@kungfu-tech/buildchain 4.0.9 → 4.1.0-alpha.0

package/packages/core/providers/signing/macos/compound-archive.py

@@ -0,0 +1,434 @@
+#!/usr/bin/env python3
+"""Sign every Mach-O in a sealed archive, including code embedded in wheels."""
+
+from __future__ import annotations
+
+import argparse
+import base64
+import csv
+import hashlib
+import io
+import json
+import os
+from pathlib import Path, PurePosixPath
+import shutil
+import stat
+import subprocess
+import tarfile
+import zipfile
+
+
+MACH_O_MAGICS = {
+    bytes.fromhex(value)
+    for value in (
+        "feedface", "cefaedfe", "feedfacf", "cffaedfe",
+        "cafebabe", "bebafeca", "cafebabf", "bfbafeca",
+    )
+}
+THIN_MACH_O_ENDIAN = {
+    bytes.fromhex("feedface"): "big",
+    bytes.fromhex("feedfacf"): "big",
+    bytes.fromhex("cefaedfe"): "little",
+    bytes.fromhex("cffaedfe"): "little",
+}
+FAT_MACH_O_LAYOUT = {
+    bytes.fromhex("cafebabe"): ("big", 20, 4),
+    bytes.fromhex("bebafeca"): ("little", 20, 4),
+    bytes.fromhex("cafebabf"): ("big", 32, 8),
+    bytes.fromhex("bfbafeca"): ("little", 32, 8),
+}
+MH_EXECUTE = 2
+JIT_EXECUTABLE_ENTITLEMENTS = """<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>com.apple.security.cs.allow-jit</key>
+  <true/>
+</dict>
+</plist>
+"""
+
+
+def safe_name(value: str, label: str) -> PurePosixPath:
+    if not value or "\\" in value:
+        raise ValueError(f"{label} contains an unsafe archive path")
+    name = PurePosixPath(value)
+    if name.is_absolute() or any(part in {"", ".", ".."} for part in name.parts):
+        raise ValueError(f"{label} contains an unsafe archive path")
+    return name
+
+
+def safe_link(name: PurePosixPath, value: str, label: str) -> None:
+    target = PurePosixPath(value)
+    if not value or target.is_absolute() or "\\" in value:
+        raise ValueError(f"{label} contains an unsafe symbolic link")
+    depth = 0
+    for part in (*name.parent.parts, *target.parts):
+        if part in {"", "."}:
+            continue
+        if part == "..":
+            depth -= 1
+        else:
+            depth += 1
+        if depth < 0:
+            raise ValueError(f"{label} contains an escaping symbolic link")
+
+
+def extract_tar(archive: Path, root: Path) -> None:
+    with tarfile.open(archive, "r:*") as source:
+        seen: set[str] = set()
+        for member in source.getmembers():
+            name = safe_name(member.name.rstrip("/"), "compound archive")
+            key = name.as_posix().casefold()
+            if key in seen:
+                raise ValueError("compound archive contains colliding paths")
+            seen.add(key)
+            target = root.joinpath(*name.parts)
+            if member.isdir():
+                target.mkdir(parents=True, exist_ok=True)
+            elif member.isfile():
+                target.parent.mkdir(parents=True, exist_ok=True)
+                stream = source.extractfile(member)
+                if stream is None:
+                    raise ValueError("compound archive file body is missing")
+                with target.open("wb") as output:
+                    shutil.copyfileobj(stream, output)
+                os.chmod(target, member.mode & 0o777)
+            elif member.issym():
+                safe_link(name, member.linkname, "compound archive")
+                target.parent.mkdir(parents=True, exist_ok=True)
+                os.symlink(member.linkname, target)
+            else:
+                raise ValueError("compound archive contains an unsupported entry type")
+
+
+def zip_is_symlink(info: zipfile.ZipInfo) -> bool:
+    return stat.S_ISLNK((info.external_attr >> 16) & 0xFFFF)
+
+
+def extract_zip(archive: Path, root: Path) -> list[zipfile.ZipInfo]:
+    with zipfile.ZipFile(archive) as source:
+        infos = source.infolist()
+        seen: set[str] = set()
+        for info in infos:
+            name = safe_name(info.filename.rstrip("/"), "compound archive")
+            key = name.as_posix().casefold()
+            if key in seen:
+                raise ValueError("compound archive contains colliding paths")
+            seen.add(key)
+            target = root.joinpath(*name.parts)
+            if info.is_dir():
+                target.mkdir(parents=True, exist_ok=True)
+                continue
+            body = source.read(info)
+            target.parent.mkdir(parents=True, exist_ok=True)
+            if zip_is_symlink(info):
+                link = body.decode("utf-8")
+                safe_link(name, link, "compound archive")
+                os.symlink(link, target)
+            else:
+                target.write_bytes(body)
+                mode = (info.external_attr >> 16) & 0o777
+                if mode:
+                    os.chmod(target, mode)
+        return infos
+
+
+def is_mach_o(path: Path) -> bool:
+    if not path.is_file() or path.is_symlink():
+        return False
+    with path.open("rb") as source:
+        return source.read(4) in MACH_O_MAGICS
+
+
+def thin_mach_o_filetype(source, offset: int = 0) -> int:
+    source.seek(offset)
+    header = source.read(16)
+    if len(header) != 16 or header[:4] not in THIN_MACH_O_ENDIAN:
+        raise ValueError("Mach-O payload has an invalid thin header")
+    return int.from_bytes(header[12:16], THIN_MACH_O_ENDIAN[header[:4]])
+
+
+def mach_o_filetypes(path: Path) -> set[int]:
+    with path.open("rb") as source:
+        magic = source.read(4)
+        if magic in THIN_MACH_O_ENDIAN:
+            return {thin_mach_o_filetype(source)}
+        byteorder, entry_size, offset_size = FAT_MACH_O_LAYOUT[magic]
+        count_body = source.read(4)
+        if len(count_body) != 4:
+            raise ValueError("Mach-O payload has an invalid fat header")
+        count = int.from_bytes(count_body, byteorder)
+        if count < 1 or count > 64:
+            raise ValueError("Mach-O payload has an invalid architecture count")
+        offsets = []
+        for _ in range(count):
+            entry = source.read(entry_size)
+            if len(entry) != entry_size:
+                raise ValueError("Mach-O payload has a truncated architecture table")
+            offsets.append(int.from_bytes(entry[8 : 8 + offset_size], byteorder))
+        return {thin_mach_o_filetype(source, offset) for offset in offsets}
+
+
+def entitlement_target(path: Path, args: argparse.Namespace) -> bool:
+    try:
+        relative = path.relative_to(args.archive_root).as_posix()
+    except ValueError:
+        return False
+    if relative not in args.entitlements_paths:
+        return False
+    if mach_o_filetypes(path) != {MH_EXECUTE}:
+        raise ValueError(
+            f"requested entitlement path is not a Mach-O executable: {relative}"
+        )
+    args.matched_entitlements_paths.add(relative)
+    return True
+
+
+def entitlements_path(args: argparse.Namespace) -> Path | None:
+    if args.entitlements_profile == "none":
+        return None
+    target = Path(args.work_root) / "jit-executable-v1.plist"
+    if not target.exists():
+        target.write_text(JIT_EXECUTABLE_ENTITLEMENTS, encoding="utf-8")
+    return target
+
+
+def run_codesign(path: Path, args: argparse.Namespace) -> bool:
+    signing = [args.codesign, "--force", "--options", "runtime", "--timestamp"]
+    entitlements = entitlements_path(args) if entitlement_target(path, args) else None
+    if entitlements is not None:
+        signing.extend(["--entitlements", str(entitlements)])
+    signing.extend(
+        ["--keychain", args.keychain, "--sign", args.identity, str(path)]
+    )
+    subprocess.run(
+        signing,
+        check=True,
+    )
+    subprocess.run(
+        [args.codesign, "--verify", "--strict", "--verbose=4", str(path)],
+        check=True,
+    )
+    detail = subprocess.run(
+        [args.codesign, "--display", "--verbose=4", str(path)],
+        check=True,
+        text=True,
+        capture_output=True,
+    )
+    output = f"{detail.stdout}\n{detail.stderr}"
+    if f"TeamIdentifier={args.team_id}" not in output:
+        raise ValueError("signed Mach-O TeamIdentifier mismatch")
+    if "Runtime Version" not in output and "runtime" not in output.lower():
+        raise ValueError("signed Mach-O does not prove hardened runtime")
+    if "Timestamp=" not in output:
+        raise ValueError("signed Mach-O does not prove a secure timestamp")
+    if entitlements is not None:
+        entitlement_detail = subprocess.run(
+            [args.codesign, "--display", "--entitlements", ":-", str(path)],
+            check=True,
+            text=True,
+            capture_output=True,
+        )
+        entitlement_output = f"{entitlement_detail.stdout}\n{entitlement_detail.stderr}"
+        if "com.apple.security.cs.allow-jit" not in entitlement_output:
+            raise ValueError("signed executable does not prove the requested JIT entitlement")
+    return entitlements is not None
+
+
+def wheel_hash(body: bytes) -> str:
+    return base64.urlsafe_b64encode(hashlib.sha256(body).digest()).rstrip(b"=").decode()
+
+
+def sign_wheel(wheel: Path, work: Path, args: argparse.Namespace) -> tuple[int, int]:
+    with zipfile.ZipFile(wheel) as source:
+        infos = source.infolist()
+        if not infos:
+            raise ValueError("embedded wheel is empty")
+        bodies: dict[str, bytes] = {}
+        seen: set[str] = set()
+        records: list[str] = []
+        for info in infos:
+            name = safe_name(info.filename.rstrip("/"), "embedded wheel")
+            key = name.as_posix().casefold()
+            if key in seen:
+                raise ValueError("embedded wheel contains colliding paths")
+            seen.add(key)
+            if zip_is_symlink(info):
+                raise ValueError("embedded wheel must not contain symbolic links")
+            if not info.is_dir():
+                bodies[info.filename] = source.read(info)
+                if len(name.parts) == 2 and name.parts[0].endswith(".dist-info") and name.name == "RECORD":
+                    records.append(info.filename)
+    if len(records) != 1:
+        raise ValueError("embedded wheel must contain exactly one top-level dist-info RECORD")
+    root = work / f"wheel-{hashlib.sha256(str(wheel).encode()).hexdigest()[:16]}"
+    root.mkdir()
+    for name, body in bodies.items():
+        target = root.joinpath(*PurePosixPath(name).parts)
+        target.parent.mkdir(parents=True, exist_ok=True)
+        target.write_bytes(body)
+    signed = 0
+    entitled = 0
+    for target in sorted(root.rglob("*")):
+        if is_mach_o(target):
+            entitled += int(run_codesign(target, args))
+            signed += 1
+    if signed == 0:
+        shutil.rmtree(root)
+        return 0, 0
+    for name in list(bodies):
+        bodies[name] = root.joinpath(*PurePosixPath(name).parts).read_bytes()
+    record = records[0]
+    rows = []
+    for name in sorted(bodies):
+        if name == record:
+            continue
+        body = bodies[name]
+        rows.append((name, f"sha256={wheel_hash(body)}", str(len(body))))
+    rows.append((record, "", ""))
+    stream = io.StringIO(newline="")
+    csv.writer(stream, lineterminator="\n").writerows(rows)
+    bodies[record] = stream.getvalue().encode()
+    replacement = wheel.with_suffix(".signed.whl")
+    with zipfile.ZipFile(replacement, "w") as output:
+        for info in infos:
+            if info.is_dir():
+                output.writestr(info, b"")
+            else:
+                output.writestr(info, bodies[info.filename])
+    replacement.replace(wheel)
+    shutil.rmtree(root)
+    return signed, entitled
+
+
+def repack_tar(root: Path, archive: Path) -> None:
+    replacement = archive.with_name(f"{archive.name}.signed")
+    with tarfile.open(replacement, "w:gz", format=tarfile.PAX_FORMAT, dereference=False) as output:
+        for child in sorted(root.iterdir(), key=lambda item: item.name):
+            output.add(child, arcname=child.name, recursive=True)
+    replacement.replace(archive)
+
+
+def repack_zip(root: Path, archive: Path, infos: list[zipfile.ZipInfo]) -> None:
+    replacement = archive.with_name(f"{archive.name}.signed")
+    with zipfile.ZipFile(replacement, "w") as output:
+        for info in infos:
+            target = root.joinpath(*PurePosixPath(info.filename.rstrip("/")).parts)
+            if info.is_dir():
+                output.writestr(info, b"")
+            elif zip_is_symlink(info):
+                output.writestr(info, os.readlink(target).encode())
+            else:
+                output.writestr(info, target.read_bytes())
+    replacement.replace(archive)
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--archive", required=True)
+    parser.add_argument("--work-root", required=True)
+    parser.add_argument("--notary-root", required=True)
+    parser.add_argument("--evidence", required=True)
+    parser.add_argument("--identity", required=True)
+    parser.add_argument("--keychain", required=True)
+    parser.add_argument("--team-id", required=True)
+    parser.add_argument(
+        "--entitlements-profile",
+        choices=("none", "jit-executable-v1"),
+        default="none",
+    )
+    parser.add_argument("--entitlements-paths", default="")
+    parser.add_argument("--codesign", default="/usr/bin/codesign")
+    args = parser.parse_args()
+    archive = Path(args.archive).resolve()
+    work = Path(args.work_root).resolve()
+    root = Path(args.notary_root).resolve()
+    args.archive_root = root
+    declared_entitlements_paths = [
+        safe_name(value, "entitlements path").as_posix()
+        for value in args.entitlements_paths.split(",")
+        if value
+    ]
+    if len(declared_entitlements_paths) != len(set(declared_entitlements_paths)):
+        raise ValueError("entitlements paths must not contain duplicates")
+    args.entitlements_paths = set(declared_entitlements_paths)
+    args.matched_entitlements_paths = set()
+    if (
+        (args.entitlements_profile == "none" and args.entitlements_paths)
+        or (args.entitlements_profile != "none" and not args.entitlements_paths)
+    ):
+        raise ValueError(
+            "entitlements paths must be non-empty exactly when a profile is enabled"
+        )
+    work.mkdir(parents=True)
+    root.mkdir(parents=True)
+    if zipfile.is_zipfile(archive):
+        archive_format = "zip"
+        infos = extract_zip(archive, root)
+    elif tarfile.is_tarfile(archive):
+        archive_format = "tar.gz"
+        infos = []
+        extract_tar(archive, root)
+    else:
+        raise ValueError("compound Apple archive must be zip or tar.gz")
+    wheel_count = 0
+    wheel_mach_o_count = 0
+    entitled_executable_count = 0
+    for wheel in sorted(root.rglob("*.whl")):
+        wheel_count += 1
+        wheel_signed, wheel_entitled = sign_wheel(wheel, work, args)
+        wheel_mach_o_count += wheel_signed
+        entitled_executable_count += wheel_entitled
+    mach_o_count = 0
+    for target in sorted(root.rglob("*"), key=lambda item: (-len(item.parts), str(item))):
+        if is_mach_o(target):
+            entitled_executable_count += int(run_codesign(target, args))
+            mach_o_count += 1
+    if mach_o_count + wheel_mach_o_count == 0:
+        raise ValueError("compound Apple archive contains no Mach-O code")
+    if args.entitlements_profile != "none" and entitled_executable_count == 0:
+        raise ValueError(
+            "requested JIT entitlement profile found no executable Mach-O payload"
+        )
+    unmatched = args.entitlements_paths - args.matched_entitlements_paths
+    if unmatched:
+        raise ValueError(
+            "requested entitlement paths were not signed: " + ", ".join(sorted(unmatched))
+        )
+    if archive_format == "zip":
+        repack_zip(root, archive, infos)
+    else:
+        repack_tar(root, archive)
+    evidence = {
+        "archiveFormat": archive_format,
+        "machOCount": mach_o_count,
+        "wheelCount": wheel_count,
+        "wheelMachOCount": wheel_mach_o_count,
+        "entitlementsProfile": args.entitlements_profile,
+        "entitledExecutableCount": entitled_executable_count,
+        "entitledPaths": sorted(args.matched_entitlements_paths),
+        **(
+            {
+                "entitlementsSha256": "sha256:"
+                + hashlib.sha256(JIT_EXECUTABLE_ENTITLEMENTS.encode()).hexdigest()
+            }
+            if args.entitlements_profile != "none"
+            else {}
+        ),
+        "checks": [
+            "codesign-strict", "developer-id-team", "hardened-runtime",
+            "secure-timestamp", "compound-archive-safe-paths",
+            "embedded-wheel-record-integrity",
+            *(
+                ["jit-executable-entitlement"]
+                if args.entitlements_profile != "none"
+                else []
+            ),
+        ],
+    }
+    Path(args.evidence).write_text(json.dumps(evidence, indent=2) + "\n", encoding="utf-8")
+
+
+if __name__ == "__main__":
+    main()

package/packages/core/providers/signing/macos/sign-request.sh

@@ -0,0 +1,145 @@
+#!/bin/bash
+set -euo pipefail
+
+: "${BUILDCHAIN_SIGNED_PAYLOAD:?BUILDCHAIN_SIGNED_PAYLOAD is required}"
+: "${BUILDCHAIN_SIGNING_EVIDENCE:?BUILDCHAIN_SIGNING_EVIDENCE is required}"
+: "${BUILDCHAIN_APPLE_CERTIFICATE_P12_BASE64:?Buildchain Apple certificate is required}"
+: "${BUILDCHAIN_APPLE_CERTIFICATE_PASSWORD:?Buildchain Apple certificate password is required}"
+: "${BUILDCHAIN_APPLE_CERTIFICATE_SHA1:?Buildchain Apple certificate fingerprint is required}"
+: "${BUILDCHAIN_APPLE_TEAM_ID:?Buildchain Apple Team ID is required}"
+: "${BUILDCHAIN_APPLE_NOTARY_KEY_P8_BASE64:?Buildchain Apple notary key is required}"
+: "${BUILDCHAIN_APPLE_NOTARY_KEY_ID:?Buildchain Apple notary key ID is required}"
+: "${BUILDCHAIN_APPLE_NOTARY_ISSUER:?Buildchain Apple notary issuer is required}"
+
+case "${BUILDCHAIN_APPLE_CERTIFICATE_SHA1}" in
+  *[!0-9A-Fa-f]*|'') echo "invalid Apple certificate fingerprint" >&2; exit 1 ;;
+esac
+
+authority_tmp="$(mktemp -d "${RUNNER_TEMP:-/tmp}/buildchain-macho-authority.XXXXXX")"
+keychain_path="${authority_tmp}/authority.keychain-db"
+keychain_password="$(openssl rand -hex 32)"
+certificate_path="${authority_tmp}/certificate.p12"
+notary_key_path="${authority_tmp}/AuthKey_${BUILDCHAIN_APPLE_NOTARY_KEY_ID}.p8"
+notary_archive="${authority_tmp}/notary-submission.zip"
+notary_submission="${authority_tmp}/notary-submission.json"
+notary_result="${authority_tmp}/notary-result.json"
+signature_details="${authority_tmp}/codesign-details.txt"
+compound_evidence="${authority_tmp}/compound-evidence.json"
+compound_work="${authority_tmp}/compound-work"
+notary_root="${authority_tmp}/notary-root"
+notary_timeout="${BUILDCHAIN_APPLE_NOTARY_TIMEOUT:-55m}"
+artifact_kind="${BUILDCHAIN_ARTIFACT_KIND:-mach-o}"
+entitlements_profile="${BUILDCHAIN_ENTITLEMENTS_PROFILE:-none}"
+entitlements_paths="${BUILDCHAIN_ENTITLEMENTS_PATHS:-}"
+
+case "${entitlements_profile}" in
+  none|jit-executable-v1) ;;
+  *) echo "unsupported Buildchain entitlements profile: ${entitlements_profile}" >&2; exit 1 ;;
+esac
+
+if [ "${entitlements_profile}" != "none" ] && [ "${artifact_kind}" != "archive" ]; then
+  echo "Buildchain entitlements profile ${entitlements_profile} requires an Apple archive" >&2
+  exit 1
+fi
+
+if { [ "${entitlements_profile}" = "none" ] && [ -n "${entitlements_paths}" ]; } ||
+   { [ "${entitlements_profile}" != "none" ] && [ -z "${entitlements_paths}" ]; }; then
+  echo "Buildchain entitlements paths must be non-empty exactly when a profile is enabled" >&2
+  exit 1
+fi
+
+cleanup() {
+  security delete-keychain "${keychain_path}" >/dev/null 2>&1 || true
+  rm -rf "${authority_tmp}"
+}
+trap cleanup EXIT INT TERM
+
+printf '%s' "${BUILDCHAIN_APPLE_CERTIFICATE_P12_BASE64}" | openssl base64 -d -A > "${certificate_path}"
+printf '%s' "${BUILDCHAIN_APPLE_NOTARY_KEY_P8_BASE64}" | openssl base64 -d -A > "${notary_key_path}"
+chmod 600 "${certificate_path}" "${notary_key_path}"
+
+security create-keychain -p "${keychain_password}" "${keychain_path}"
+security set-keychain-settings -lut 21600 "${keychain_path}"
+security unlock-keychain -p "${keychain_password}" "${keychain_path}"
+security import "${certificate_path}" -k "${keychain_path}" -P "${BUILDCHAIN_APPLE_CERTIFICATE_PASSWORD}" -T /usr/bin/codesign -T /usr/bin/security
+echo "Buildchain macOS authority: configure imported private-key access"
+security set-key-partition-list -S apple-tool:,apple:,codesign: -k "${keychain_password}" "${keychain_path}" >/dev/null
+security list-keychains -d user -s "${keychain_path}"
+echo "Buildchain macOS authority: verify requested signing identity"
+security find-identity -v -p codesigning "${keychain_path}" | grep -Fqi "${BUILDCHAIN_APPLE_CERTIFICATE_SHA1}" || {
+  echo "configured Developer ID identity was not imported" >&2
+  exit 1
+}
+
+case "${artifact_kind}" in
+  archive)
+    echo "Buildchain macOS authority: sign compound archive Mach-O payloads"
+    python3 packages/core/providers/signing/macos/compound-archive.py \
+      --archive "${BUILDCHAIN_SIGNED_PAYLOAD}" \
+      --work-root "${compound_work}" \
+      --notary-root "${notary_root}" \
+      --evidence "${compound_evidence}" \
+      --identity "${BUILDCHAIN_APPLE_CERTIFICATE_SHA1}" \
+      --keychain "${keychain_path}" \
+      --team-id "${BUILDCHAIN_APPLE_TEAM_ID}" \
+      --entitlements-profile "${entitlements_profile}" \
+      --entitlements-paths "${entitlements_paths}"
+    /usr/bin/ditto -c -k --keepParent "${notary_root}" "${notary_archive}"
+    ;;
+  mach-o|binary|dylib)
+    echo "Buildchain macOS authority: sign exact Mach-O payload"
+    codesign --force --options runtime --timestamp --keychain "${keychain_path}" --sign "${BUILDCHAIN_APPLE_CERTIFICATE_SHA1}" "${BUILDCHAIN_SIGNED_PAYLOAD}"
+    codesign --verify --strict --verbose=4 "${BUILDCHAIN_SIGNED_PAYLOAD}"
+    codesign --display --verbose=4 "${BUILDCHAIN_SIGNED_PAYLOAD}" 2> "${signature_details}"
+    grep -Fqx "TeamIdentifier=${BUILDCHAIN_APPLE_TEAM_ID}" "${signature_details}" || {
+      echo "signed Mach-O TeamIdentifier mismatch" >&2
+      exit 1
+    }
+    grep -Fq "Runtime Version" "${signature_details}" || {
+      echo "signed Mach-O does not prove hardened runtime" >&2
+      exit 1
+    }
+    grep -Fq "Timestamp=" "${signature_details}" || {
+      echo "signed Mach-O does not prove a secure timestamp" >&2
+      exit 1
+    }
+    /usr/bin/ditto -c -k --keepParent "${BUILDCHAIN_SIGNED_PAYLOAD}" "${notary_archive}"
+    ;;
+  *)
+    echo "unsupported Apple native artifact kind: ${artifact_kind}" >&2
+    exit 1
+    ;;
+esac
+echo "Buildchain macOS authority: submit signed ${artifact_kind} for notarization"
+xcrun notarytool submit "${notary_archive}" --key "${notary_key_path}" --key-id "${BUILDCHAIN_APPLE_NOTARY_KEY_ID}" --issuer "${BUILDCHAIN_APPLE_NOTARY_ISSUER}" --output-format json > "${notary_submission}"
+notary_id="$(node -e 'const fs=require("fs");const value=JSON.parse(fs.readFileSync(process.argv[1],"utf8"));if(!value.id)throw new Error("Apple notarization submission did not return an id");process.stdout.write(value.id)' "${notary_submission}")"
+echo "Buildchain macOS authority: notarization submission ${notary_id}; wait up to ${notary_timeout}"
+xcrun notarytool wait "${notary_id}" --key "${notary_key_path}" --key-id "${BUILDCHAIN_APPLE_NOTARY_KEY_ID}" --issuer "${BUILDCHAIN_APPLE_NOTARY_ISSUER}" --timeout "${notary_timeout}" --output-format json > "${notary_result}"
+node -e 'const fs=require("fs");const value=JSON.parse(fs.readFileSync(process.argv[1],"utf8"));if(value.status!=="Accepted"||value.id!==process.argv[2])throw new Error("Apple notarization was not accepted for the submitted artifact")' "${notary_result}" "${notary_id}"
+echo "Buildchain macOS authority: Apple accepted notarization ${notary_id}; ${artifact_kind} ticket is available online and cannot be stapled"
+
+node - "${notary_result}" "${BUILDCHAIN_SIGNING_EVIDENCE}" "${BUILDCHAIN_APPLE_CERTIFICATE_SHA1}" "${BUILDCHAIN_APPLE_TEAM_ID}" "${artifact_kind}" "${compound_evidence}" <<'NODE'
+const fs = require("fs");
+const notary = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
+const artifactKind = process.argv[6];
+const compound = fs.existsSync(process.argv[7])
+  ? JSON.parse(fs.readFileSync(process.argv[7], "utf8"))
+  : null;
+const checks = compound?.checks || ["codesign-strict", "developer-id-team", "hardened-runtime", "secure-timestamp"];
+checks.push("notarytool-accepted", artifactKind === "archive" ? "compound-notary-ticket-online" : "standalone-notary-ticket-online");
+const evidence = {
+  schemaVersion: 1,
+  contract: "kungfu-buildchain-apple-developer-id-evidence/v1",
+  status: "passed",
+  provider: "apple",
+  certificateSha1: process.argv[4].toUpperCase(),
+  teamId: process.argv[5],
+  notarization: { id: notary.id, status: notary.status, ticketDelivery: "online" },
+  artifactKind,
+  ...(compound ? { compound } : {}),
+  stapling: { status: "not-applicable", reason: artifactKind === "archive" ? "generic archives do not support stapled notarization tickets" : "standalone Mach-O executables do not support stapled notarization tickets" },
+  gatekeeper: { status: "not-directly-assessable", reason: artifactKind === "archive" ? "Gatekeeper assesses the extracted signed code rather than a generic archive container" : "spctl execute assessment applies app semantics and does not directly assess standalone Mach-O executables" },
+  checks,
+};
+fs.writeFileSync(process.argv[3], `${JSON.stringify(evidence, null, 2)}\n`);
+NODE

package/packages/core/providers/signing/native.js

@@ -0,0 +1,77 @@
+import path from "node:path";
+import { command } from "../../runtime/action-process.mjs";
+export function signMacosPayload(
+  {
+    runtimeRoot,
+    payload,
+    evidencePath,
+    artifact,
+    signature,
+    credentials,
+    environment,
+  },
+  execute = command,
+) {
+  execute(
+    "bash",
+    [
+      path.join(
+        runtimeRoot,
+        "packages/core/providers/signing/macos/sign-request.sh",
+      ),
+    ],
+    {
+      cwd: runtimeRoot,
+      env: {
+        ...environment,
+        BUILDCHAIN_SIGNED_PAYLOAD: payload,
+        BUILDCHAIN_SIGNING_EVIDENCE: evidencePath,
+        BUILDCHAIN_ARTIFACT_KIND: artifact.kind,
+        BUILDCHAIN_ENTITLEMENTS_PROFILE:
+          signature.entitlementsProfile || "none",
+        BUILDCHAIN_ENTITLEMENTS_PATHS: (signature.entitlementsPaths || []).join(
+          ",",
+        ),
+        BUILDCHAIN_APPLE_CERTIFICATE_P12_BASE64: credentials.certificateBase64,
+        BUILDCHAIN_APPLE_CERTIFICATE_PASSWORD: credentials.certificatePassword,
+        BUILDCHAIN_APPLE_CERTIFICATE_SHA1: credentials.certificateSha1,
+        BUILDCHAIN_APPLE_TEAM_ID: credentials.teamId,
+        BUILDCHAIN_APPLE_NOTARY_KEY_P8_BASE64: credentials.notaryKeyBase64,
+        BUILDCHAIN_APPLE_NOTARY_KEY_ID: credentials.notaryKeyId,
+        BUILDCHAIN_APPLE_NOTARY_ISSUER: credentials.notaryIssuer,
+      },
+    },
+  );
+}
+export function signWindowsPayload(
+  { runtimeRoot, payload, evidencePath, credentials, environment },
+  execute = command,
+) {
+  execute(
+    "pwsh",
+    [
+      "-NoLogo",
+      "-NoProfile",
+      "-NonInteractive",
+      "-File",
+      path.join(
+        runtimeRoot,
+        "packages/core/providers/signing/windows/sign-request.ps1",
+      ),
+    ],
+    {
+      cwd: runtimeRoot,
+      env: {
+        ...environment,
+        BUILDCHAIN_SIGNED_PAYLOAD: payload,
+        BUILDCHAIN_SIGNING_EVIDENCE: evidencePath,
+        BUILDCHAIN_WINDOWS_CERTIFICATE_PFX_BASE64:
+          credentials.certificateBase64,
+        BUILDCHAIN_WINDOWS_CERTIFICATE_PASSWORD:
+          credentials.certificatePassword,
+        BUILDCHAIN_WINDOWS_CERTIFICATE_SHA1: credentials.certificateSha1,
+        BUILDCHAIN_WINDOWS_TIMESTAMP_URL: credentials.timestampUrl,
+      },
+    },
+  );
+}