@kungfu-tech/buildchain 4.0.1 → 4.0.2-alpha.2

package/scripts/publication-commit-evidence.mjs

@@ -1,444 +0,0 @@
-#!/usr/bin/env node
-
-import fs from "node:fs";
-import { createHash } from "node:crypto";
-import path from "node:path";
-import { pathToFileURL } from "node:url";
-
-const SCHEMA = "kungfu-buildchain-publication-commit-evidence/v1";
-const INSTALLER_BUNDLE_SCHEMA = "kungfu.installer-publication-bundle/v1";
-
-function requiredString(value, label) {
-  if (typeof value !== "string" || value.trim() === "") {
-    throw new Error(`${label} is required`);
-  }
-  return value.trim();
-}
-
-function sha256Root(value, label) {
-  const normalized = requiredString(value, label);
-  if (!/^sha256:[0-9a-f]{64}$/.test(normalized)) {
-    throw new Error(`${label} must be a lowercase sha256 root`);
-  }
-  return normalized;
-}
-
-function exactSha(value, label) {
-  const normalized = requiredString(value, label);
-  if (!/^[0-9a-f]{40}$/.test(normalized)) {
-    throw new Error(`${label} must be an exact Git SHA`);
-  }
-  return normalized;
-}
-
-function publicHttps(value, label) {
-  const normalized = requiredString(value, label);
-  let url;
-  try {
-    url = new URL(normalized);
-  } catch {
-    throw new Error(`${label} must be a public HTTPS URL`);
-  }
-  if (
-    url.protocol !== "https:" ||
-    !url.hostname ||
-    url.username ||
-    url.password ||
-    url.search ||
-    url.hash
-  ) {
-    throw new Error(
-      `${label} must be a public HTTPS URL without credentials, query, or fragment`,
-    );
-  }
-  return normalized;
-}
-
-function canonical(value) {
-  if (Array.isArray(value)) return value.map(canonical);
-  if (value && typeof value === "object") {
-    return Object.fromEntries(
-      Object.entries(value)
-        .filter(([, item]) => item !== undefined)
-        .sort(([left], [right]) => left.localeCompare(right))
-        .map(([key, item]) => [key, canonical(item)]),
-    );
-  }
-  return value;
-}
-
-function digest(bytes) {
-  return `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
-}
-
-function semanticRoot(value) {
-  return digest(Buffer.from(JSON.stringify(canonical(value))));
-}
-
-function expectedContentType(assetPath) {
-  if (assetPath.endsWith(".json")) return "application/json; charset=utf-8";
-  if (assetPath.endsWith(".sh")) return "text/x-shellscript; charset=utf-8";
-  if (assetPath.endsWith(".ps1")) return "text/plain; charset=utf-8";
-  throw new Error(`installer bundle asset type is unsupported: ${assetPath}`);
-}
-
-function validateInstallerBundle(evidence, expected) {
-  const bundle = evidence.publication?.installerBundle;
-  if (!bundle) return null;
-  if (bundle.schema !== INSTALLER_BUNDLE_SCHEMA) {
-    throw new Error(
-      `installer bundle schema must be ${INSTALLER_BUNDLE_SCHEMA}`,
-    );
-  }
-  const bundleRoot = sha256Root(
-    bundle.bundleRoot,
-    "installerBundle.bundleRoot",
-  );
-  if (
-    bundleRoot !== evidence.publication.payloadRoot ||
-    bundleRoot !== evidence.readback?.payloadRoot
-  ) {
-    throw new Error(
-      "installer bundle root must be the publication payload root",
-    );
-  }
-  if (
-    exactSha(bundle.sourceCommit, "installerBundle.sourceCommit") !==
-      expected.sourceSha ||
-    !["alpha", "stable"].includes(bundle.channel)
-  ) {
-    throw new Error("installer bundle release identity mismatch");
-  }
-  sha256Root(bundle.channelPayloadRoot, "installerBundle.channelPayloadRoot");
-  sha256Root(bundle.channelFileDigest, "installerBundle.channelFileDigest");
-  sha256Root(
-    bundle.releasePassport?.root,
-    "installerBundle.releasePassport.root",
-  );
-  sha256Root(bundle.manifestDigest, "installerBundle.manifestDigest");
-  if (
-    evidence.readback?.manifestDigest !== bundle.manifestDigest ||
-    !Array.isArray(bundle.assets) ||
-    bundle.assets.length !== 7
-  ) {
-    throw new Error("installer bundle read-back or asset set is incomplete");
-  }
-  const paths = new Set();
-  const topLevel = new Set([
-    "installer-publication.json",
-    "channel-index.json",
-    "trusted-keys.json",
-    "install.sh",
-    "install.ps1",
-  ]);
-  const expectedRoles = new Map([
-    ["installer-publication.json", "publication-manifest"],
-    ["channel-index.json", "signed-channel-index"],
-    ["trusted-keys.json", "public-trust-anchors"],
-    ["install.sh", "friendly-installer"],
-    ["install.ps1", "friendly-installer"],
-  ]);
-  const immutableDirectories = new Set();
-  let immutableShell = 0;
-  let immutablePowerShell = 0;
-  const releaseBaseUrl =
-    `https://github.com/kungfu-systems/kungfu/releases/download/` +
-    expected.releaseTag;
-  for (const asset of bundle.assets) {
-    const assetPath = requiredString(
-      asset.path,
-      "installer bundle asset path",
-    ).replaceAll("\\", "/");
-    if (
-      assetPath.startsWith("/") ||
-      assetPath.endsWith("/") ||
-      assetPath.split("/").some((part) => part === "" || part === "..") ||
-      paths.has(assetPath)
-    ) {
-      throw new Error(
-        `unsafe or duplicate installer bundle asset: ${assetPath}`,
-      );
-    }
-    paths.add(assetPath);
-    topLevel.delete(assetPath);
-    if (assetPath.includes("/") && assetPath.endsWith("/install.sh")) {
-      immutableShell += 1;
-      immutableDirectories.add(path.posix.dirname(assetPath));
-    }
-    if (assetPath.includes("/") && assetPath.endsWith("/install.ps1")) {
-      immutablePowerShell += 1;
-      immutableDirectories.add(path.posix.dirname(assetPath));
-    }
-    if (!Number.isSafeInteger(asset.size) || asset.size < 1) {
-      throw new Error(`installer bundle asset size is invalid: ${assetPath}`);
-    }
-    sha256Root(asset.digest, `installer bundle asset digest: ${assetPath}`);
-    const releaseAsset = requiredString(
-      asset.releaseAsset,
-      `installer bundle release asset: ${assetPath}`,
-    );
-    if (
-      asset.contentType !== expectedContentType(assetPath) ||
-      publicHttps(
-        asset.releaseUrl,
-        `installer bundle asset URL: ${assetPath}`,
-      ) !== `${releaseBaseUrl}/${releaseAsset}` ||
-      !/^kungfu-[a-z0-9.-]+$/.test(releaseAsset)
-    ) {
-      throw new Error(
-        `installer bundle asset transport metadata is invalid: ${assetPath}`,
-      );
-    }
-    const expectedRole = assetPath.includes("/")
-      ? "immutable-installer"
-      : expectedRoles.get(assetPath);
-    if (asset.role !== expectedRole) {
-      throw new Error(`installer bundle asset role is invalid: ${assetPath}`);
-    }
-  }
-  const immutableDirectory = [...immutableDirectories][0] || "";
-  const immutableParts = immutableDirectory.split("/");
-  if (
-    topLevel.size !== 0 ||
-    immutableShell !== 1 ||
-    immutablePowerShell !== 1 ||
-    immutableDirectories.size !== 1 ||
-    immutableParts.length !== 5 ||
-    immutableParts[0] !== "installers" ||
-    immutableParts[1] !== "v1" ||
-    immutableParts[2] !== bundle.channel ||
-    immutableParts[3] !== expected.version ||
-    !/^[a-f0-9]{64}$/.test(immutableParts[4])
-  ) {
-    throw new Error("installer bundle asset topology is incomplete");
-  }
-  if (
-    bundle.cachePolicy?.friendly !== "public,max-age=300,must-revalidate" ||
-    bundle.cachePolicy?.immutable !== "public,max-age=31536000,immutable"
-  ) {
-    throw new Error("installer bundle cache policy is invalid");
-  }
-  if (
-    evidence.siteHandoff?.state !== "deferred-to-site-owned-consumer" ||
-    evidence.siteHandoff?.productionAvailable !== false ||
-    evidence.siteHandoff?.requiredBundleRoot !== bundleRoot
-  ) {
-    throw new Error("installer bundle site handoff must remain deferred");
-  }
-  return {
-    schema: bundle.schema,
-    bundleRoot,
-    manifestDigest: bundle.manifestDigest,
-    channel: bundle.channel,
-    channelPayloadRoot: bundle.channelPayloadRoot,
-    channelFileDigest: bundle.channelFileDigest,
-    releasePassport: bundle.releasePassport,
-    cachePolicy: bundle.cachePolicy,
-    immutablePath: immutableDirectory,
-    assets: bundle.assets,
-  };
-}
-
-export function validatePublicationCommitEvidence(
-  evidence,
-  { version, sourceSha, releaseSha, releaseTag } = {},
-) {
-  if (!evidence || typeof evidence !== "object" || Array.isArray(evidence)) {
-    throw new Error("publication commit evidence must be an object");
-  }
-  if (evidence.schema !== SCHEMA) {
-    throw new Error(`publication commit evidence schema must be ${SCHEMA}`);
-  }
-  if (evidence.status !== "passed") {
-    throw new Error("publication commit evidence status must be passed");
-  }
-  const identity = evidence.identity || {};
-  const expected = {
-    version: requiredString(version, "expected version"),
-    sourceSha: exactSha(sourceSha, "expected sourceSha"),
-    releaseSha: exactSha(releaseSha, "expected releaseSha"),
-    releaseTag: requiredString(releaseTag, "expected releaseTag"),
-  };
-  for (const [field, value] of Object.entries(expected)) {
-    if (identity[field] !== value) {
-      throw new Error(`publication commit evidence ${field} mismatch`);
-    }
-  }
-  const publicUrl = publicHttps(evidence.publication?.url, "publication.url");
-  const payloadRoot = sha256Root(
-    evidence.publication?.payloadRoot,
-    "publication.payloadRoot",
-  );
-  if (
-    evidence.readback?.status !== "passed" ||
-    publicHttps(evidence.readback?.url, "readback.url") !== publicUrl ||
-    sha256Root(evidence.readback?.payloadRoot, "readback.payloadRoot") !==
-      payloadRoot
-  ) {
-    throw new Error(
-      "publication read-back must pass at the canonical URL with the exact payload root",
-    );
-  }
-  const previousAuthority = evidence.recovery?.previousAuthority;
-  const rollbackReference = requiredString(
-    evidence.recovery?.rollbackReference,
-    "recovery.rollbackReference",
-  );
-  if (!["preserved", "none"].includes(previousAuthority)) {
-    throw new Error(
-      "publication recovery must preserve or explicitly declare no previous authority",
-    );
-  }
-  const installerBundle = validateInstallerBundle(evidence, expected);
-  return {
-    schema: SCHEMA,
-    status: "passed",
-    publicUrl,
-    payloadRoot,
-    identity: expected,
-    recovery: {
-      previousAuthority,
-      rollbackReference,
-    },
-    ...(installerBundle ? { installerBundle } : {}),
-  };
-}
-
-export async function verifyInstallerBundleReadback(
-  result,
-  fetchImpl = globalThis.fetch,
-) {
-  const bundle = result.installerBundle;
-  if (!bundle) return null;
-  if (typeof fetchImpl !== "function") {
-    throw new Error("installer bundle read-back requires fetch");
-  }
-  const manifestResponse = await fetchImpl(result.publicUrl, {
-    redirect: "manual",
-    cache: "no-store",
-  });
-  if (manifestResponse.status !== 200) {
-    throw new Error(
-      `installer bundle manifest read-back failed: HTTP ${manifestResponse.status}`,
-    );
-  }
-  const manifestBytes = Buffer.from(await manifestResponse.arrayBuffer());
-  if (digest(manifestBytes) !== bundle.manifestDigest) {
-    throw new Error("installer bundle manifest digest mismatch");
-  }
-  const manifest = JSON.parse(manifestBytes);
-  const unsigned = Object.fromEntries(
-    Object.entries(manifest).filter(([key]) => key !== "bundleRoot"),
-  );
-  if (
-    manifest.schema !== INSTALLER_BUNDLE_SCHEMA ||
-    manifest.bundleRoot !== bundle.bundleRoot ||
-    semanticRoot(unsigned) !== bundle.bundleRoot ||
-    manifest.package?.name !== "@kungfu-tech/site" ||
-    typeof manifest.package?.version !== "string" ||
-    manifest.identity?.sourceCommit !== result.identity.sourceSha ||
-    manifest.identity?.releaseSha !== result.identity.releaseSha ||
-    manifest.identity?.releaseTag !== result.identity.releaseTag ||
-    manifest.identity?.version !== result.identity.version ||
-    manifest.identity?.channel !== bundle.channel ||
-    manifest.identity?.channelPayloadRoot !== bundle.channelPayloadRoot ||
-    manifest.identity?.channelFileDigest !== bundle.channelFileDigest ||
-    manifest.identity?.releasePassport?.root !== bundle.releasePassport.root ||
-    manifest.distribution?.repository !== "kungfu-systems/kungfu" ||
-    manifest.routes?.immutablePath !== bundle.immutablePath ||
-    manifest.routes?.friendly?.["install.sh"] !==
-      "https://kungfu.tech/install.sh" ||
-    manifest.routes?.friendly?.["install.ps1"] !==
-      "https://kungfu.tech/install.ps1" ||
-    JSON.stringify(canonical(manifest.cachePolicy)) !==
-      JSON.stringify(canonical(bundle.cachePolicy)) ||
-    JSON.stringify(canonical(manifest.assets)) !==
-      JSON.stringify(canonical(bundle.assets)) ||
-    `${manifest.distribution?.releaseBaseUrl}/` +
-      manifest.distribution?.manifestAsset !==
-      result.publicUrl
-  ) {
-    throw new Error("installer bundle manifest root mismatch");
-  }
-  const observations = [];
-  const byUrl = new Map();
-  for (const asset of bundle.assets) {
-    let observation = byUrl.get(asset.releaseUrl);
-    if (!observation) {
-      const response = await fetchImpl(asset.releaseUrl, {
-        redirect: "manual",
-        cache: "no-store",
-      });
-      if (response.status !== 200) {
-        throw new Error(
-          `installer bundle asset read-back failed: HTTP ${response.status}`,
-        );
-      }
-      const bytes = Buffer.from(await response.arrayBuffer());
-      observation = {
-        releaseUrl: asset.releaseUrl,
-        size: bytes.length,
-        digest: digest(bytes),
-      };
-      byUrl.set(asset.releaseUrl, observation);
-    }
-    if (
-      observation.size !== asset.size ||
-      observation.digest !== asset.digest
-    ) {
-      throw new Error(`installer bundle asset drifted: ${asset.path}`);
-    }
-    observations.push({ path: asset.path, ...observation });
-  }
-  const seal = {
-    schema: "kungfu-buildchain-installer-publication-bundle-seal/v1",
-    bundleRoot: bundle.bundleRoot,
-    manifestDigest: bundle.manifestDigest,
-    sourceCommit: result.identity.sourceSha,
-    releaseTag: result.identity.releaseTag,
-    releasePassport: bundle.releasePassport,
-    observations,
-  };
-  return { ...seal, sealRoot: semanticRoot(seal) };
-}
-
-async function main(args) {
-  const options = {};
-  for (let index = 0; index < args.length; index += 1) {
-    const value = args[index];
-    if (value === "--evidence") options.evidence = args[++index];
-    else if (value === "--version") options.version = args[++index];
-    else if (value === "--source-sha") options.sourceSha = args[++index];
-    else if (value === "--release-sha") options.releaseSha = args[++index];
-    else if (value === "--release-tag") options.releaseTag = args[++index];
-    else throw new Error(`unknown argument: ${value}`);
-  }
-  const evidencePath = path.resolve(
-    requiredString(options.evidence, "--evidence"),
-  );
-  const result = validatePublicationCommitEvidence(
-    JSON.parse(fs.readFileSync(evidencePath, "utf8")),
-    options,
-  );
-  const installerBundleSeal = await verifyInstallerBundleReadback(result);
-  process.stdout.write(
-    `${JSON.stringify({
-      ...result,
-      ...(installerBundleSeal ? { installerBundleSeal } : {}),
-    })}\n`,
-  );
-}
-
-if (
-  process.argv[1] &&
-  import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href
-) {
-  main(process.argv.slice(2)).catch((error) => {
-    console.error(
-      `publication commit evidence failed: ${
-        error instanceof Error ? error.message : String(error)
-      }`,
-    );
-    process.exit(1);
-  });
-}

package/scripts/publish-github-artifact-attestation-evidence.mjs

@@ -1,201 +0,0 @@
-#!/usr/bin/env node
-
-import crypto from "node:crypto";
-import fs from "node:fs";
-import path from "node:path";
-import process from "node:process";
-import { spawnSync } from "node:child_process";
-
-import {
-  createGitHubArtifactAttestationVerificationPlan,
-  verifyGitHubArtifactAttestationEvidence,
-} from "../packages/core/github-artifact-attestation.js";
-
-function parseArgs(argv) {
-  const result = {};
-  for (let index = 0; index < argv.length; index += 2) {
-    const key = argv[index];
-    const value = argv[index + 1];
-    if (!key?.startsWith("--") || value === undefined) throw new Error(`invalid argument near ${key || "<end>"}`);
-    result[key.slice(2)] = value;
-  }
-  return result;
-}
-
-function required(value, label) {
-  const normalized = String(value || "").trim();
-  if (!normalized) throw new Error(`${label} is required`);
-  return normalized;
-}
-
-function sha256(value) {
-  return crypto.createHash("sha256").update(value).digest("hex");
-}
-
-function sha256File(filePath) {
-  return `sha256:${sha256(fs.readFileSync(filePath))}`;
-}
-
-function readJson(filePath, label) {
-  try {
-    return JSON.parse(fs.readFileSync(filePath, "utf8"));
-  } catch (error) {
-    throw new Error(`${label} is not readable JSON: ${error.message}`);
-  }
-}
-
-function safeAssetStem(value) {
-  return path.basename(required(value, "subject name"))
-    .replace(/[^0-9A-Za-z._-]+/g, "-")
-    .replace(/^-+|-+$/g, "");
-}
-
-async function api({ token, apiUrl, route, method = "GET", headers = {}, body }) {
-  const response = await fetch(`${apiUrl}${route}`, {
-    method,
-    headers: {
-      accept: "application/vnd.github+json",
-      authorization: `Bearer ${token}`,
-      "x-github-api-version": "2022-11-28",
-      ...headers,
-    },
-    body,
-  });
-  if (!response.ok) {
-    const detail = (await response.text()).slice(0, 500);
-    throw new Error(`GitHub API ${method} ${route} failed with ${response.status}: ${detail}`);
-  }
-  return response;
-}
-
-async function remoteAssetDigest({ token, apiUrl, repository, asset }) {
-  const declared = String(asset.digest || "").match(/^sha256:([0-9a-f]{64})$/i);
-  if (declared) return `sha256:${declared[1].toLowerCase()}`;
-  const response = await api({
-    token,
-    apiUrl,
-    route: `/repos/${repository}/releases/assets/${asset.id}`,
-    headers: { accept: "application/octet-stream" },
-  });
-  return `sha256:${sha256(Buffer.from(await response.arrayBuffer()))}`;
-}
-
-async function uploadImmutable({ token, apiUrl, repository, release, filePath, assetName }) {
-  const localDigest = sha256File(filePath);
-  const existing = (release.assets || []).filter((asset) => asset.name === assetName);
-  if (existing.length > 1) throw new Error(`release asset ${assetName} exists more than once`);
-  if (existing.length === 1) {
-    const remoteDigest = await remoteAssetDigest({ token, apiUrl, repository, asset: existing[0] });
-    if (remoteDigest !== localDigest) {
-      throw new Error(`immutable release asset collision for ${assetName}: ${remoteDigest} != ${localDigest}`);
-    }
-    return { action: "preserved", name: assetName, digest: localDigest, url: existing[0].browser_download_url };
-  }
-  const uploadBase = required(release.upload_url, "release.upload_url").replace(/\{.*$/, "");
-  const response = await fetch(`${uploadBase}?name=${encodeURIComponent(assetName)}`, {
-    method: "POST",
-    headers: {
-      accept: "application/vnd.github+json",
-      authorization: `Bearer ${token}`,
-      "content-type": "application/octet-stream",
-      "x-github-api-version": "2022-11-28",
-    },
-    body: fs.readFileSync(filePath),
-  });
-  if (!response.ok) throw new Error(`GitHub release asset upload failed with ${response.status}: ${(await response.text()).slice(0, 500)}`);
-  const asset = await response.json();
-  release.assets = [...(release.assets || []), asset];
-  const remoteDigest = await remoteAssetDigest({ token, apiUrl, repository, asset });
-  if (remoteDigest !== localDigest) throw new Error(`release asset read-back mismatch for ${assetName}`);
-  return { action: "uploaded", name: assetName, digest: localDigest, url: asset.browser_download_url };
-}
-
-function appendOutput(name, value) {
-  if (process.env.GITHUB_OUTPUT) fs.appendFileSync(process.env.GITHUB_OUTPUT, `${name}=${String(value)}\n`);
-}
-
-async function main() {
-  const options = parseArgs(process.argv.slice(2));
-  const token = required(process.env.GITHUB_TOKEN || process.env.GH_TOKEN, "GITHUB_TOKEN");
-  const apiUrl = (process.env.GITHUB_API_URL || "https://api.github.com").replace(/\/$/, "");
-  const repository = required(options.repository || process.env.GITHUB_REPOSITORY, "repository");
-  const tag = required(options.tag, "tag");
-  const subjectPath = path.resolve(required(options.subject, "subject"));
-  const manifestPath = path.resolve(required(options.manifest, "manifest"));
-  const passportPath = path.resolve(required(options.passport, "passport"));
-  const bundlePath = path.resolve(required(options.bundle, "bundle"));
-  const evidencePath = path.resolve(required(options.evidence, "evidence"));
-  const predicatePath = path.resolve(required(options.predicate, "predicate"));
-  const providerVerificationPath = path.resolve(required(options["provider-verification"], "provider-verification"));
-  const receiptPath = path.resolve(required(options.receipt, "receipt"));
-  const evidence = readJson(evidencePath, "Buildchain attestation evidence");
-  const plan = createGitHubArtifactAttestationVerificationPlan({ artifactPath: subjectPath, bundlePath, evidence });
-  const provider = spawnSync(plan.command, plan.args, { encoding: "utf8", env: process.env });
-  if (provider.status !== 0) throw new Error(`gh attestation verify failed: ${String(provider.stderr || provider.stdout).slice(0, 1000)}`);
-  const verificationResults = JSON.parse(provider.stdout);
-  const local = verifyGitHubArtifactAttestationEvidence({
-    artifactPath: subjectPath,
-    platformManifestPath: manifestPath,
-    releasePassportPath: passportPath,
-    bundlePath,
-    evidence,
-    verificationResults,
-  });
-  if (!local.ok) throw new Error(`Buildchain evidence verification failed: ${local.issues.map((issue) => issue.message).join("; ")}`);
-  const retainedProvider = readJson(providerVerificationPath, "retained provider verification");
-  const retained = verifyGitHubArtifactAttestationEvidence({
-    artifactPath: subjectPath,
-    platformManifestPath: manifestPath,
-    releasePassportPath: passportPath,
-    bundlePath,
-    evidence,
-    verificationResults: retainedProvider,
-  });
-  if (!retained.ok) {
-    throw new Error(`retained provider verification failed: ${retained.issues.map((issue) => issue.message).join("; ")}`);
-  }
-  const releaseResponse = await api({ token, apiUrl, route: `/repos/${repository}/releases/tags/${encodeURIComponent(tag)}` });
-  const release = await releaseResponse.json();
-  const stem = safeAssetStem(evidence.subject?.name);
-  const declarations = [
-    [bundlePath, `${stem}.sigstore-bundle.json`],
-    [evidencePath, `${stem}.buildchain-attestation.json`],
-    [predicatePath, `${stem}.buildchain-predicate.json`],
-    [providerVerificationPath, `${stem}.github-verification.json`],
-  ];
-  const assets = [];
-  for (const [filePath, assetName] of declarations) {
-    assets.push(await uploadImmutable({ token, apiUrl, repository, release, filePath, assetName }));
-  }
-  const receipt = {
-    contract: "buildchain.github-artifact-attestation-publication/v1",
-    repository,
-    tag,
-    releaseUrl: release.html_url,
-    subject: evidence.subject,
-    evidenceRoot: evidence.evidenceRoot,
-    attestation: evidence.attestation,
-    assets,
-    verified: true,
-  };
-  fs.mkdirSync(path.dirname(receiptPath), { recursive: true });
-  fs.writeFileSync(receiptPath, `${JSON.stringify(receipt, null, 2)}\n`);
-  const receiptAsset = await uploadImmutable({
-    token,
-    apiUrl,
-    repository,
-    release,
-    filePath: receiptPath,
-    assetName: `${stem}.buildchain-attestation-publication.json`,
-  });
-  appendOutput("release-url", release.html_url);
-  appendOutput("evidence-root", evidence.evidenceRoot);
-  appendOutput("publication-receipt", receiptPath);
-  appendOutput("publication-receipt-digest", receiptAsset.digest);
-  process.stdout.write(`${JSON.stringify({ ...receipt, receiptAsset }, null, 2)}\n`);
-}
-
-main().catch((error) => {
-  console.error(error.message);
-  process.exitCode = 1;
-});