@kungfu-tech/buildchain 4.0.2-alpha.48 → 4.0.2-alpha.49

package/packages/core/oci-publication-bundle.js

@@ -2,6 +2,10 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { v4ContentRoot } from "./v4-canonical-contracts.js";
+import {
+  verifyOciGraph,
+  verifyOciDestination,
+} from "./oci-publication-graph.js";
 
 export const OCI_FAMILY_SCHEMA = "kungfu-buildchain-oci-family/v1";
 const digestPattern = /^sha256:[0-9a-f]{64}$/u;
@@ -119,7 +123,9 @@ export function verifyOciPublicationBundle({
   version,
 }) {
   requireValue(
-    manifest?.schema === OCI_FAMILY_SCHEMA,
+    [OCI_FAMILY_SCHEMA, "kungfu-buildchain-oci-family/v2"].includes(
+      manifest?.schema,
+    ),
     "unsupported manifest schema",
   );
   const { root, ...body } = manifest;
@@ -152,18 +158,18 @@ export function verifyOciPublicationBundle({
     "incomplete or duplicate image family",
   );
   const files = new Map();
+  const graphs = new Map();
   for (const image of manifest.images) {
-    requireValue(
-      image.repository === `ghcr.io/${repository}/${image.name}`,
-      "destination must belong to the consumer repository",
-    );
+    verifyOciDestination(image, manifest, requireValue);
     requireValue(
       digestPattern.test(image.digest) &&
         ["built", "reused"].includes(image.action),
       "invalid image identity",
     );
     requireValue(
-      /^linux\/(amd64|arm64)$/u.test(image.platform),
+      /^linux\/(amd64|arm64)$/u.test(image.platform) ||
+        (manifest.schema.endsWith("/v2") &&
+          ["multi-platform", "compose"].includes(image.platform)),
       "unsupported image platform",
     );
     const prefix = image.layout;
@@ -171,7 +177,9 @@ export function verifyOciPublicationBundle({
       requireValue(
         digestPattern.test(descriptor.digest) &&
           Number.isSafeInteger(descriptor.size) &&
-          descriptor.size >= 0,
+          descriptor.size >= 0 &&
+          !descriptor.urls &&
+          !descriptor.data,
         "invalid OCI descriptor",
       );
       const relative = `${prefix}/blobs/sha256/${descriptor.digest.slice(7)}`;
@@ -209,23 +217,44 @@ export function verifyOciPublicationBundle({
       index.schemaVersion === 2 && selected.length === 1,
       "OCI index must select one exact image manifest",
     );
-    const document = JSON.parse(fs.readFileSync(descriptorFile(selected[0])));
-    requireValue(
-      document.schemaVersion === 2 &&
-        [
-          "application/vnd.oci.image.manifest.v1+json",
-          "application/vnd.docker.distribution.manifest.v2+json",
-        ].includes(document.mediaType) &&
-        Array.isArray(document.layers),
-      "unsupported OCI image manifest",
-    );
-    const config = JSON.parse(fs.readFileSync(descriptorFile(document.config)));
-    requireValue(
-      `${config.os}/${config.architecture}` === image.platform,
-      "OCI platform mismatch",
-    );
-    verifyImageProvenance(image, config, sourceSha, version);
-    for (const layer of document.layers) descriptorFile(layer);
+    if (manifest.schema.endsWith("/v2")) {
+      graphs.set(
+        image.name,
+        verifyOciGraph({
+          image,
+          manifest,
+          descriptor: selected[0],
+          descriptorFile,
+          requireValue,
+          verifyProvenance: (config) =>
+            verifyImageProvenance(image, config, sourceSha, version),
+        }),
+      );
+    } else {
+      const document = JSON.parse(fs.readFileSync(descriptorFile(selected[0])));
+      requireValue(
+        document.schemaVersion === 2 &&
+          [
+            "application/vnd.oci.image.manifest.v1+json",
+            "application/vnd.docker.distribution.manifest.v2+json",
+          ].includes(document.mediaType) &&
+          Array.isArray(document.layers),
+        "unsupported OCI image manifest",
+      );
+      const config = JSON.parse(
+        fs.readFileSync(descriptorFile(document.config)),
+      );
+      requireValue(
+        `${config.os}/${config.architecture}` === image.platform,
+        "OCI platform mismatch",
+      );
+      verifyImageProvenance(image, config, sourceSha, version);
+      for (const layer of document.layers) descriptorFile(layer);
+      graphs.set(image.name, {
+        manifests: [selected[0]],
+        blobs: [document.config, ...document.layers],
+      });
+    }
     const smokeFile = ociBundleFile(bundleRoot, image.smoke.path);
     requireValue(
       fileDigest(smokeFile) === image.smoke.sha256,
@@ -237,5 +266,10 @@ export function verifyOciPublicationBundle({
       "smoke qualification failed",
     );
   }
-  return { root: computed, manifest, bundleRoot: fs.realpathSync(bundleRoot) };
+  return {
+    root: computed,
+    manifest,
+    graphs,
+    bundleRoot: fs.realpathSync(bundleRoot),
+  };
 }

package/packages/core/oci-publication-graph.js

@@ -0,0 +1,206 @@
+import fs from "node:fs";
+
+const imageTypes = [
+  "application/vnd.oci.image.manifest.v1+json",
+  "application/vnd.docker.distribution.manifest.v2+json",
+];
+const indexTypes = [
+  "application/vnd.oci.image.index.v1+json",
+  "application/vnd.docker.distribution.manifest.list.v2+json",
+];
+const composeType = "application/vnd.docker.compose.project";
+
+export function ociPublicationTag(image, version) {
+  return `${image.kind === "compose" ? "compose-" : ""}v${version}`;
+}
+
+export function verifyOciDestination(image, manifest, requireValue) {
+  const compose = manifest.schema.endsWith("/v2") && image.kind === "compose";
+  requireValue(
+    manifest.schema.endsWith("/v2") || !image.kind,
+    "artifact kinds require family v2",
+  );
+  const target =
+    compose &&
+    manifest.images.find(
+      (entry) => entry.name === image.targetImage && entry.kind !== "compose",
+    );
+  requireValue(
+    !image.kind || ["image", "compose"].includes(image.kind),
+    "unsupported artifact kind",
+  );
+  requireValue(!compose || target, "Compose target image is absent");
+  requireValue(
+    image.repository ===
+      `ghcr.io/${manifest.repository}/${compose ? target.name : image.name}`,
+    "destination must belong to the consumer repository",
+  );
+  requireValue(
+    manifest.images.filter(
+      (entry) =>
+        entry.repository === image.repository &&
+        ociPublicationTag(entry, manifest.version) ===
+          ociPublicationTag(image, manifest.version),
+    ).length === 1,
+    "duplicate publication destination",
+  );
+}
+
+export function verifyOciGraph({
+  image,
+  manifest,
+  descriptor,
+  descriptorFile,
+  requireValue: check,
+  verifyProvenance,
+}) {
+  const manifests = [],
+    blobs = new Map(),
+    platforms = [],
+    attestations = [];
+  const visited = new Set();
+  const read = (entry) => JSON.parse(fs.readFileSync(descriptorFile(entry)));
+  function blob(entry) {
+    descriptorFile(entry);
+    blobs.set(entry.digest, entry);
+  }
+  function visit(entry, depth = 0) {
+    check(
+      depth < 4 && visited.size < 256 && !visited.has(entry.digest),
+      "duplicate or excessive OCI graph",
+    );
+    visited.add(entry.digest);
+    const document = read(entry);
+    check(
+      document.schemaVersion === 2 && document.mediaType === entry.mediaType,
+      "OCI descriptor media type mismatch",
+    );
+    if (indexTypes.includes(document.mediaType)) {
+      check(
+        image.kind !== "compose" &&
+          Array.isArray(document.manifests) &&
+          document.manifests.length > 0,
+        "invalid OCI index",
+      );
+      for (const child of document.manifests) visit(child, depth + 1);
+    } else {
+      check(
+        imageTypes.includes(document.mediaType) &&
+          Array.isArray(document.layers),
+        "unsupported OCI manifest",
+      );
+      const config = read(document.config);
+      blob(document.config);
+      for (const layer of document.layers) blob(layer);
+      if (image.kind === "compose") {
+        verifyCompose(document, image, manifest, read, check);
+      } else if (
+        entry.annotations?.["vnd.docker.reference.type"] ===
+        "attestation-manifest"
+      ) {
+        check(
+          entry.platform?.os === "unknown" &&
+            entry.platform?.architecture === "unknown" &&
+            document.layers.length > 0 &&
+            document.layers.every(
+              (layer) => layer.mediaType === "application/vnd.in-toto+json",
+            ),
+          "invalid image attestation",
+        );
+        attestations.push({
+          target: entry.annotations["vnd.docker.reference.digest"],
+          statements: document.layers.map(read),
+        });
+      } else {
+        const platform = `${config.os}/${config.architecture}`;
+        check(
+          /^linux\/(amd64|arm64)$/u.test(platform) &&
+            (!entry.platform ||
+              platform ===
+                `${entry.platform.os}/${entry.platform.architecture}`),
+          "OCI platform mismatch",
+        );
+        check(
+          !platforms.some((found) => found.platform === platform),
+          "duplicate image platform",
+        );
+        platforms.push({ platform, digest: entry.digest });
+        verifyProvenance(config);
+      }
+    }
+    manifests.push(entry);
+  }
+  visit(descriptor);
+  if (image.kind !== "compose") {
+    const expected =
+      image.platform === "multi-platform" ? image.platforms : [image.platform];
+    check(
+      Array.isArray(expected) &&
+        expected.length > 0 &&
+        new Set(expected).size === expected.length &&
+        JSON.stringify([...expected].sort()) ===
+          JSON.stringify(platforms.map((entry) => entry.platform).sort()),
+      "incomplete image platform family",
+    );
+    for (const attestation of attestations) {
+      check(
+        platforms.some((entry) => entry.digest === attestation.target) &&
+          attestation.statements.every((statement) =>
+            statement.subject?.some(
+              (subject) =>
+                `sha256:${subject.digest?.sha256}` === attestation.target,
+            ),
+          ),
+        "image attestation subject mismatch",
+      );
+    }
+  }
+  return { manifests, blobs: [...blobs.values()], platforms };
+}
+
+function verifyCompose(document, image, manifest, read, check) {
+  if (image.preview)
+    check(
+      image.preview.alias === "compose-preview" &&
+        /^\.github\/workflows\/[a-z0-9-]+\.yml$/u.test(
+          image.preview.qualificationWorkflow,
+        ) &&
+        /^(none|sha256:[0-9a-f]{64})$/u.test(image.preview.previousDigest),
+      "invalid Compose preview policy",
+    );
+  check(
+    image.platform === "compose" &&
+      document.artifactType === composeType &&
+      document.config.mediaType === "application/vnd.oci.empty.v1+json" &&
+      document.layers.length === 1 &&
+      document.layers[0].mediaType ===
+        "application/vnd.docker.compose.file+yaml",
+    "unsupported Compose artifact",
+  );
+  // JSON is a YAML subset; this bounded public form needs no executable YAML loader.
+  const project = read(document.layers[0]);
+  check(
+    project.services && Object.keys(project.services).length > 0,
+    "empty Compose application",
+  );
+  const target = manifest.images.find(
+    (entry) => entry.name === image.targetImage,
+  );
+  const references = Object.values(project.services).map(
+    (service) => service.image,
+  );
+  check(
+    references.every(
+      (ref) =>
+        typeof ref === "string" &&
+        /^[a-z0-9./:_-]+@sha256:[0-9a-f]{64}$/u.test(ref),
+    ) && references.includes(`${target.repository}@${target.digest}`),
+    "Compose images must bind exact digests",
+  );
+  check(
+    image.content?.sourceSha === manifest.sourceSha &&
+      image.content?.version === manifest.version &&
+      image.action === "built",
+    "Compose candidate provenance mismatch",
+  );
+}

package/scripts/check-v4-release-topology.mjs

@@ -25,6 +25,7 @@ const PRIVILEGED_ENTRYPOINTS = [
   "actions/v4-release-candidate-promote/index.js",
   "scripts/binary-publication-evidence.mjs",
   "scripts/next-development-review.mjs",
+  "scripts/oci-compose-preview.mjs",
   "scripts/v4-publication-settlement.mjs",
 ];
 
@@ -502,6 +503,17 @@ export function checkV4ReleaseTopology() {
   assert.equal(ledger.contract, "kungfu-buildchain-v4-release-topology/v1");
   assertClosedWorld(ledger.closedWorld.workflowPaths);
   assertAuthorityClosure(ledger);
+  const preview = ledger.postPublicationScope;
+  assert.deepEqual(preview.workflowPaths, [
+    ".github/workflows/public-release-oci-compose-preview.yml",
+  ]);
+  const previewTopology = discoverV4ReleaseTopology(
+    preview.workflowPaths,
+    preview.workflowPaths,
+  );
+  assert.equal(previewTopology.semanticMetrics.contentsWriteJobCount, 1);
+  assert.equal(previewTopology.semanticMetrics.oidcWriteJobCount, 0);
+  assert.deepEqual(preview.observedTopology, previewTopology);
   const actual = discoverV4ReleaseTopology(
     ledger.closedWorld.workflowPaths,
     ledger.semanticScope.workflowPaths,

package/scripts/generate-v4-universal-workflow-facades.mjs

@@ -1,7 +1,11 @@
 #!/usr/bin/env node
 import fs from "node:fs";
 import crypto from "node:crypto";
-import { currentWorkflowPath, writeWorkflowSource, rewriteRepositoryWorkflowPaths } from "./workflow-taxonomy.mjs";
+import {
+  currentWorkflowPath,
+  writeWorkflowSource,
+  rewriteRepositoryWorkflowPaths,
+} from "./workflow-taxonomy.mjs";
 import path from "node:path";
 import { execFileSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
@@ -96,6 +100,7 @@ function frozenFacadeSource(relative) {
 const mutableFacades = new Set([
   ...(contract.migration.channelGeneratedFacades || []),
   ".github/workflows/dev-pr-auto-merge.yml",
+  ...(contract.migration.postMigrationWorkflows || []),
 ]);
 
 function isMutableFacade(relative) {
@@ -187,9 +192,7 @@ function guardCompatibilityJobs(source, relative) {
 function addRuntimeBootstrapDependencies(source, relative) {
   if (
     relative !== ".github/workflows/.build.yml" ||
-    source.includes(
-      ".buildchain/workflow-shell/scripts/github-output.mjs\n",
-    )
+    source.includes(".buildchain/workflow-shell/scripts/github-output.mjs\n")
   )
     return source;
   const anchor =
@@ -201,32 +204,60 @@ function addRuntimeBootstrapDependencies(source, relative) {
 }
 
 function applyPublicationFacadePatches(source, relative) {
-  const document = JSON.parse(fs.readFileSync(path.join(root,
-    "architecture/v4-publication-facade-patches.json"), "utf8"));
-  const patch = document.facades.find(entry => entry.workflow === relative);
+  const document = JSON.parse(
+    fs.readFileSync(
+      path.join(root, "architecture/v4-publication-facade-patches.json"),
+      "utf8",
+    ),
+  );
+  const patch = document.facades.find((entry) => entry.workflow === relative);
   if (!patch) return source;
-  const digest = value => crypto.createHash("sha256").update(value).digest("hex");
+  const digest = (value) =>
+    crypto.createHash("sha256").update(value).digest("hex");
   if (digest(source) === patch.afterSha256) return source;
-  if (digest(source) !== patch.beforeSha256) fail(`${relative}: publication facade source drift`);
+  if (digest(source) !== patch.beforeSha256)
+    fail(`${relative}: publication facade source drift`);
   for (const { before, after } of patch.replacements) {
-    if (source.split(before).length !== 2) fail(`${relative}: ambiguous publication patch`);
+    if (source.split(before).length !== 2)
+      fail(`${relative}: ambiguous publication patch`);
     source = source.replace(before, () => after);
   }
-  if (digest(source) !== patch.afterSha256) fail(`${relative}: publication facade result drift`);
+  if (digest(source) !== patch.afterSha256)
+    fail(`${relative}: publication facade result drift`);
   return source;
 }
 
 function inheritPublicationProviderAuthority(source, relative) {
-  if (relative !== ".github/workflows/.release-candidate-promote.yml") return source;
-  return source.replace("permissions:\n  contents: read\n", "# Provider authority is inherited from the explicit caller envelope.\n")
-    .replace("    permissions:\n      actions: read\n      checks: write\n      contents: write\n      id-token: write\n      pull-requests: write\n", "    # Provider authority is inherited from the explicit caller envelope.\n");
+  if (relative !== ".github/workflows/.release-candidate-promote.yml")
+    return source;
+  return source
+    .replace(
+      "permissions:\n  contents: read\n",
+      "# Provider authority is inherited from the explicit caller envelope.\n",
+    )
+    .replace(
+      "    permissions:\n      actions: read\n      checks: write\n      contents: write\n      id-token: write\n      pull-requests: write\n",
+      "    # Provider authority is inherited from the explicit caller envelope.\n",
+    );
 }
 
 export function migrateV4UniversalWorkflowFacade(source, relative) {
-  return rewriteRepositoryWorkflowPaths(root, inheritPublicationProviderAuthority(applyPublicationFacadePatches(guardCompatibilityJobs(
-    addUniversalInput(addRuntimeBootstrapDependencies(source, relative), relative),
-    relative,
-  ), relative), relative));
+  return rewriteRepositoryWorkflowPaths(
+    root,
+    inheritPublicationProviderAuthority(
+      applyPublicationFacadePatches(
+        guardCompatibilityJobs(
+          addUniversalInput(
+            addRuntimeBootstrapDependencies(source, relative),
+            relative,
+          ),
+          relative,
+        ),
+        relative,
+      ),
+      relative,
+    ),
+  );
 }
 
 function verify(source, relative) {
@@ -427,7 +458,8 @@ function main() {
       );
   } else {
     writeWorkflowSource(
-      root, path.relative(root, recoveryWorkflowPath),
+      root,
+      path.relative(root, recoveryWorkflowPath),
       fs.readFileSync(recoveryTemplatePath, "utf8"),
     );
   }
@@ -440,7 +472,8 @@ function main() {
     if (check) verify(source, relative);
     else
       writeWorkflowSource(
-        root, current,
+        root,
+        current,
         migrateV4UniversalWorkflowFacade(source, relative),
       );
   }