@kungfu-tech/buildchain 4.0.9 → 4.1.0-alpha.0

package/scripts/finalize-native-artifact-signing-result.mjs

@@ -1,272 +0,0 @@
-#!/usr/bin/env node
-import crypto from "node:crypto";
-import fs from "node:fs";
-import path from "node:path";
-import { pathToFileURL } from "node:url";
-
-import {
-  createArtifactSigningReceipt,
-  validateArtifactSigningRequest,
-} from "../packages/core/artifact-signing.js";
-import {
-  artifactSigningEvidenceDigest,
-  createArtifactSigningResult,
-} from "../packages/core/artifact-signing-result.js";
-import { acceptedMacosCredentialEvidence } from "../actions/macos-credential-island/dmg-assembly.js";
-import { writeGitHubOutputs } from "./build-contract-core.mjs";
-
-function required(value, label) {
-  const normalized = String(value || "").trim();
-  if (!normalized) throw new Error(`${label} is required`);
-  return normalized;
-}
-
-function sha256File(filePath) {
-  return `sha256:${crypto.createHash("sha256").update(fs.readFileSync(filePath)).digest("hex")}`;
-}
-
-function resolveBelow(root, relative, label) {
-  const target = path.resolve(root, required(relative, label));
-  const rel = path.relative(path.resolve(root), target);
-  if (rel.startsWith("..") || path.isAbsolute(rel))
-    throw new Error(`${label} escapes its root`);
-  return target;
-}
-
-function expectedCredentialExecution(
-  appBundleResult,
-  expectedRunId,
-  expectedRunAttempt,
-) {
-  if (!appBundleResult) return null;
-  return {
-    runId: required(expectedRunId, "credential execution run id"),
-    runAttempt: required(
-      expectedRunAttempt,
-      "credential execution run attempt",
-    ),
-  };
-}
-
-function acceptedProviderEvidence(evidence, request, expectedExecution) {
-  return expectedExecution
-    ? acceptedMacosCredentialEvidence(evidence, request, expectedExecution)
-    : evidence.status === "passed" &&
-        evidence.provider === request.signature.provider;
-}
-
-export function finalizeNativeArtifactSigningResult({
-  requestRoot = process.env.BUILDCHAIN_SIGNING_REQUEST_ROOT,
-  requestPath = process.env.BUILDCHAIN_SIGNING_REQUEST_PATH,
-  signedPayload = process.env.BUILDCHAIN_SIGNED_PAYLOAD,
-  evidencePath = process.env.BUILDCHAIN_SIGNING_EVIDENCE,
-  credentialArtifactRoot = process.env
-    .BUILDCHAIN_SIGNING_CREDENTIAL_ARTIFACT_ROOT,
-  outputRoot = process.env.BUILDCHAIN_SIGNING_RESULT_ROOT,
-  checks = process.env.BUILDCHAIN_SIGNING_VERIFICATION_CHECKS,
-  expectedRunId = process.env.GITHUB_RUN_ID,
-  expectedRunAttempt = process.env.GITHUB_RUN_ATTEMPT,
-} = {}) {
-  const requests = path.resolve(required(requestRoot, "signing request root"));
-  const request = JSON.parse(
-    fs.readFileSync(
-      resolveBelow(requests, requestPath, "request path"),
-      "utf8",
-    ),
-  );
-  const requestCheck = validateArtifactSigningRequest(request);
-  if (!requestCheck.ok)
-    throw new Error(
-      `invalid signing request: ${requestCheck.issues.join(", ")}`,
-    );
-  if (request.signature.semantics !== "native-platform-signature") {
-    throw new Error(
-      "native result finalizer rejects non-native signature profiles",
-    );
-  }
-  const payloadSource = path.resolve(required(signedPayload, "signed payload"));
-  const evidenceSource = path.resolve(
-    required(evidencePath, "signing evidence"),
-  );
-  const resultDirectory = path.resolve(
-    required(outputRoot, "signing result root"),
-  );
-  fs.mkdirSync(path.join(resultDirectory, "payload"), { recursive: true });
-  const payloadPath = path.join(
-    resultDirectory,
-    "payload",
-    path.basename(payloadSource),
-  );
-  fs.copyFileSync(payloadSource, payloadPath, fs.constants.COPYFILE_EXCL);
-  const evidenceOutput = path.join(resultDirectory, "provider-evidence.json");
-  fs.copyFileSync(evidenceSource, evidenceOutput, fs.constants.COPYFILE_EXCL);
-  const evidenceDocument = JSON.parse(fs.readFileSync(evidenceOutput, "utf8"));
-  const appBundleResult = request.artifact.kind === "app-bundle";
-  const expectedExecution = expectedCredentialExecution(
-    appBundleResult,
-    expectedRunId,
-    expectedRunAttempt,
-  );
-  const providerEvidencePassed = acceptedProviderEvidence(
-    evidenceDocument,
-    request,
-    expectedExecution,
-  );
-  if (!providerEvidencePassed) {
-    throw new Error(
-      "provider evidence does not prove the requested native signature",
-    );
-  }
-  let credentialOutput = "";
-  let credentialEvidence = [];
-  if (appBundleResult) {
-    const credentialSource = path.resolve(
-      required(
-        credentialArtifactRoot,
-        "credential artifact root for app-bundle result",
-      ),
-    );
-    const credentialManifest = path.join(credentialSource, "manifest.json");
-    if (!fs.statSync(credentialManifest).isFile())
-      throw new Error("credential artifact manifest is missing");
-    credentialOutput = path.join(resultDirectory, "credential-artifact");
-    fs.cpSync(credentialSource, credentialOutput, {
-      recursive: true,
-      force: false,
-      errorOnExist: true,
-    });
-    const manifestOutput = path.join(credentialOutput, "manifest.json");
-    const manifest = JSON.parse(fs.readFileSync(manifestOutput, "utf8"));
-    if (!Array.isArray(manifest.files) || manifest.files.length === 0)
-      throw new Error("credential artifact manifest contains no files");
-    credentialEvidence = [
-      {
-        kind: "credential-artifact-manifest",
-        path: "credential-artifact/manifest.json",
-        digest: sha256File(manifestOutput),
-      },
-      ...manifest.files.map((file, index) => {
-        const filePath = resolveBelow(
-          credentialOutput,
-          file.path,
-          `credential artifact file ${index}`,
-        );
-        const observed = sha256File(filePath);
-        if (observed !== `sha256:${String(file.sha256 || "").toLowerCase()}`)
-          throw new Error(
-            `credential artifact file digest mismatch: ${file.path}`,
-          );
-        return {
-          kind: `credential-artifact-${index}`,
-          path: `credential-artifact/${String(file.path).replaceAll("\\", "/")}`,
-          digest: observed,
-        };
-      }),
-    ];
-  }
-  const evidence = [
-    {
-      kind: `${request.signature.profile}-verification`,
-      path: "provider-evidence.json",
-      digest: sha256File(evidenceOutput),
-    },
-    ...credentialEvidence,
-  ];
-  const payloadDigest = sha256File(payloadPath);
-  const receipt = createArtifactSigningReceipt({
-    request,
-    result: {
-      artifactDigest: payloadDigest,
-      evidenceDigest: artifactSigningEvidenceDigest(evidence),
-    },
-    signatures: [
-      { kind: request.signature.profile, digest: evidence[0].digest },
-    ],
-  });
-  fs.writeFileSync(
-    path.join(resultDirectory, "receipt.json"),
-    `${JSON.stringify(receipt, null, 2)}\n`,
-  );
-  const verificationChecks = String(checks || "")
-    .split(",")
-    .map((value) => value.trim())
-    .filter(Boolean);
-  if (
-    verificationChecks.length === 0 &&
-    Array.isArray(evidenceDocument.checks)
-  ) {
-    verificationChecks.push(
-      ...evidenceDocument.checks
-        .map((value) => String(value).trim())
-        .filter(Boolean),
-    );
-  }
-  if (verificationChecks.length === 0 && appBundleResult) {
-    verificationChecks.push(
-      ...Object.entries(evidenceDocument.verification || {})
-        .filter(([, passed]) => passed === true)
-        .map(([name]) => name),
-      "application-notarytool-accepted",
-      "disk-image-notarytool-accepted",
-    );
-  }
-  if (verificationChecks.length === 0)
-    throw new Error("provider evidence contains no verification checks");
-  const result = createArtifactSigningResult({
-    request,
-    receipt,
-    payload: {
-      path: `payload/${path.basename(payloadPath)}`,
-      bytes: fs.statSync(payloadPath).size,
-      digest: payloadDigest,
-    },
-    evidence,
-    verification: {
-      status: "passed",
-      provider: request.signature.provider,
-      checks: verificationChecks,
-    },
-  });
-  fs.writeFileSync(
-    path.join(resultDirectory, "result.json"),
-    `${JSON.stringify(result, null, 2)}\n`,
-  );
-  const index = {
-    schemaVersion: 1,
-    contract: "kungfu-buildchain-artifact-signing-result-index/v1",
-    results: [
-      {
-        id: request.artifact.id,
-        requestDigest: request.digest,
-        resultDigest: result.digest,
-        result: "result.json",
-        payload: result.artifact.path,
-        receipt: "receipt.json",
-      },
-    ],
-  };
-  fs.writeFileSync(
-    path.join(resultDirectory, "index.json"),
-    `${JSON.stringify(index, null, 2)}\n`,
-  );
-  writeGitHubOutputs({
-    "result-root": resultDirectory,
-    "result-index": path.join(resultDirectory, "index.json"),
-    "credential-artifact-root": credentialOutput,
-  });
-  return index;
-}
-
-if (
-  process.argv[1] &&
-  import.meta.url === pathToFileURL(process.argv[1]).href
-) {
-  try {
-    finalizeNativeArtifactSigningResult();
-  } catch (error) {
-    console.error(
-      `::error::${String(error?.message || error).replace(/\r?\n/gu, "%0A")}`,
-    );
-    process.exitCode = 1;
-  }
-}

package/scripts/generate-channel-build-workflow.mjs

@@ -1,69 +0,0 @@
-#!/usr/bin/env node
-import fs from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import { writeWorkflowSource } from "./workflow-taxonomy.mjs";
-
-const root = path.resolve(import.meta.dirname, "..");
-function block(source, start, end) {
-  const first = source.indexOf(start);
-  const last = source.indexOf(end, first + start.length);
-  if (first < 0 || last < 0) throw new Error(`Missing build contract block: ${start.trim()}`);
-  return source.slice(first + start.length, last).trimEnd();
-}
-
-export function generateChannelBuildWorkflow(source) {
-  const inputs = block(source, "    inputs:\n", "    secrets:\n");
-  if (JSON.stringify([...inputs.matchAll(/^      ([a-z0-9-]+):$/gmu)].map((match) => match[1])) !== '["config-path"]') {
-    throw new Error("Ordinary builds expose only the optional configuration locator");
-  }
-  const secrets = block(source, "    secrets:\n", "    outputs:\n");
-  const outputs = block(source, "    outputs:\n", "\npermissions:\n")
-    .replace(/(^      ([a-z0-9-]+):\n(?:        description:.*\n)*)        value:.*$/gmu, "$1        value: ${{ jobs.build.outputs.$2 }}");
-  return `# Generated by scripts/generate-channel-build-workflow.mjs. Do not edit directly.
-name: Buildchain Build
-
-on:
-  workflow_call:
-    inputs:
-${inputs}
-    secrets:
-${secrets}
-    outputs:
-      buildchain-channel:
-        description: "Channel bound to the called workflow ref"
-        value: \${{ jobs.build.outputs.buildchain-runtime-class }}
-      buildchain-channel-selection-source:
-        description: "Runtime identity authority"
-        value: "called-workflow"
-      buildchain-channel-reason:
-        description: "Buildchain runtime is the exact called workflow"
-        value: \${{ jobs.build.outputs.buildchain-runtime-ref }}
-${outputs}
-
-permissions:
-  actions: read
-  contents: read
-  issues: write
-  id-token: write
-
-jobs:
-  build:
-    name: Build configured project
-    uses: ./.github/workflows/.build.yml
-    with:
-      config-path: \${{ inputs.config-path }}
-    secrets: inherit
-`;
-}
-
-function main() {
-  const generated = generateChannelBuildWorkflow(fs.readFileSync(path.join(root, ".github/workflows/.build.yml"), "utf8"));
-  const target = ".github/workflows/build.yml";
-  if (process.argv.includes("--check")) {
-    if (fs.readFileSync(path.join(root, target), "utf8") !== generated) {
-      throw new Error("build.yml is stale; run node scripts/generate-channel-build-workflow.mjs");
-    }
-  } else writeWorkflowSource(root, target, generated);
-}
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) main();

package/scripts/generate-release-candidate-passport.mjs

@@ -1,285 +0,0 @@
-#!/usr/bin/env node
-import fs from "node:fs";
-import path from "node:path";
-import { execFileSync } from "node:child_process";
-import { pathToFileURL } from "node:url";
-import { createReleaseCandidatePassport, validateReleaseCandidatePassport } from "../packages/core/release-candidate.js";
-import { scanFloatingConsumerPolicy, consumerPolicyScannerRoot } from "../packages/core/floating-consumer-policy.js";
-import { domainContentRoot } from "../packages/core/canonical-contracts.js";
-import { STAGE_CAPSULE_CONTRACT, STAGE_CAPSULE_IDENTITY_CONTRACT, stageCapsuleIdentityRoot, stageCapsuleRoot, validateStageCapsule } from "../packages/core/stage-capsule.js";
-import { runtimeResumeDocumentRoot } from "../packages/core/runtime-ref-resume-authority.js";
-import { createDomainPublicationQualificationReceipt } from "../packages/core/publication-qualification.js";
-import { writeGitHubOutputs } from "./build-contract-core.mjs";
-
-const env = (name, fallback = "") => process.env[name] || fallback;
-const readJsonFile = (filePath) => JSON.parse(fs.readFileSync(filePath, "utf8"));
-
-export function createReleaseCandidateStageCapsules({
-  passport,
-  buildSummary,
-  coordinates,
-}) {
-  if (!passport.consumerPolicy?.receiptRoot) return undefined;
-  if (
-    coordinates.repository !== passport.repository ||
-    String(coordinates.runId) !== String(passport.workflow.runId) ||
-    String(coordinates.runAttempt) !== String(passport.workflow.runAttempt) ||
-    coordinates.sourceSha !== passport.source.headSha
-  ) {
-    throw new Error(
-      "Stage Capsule coordinate set does not bind the candidate run",
-    );
-  }
-  const coordinateByPlatform = new Map(
-    coordinates.artifacts.map((entry) => [entry.platformId, entry]),
-  );
-  const qualificationArtifacts = passport.platformMatrix.map((platform) => {
-    const coordinate = coordinateByPlatform.get(platform.platformId);
-    if (!coordinate || coordinate.name !== platform.artifactName) throw new Error(`Stage Capsule coordinate missing for ${platform.platformId}`);
-    const manifest = readJsonFile(platform.manifestPath);
-    return { role: platform.artifactName, platform: platform.platformId, artifactRoot: coordinate.digest, manifestRoot: domainContentRoot("stage-capsule-artifact-manifest", manifest) };
-  });
-  const qualificationExpiresAt = coordinates.artifacts.map((entry) => entry.expiresAt).sort((left, right) => Date.parse(left) - Date.parse(right))[0];
-  const qualificationReceipt = createDomainPublicationQualificationReceipt({
-    repository: passport.repository, candidateRoot: `sha256:${passport.candidateHash}`,
-    sourceSha: passport.source.headSha, sourceRoot: domainContentRoot("candidate-identity", passport.source),
-    policyDigest: passport.consumerPolicy.receiptRoot, artifacts: qualificationArtifacts,
-    issuedAt: passport.createdAt || new Date(Date.parse(qualificationExpiresAt) - 86_400_000).toISOString(), expiresAt: qualificationExpiresAt,
-  });
-  const qualificationRoot = qualificationReceipt.receiptRoot;
-  const entries = passport.platformMatrix
-    .map((platform) => {
-      const coordinate = coordinateByPlatform.get(platform.platformId);
-      if (!coordinate || coordinate.name !== platform.artifactName) {
-        throw new Error(
-          `Stage Capsule coordinate missing for ${platform.platformId}`,
-        );
-      }
-      const manifest = readJsonFile(platform.manifestPath);
-      const identity = {
-        schema: STAGE_CAPSULE_IDENTITY_CONTRACT,
-        sourceRoot: domainContentRoot("candidate-identity", passport.source),
-        platform: platform.platformId,
-        platformRoot: domainContentRoot("candidate-identity", manifest.platform),
-        stage: "verify",
-        toolchainRoots: [],
-        runtimeRoot: domainContentRoot("candidate-identity", {
-          sha: passport.buildchain.sha,
-        }),
-        policyRoot: passport.consumerPolicy.receiptRoot,
-        declaredInputs: [
-          {
-            name: "release-candidate",
-            root: `sha256:${passport.candidateHash}`,
-          },
-        ],
-        transformationRoot: domainContentRoot("candidate-identity", {
-          lifecycle: manifest.lifecycle,
-          summary: platform.summary,
-        }),
-        outputManifestRoot: domainContentRoot(
-          "stage-capsule-artifact-manifest",
-          { artifact: coordinate, manifest },
-        ),
-        qualificationRoot,
-        observationRoots: [
-          {
-            name: "provider-coordinate",
-            root: domainContentRoot("provider-readback-sample", coordinate),
-          },
-        ],
-      };
-      const capsule = {
-        schema: STAGE_CAPSULE_CONTRACT,
-        writerAuthority: "typescript-v3",
-        rustAuthority: "validation-only",
-        identity,
-        identityRoot: stageCapsuleIdentityRoot(identity),
-        retentionPromise: {
-          class: "github-artifact",
-          retainUntil: coordinate.expiresAt,
-        },
-        capsuleRoot: `sha256:${"0".repeat(64)}`,
-      };
-      capsule.capsuleRoot = stageCapsuleRoot(capsule);
-      validateStageCapsule(capsule);
-      return {
-        platform: platform.platformId,
-        artifactName: coordinate.name,
-        artifactDigest: coordinate.digest,
-        publicationArtifact: qualificationArtifacts.find(
-          ({ platform: platformId }) => platformId === platform.platformId,
-        ),
-        artifact: coordinate,
-        capsule,
-      };
-    })
-    .sort((left, right) => left.platform.localeCompare(right.platform));
-  const body = {
-    schemaVersion: 1,
-    contract: "kungfu-buildchain-v4-release-candidate-stage-capsules/v1",
-    status: "sealed",
-    repository: passport.repository,
-    buildAttempt: {
-      id: `github-run:${passport.workflow.runId}:attempt:${passport.workflow.runAttempt}`,
-      runtimeSha: passport.buildchain.sha,
-    },
-    source: {
-      sha: passport.source.headSha,
-      treeSha: passport.source.treeHash,
-    },
-    consumerPolicyReceiptRoot: passport.consumerPolicy.receiptRoot,
-    publicationQualificationRoot: qualificationRoot,
-    publicationQualificationReceipt: qualificationReceipt,
-    capsules: entries,
-  };
-  return { ...body, root: runtimeResumeDocumentRoot(body) };
-}
-
-function writeReleaseCandidateStageCapsules({
-  passport,
-  buildSummary,
-  outputPath,
-}) {
-  const coordinatesPath = path.resolve(
-    env(
-      "BUILDCHAIN_ARTIFACT_COORDINATES_PATH",
-      ".buildchain/artifacts/artifact-coordinates.json",
-    ),
-  );
-  if (!fs.existsSync(coordinatesPath)) {
-    if (passport.consumerPolicy?.receiptRoot) {
-      throw new Error(
-        "v4 release candidate Stage Capsules require exact artifact coordinates",
-      );
-    }
-    return { path: "", root: "" };
-  }
-  const stageCapsules = createReleaseCandidateStageCapsules({
-    passport,
-    buildSummary,
-    coordinates: readJsonFile(coordinatesPath),
-  });
-  if (!stageCapsules) return { path: "", root: "" };
-  const stageCapsulesPath = path.join(
-    path.dirname(outputPath),
-    "release-candidate-stage-capsules.json",
-  );
-  fs.writeFileSync(
-    stageCapsulesPath,
-    `${JSON.stringify(stageCapsules, null, 2)}\n`,
-  );
-  const qualificationPath = path.join(path.dirname(outputPath), "release-candidate-publication-qualification.json");
-  fs.writeFileSync(qualificationPath, `${JSON.stringify(stageCapsules.publicationQualificationReceipt, null, 2)}\n`);
-  return {
-    path: path
-      .relative(process.cwd(), stageCapsulesPath)
-      .split(path.sep)
-      .join("/"),
-    root: stageCapsules.root,
-    qualificationPath: path.relative(process.cwd(), qualificationPath).split(path.sep).join("/"),
-    qualificationRoot: stageCapsules.publicationQualificationRoot,
-  };
-}
-
-export function resolveLegacyConsumerPolicyReceipt(options = {}) {
-  if (options.json) return { receipt: JSON.parse(options.json), receiptRoot: options.receiptRoot };
-  if (options.repository !== "kungfu-systems/buildchain" || options.targetChannel !== "alpha" || options.workflowShellRef !== "v4-alpha" || options.runtimeOverride !== true) return undefined;
-  if (!/^[0-9a-f]{40}$/u.test(options.runtimeRef || "") || options.runtimeRef !== options.runtimeSha || options.sourceTreeHash !== options.runtimeTreeHash()) return undefined;
-  const root = path.resolve(options.root || ".buildchain/runtime");
-  const alphaLock = readJsonFile(path.join(root, ".buildchain/alpha-contract-lock.json"));
-  const result = scanFloatingConsumerPolicy({
-    root, repository: options.repository, sourceSha: options.sourceSha,
-    invokedWorkflow: options.invokedWorkflow || ".github/workflows/build.yml", invocationSourcePath: options.invocationSourcePath,
-    expectedInvocationChannel: "alpha", resolvedWorkflowSha: alphaLock.buildchain?.resolvedSha,
-    resolvedRuntimeSha: options.runtimeSha, scannerRoot: consumerPolicyScannerRoot(),
-    policy: readJsonFile(path.resolve(import.meta.dirname, "../architecture/floating-consumer-policy.json")),
-  });
-  if (!result.ok) throw new Error(`legacy floating-shell policy receipt invalid: ${result.failures.map(({ code }) => code).join(", ")}`);
-  return { receipt: result.receipt, receiptRoot: result.receiptRoot };
-}
-
-export function generateReleaseCandidatePassportCli() {
-  const buildSummaryPath = path.resolve(env("BUILDCHAIN_BUILD_SUMMARY_PATH", ".buildchain/artifacts/build-summary.json"));
-  const outputPath = path.resolve(env("BUILDCHAIN_RC_PASSPORT_PATH", ".buildchain/artifacts/release-candidate-passport.json"));
-  const buildSummary = readJsonFile(buildSummaryPath);
-  const sourceSha = env("BUILDCHAIN_RC_SOURCE_HEAD_SHA", buildSummary.publishSource?.sha || buildSummary.git?.sha || "");
-  const version = env("BUILDCHAIN_RC_VERSION", buildSummary.publishSource?.consumerVersion || "");
-  const gateAggregateJson = env("BUILDCHAIN_GATE_PROFILE_AGGREGATE_JSON");
-  const gateAggregate = gateAggregateJson ? JSON.parse(gateAggregateJson) : undefined;
-  const controllerReceiptJson = env("BUILDCHAIN_CONTROLLER_RECEIPT_JSON");
-  const controllerReceipts = controllerReceiptJson ? [JSON.parse(controllerReceiptJson)] : [];
-  const familyEvidenceJson = env("BUILDCHAIN_RC_FAMILY_EVIDENCE_JSON");
-  const familyEvidence = familyEvidenceJson ? JSON.parse(familyEvidenceJson) : undefined;
-  const consumerPolicyJson = env("BUILDCHAIN_V4_POLICY_RECEIPT_JSON");
-  const consumerPolicyReceipt = resolveLegacyConsumerPolicyReceipt({
-    json: consumerPolicyJson, receiptRoot: env("BUILDCHAIN_V4_POLICY_RECEIPT_ROOT"),
-    repository: env("GITHUB_REPOSITORY", buildSummary.git?.repository || ""), sourceSha,
-    targetChannel: env("BUILDCHAIN_RC_TARGET_CHANNEL", buildSummary.publishSource?.channel || buildSummary.publishGate?.channel || ""),
-    runtimeRef: env("BUILDCHAIN_RUNTIME_REF", buildSummary.runtime?.ref || ""), runtimeSha: env("BUILDCHAIN_RUNTIME_SHA", buildSummary.runtime?.sha || ""),
-    workflowShellRef: env("BUILDCHAIN_WORKFLOW_SHELL_REF", buildSummary.runtime?.workflowShellRef || ""), runtimeOverride: buildSummary.runtime?.override === true,
-    root: ".buildchain/runtime", invocationSourcePath: env("GITHUB_WORKFLOW_REF"), sourceTreeHash: env("BUILDCHAIN_RC_SOURCE_TREE_HASH"),
-    runtimeTreeHash: () => execFileSync("git", ["-C", ".buildchain/runtime", "rev-parse", "HEAD^{tree}"], { encoding: "utf8" }).trim(),
-  });
-  const passport = createReleaseCandidatePassport({
-    repository: env("GITHUB_REPOSITORY", buildSummary.git?.repository || ""),
-    pullRequest: {
-      number: env("BUILDCHAIN_PULL_REQUEST_NUMBER"), url: env("BUILDCHAIN_PULL_REQUEST_URL"),
-      headRef: env("BUILDCHAIN_PULL_REQUEST_HEAD_REF"), baseRef: env("BUILDCHAIN_PULL_REQUEST_BASE_REF"),
-    },
-    targetChannel: env("BUILDCHAIN_RC_TARGET_CHANNEL", buildSummary.publishSource?.channel || buildSummary.publishGate?.channel || ""),
-    version,
-    sourceHeadSha: sourceSha,
-    baseSha: env("BUILDCHAIN_RC_BASE_SHA"),
-    mergeRefSha: env("BUILDCHAIN_RC_MERGE_REF_SHA", buildSummary.git?.sha || ""),
-    sourceTreeHash: env("BUILDCHAIN_RC_SOURCE_TREE_HASH"),
-    buildSummary,
-    buildchain: {
-      ref: env("BUILDCHAIN_RUNTIME_REF", buildSummary.runtime?.ref || ""), sha: env("BUILDCHAIN_RUNTIME_SHA", buildSummary.runtime?.sha || ""),
-      version: env("BUILDCHAIN_RUNTIME_VERSION"), workflowShellRef: env("BUILDCHAIN_WORKFLOW_SHELL_REF", buildSummary.runtime?.workflowShellRef || ""),
-    },
-    gateAggregate,
-    familyEvidence,
-    consumerPolicyReceipt,
-    controllerReceipts,
-    workflow: {
-      name: env("GITHUB_WORKFLOW"), runId: env("GITHUB_RUN_ID", buildSummary.git?.runId || ""),
-      runAttempt: env("GITHUB_RUN_ATTEMPT", buildSummary.git?.runAttempt || ""), url: env("BUILDCHAIN_WORKFLOW_RUN_URL"),
-    },
-  });
-  const validation = validateReleaseCandidatePassport({
-    passport, repository: env("GITHUB_REPOSITORY", buildSummary.git?.repository || ""), sourceHeadSha: sourceSha, buildSummary });
-  if (!validation.ok) throw new Error(`release candidate passport invalid: ${validation.errors.join("; ")}`);
-  fs.mkdirSync(path.dirname(outputPath), { recursive: true });
-  fs.writeFileSync(outputPath, `${JSON.stringify(passport, null, 2)}\n`);
-  const stageCapsules = writeReleaseCandidateStageCapsules({ passport, buildSummary, outputPath });
-  writeGitHubOutputs({
-    "release-candidate-passport-path": path.relative(process.cwd(), outputPath).split(path.sep).join("/"),
-    "release-candidate-passport-json": JSON.stringify({
-      contract: passport.contract,
-      repository: passport.repository,
-      target: passport.target,
-      source: passport.source,
-      candidateHash: passport.candidateHash,
-      platformCount: passport.platformMatrix.length,
-      gateProfileEvidence: passport.gateProfileEvidence,
-      familyEvidence: passport.familyEvidence,
-      consumerPolicy: passport.consumerPolicy,
-      controllerReceipts: passport.controllerReceipts || [],
-    }),
-    "release-candidate-stage-capsules-path": stageCapsules.path,
-    "release-candidate-stage-capsules-root": stageCapsules.root,
-    "release-candidate-publication-qualification-path": stageCapsules.qualificationPath,
-    "release-candidate-publication-qualification-root": stageCapsules.qualificationRoot,
-  });
-  return passport;
-}
-
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
-  try {
-    generateReleaseCandidatePassportCli();
-  } catch (error) {
-    console.error(`::error::${String(error.message || error).replace(/\r?\n/g, "%0A")}`);
-    process.exitCode = 1;
-  }
-}