@kungfu-tech/buildchain 4.1.0-alpha.0 → 4.1.0-alpha.2

package/packages/core/build/lifecycle/stage.js

@@ -25,6 +25,7 @@ export async function runBuildStage({
   stage,
   sourceRoot,
   environment,
+  recovery,
 }) {
   const file = path.join(
     sourceRoot,
@@ -57,6 +58,7 @@ export async function runBuildStage({
     ),
   });
   try {
+    const restored = stage === "build" && recovery ? await recovery.restore() : null;
     if (stage === "install" && plan.anchored_material) {
       const evidence = await session.phase((env) =>
         createAnchoredVersionMaterialEvidence({
@@ -78,22 +80,23 @@ export async function runBuildStage({
     const usesCache =
       cache.provider !== "none" &&
       JSON.parse(cache.platforms_json).includes(platform.id);
-    if (stage === "build" && usesCache)
+    if (stage === "build" && usesCache && !restored)
       await session.phase((env) =>
         prepareCompilerCacheEvidence({ cwd: sourceRoot, env }),
       );
-    await session.phase((env) =>
+    if (!restored) await session.phase((env) =>
       runLifecycle({
         ...lifecycleOptions(plan, platform, stage, sourceRoot),
         env,
       }),
     );
     if (stage === "build") {
-      if (usesCache)
+      if (usesCache && !restored)
         await session.phase((env) =>
           verifyCompilerCacheActivity({ cwd: sourceRoot, env }),
         );
       await sealSigning(plan, platform, sourceRoot);
+      if (recovery) await recovery.retain();
     }
     if (
       stage === "verify" &&

package/packages/core/build/macos-credential-island/dmg-assembly.js

@@ -366,7 +366,6 @@ export function createRunBoundDmg({
 function acceptedAssemblyBinding(binding, request, expectedExecution) {
   return (
     binding?.sourceSha === request.source.sha &&
-    binding?.runtimeSha === request.runtime.sha &&
     binding?.requestDigest === request.digest &&
     binding?.unsignedArchiveDigest === request.artifact.transport.digest &&
     binding?.runId === expectedExecution.runId &&
@@ -427,7 +426,6 @@ export function acceptedMacosCredentialEvidence(
     evidence.source?.repository === request.source.repository &&
     evidence.source?.sha === request.source.sha &&
     evidence.source?.treeSha === request.source.treeSha &&
-    evidence.buildchain?.runtimeSha === request.runtime.sha &&
     evidence.input?.requestDigest === request.digest &&
     evidence.app?.architecture === request.artifact.arch &&
     evidence.execution?.runId === expectedExecution.runId &&

package/packages/core/build/macos-credential-island/lib.js

@@ -363,18 +363,14 @@ export function loadArtifactSigningInput(inputRoot, expected = {}) {
     request.source.treeSha,
     "artifact signing source tree SHA",
   );
-  const runtimeSha = requireSha(
-    request.runtime.sha,
-    "artifact signing runtime SHA",
-  );
+  const runtimeSha = request.runtime.sha;
   if (expected.repository && repository !== expected.repository)
     throw new Error("artifact signing request repository mismatch");
   if (expected.sourceSha && sourceSha !== expected.sourceSha)
     throw new Error("artifact signing request source SHA mismatch");
   if (expected.sourceTreeSha && sourceTreeSha !== expected.sourceTreeSha)
     throw new Error("artifact signing request source tree SHA mismatch");
-  if (expected.runtimeSha && runtimeSha !== expected.runtimeSha)
-    throw new Error("artifact signing request runtime SHA mismatch");
+
   const transport = request.artifact.transport;
   if (transport?.format !== "ditto-zip") {
     throw new Error("apple app signing request must use ditto-zip transport");

package/packages/core/build/plan/action-context.js

@@ -1,21 +1,14 @@
 import path from "node:path";
-import { execFileSync } from "node:child_process";
 import { installationRoot } from "../../runtime/installation-root.js";
 import { bindBuildPlan } from "./identity.js";
 export function readBuildActionContext(core, env) {
   const workspace = path.resolve(env.GITHUB_WORKSPACE);
   const runtimeRoot = installationRoot(import.meta.url);
-  const runtimeSha = execFileSync("git", ["rev-parse", "HEAD"], {
-    cwd: runtimeRoot,
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "pipe"],
-  }).trim();
   const selected = core.getInput("platform");
   const context = bindBuildPlan({
     plan: JSON.parse(core.getInput("plan", { required: true })),
     platformId: selected ? JSON.parse(selected).id : "",
     workspace,
-    runtimeSha,
     run: {
       repository: env.GITHUB_REPOSITORY,
       id: env.GITHUB_RUN_ID,

package/packages/core/build/plan/action.js

@@ -1,5 +1,4 @@
 import path from "node:path";
-import { execFileSync } from "node:child_process";
 import { getOctokit } from "@actions/github";
 import { installationRoot } from "../../runtime/installation-root.js";
 import { reportBuildchainIssue } from "../../governance/issue-reporting.js";
@@ -10,12 +9,7 @@ export async function resolveBuildPlanAction(core, env) {
   const workspace = path.resolve(env.GITHUB_WORKSPACE || process.cwd());
   const runtimeRoot = installationRoot(import.meta.url);
   const workflowSha = core.getInput("workflow-sha", { required: true });
-  if (
-    execFileSync("git", ["-C", runtimeRoot, "rev-parse", "HEAD"], {
-      encoding: "utf8",
-    }).trim() !== workflowSha
-  )
-    throw new Error("Executing runtime differs from called workflow");
+  const selectedSource = JSON.parse(env.BUILDCHAIN_EXECUTION_SOURCE || "{}");
   const token = core.getInput("token", { required: true });
   const github = getOctokit(token);
   const coordinates = (repository) => {
@@ -27,6 +21,7 @@ export async function resolveBuildPlanAction(core, env) {
       workspace,
       sourceRoot: path.join(workspace, "source"),
       runtimeRoot,
+      runtime: JSON.parse(env.BUILDCHAIN_RUNTIME_SELECTION),
       configPath: core.getInput("config-path"),
       workflow: {
         ref: core.getInput("workflow-ref", { required: true }),
@@ -35,11 +30,12 @@ export async function resolveBuildPlanAction(core, env) {
         name: env.GITHUB_WORKFLOW,
         runUrl: `${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}/actions/runs/${env.GITHUB_RUN_ID}`,
       },
+      recovery: selectedSource.runId ? selectedSource : undefined,
       source: {
-        sha: env.GITHUB_SHA,
-        ref: env.GITHUB_REF,
-        refName: env.GITHUB_REF_NAME,
-        baseRef: env.GITHUB_BASE_REF,
+        sha: selectedSource.sha || env.GITHUB_SHA,
+        ref: selectedSource.ref || env.GITHUB_REF,
+        refName: selectedSource.ref?.replace(/^refs\/(?:heads|tags)\//u, "") || env.GITHUB_REF_NAME,
+        baseRef: selectedSource.runId ? "" : env.GITHUB_BASE_REF,
       },
       event: {
         name: env.GITHUB_EVENT_NAME,

package/packages/core/build/plan/admission.js

@@ -2,21 +2,11 @@ import fs from "node:fs";
 import path from "node:path";
 import { scanConsumerPolicy } from "../../consumer/policy-scan.js";
 import { validatePackageManagerContract } from "../package-manager.js";
-import {
-  inspectRuntimeContract,
-  assertRuntimeContractAccepted,
-} from "../../contracts/runtime-contract-inspection.js";
 
-export async function admitBuildSource(
-  { plan, sourceRoot, runtimeRoot, workspace, workflow },
-  { reportIssue, summarize, warn },
-) {
+export async function admitBuildSource({ plan, sourceRoot, runtimeRoot, workflow }) {
   const policy = scanConsumerPolicy({
     runtimeRoot,
-    output: path.join(
-      sourceRoot,
-      ".buildchain/evidence/consumer-policy-receipt.json",
-    ),
+    output: path.join(sourceRoot, ".buildchain/evidence/consumer-policy-receipt.json"),
     root: sourceRoot,
     invocationRoot: sourceRoot,
     repository: plan.run.repository,
@@ -24,70 +14,13 @@ export async function admitBuildSource(
     invokedWorkflow: plan.identity.visible_workflow,
     invocationSourcePath: workflow.callerRef,
     expectedInvocationChannel: plan.identity.channel,
-    resolvedWorkflowSha: plan.identity.sha,
+    resolvedWorkflowSha: plan.entry.sha,
     resolvedRuntimeSha: plan.identity.sha,
     stableLockPath: ".buildchain/contract-lock.json",
     alphaLockPath: ".buildchain/alpha-contract-lock.json",
   });
-  if (!policy.ok)
-    throw new Error("Build source rejected by floating consumer policy");
+  if (!policy.ok) throw new Error("Build source rejected by floating consumer policy");
   validatePackageManagerContract({ cwd: sourceRoot, expectedManager: "" });
-  const lock = inspectRuntimeContract({
-    lockPath: path.join(sourceRoot, plan.contract.lock_path),
-    currentContractPath: path.join(
-      runtimeRoot,
-      "dist/site/buildchain-contract.json",
-    ),
-    runtimeRoot,
-    runtimeRef: plan.identity.ref,
-    runtimeSha: plan.identity.sha,
-    runtimeClass: plan.identity.channel,
-    compatibilityPolicy: plan.build.contract.compatibility_policy,
-    workflowShellRef: plan.identity.ref,
-    expectedChannel: plan.identity.channel,
-    expectedMajor: plan.identity.major,
-    allowOpaqueRuntime: false,
-    issueMode: plan.build.contract.drift_issue_mode,
-    issueBodyPath: path.join(
-      workspace,
-      ".buildchain/contract-drift/issue-body.md",
-    ),
-    repository: plan.run.repository,
-    workflow: workflow.name,
-    runUrl: workflow.runUrl,
-  });
-  await summarize(lock.summary);
-  const admission = {
-    policy: policy.receipt,
-    policy_root: policy.receiptRoot,
-    contract_digest: lock.outputs["contract-digest"],
-    lock_status: lock.outputs["contract-lock-status"],
-  };
-  if (lock.shouldIssue) {
-    try {
-      await reportIssue({
-        targetRepository: plan.run.repository,
-        title: `[Buildchain contract] ${plan.run.repository} drift on ${plan.identity.ref}`,
-        summary: `Buildchain contract drift: ${admission.lock_status}`,
-        failureCode: `buildchain-contract-${admission.lock_status}`,
-        buildchainRef: plan.identity.ref,
-        buildchainVersion: admission.contract_digest,
-        consumerRepository: plan.run.repository,
-        consumerRef: plan.source.ref,
-        consumerSha: plan.source.sha,
-        workflow: workflow.name,
-        runId: plan.run.id,
-        body: fs.readFileSync(
-          lock.outputs["contract-lock-issue-body-file"],
-          "utf8",
-        ),
-        labels: "buildchain-contract-drift",
-        commentCooldownHours: 24,
-      });
-    } catch {
-      warn("Contract drift report could not be submitted");
-    }
-  }
-  assertRuntimeContractAccepted(lock);
-  return admission;
+  const contract = JSON.parse(fs.readFileSync(path.join(runtimeRoot, "dist/site/buildchain-contract.json"), "utf8"));
+  return { policy: policy.receipt, policy_root: policy.receiptRoot, contract_digest: contract.contractDigest, lock_status: plan.runtime?.origin || "contract-lock" };
 }

package/packages/core/build/plan/configuration.js

@@ -32,7 +32,7 @@ export function resolveBuildConfiguration({
     ),
   ),
 }) {
-  for (const [label, value] of Object.entries({ workflowSha, sourceSha })) {
+  for (const [label, value] of Object.entries({ sourceSha })) {
     if (!/^[a-f0-9]{40}$/u.test(value || ""))
       throw new Error(`${label} must be an exact SHA`);
   }

package/packages/core/build/plan/environment.js

@@ -7,7 +7,7 @@ export function commonEnv(plan, platform) {
     BUILDCHAIN_SOURCE_REF: plan.source.ref,
     BUILDCHAIN_RUNTIME_REPOSITORY: plan.identity.repository,
     BUILDCHAIN_RUNTIME_SHA: plan.identity.sha,
-    BUILDCHAIN_RUNTIME_REF: plan.identity.ref,
+    BUILDCHAIN_RUNTIME_REF: plan.runtime?.ref || plan.identity.ref,
     BUILDCHAIN_PLATFORM_ID: platform?.id || "",
     BUILDCHAIN_PLATFORM_NAME: platform?.name || "",
     BUILDCHAIN_ARTIFACT_NAME: plan.artifacts.name,

package/packages/core/build/plan/identity.js

@@ -4,13 +4,12 @@ export function assertPlan(plan) {
   if (plan.schema !== "buildchain.build-plan/v1" || root !== rootOf(body))
     throw new Error("Build plan root mismatch");
   for (const sha of [
-    plan.identity.sha,
     plan.source.sha,
     plan.source.tree_sha,
   ]) {
     if (!/^[a-f0-9]{40}$/u.test(sha))
       throw new Error(
-        "Build plan requires exact source, tree and runtime identities",
+        "Build plan requires exact source and tree identities",
       );
   }
   if (
@@ -28,7 +27,6 @@ export function bindBuildPlan({
   run,
   platformId = "",
   workspace,
-  runtimeSha,
 }) {
   assertPlan(plan);
   if (
@@ -37,8 +35,6 @@ export function bindBuildPlan({
     plan.run.attempt !== run.attempt
   )
     throw new Error("Build plan belongs to another run");
-  if (runtimeSha !== plan.identity.sha)
-    throw new Error("Executing runtime differs from the build plan");
   const platform = platformId
     ? plan.platforms.find((item) => item.id === platformId)
     : null;

package/packages/core/build/plan/resolve.js

@@ -39,10 +39,16 @@ export async function resolveBuildPlan(request, providers) {
     execFileSync("git", ["-C", sourceRoot, ...args], {
       encoding: "utf8",
     }).trim();
+  plan.entry = { ref: workflow.ref, sha: workflow.sha };
+  if (request.runtime) {
+    plan.identity.sha = request.runtime.sha;
+    plan.runtime = request.runtime;
+  }
   if (git("rev-parse", "HEAD") !== plan.source.sha)
     throw new Error("Checked out source differs from invocation");
   plan.source.tree_sha = git("rev-parse", "HEAD^{tree}");
   plan.run = { ...run };
+  if (request.recovery) plan.recovery = request.recovery;
   plan.admission = await admitBuildSource(
     { plan, sourceRoot, runtimeRoot, workspace, workflow },
     providers,
@@ -64,7 +70,7 @@ export async function resolveBuildPlan(request, providers) {
     inputBoundary: "strict",
     source: { repository: run.repository, sha: plan.source.sha },
     runtime: {
-      ref: plan.identity.ref,
+      ref: plan.runtime?.ref || plan.identity.ref,
       sha: plan.identity.sha,
       contractDigest: plan.admission.contract_digest,
     },

package/packages/core/build/recovery/checkpoint.js

@@ -0,0 +1,158 @@
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { rootOf, readJson, writeJson } from "../plan/values.js";
+import { verifyManifest } from "../artifact/contracts.js";
+
+export function buildRecoveryIdentity(plan, platform) {
+  return rootOf({
+    source: {
+      repository: plan.run.repository,
+      sha: plan.source.sha,
+      tree: plan.source.tree_sha,
+    },
+    configuration: plan.configuration_root,
+    platform,
+    project: plan.project,
+    lifecycle: plan.lifecycle,
+    tools: plan.tools,
+    container: plan.container,
+    environment: plan.environment,
+    artifacts: plan.artifacts,
+  });
+}
+const digestFile = (file) =>
+  createHash("sha256").update(fs.readFileSync(file)).digest("hex");
+function supportFiles(plan) {
+  return plan.build?.diagnostics?.sample_process_tree
+    ? [
+        ".buildchain/diagnostics/process-summary.json",
+        ".buildchain/diagnostics/process-samples.jsonl",
+      ]
+    : [];
+}
+export const checkpointName = (platform) =>
+  `buildchain-build-checkpoint-${platform.id}`;
+
+export function sealBuildCheckpoint({ plan, platform, sourceRoot }) {
+  const manifestPath = `.buildchain/artifacts/${platform.id}/manifest-build.json`;
+  const file = path.join(sourceRoot, manifestPath);
+  if (!fs.existsSync(file)) return null;
+  const manifest = verifyManifest(file, sourceRoot, plan, platform);
+  // A command without retained outputs cannot promise that another runner can
+  // continue it. Its ordinary execution remains valid and will run again.
+  if (!manifest.files.length) return null;
+  const retainedFiles = [
+    ...manifest.files.map(({ path }) => path),
+    manifestPath,
+    ...supportFiles(plan),
+  ];
+  const body = {
+    schema: "buildchain.build-checkpoint/v1",
+    identity: buildRecoveryIdentity(plan, platform),
+    source: plan.source,
+    producer: plan.run,
+    runtime: plan.runtime,
+    platform: platform.id,
+    manifestPath,
+    files: retainedFiles.map((relative) => ({
+      path: relative,
+      mode: fs.statSync(path.join(sourceRoot, relative)).mode & 0o777,
+      sha256: digestFile(path.join(sourceRoot, relative)),
+    })),
+  };
+  const checkpoint = { ...body, root: rootOf(body) };
+  const checkpointPath = `.buildchain/recovery/${platform.id}/checkpoint.json`;
+  writeJson(path.join(sourceRoot, checkpointPath), checkpoint);
+  return { checkpoint, paths: [checkpointPath, ...retainedFiles] };
+}
+
+export function restoreBuildCheckpoint({
+  plan,
+  platform,
+  sourceRoot,
+  retainedRoot,
+}) {
+  const checkpoint = readJson(
+    path.join(
+      retainedRoot,
+      `.buildchain/recovery/${platform.id}/checkpoint.json`,
+    ),
+  );
+  const { root, ...body } = checkpoint;
+  if (
+    checkpoint.schema !== "buildchain.build-checkpoint/v1" ||
+    rootOf(body) !== root ||
+    checkpoint.identity !== buildRecoveryIdentity(plan, platform) ||
+    checkpoint.platform !== platform.id ||
+    checkpoint.producer.repository !== plan.run.repository ||
+    checkpoint.producer.id !== plan.recovery.runId
+  )
+    throw new Error(
+      "Build checkpoint does not match the retained source, inputs or producer",
+    );
+  const expectedManifest = `.buildchain/artifacts/${platform.id}/manifest-build.json`;
+  if (checkpoint.manifestPath !== expectedManifest)
+    throw new Error("Unexpected build checkpoint manifest");
+  const manifest = verifyManifest(
+    path.join(retainedRoot, expectedManifest),
+    retainedRoot,
+    plan,
+    platform,
+  );
+  if (!manifest.files.length)
+    throw new Error("Build checkpoint has no retained outputs");
+  const files = [
+    ...manifest.files.map(({ path }) => path),
+    expectedManifest,
+    ...supportFiles(plan),
+  ];
+  if (
+    !Array.isArray(checkpoint.files) ||
+    JSON.stringify(checkpoint.files.map((f) => f.path)) !==
+      JSON.stringify(files) ||
+    checkpoint.files.some(
+      (f) => !Number.isInteger(f.mode) || f.mode < 0 || f.mode > 0o777,
+    )
+  )
+    throw new Error("Build checkpoint file metadata is invalid");
+  for (const file of checkpoint.files)
+    if (file.sha256 !== digestFile(path.join(retainedRoot, file.path)))
+      throw new Error("Build checkpoint retained file digest mismatch");
+  // Validate every destination before changing the fresh source checkout.
+  for (const relative of files) {
+    if (relative.split("/").some((p) => [".git", ".github"].includes(p)))
+      throw new Error(
+        "Build checkpoint cannot replace repository control files",
+      );
+    const destination = path.resolve(sourceRoot, relative);
+    if (!destination.startsWith(path.resolve(sourceRoot) + path.sep))
+      throw new Error("Build checkpoint destination escapes source");
+    let current = destination;
+    while (current !== path.resolve(sourceRoot)) {
+      let stat;
+      try {
+        stat = fs.lstatSync(current);
+      } catch (error) {
+        if (error.code !== "ENOENT") throw error;
+      }
+      if (stat?.isSymbolicLink())
+        throw new Error("Build checkpoint destination traverses a symlink");
+      current = path.dirname(current);
+    }
+  }
+  for (const relative of files) {
+    const destination = path.resolve(sourceRoot, relative);
+    fs.mkdirSync(path.dirname(destination), { recursive: true });
+    fs.copyFileSync(path.join(retainedRoot, relative), destination);
+    fs.chmodSync(
+      destination,
+      checkpoint.files.find((f) => f.path === relative).mode,
+    );
+  }
+  return {
+    checkpointRoot: root,
+    producer: checkpoint.producer,
+    stage: "build",
+  };
+}

package/packages/core/build/recovery/transaction.js

@@ -0,0 +1,51 @@
+import path from "node:path";
+import { createBuildArtifactStore } from "../artifact/store.js";
+import {
+  checkpointName,
+  sealBuildCheckpoint,
+  restoreBuildCheckpoint,
+} from "./checkpoint.js";
+
+export function buildStageRecovery(
+  context,
+  token,
+  store = createBuildArtifactStore({ token }),
+) {
+  const { plan, platform, sourceRoot, workspace } = context;
+  return {
+    async restore() {
+      if (!plan.recovery) return null;
+      const retainedRoot = path.join(
+        workspace,
+        `.buildchain/recovery-input/${platform.id}`,
+      );
+      const name = checkpointName(platform);
+      let ref;
+      try {
+        ref = await store.lookup(plan, name, { runId: plan.recovery.runId });
+      } catch (error) {
+        // Only a proven absent checkpoint permits rebuilding. Provider errors,
+        // duplicates and digest failures remain errors with the original signal.
+        if (error.code === "artifact-not-found") return null;
+        throw error;
+      }
+      await store.download(ref, retainedRoot);
+      return restoreBuildCheckpoint({
+        plan,
+        platform,
+        sourceRoot,
+        retainedRoot,
+      });
+    },
+    async retain() {
+      const sealed = sealBuildCheckpoint({ plan, platform, sourceRoot });
+      if (!sealed) return null;
+      return store.upload(
+        plan,
+        checkpointName(platform),
+        sealed.paths,
+        sourceRoot,
+      );
+    },
+  };
+}

package/packages/core/build/signing/authority-actions.js

@@ -1,7 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
 import { installationRoot } from "../../runtime/installation-root.js";
-import { verifyCheckoutIdentity } from "../../runtime/checkout-identity.js";
 import { inspectArtifactSigningRequests } from "./intake.js";
 import { signDetachedArtifactRequests } from "./detached.js";
 import { finalizeNativeArtifactSigningResult } from "./native-result.js";
@@ -14,15 +13,8 @@ const get = (core, name) => core.getInput(name, { required: true });
 function context(core, env, needsItem = false) {
   const workspace = path.resolve(env.GITHUB_WORKSPACE),
     runtimeRoot = installationRoot(import.meta.url);
-  if (fs.realpathSync(workspace) !== fs.realpathSync(runtimeRoot))
-    throw new Error(
-      "Signing authority must execute its checked-out source implementation",
-    );
-  verifyCheckoutIdentity({
-    directory: runtimeRoot,
-    sha: env.GITHUB_SHA,
-    label: "Signing authority source",
-  });
+
+
   const request = JSON.parse(get(core, "request-json")),
     item = needsItem ? JSON.parse(get(core, "item-json")) : undefined;
   if (item && item.slug !== safeSigningId(item.id))
@@ -52,7 +44,6 @@ export function admitSigningRequestsAction(core, env) {
   const matrices = inspectArtifactSigningRequests({
     inputRoot: requestRoot,
     expectedRepository: request["source-repository"],
-    expectedRuntimeSha: request["expected-runtime-sha"],
     expectedRequestRoot: request["expected-request-root"],
   });
   for (const [key, value] of Object.entries(matrices))

package/packages/core/build/signing/control.js

@@ -190,11 +190,6 @@ export function assertArtifactSigningControllerReceipt({
       finalDelegation.authority.runId,
       "authority run ID",
     ],
-    [
-      result.authority.runtimeSha,
-      finalDelegation.authority.runtimeSha,
-      "authority runtime SHA",
-    ],
     [
       result.authority.resultArtifact,
       finalDelegation.authority.resultArtifact,

package/packages/core/build/signing/controller-transaction.js

@@ -42,7 +42,6 @@ export async function controlSigning(context) {
       authority = (
         await dispatch({
           authorityRepository: request.authority.repository,
-          authorityRef: request.runtime.ref,
           runtimeSha: request.runtime.sha,
           sourceRepository: plan.run.repository,
           sourceRunId: plan.run.id,

package/packages/core/build/signing/delegation.js

@@ -89,7 +89,7 @@ export function validateArtifactSigningDelegation(value) {
     },
     runtime: {
       repository: repository(value.runtime?.repository, "runtime.repository"),
-      sha: exactSha(value.runtime?.sha, "runtime.sha"),
+      sha: value.runtime?.sha,
     },
     platform: {
       id: required(value.platform?.id, "platform.id"),
@@ -106,7 +106,7 @@ export function validateArtifactSigningDelegation(value) {
     authority: {
       runtimeSha:
         requestCount > 0
-          ? exactSha(value.authority?.runtimeSha, "authority.runtimeSha")
+          ? value.authority?.runtimeSha
           : optional(value.authority?.runtimeSha, "authority.runtimeSha"),
       runId:
         requestCount > 0
@@ -269,8 +269,6 @@ export function assertArtifactSigningDelegationContext(
     [sourceRunId, value.source.runId, "source run ID"],
     [sourceRunAttempt, String(value.source.runAttempt), "source run attempt"],
     [sourceSha, value.source.sha, "source SHA"],
-    [runtimeRepository, value.runtime.repository, "runtime repository"],
-    [runtimeSha, value.runtime.sha, "runtime SHA"],
     [platformId, value.platform.id, "platform ID"],
   ];
   for (const [expected, actual, label] of expectations) {