@kungfu-tech/buildchain 4.0.1-alpha.5 → 4.0.1-alpha.6

package/packages/core/legacy-kfd-adopter-driver.js

@@ -0,0 +1,167 @@
+import {
+  ADOPTER_PROTOCOL_DRIVER_INTERFACE,
+  adopterDeliveryGateDigest,
+  defineAdopterProtocolDriver,
+} from "./adopter-delivery-gate.js";
+import {
+  KFD_LEGACY_SUPPORT_MATRIX_CONTRACT,
+  validateKfdAdopterManifestGate,
+  validateKfdLegacySupportMatrixProjection,
+} from "./kfd-adopter-manifest.js";
+
+export const LEGACY_KFD_ADOPTER_PROTOCOL_ID =
+  "buildchain.kfd-adopter/legacy-support-matrix";
+export const LEGACY_KFD_ADOPTER_PROTOCOL_VERSION = "1.0.0";
+export const LEGACY_KFD_ADOPTER_DRIVER_REPORT_CONTRACT =
+  "kungfu-buildchain-legacy-kfd-adopter-driver-report";
+
+function issue(code, path, message) {
+  return { code, path, message };
+}
+
+function normalizedIssues(entries) {
+  return (entries ?? []).map(({ code, path, message }) => ({
+    code,
+    path: path ? `/${path.replaceAll(".", "/")}` : "/declaration",
+    message,
+  }));
+}
+
+function sameJson(left, right) {
+  try {
+    return adopterDeliveryGateDigest(left) === adopterDeliveryGateDigest(right);
+  } catch {
+    return false;
+  }
+}
+
+function bindingIssues(request, manifest) {
+  const issues = [];
+  if (
+    request.project.instanceId !== manifest?.manifestId ||
+    request.project.adopterId !== manifest?.adopter?.id
+  ) {
+    issues.push(
+      issue(
+        "delivery-legacy-project-binding-mismatch",
+        "/project",
+        "Delivery project identity must match the standard adopter manifest.",
+      ),
+    );
+  }
+  if (!sameJson(request.artifact, manifest?.adopter?.artifact)) {
+    issues.push(
+      issue(
+        "delivery-legacy-artifact-binding-mismatch",
+        "/artifact",
+        "Delivery artifact must match the standard adopter manifest artifact.",
+      ),
+    );
+  }
+  return issues;
+}
+
+function invalidContextResult(issues) {
+  const report = {
+    schemaVersion: 1,
+    contract: LEGACY_KFD_ADOPTER_DRIVER_REPORT_CONTRACT,
+    valid: false,
+    qualifying: false,
+    selfCertified: false,
+    independentlyCertified: false,
+    manifestRoot: null,
+    manifestGateRoot: null,
+    legacyProjectionRoot: null,
+    legacyProjection: null,
+    adapterIssues: issues,
+    nonClaims: [
+      "The legacy support matrix is a one-way projection, not declaration authority.",
+      "Buildchain carries the existing standard manifest decision and does not certify KFD adoption.",
+    ],
+  };
+  return {
+    valid: false,
+    report,
+    reportRoot: adopterDeliveryGateDigest(report),
+    issues,
+  };
+}
+
+export function createLegacyKfdAdopterProtocolDriver() {
+  return defineAdopterProtocolDriver({
+    interface: ADOPTER_PROTOCOL_DRIVER_INTERFACE,
+    id: LEGACY_KFD_ADOPTER_PROTOCOL_ID,
+    version: LEGACY_KFD_ADOPTER_PROTOCOL_VERSION,
+    verify({ request, context }) {
+      const manifest = context?.adopterManifest;
+      const manifestGate = context?.adopterManifestGate;
+      if (!manifest || !manifestGate) {
+        return invalidContextResult([
+          issue(
+            "delivery-legacy-verification-context-invalid",
+            "/protocol",
+            "The exact standard adopter manifest and manifest gate are required.",
+          ),
+        ]);
+      }
+
+      const source = manifest?.adopter?.artifact?.coordinate?.match(
+        /^([^@\s]+)@([0-9a-f]{40})$/,
+      );
+      const gateValidation = validateKfdAdopterManifestGate(manifestGate, {
+        expectedAdopterId: manifest?.adopter?.id,
+        expectedSourceRepository: source?.[1] ?? "",
+        expectedSourceSha: source?.[2] ?? "",
+        checkedAt: manifestGate?.checkedAt,
+      });
+      const projectionValidation = validateKfdLegacySupportMatrixProjection(
+        request.declaration,
+        { manifest, manifestGate },
+      );
+      const adapterIssues = [
+        ...bindingIssues(request, manifest),
+        ...normalizedIssues(gateValidation.issues),
+        ...normalizedIssues(projectionValidation.issues),
+      ];
+      if (
+        request.declaration?.contract !== KFD_LEGACY_SUPPORT_MATRIX_CONTRACT
+      ) {
+        adapterIssues.push(
+          issue(
+            "delivery-legacy-contract-invalid",
+            "/declaration/contract",
+            `Legacy declaration must use ${KFD_LEGACY_SUPPORT_MATRIX_CONTRACT}.`,
+          ),
+        );
+      }
+
+      const valid =
+        gateValidation.valid &&
+        projectionValidation.valid &&
+        adapterIssues.length === 0;
+      const report = {
+        schemaVersion: 1,
+        contract: LEGACY_KFD_ADOPTER_DRIVER_REPORT_CONTRACT,
+        valid,
+        qualifying: false,
+        selfCertified: false,
+        independentlyCertified: false,
+        manifestRoot: manifestGate?.authority?.manifestRoot ?? null,
+        manifestGateRoot: manifestGate?.gateRoot ?? null,
+        legacyProjectionRoot: adopterDeliveryGateDigest(request.declaration),
+        legacyProjection: structuredClone(request.declaration),
+        adapterIssues,
+        nonClaims: [
+          "The legacy support matrix is a one-way projection, not declaration authority.",
+          "Buildchain carries the existing standard manifest decision and does not certify KFD adoption.",
+        ],
+      };
+      return {
+        valid,
+        report,
+        reportRoot: adopterDeliveryGateDigest(report),
+        issues: adapterIssues,
+      };
+    },
+  });
+}

package/packages/core/published-delivery-authority.js

@@ -0,0 +1,266 @@
+import { createHash } from "node:crypto";
+import { createReadStream } from "node:fs";
+import {
+  copyFile,
+  mkdir,
+  mkdtemp,
+  readFile,
+  realpath,
+  rm,
+} from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { promisify } from "node:util";
+import { pathToFileURL } from "node:url";
+import { execFile } from "node:child_process";
+
+import { adopterDeliveryGateDigest } from "./adopter-delivery-gate.js";
+
+export const PUBLISHED_DELIVERY_AUTHORITY_CONTRACT =
+  "kungfu-buildchain-published-delivery-authority/v1";
+
+const execFileAsync = promisify(execFile);
+const ROOT_PATTERN = /^sha256:[0-9a-f]{64}$/;
+const PACKAGES = [
+  {
+    key: "buildchain",
+    name: "@kungfu-tech/buildchain",
+    packageRoot: "archive",
+    modules: {
+      adopterDeliveryGate: "packages/core/adopter-delivery-gate.js",
+      bootstrap: "packages/core/buildchain-delivery-bootstrap.js",
+      infrastructure: "packages/core/buildchain-delivery-infrastructure.js",
+      kfdCategoryDriver: "packages/core/kfd-adopter-category-driver.js",
+    },
+  },
+  {
+    key: "kfd",
+    name: "@kungfu-tech/kfd",
+    packageRoot: "profiles/adopter-conformance/adopters/kfd/manifest.json",
+    modules: {},
+  },
+];
+
+async function sha256File(file) {
+  const hash = createHash("sha256");
+  for await (const chunk of createReadStream(file)) hash.update(chunk);
+  return `sha256:${hash.digest("hex")}`;
+}
+
+function exactDeclaration(value, expectedName, label) {
+  if (
+    value?.name !== expectedName ||
+    typeof value.version !== "string" ||
+    value.version.length === 0 ||
+    typeof value.archivePath !== "string" ||
+    value.archivePath.length === 0 ||
+    !ROOT_PATTERN.test(value.archiveRoot ?? "") ||
+    !ROOT_PATTERN.test(value.artifactRoot ?? "")
+  ) {
+    throw new TypeError(`${label} package declaration is incomplete`);
+  }
+  return structuredClone(value);
+}
+
+function safeArchiveEntries(listing, verboseListing, label) {
+  const entries = listing.split("\n").filter(Boolean);
+  const types = verboseListing.split("\n").filter(Boolean);
+  if (entries.length === 0 || entries.length !== types.length) {
+    throw new Error(`${label} archive listing is incomplete`);
+  }
+  for (let index = 0; index < entries.length; index += 1) {
+    const entry = entries[index];
+    const parts = entry.split("/");
+    if (
+      parts[0] !== "package" ||
+      parts.some((part, partIndex) =>
+        partIndex === parts.length - 1 && part === ""
+          ? false
+          : part === "" || part === "." || part === "..",
+      )
+    ) {
+      throw new Error(`${label} archive contains an unsafe path`);
+    }
+    if (!["-", "d"].includes(types[index][0])) {
+      throw new Error(`${label} archive contains a non-file entry`);
+    }
+  }
+}
+
+async function extractPackage(declaration, destination, definition, label) {
+  const archivePath = path.resolve(declaration.archivePath);
+  const observedRoot = await sha256File(archivePath);
+  if (observedRoot !== declaration.archiveRoot) {
+    throw new Error(`${label} archive bytes do not match archiveRoot`);
+  }
+  await mkdir(destination, { recursive: true });
+  const stagedArchiveName = `.buildchain-${definition.key}-authority.tgz`;
+  const stagedArchivePath = path.join(
+    path.dirname(destination),
+    stagedArchiveName,
+  );
+  const stagedArchiveFile = `../${stagedArchiveName}`;
+  await copyFile(archivePath, stagedArchivePath);
+  try {
+    if ((await sha256File(stagedArchivePath)) !== declaration.archiveRoot) {
+      throw new Error(`${label} staged archive bytes do not match archiveRoot`);
+    }
+    const [{ stdout: listing }, { stdout: verboseListing }] = await Promise.all(
+      [
+        execFileAsync("tar", ["-tzf", stagedArchiveFile], {
+          cwd: destination,
+          maxBuffer: 16 * 1024 * 1024,
+        }),
+        execFileAsync("tar", ["-tvzf", stagedArchiveFile], {
+          cwd: destination,
+          maxBuffer: 16 * 1024 * 1024,
+        }),
+      ],
+    );
+    safeArchiveEntries(listing, verboseListing, label);
+    await execFileAsync(
+      "tar",
+      ["-xzf", stagedArchiveFile, "--strip-components", "1"],
+      { cwd: destination, maxBuffer: 16 * 1024 * 1024 },
+    );
+  } finally {
+    await rm(stagedArchivePath, { force: true });
+  }
+  const packageJsonPath = path.join(destination, "package.json");
+  const packageJson = JSON.parse(await readFile(packageJsonPath, "utf8"));
+  if (
+    packageJson.name !== declaration.name ||
+    packageJson.version !== declaration.version
+  ) {
+    throw new Error(`${label} extracted package identity does not match`);
+  }
+  if (definition.packageRoot === "archive") {
+    if (declaration.artifactRoot !== declaration.archiveRoot) {
+      throw new Error(`${label} package artifactRoot must match archiveRoot`);
+    }
+  } else {
+    const packageManifest = JSON.parse(
+      await readFile(path.join(destination, definition.packageRoot), "utf8"),
+    );
+    const packageCut = packageManifest?.kfdCut?.package;
+    if (
+      packageCut?.name !== declaration.name ||
+      packageCut?.version !== declaration.version ||
+      packageCut?.artifactRoot !== declaration.artifactRoot
+    ) {
+      throw new Error(`${label} semantic package identity does not match`);
+    }
+  }
+  const destinationRoot = await realpath(destination);
+  if (!destinationRoot.endsWith(path.join(...declaration.name.split("/")))) {
+    throw new Error(`${label} extraction escaped its package coordinate`);
+  }
+  return {
+    name: declaration.name,
+    version: declaration.version,
+    archiveRoot: declaration.archiveRoot,
+    artifactRoot: declaration.artifactRoot,
+  };
+}
+
+async function importAuthorityRuntime(buildchainRoot) {
+  const definition = PACKAGES[0];
+  const imported = {};
+  for (const [key, relativePath] of Object.entries(definition.modules)) {
+    imported[key] = await import(
+      pathToFileURL(path.join(buildchainRoot, relativePath)).href
+    );
+  }
+  const runtime = {
+    createAdopterDeliveryGate:
+      imported.adopterDeliveryGate.createAdopterDeliveryGate,
+    createPackageArtifactProfile:
+      imported.adopterDeliveryGate.createPackageArtifactProfile,
+    qualifyBuildchainDeliveryInfrastructureBootstrap:
+      imported.bootstrap.qualifyBuildchainDeliveryInfrastructureBootstrap,
+    createBuildchainDeliveryInfrastructureInstanceManifest:
+      imported.infrastructure
+        .createBuildchainDeliveryInfrastructureInstanceManifest,
+    verifyBuildchainDeliveryInfrastructureInstance:
+      imported.infrastructure.verifyBuildchainDeliveryInfrastructureInstance,
+    createKfdAdopterCategoryProtocolDriver:
+      imported.kfdCategoryDriver.createKfdAdopterCategoryProtocolDriver,
+  };
+  for (const [name, implementation] of Object.entries(runtime)) {
+    if (typeof implementation !== "function") {
+      throw new Error(`published Buildchain authority is missing ${name}`);
+    }
+  }
+  return runtime;
+}
+
+export async function loadPublishedBuildchainDeliveryAuthority({
+  buildchain,
+  kfd,
+} = {}) {
+  const declarations = {
+    buildchain: exactDeclaration(
+      buildchain,
+      "@kungfu-tech/buildchain",
+      "Buildchain authority",
+    ),
+    kfd: exactDeclaration(kfd, "@kungfu-tech/kfd", "KFD authority"),
+  };
+  const temporaryRoot = await mkdtemp(
+    path.join(tmpdir(), "buildchain-published-delivery-authority-"),
+  );
+  let retained = false;
+  try {
+    const identities = {};
+    for (const definition of PACKAGES) {
+      identities[definition.key] = await extractPackage(
+        declarations[definition.key],
+        path.join(temporaryRoot, "node_modules", ...definition.name.split("/")),
+        definition,
+        `${definition.key} authority`,
+      );
+    }
+    const authorityRuntime = await importAuthorityRuntime(
+      path.join(temporaryRoot, "node_modules", ...PACKAGES[0].name.split("/")),
+    );
+    const authority = {
+      schemaVersion: 1,
+      contract: PUBLISHED_DELIVERY_AUTHORITY_CONTRACT,
+      packages: identities,
+      moduleCoordinates: structuredClone(PACKAGES[0].modules),
+      qualifying: false,
+      selfCertified: false,
+      releaseAuthorized: false,
+      finalAuthority:
+        "caller-bound-public-npm-archive-bytes-and-package-identity",
+    };
+    authority.authorityRoot = adopterDeliveryGateDigest(authority);
+    retained = true;
+    return {
+      ...authority,
+      authorityRuntime,
+      temporaryRoot,
+      async dispose() {
+        await rm(temporaryRoot, { recursive: true, force: true });
+      },
+    };
+  } finally {
+    if (!retained) await rm(temporaryRoot, { recursive: true, force: true });
+  }
+}
+
+export async function withPublishedBuildchainDeliveryAuthority(
+  declarations,
+  operation,
+) {
+  if (typeof operation !== "function") {
+    throw new TypeError("published authority operation must be a function");
+  }
+  const authority =
+    await loadPublishedBuildchainDeliveryAuthority(declarations);
+  try {
+    return await operation(authority);
+  } finally {
+    await authority.dispose();
+  }
+}

package/packages/core/release-passport.js

@@ -439,11 +439,17 @@ function mergeAuthoritativePassportBase(passport, basePassport = undefined, { re
       kfd3: basePassport.evidence?.kfd3 || passport.evidence?.kfd3 || "",
     },
   };
-  for (const key of ["versionImpact", "surfaceImpacts"]) {
-    if (basePassport[key] !== undefined) {
-      merged[key] = basePassport[key];
-    }
-  }
+  for (const key of [
+    "versionImpact",
+    "surfaceImpacts",
+    "promotionRouting",
+    "v4ConsumerPolicy",
+    "v4RuntimeResume",
+    "transaction",
+    "trustedPublishing",
+    "distTagPromotion",
+  ])
+    if (basePassport[key] !== undefined) merged[key] = basePassport[key];
   if (basePassport.controllerReceipts !== undefined) {
     merged.controllerReceipts = basePassport.controllerReceipts;
   }
@@ -1162,6 +1168,18 @@ function normalizeV4RuntimeResumeEvidence(value, expected = {}) {
   };
 }
 
+function v4RuntimeResumeSourceSha(release, fallback = "") {
+  const builtSourceSha = releaseField(
+    release || {},
+    "builtSourceSha",
+    "built_source_sha",
+  );
+  return release?.treeEquivalent === true && builtSourceSha
+    ? builtSourceSha
+    : fallback;
+}
+
+
 function prepareBuildEvidence({
   buildSummary,
   buildFacts,
@@ -1317,7 +1335,7 @@ export function createReleasePassport(options = {}) {
   const { promotion, buildEvidence } = preparePromotionBuild(options);
   const normalizedV4RuntimeResume = normalizeV4RuntimeResumeEvidence(v4RuntimeResumeEvidence, {
     repository,
-    sourceSha,
+    sourceSha: v4RuntimeResumeSourceSha(release, sourceSha),
     resumeRuntimeSha: promotion.routing?.runtime?.resolvedSha || "",
     consumerPolicyReceiptRoot: promotion.consumerPolicy?.certification?.receiptRoot || "",
   });
@@ -2302,7 +2320,7 @@ function validateV4RuntimeResumePassportSection({ passport, issues }) {
     receipt: evidence.authorization,
     receiptRoot: evidence.authorizationRoot,
     repository: passport?.product?.repository || "",
-    sourceSha: passport?.release?.sourceSha || "",
+    sourceSha: v4RuntimeResumeSourceSha(passport?.release, passport?.release?.sourceSha || ""),
     runtimeSha: passport?.promotionRouting?.runtime?.resolvedSha || "",
     consumerPolicyReceiptRoot,
   });
@@ -2313,7 +2331,7 @@ function validateV4RuntimeResumePassportSection({ passport, issues }) {
     lineage: evidence.lineage,
     lineageRoot: evidence.lineageRoot,
     repository: passport?.product?.repository || "",
-    sourceSha: passport?.release?.sourceSha || "",
+    sourceSha: v4RuntimeResumeSourceSha(passport?.release, passport?.release?.sourceSha || ""),
     resumeRuntimeSha: passport?.promotionRouting?.runtime?.resolvedSha || "",
     consumerPolicyReceiptRoot,
   });

package/packages/core/v4-adopter-delivery-parity.js

@@ -31,10 +31,10 @@ const root = path.resolve(
 );
 
 export const V4_ADOPTER_DELIVERY_PARITY_SOURCE = Object.freeze({
-  v3Commit: "c3f58d76391c1c6ceddfc900a68e91c7ab82a575",
+  v3Commit: "6b96bdad8d9f8ccf9275f27d9370a226a9c78465",
   vectorSuiteRoot:
-    "sha256:cf329805d928a9883cbafbdfdf21ef66c6a0889ed8dfe14356b4e0d25d6738f9",
-  kfdPackage: "@kungfu-tech/kfd@1.0.0-alpha.62",
+    "sha256:c978707556406ffda4ef4192032332c01c2da1cebb6ad8c4f0edfc65d5cef0c7",
+  kfdPackage: "@kungfu-tech/kfd@1.0.0-alpha.65",
 });
 
 function clone(value) {