  runtimeSha = "",
   routing,
   cwd,
   certificationRoot,
@@ -100,7 +125,7 @@ export function requireV4ConsumerPolicyCertification({
   return normalizeCertification(value, {
     repository,
     sourceSha,
-    runtimeSha: routing?.runtime?.resolvedSha || "",
+    runtimeSha: runtimeSha || routing?.runtime?.resolvedSha || "",
     certificationRoot,
     ...(v4Routing ? resolveV4FloatingConsumerCallerLocks(value, cwd) : {}),
   });
@@ -112,15 +137,136 @@ export function releasePassportCertificationVerificationOptions({
   routing,
 }) {
   const authority = evidence?.certification?.authority || {};
+  const identity = resolveV4ConsumerPolicyCertificationIdentity({
+    release: { ...passport?.release, certification: evidence?.certification },
+    routing,
+    runtimeResume: passport?.v4RuntimeResume,
+    sourceSha: passport?.release?.sourceSha || "",
+  });
   return {
     certification: evidence?.certification,
     certificationRoot: evidence?.certificationRoot,
     repository: passport?.product?.repository || "",
-    sourceSha: passport?.release?.sourceSha || "",
-    resolvedRuntimeSha: routing?.runtime?.resolvedSha || "",
+    sourceSha: identity.sourceSha,
+    resolvedRuntimeSha: identity.runtimeSha,
     stableLockRoot: authority.contractLocks?.stable?.root || "",
     alphaLockRoot: authority.contractLocks?.alpha?.root || "",
     stableLockPath: authority.contractLocks?.stable?.path || "",
     alphaLockPath: authority.contractLocks?.alpha?.path || "",
   };
 }
+export function normalizePromotionRouting(value = undefined) {
+  if (value === undefined) return undefined;
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("release.promotionRouting must be a JSON object");
+  }
+  if (value.contract !== "buildchain.promotion-routing/v1") {
+    throw new Error(
+      "release.promotionRouting contract must be buildchain.promotion-routing/v1",
+    );
+  }
+  for (const [label, field] of [
+    ["router.ref", value.router?.ref],
+    ["router.sha", value.router?.sha],
+    ["shell.ref", value.shell?.ref],
+    ["shell.sha", value.shell?.sha],
+    ["runtime.requestedRef", value.runtime?.requestedRef],
+    ["runtime.resolvedSha", value.runtime?.resolvedSha],
+    ["contractLock.path", value.contractLock?.path],
+    ["contractLock.digest", value.contractLock?.digest],
+    ["publication.channel", value.publication?.channel],
+    ["publication.targetRef", value.publication?.targetRef],
+  ]) {
+    if (!String(field || "").trim())
+      throw new Error(`release.promotionRouting.${label} is required`);
+  }
+  for (const [label, sha] of [
+    ["router.sha", value.router.sha],
+    ["shell.sha", value.shell.sha],
+    ["runtime.resolvedSha", value.runtime.resolvedSha],
+  ]) {
+    if (!/^[0-9a-f]{40}$/i.test(String(sha))) {
+      throw new Error(
+        `release.promotionRouting.${label} must be a 40-character Git SHA`,
+      );
+    }
+  }
+  if (!/^sha256:[0-9a-f]{64}$/i.test(String(value.contractLock.digest))) {
+    throw new Error(
+      "release.promotionRouting.contractLock.digest must be a sha256 digest",
+    );
+  }
+  return JSON.parse(JSON.stringify(value));
+}
+
+export function normalizePromotionEvidence({
+  release = {},
+  v4ConsumerPolicyCertification: certification,
+  v4ConsumerPolicyCertificationRoot: certificationRoot,
+  v4RuntimeResumeEvidence,
+  repository,
+  sourceSha,
+  cwd,
+}) {
+  const routing = normalizePromotionRouting(release.promotionRouting);
+  const identity = resolveV4ConsumerPolicyCertificationIdentity({
+    release: { ...release, certification },
+    routing,
+    runtimeResume: v4RuntimeResumeEvidence,
+    sourceSha,
+  });
+  return {
+    routing,
+    consumerPolicy: requireV4ConsumerPolicyCertification({
+      value: certification,
+      repository,
+      sourceSha: identity.sourceSha,
+      runtimeSha: identity.runtimeSha,
+      routing,
+      cwd,
+      certificationRoot,
+    }),
+  };
+}
+
+export function normalizeV4RuntimeResumeEvidence(value, expected = {}) {
+  if (value === undefined || value === null || value === "") return undefined;
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("v4RuntimeResumeEvidence must be a JSON object");
+  }
+  const authorizationVerification = verifyV4RuntimeAuthorizationReceipt({
+    receipt: value.authorization,
+    receiptRoot: value.authorizationRoot,
+    repository: expected.repository,
+    sourceSha: expected.sourceSha,
+    runtimeSha: expected.resumeRuntimeSha,
+    consumerPolicyReceiptRoot: expected.consumerPolicyReceiptRoot,
+  });
+  if (!authorizationVerification.ok) {
+    throw new Error(
+      `v4 runtime authorization invalid: ${authorizationVerification.failures.join(", ")}`,
+    );
+  }
+  const lineageVerification = verifyV4RuntimeResumeLineage({
+    lineage: value.lineage,
+    lineageRoot: value.lineageRoot,
+    repository: expected.repository,
+    sourceSha: expected.sourceSha,
+    resumeRuntimeSha: expected.resumeRuntimeSha,
+    consumerPolicyReceiptRoot: expected.consumerPolicyReceiptRoot,
+  });
+  if (!lineageVerification.ok) {
+    throw new Error(
+      `v4 runtime resume lineage invalid: ${lineageVerification.failures.join(", ")}`,
+    );
+  }
+  if (value.lineage?.authorizationRoot !== value.authorizationRoot) {
+    throw new Error("v4 runtime resume lineage authorization root mismatch");
+  }
+  return {
+    authorizationRoot: value.authorizationRoot,
+    authorization: structuredClone(value.authorization),
+    lineageRoot: value.lineageRoot,
+    lineage: structuredClone(value.lineage),
+  };
+}

package/packages/core/v4-publication-qualification.js

@@ -0,0 +1,222 @@
+import crypto from "node:crypto";
+
+export const V4_PUBLICATION_QUALIFICATION_SCHEMA =
+  "kungfu.buildchain.v4-publication-qualification/v1";
+
+const ROOT = /^sha256:[0-9a-f]{64}$/u;
+const SHA = /^[0-9a-f]{40}$/u;
+const FORBIDDEN_EXECUTION_KEYS = new Set([
+  "cmd",
+  "command",
+  "eval",
+  "executable",
+  "javascript",
+  "run",
+  "script",
+  "shell",
+]);
+
+export class V4PublicationQualificationError extends Error {
+  constructor(code, message) {
+    super(message);
+    this.name = "V4PublicationQualificationError";
+    this.code = code;
+  }
+}
+
+function fail(code, message) {
+  throw new V4PublicationQualificationError(code, message);
+}
+
+function canonical(value) {
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.keys(value)
+      .sort()
+      .map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`)
+      .join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+
+export function v4PublicationQualificationRoot(value) {
+  return `sha256:${crypto.createHash("sha256").update(canonical(value)).digest("hex")}`;
+}
+
+export function assertNoV4ExecutionFields(value, location = "$") {
+  if (Array.isArray(value)) {
+    value.forEach((entry, index) =>
+      assertNoV4ExecutionFields(entry, `${location}[${index}]`),
+    );
+    return;
+  }
+  if (!value || typeof value !== "object") return;
+  for (const [key, entry] of Object.entries(value)) {
+    if (FORBIDDEN_EXECUTION_KEYS.has(key.toLowerCase())) {
+      fail(
+        "execution-field-forbidden",
+        `v4 declarative publication forbids ${location}.${key}`,
+      );
+    }
+    assertNoV4ExecutionFields(entry, `${location}.${key}`);
+  }
+}
+
+function exactRoot(value, label) {
+  const root = String(value || "").toLowerCase();
+  if (!ROOT.test(root))
+    fail("schema-invalid", `${label} must be a sha256 root`);
+  return root;
+}
+
+function exactSha(value, label) {
+  const sha = String(value || "").toLowerCase();
+  if (!SHA.test(sha))
+    fail("schema-invalid", `${label} must be an exact Git SHA`);
+  return sha;
+}
+
+function normalizedArtifacts(artifacts) {
+  if (!Array.isArray(artifacts) || artifacts.length === 0) {
+    fail(
+      "schema-invalid",
+      "publication qualification requires typed artifacts",
+    );
+  }
+  const normalized = artifacts
+    .map((artifact) => {
+      const value = {
+        role: String(artifact?.role || ""),
+        platform: String(artifact?.platform || ""),
+        artifactRoot: exactRoot(artifact?.artifactRoot, "artifactRoot"),
+        manifestRoot: exactRoot(artifact?.manifestRoot, "manifestRoot"),
+      };
+      if (!value.role || !value.platform)
+        fail("schema-invalid", "artifact role and platform are required");
+      return value;
+    })
+    .sort((left, right) =>
+      `${left.role}\0${left.platform}`.localeCompare(
+        `${right.role}\0${right.platform}`,
+      ),
+    );
+  if (
+    new Set(normalized.map(({ role, platform }) => `${role}\0${platform}`))
+      .size !== normalized.length
+  ) {
+    fail("schema-invalid", "artifact role/platform bindings must be unique");
+  }
+  return normalized;
+}
+
+export function createV4PublicationQualificationReceipt({
+  repository,
+  candidateRoot,
+  sourceSha,
+  sourceRoot,
+  policyDigest,
+  artifacts,
+  issuedAt,
+  expiresAt,
+}) {
+  const body = {
+    schema: V4_PUBLICATION_QUALIFICATION_SCHEMA,
+    repository: String(repository || ""),
+    candidateRoot: exactRoot(candidateRoot, "candidateRoot"),
+    sourceSha: exactSha(sourceSha, "sourceSha"),
+    sourceRoot: exactRoot(sourceRoot, "sourceRoot"),
+    policyDigest: exactRoot(policyDigest, "policyDigest"),
+    artifacts: normalizedArtifacts(artifacts),
+    issuedAt: String(issuedAt || ""),
+    expiresAt: String(expiresAt || ""),
+  };
+  if (!/^[^/\s]+\/[^/\s]+$/u.test(body.repository))
+    fail("schema-invalid", "repository must be owner/repo");
+  const issued = Date.parse(body.issuedAt);
+  const expires = Date.parse(body.expiresAt);
+  if (
+    !Number.isFinite(issued) ||
+    !Number.isFinite(expires) ||
+    expires <= issued
+  )
+    fail("schema-invalid", "qualification freshness interval is invalid");
+  assertNoV4ExecutionFields(body);
+  const artifactRoot = v4PublicationQualificationRoot(body.artifacts);
+  const receipt = { ...body, artifactRoot };
+  return {
+    ...receipt,
+    receiptRoot: v4PublicationQualificationRoot(receipt),
+  };
+}
+
+export function validateV4PublicationQualificationReceipt(
+  receipt,
+  {
+    repository,
+    candidateRoot,
+    sourceSha,
+    sourceRoot,
+    artifactRoot,
+    policyDigest,
+    evaluatedAt = new Date().toISOString(),
+  } = {},
+) {
+  if (!receipt)
+    fail("qualification-missing", "qualification receipt is required");
+  assertNoV4ExecutionFields(receipt);
+  const recreated = createV4PublicationQualificationReceipt(receipt);
+  if (
+    receipt.artifactRoot !== recreated.artifactRoot ||
+    receipt.receiptRoot !== recreated.receiptRoot
+  ) {
+    fail(
+      "qualification-tampered",
+      "qualification receipt root does not verify",
+    );
+  }
+  if (repository && receipt.repository !== repository)
+    fail("repository-mismatch", "qualification repository does not match");
+  if (candidateRoot && receipt.candidateRoot !== candidateRoot)
+    fail("candidate-mismatch", "qualification candidate root does not match");
+  if (sourceSha && receipt.sourceSha !== sourceSha)
+    fail("source-mismatch", "qualification source SHA does not match");
+  if (sourceRoot && receipt.sourceRoot !== sourceRoot)
+    fail("source-mismatch", "qualification source root does not match");
+  if (artifactRoot && receipt.artifactRoot !== artifactRoot)
+    fail("artifact-mismatch", "qualification artifact root does not match");
+  if (policyDigest && receipt.policyDigest !== policyDigest)
+    fail("policy-mismatch", "qualification policy digest does not match");
+  const evaluated = Date.parse(evaluatedAt);
+  if (!Number.isFinite(evaluated))
+    fail("schema-invalid", "evaluatedAt is invalid");
+  if (
+    evaluated < Date.parse(receipt.issuedAt) ||
+    evaluated >= Date.parse(receipt.expiresAt)
+  )
+    fail(
+      "qualification-stale",
+      "qualification receipt is outside its freshness window",
+    );
+  return Object.freeze({
+    ok: true,
+    receiptRoot: receipt.receiptRoot,
+    artifactRoot: receipt.artifactRoot,
+  });
+}
+
+export function assertV4DeclarativePromotionInputs(inputs) {
+  const forbidden = Object.entries(inputs || {}).filter(
+    ([name, value]) =>
+      /(command|cmd|script|shell|run)$/iu.test(name) &&
+      String(value || "").trim() !== "",
+  );
+  if (forbidden.length > 0) {
+    fail(
+      "legacy-command-input-forbidden",
+      `v4 declarative publication rejects: ${forbidden
+        .map(([name]) => name)
+        .sort()
+        .join(", ")}`,
+    );
+  }
+}