@portll/cobolwork 0.5.0 → 0.6.0

package/lib/equivalence.mjs

@@ -50,6 +50,34 @@ function closure(root, file, idx, systemDirs) {
   return out;
 }
 
+// The first program's paragraphs, by name, each as its own statements read with every position
+// left out, so a paragraph that only moved is the same paragraph (as ironwork compare reads them).
+function paragraphPrints(file) {
+  let program;
+  try { program = parseSource(readSource(file).text, file, { format: 'auto', mainDir: dirname(file) }).programs[0]; } catch { return null; }
+  if (!program) return null;
+  const positionFree = (x) => (Array.isArray(x) ? x.map(positionFree)
+    : x && typeof x === 'object' ? Object.fromEntries(Object.entries(x).filter(([k]) => !['line', 'file', 'at', 'end', 'col', 'fmt'].includes(k)).map(([k, v]) => [k, positionFree(v)]))
+      : x);
+  const labels = [...program.labels].sort((a, b) => a.at - b.at);
+  const prints = new Map();
+  labels.forEach((label, i) => {
+    if (label.kind !== 'P') return;
+    const end = i + 1 < labels.length ? labels[i + 1].at : Infinity;
+    const body = program.statements.filter((s) => s.at > label.at && s.at < end).map(positionFree);
+    prints.set(label.name, [...(prints.get(label.name) || []), JSON.stringify(body)]);
+  });
+  return prints;
+}
+
+// The head's paragraphs whose own statements the change edits or adds.
+function editedParagraphs(baseFile, headFile) {
+  const before = paragraphPrints(baseFile);
+  const after = paragraphPrints(headFile);
+  if (!before || !after) return [];
+  return [...after].filter(([name, prints]) => String(before.get(name)) !== String(prints)).map(([name]) => name).sort();
+}
+
 // Programs the change edits, adds or deletes, or whose copybooks it edits: [{ path, base, head, via }]
 // with each side's source digest (head null for a deleted program) and the copybooks that changed
 // under an unchanged program.
@@ -112,14 +140,21 @@ export function checkEquivalence({ baseDir, headDir, allow, files = [], allowed
       problems.push(`${s.file} names head ${h ? h.slice(0, 12) : 'nothing'} and base ${b ? b.slice(0, 12) : 'nothing'}, which match no program this change edits`);
     }
   }
+  const authorship = mode === 'machineAuthored' && repo && base ? machineAuthored(repo, base, head || 'HEAD', env) : null;
+  const required = mode === 'always' ? true : mode === 'machineAuthored' ? (authorship && authorship.known ? authorship.commits.length > 0 : null) : false;
   // Every statement that names a program is judged, and the program passes only if each does.
+  // Where equivalence may be required, a statement no allowed signer signed could have been written
+  // by anyone who can commit.
   const programs = changed.map((c) => {
     if (c.deleted) return { path: c.path, deleted: true, statement: null, ok: false, because: 'the change deletes this program, and no equivalence statement can show what its callers do now' };
     const matching = statements.filter((x) => x.statement && subjectDigest(x.statement, 'head') === c.head && subjectDigest(x.statement, 'base') === c.base);
     const via = c.via ? { via: c.via } : {};
     if (!matching.length) return { path: c.path, ...via, statement: null, ok: false, because: c.via ? `no equivalence statement names this program, whose copybook${c.via.length > 1 ? 's' : ''} ${c.via.join(', ')} the change edits` : 'no equivalence statement names this change' };
     const judged = matching.map((s) => judge(c, s));
-    return judged.find((j) => !j.ok) || judged[0];
+    const failed = judged.find((j) => !j.ok);
+    if (failed) return failed;
+    if (!allowed && required !== false) return { ...judged[0], ok: false, because: 'no --allowed-signers were given, so nothing shows who wrote the statement' };
+    return judged[0];
   });
   function judge(c, s) {
     const via = c.via ? { via: c.via } : {};
@@ -128,15 +163,19 @@ export function checkEquivalence({ baseDir, headDir, allow, files = [], allowed
     const covered = !!p.coverage && typeof p.coverage === 'object' && Array.isArray(p.coverage.unreached) && p.coverage.unreached.every((u) => typeof u === 'string');
     const ranOn = new Set(((p.closure && p.closure.head) || []).map((x) => x.sha256));
     const missing = (c.viaDigests || []).filter((d) => !ranOn.has(d));
+    // ironwork decides which paragraphs changed; a paragraph whose statements this diff shows
+    // edited and the statement does not list as changed was never held to coverage.
+    const claimed = covered && Array.isArray(p.coverage.changed) ? new Set(p.coverage.changed.map((n) => String(n).toUpperCase())) : null;
+    const edited = covered && c.base ? editedParagraphs(join(baseDir, c.path), join(headDir, c.path)) : [];
+    const unclaimed = edited.filter((n) => !claimed || !claimed.has(n));
     const because = !PASSING.has(verdict) ? `the statement's verdict is ${verdict}${Array.isArray(p.inconclusive) && p.inconclusive.length ? ` (${p.inconclusive.join('; ')})` : ''}`
       : missing.length ? `the statement does not show the head run read the edited copybook${c.via.length > 1 ? 's' : ''} ${c.via.join(', ')}`
       : !covered ? 'the statement measured no coverage of the changed paragraphs, so it is inconclusive'
-        : allowed && !s.signed ? `the statement is ${s.reason}`
-          : null;
+        : unclaimed.length ? `the statement's coverage does not list ${unclaimed.join(', ')} as changed, and the change edits ${unclaimed.length > 1 ? 'them' : 'it'}`
+          : allowed && !s.signed ? `the statement is ${s.reason}`
+            : null;
     const unreached = covered ? p.coverage.unreached : [];
     return { path: c.path, ...via, statement: s.file, verdict, signed: s.signed, signer: s.signer, coverage: covered, ...(unreached.length ? { unreached } : {}), ok: because === null && !unreached.length, ...(because || unreached.length ? { because: because || `the inputs never reached ${unreached.join(', ')}` } : {}) };
   }
-  const authorship = mode === 'machineAuthored' && repo && base ? machineAuthored(repo, base, head || 'HEAD', env) : null;
-  const required = mode === 'always' ? true : mode === 'machineAuthored' ? (authorship && authorship.known ? authorship.commits.length > 0 : null) : false;
   return { mode, required, ...(authorship ? { machineAuthored: authorship } : {}), programs, problems };
 }

package/lib/evidence/cli.mjs

@@ -1,11 +1,11 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 // `cobolwork evidence verify|seal|anchor`: the command half of docs/spec/evidence.md §7-9. Returns
 // the exit status; writes one JSON document through `write`.
-import { readFileSync, writeFileSync } from 'node:fs';
-import { resolve } from 'node:path';
+import { existsSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
 import { anchorGit, envelopeFor, seal, sealFiles, timeStampRequest } from './seal.mjs';
 import { parseAllowedSigners } from './sshsig.mjs';
-import { EvidenceRefusal, evidenceDirFrom } from './store.mjs';
+import { EvidenceRefusal, createExclusive, evidenceDirFrom, syncClose, writeAll } from './store.mjs';
 import { verifyEvidence } from './verify.mjs';
 
 const VERBS = ['verify', 'seal', 'anchor', 'sign'];
@@ -22,7 +22,12 @@ function anchorNewest(dir, opts) {
   if (opts.tsq) {
     const req = timeStampRequest(Buffer.from(text, 'utf8'));
     writeFileSync(resolve(opts.tsq), req.der);
-    out.tsq = { path: resolve(opts.tsq), sha256: req.digest, nonce: req.nonce };
+    // The request is kept beside its seal, so verify can check the response's nonce against it.
+    const kept = join(dir, 'seals', `${newest.seq}.tsq`);
+    if (existsSync(kept)) unlinkSync(kept);
+    const fd = createExclusive(kept);
+    try { writeAll(fd, req.der); } finally { syncClose(fd); }
+    out.tsq = { path: resolve(opts.tsq), sha256: req.digest, nonce: req.nonce, kept: `seals/${newest.seq}.tsq` };
   }
   return out;
 }
@@ -47,7 +52,10 @@ export function evidenceCommand(verb, opts, { toolVersion, write, env = process.
     const allowed = opts.allowedSigners ? parseAllowedSigners(readFileSync(resolve(opts.allowedSigners), 'utf8')) : null;
     const max = opts.maxUnsealed === undefined ? 0 : Number(opts.maxUnsealed);
     if (!Number.isSafeInteger(max) || max < 0) throw new EvidenceRefusal(`--max-unsealed takes a whole number; got ${opts.maxUnsealed}`);
-    const verdict = verifyEvidence(dir, { allowed, anchorGit: opts.anchorGit ? resolve(opts.anchorGit) : null, anchorRef: opts.ref || null, maxUnsealed: max, env });
+    if (opts.anchorPin && !opts.anchorGit) throw new EvidenceRefusal('--anchor-pin names a commit of the --anchor-git witness');
+    const file = (x) => (x ? resolve(x) : null);
+    const cosign = opts.cosignBundle ? { bundle: file(opts.cosignBundle), key: file(opts.cosignKey), identity: opts.certificateIdentity || null, issuer: opts.certificateOidcIssuer || null, trustedRoot: file(opts.trustedRoot), ignoreTlog: opts.insecureIgnoreTlog === true } : null;
+    const verdict = verifyEvidence(dir, { allowed, anchorGit: file(opts.anchorGit), anchorRef: opts.ref || null, anchorPin: opts.anchorPin || null, tsr: file(opts.tsr), tsaCa: file(opts.tsaCa), cosign, maxUnsealed: max, env });
     emit(verdict);
     return verdict.exit;
   }

package/lib/evidence/record.mjs

@@ -21,7 +21,8 @@ const strOrNull = (x) => x === null || str(x);
 const any = () => true;
 const strings = (x) => Array.isArray(x) && x.every(str);
 
-// kind -> { field: check }; a field listed as required must be present.
+// kind -> { field: check }; a field listed as required must be present, and `check`, where a kind
+// has one, names what its fields fail together.
 export const KINDS = {
   open: { fields: { tool: str, toolVersion: str, toolRevision: any, command: str, argv: strings, roots: strings, node: str, platform: str }, required: ['tool', 'toolVersion', 'command', 'argv', 'roots'] },
   input: { fields: { root: int, path: str, sha256: hex64, bytes: int }, required: ['root', 'path', 'sha256'] },
@@ -31,19 +32,26 @@ export const KINDS = {
   witness: { fields: { fingerprint: str, outcome: str, who: strOrNull, when: strOrNull, system: strOrNull, sourceSha256: hex64 }, required: ['fingerprint', 'outcome'] },
   verdict: { fields: { verdict: str, checks: any, relaxed: strings, exit: int }, required: ['verdict'] },
   output: { fields: { name: str, sha256: hex64, bytes: int, path: str, stdout: (x) => x === true }, required: ['name', 'sha256'] },
-  close: { fields: { exit: (x) => x === null || int(x), counts: any, durationMs: int, ledger: str }, required: ['exit'] },
+  // ironwork's run journal closes with the program's true RETURN-CODE, which may be negative.
+  close: { fields: { exit: (x) => x === null || Number.isSafeInteger(x), counts: any, durationMs: int, ledger: str }, required: ['exit'] },
   // Written by ironwork's run journal, in this format, so one verifier reads both tools.
   dd: { fields: { dd: str, event: (x) => ['open', 'close', 'end'].includes(x), mode: str, sha256: hex64, bytes: int }, required: ['dd', 'event'] },
   call: { fields: { program: str, from: str, sha256: hex64 }, required: ['program'] },
   abend: { fields: { code: str, file: str, line: int }, required: ['code'] },
   step: { fields: { step: str, pgm: str, outcome: str }, required: ['step', 'pgm', 'outcome'] },
-  sink: { fields: { sink: str, file: str, line: int, marker: str, reached: (x) => typeof x === 'boolean' }, required: ['sink', 'file', 'line', 'marker', 'reached'] },
-  genesis: { fields: { createdAt: str, rotatedFrom: any }, required: ['createdAt'] },
+  sink: {
+    fields: { sink: str, file: str, line: int, marker: str, reached: (x) => typeof x === 'boolean', input: (x) => x === null || typeof x === 'boolean' },
+    required: ['sink', 'file', 'line'],
+    check: (f) => ((f.marker === undefined) !== (f.reached === undefined) ? 'marker and reached come together'
+      : f.marker === undefined && f.input === undefined ? 'needs marker and reached, or input' : null),
+  },
+  statement: { fields: { file: str, line: int, capped: (x) => x === true }, required: ['file', 'line'] },
+  genesis: { fields: { createdAt: str }, required: ['createdAt'] },
   run: { fields: { run: str, runChain: hex32, runLength: int, runTip: hex64 }, required: ['run', 'runChain', 'runLength', 'runTip'] },
-  'lock-broken': { fields: { holderPid: int, ageMs: int }, required: ['holderPid', 'ageMs'] },
+  'lock-broken': { fields: { holderPid: (x) => x === null || int(x), ageMs: int }, required: ['holderPid', 'ageMs'] },
 };
 
-export const JOURNAL_KINDS = new Set(['open', 'input', 'finding', 'suppressed', 'baseline-write', 'witness', 'verdict', 'output', 'close', 'dd', 'call', 'abend', 'step', 'sink']);
+export const JOURNAL_KINDS = new Set(['open', 'input', 'finding', 'suppressed', 'baseline-write', 'witness', 'verdict', 'output', 'close', 'dd', 'call', 'abend', 'step', 'sink', 'statement']);
 export const LEDGER_KINDS = new Set(['genesis', 'run', 'lock-broken']);
 
 export const newChain = () => randomBytes(16).toString('hex');
@@ -80,6 +88,8 @@ export function checkFields(kind, fields) {
     if (v !== undefined && !check(v)) throw new TypeError(`${kind}: ${k} does not hold what the spec says it holds`);
   }
   for (const k of spec.required) if (fields[k] === undefined) throw new TypeError(`${kind}: ${k} is required`);
+  const fault = spec.check?.(fields);
+  if (fault) throw new TypeError(`${kind}: ${fault}`);
 }
 
 // The next record after `prev` ({ chain, seq, hash } or null for the first), as its line.

package/lib/evidence/seal.mjs

@@ -159,6 +159,23 @@ export function resolveRef(repo, ref, env = process.env) {
   return r.status === 0 ? String(r.stdout).trim() : null;
 }
 
+// Whether commit `older` is in the history of `newer`.
+export function isAncestor(repo, older, newer, env = process.env) {
+  return git(repo, ['merge-base', '--is-ancestor', older, newer], env).status === 0;
+}
+
+// The blob of every seal the witness holds at `ref`, by its path: Map(`<chain>/<seq>.dsse.json` -> blob id).
+export function witnessedBlobs(repo, ref, env = process.env) {
+  const r = git(repo, ['ls-tree', '-r', ref], env);
+  const out = new Map();
+  if (r.status !== 0) return out;
+  for (const line of String(r.stdout).split('\n')) {
+    const m = /^\d+ blob ([0-9a-f]+)\t([0-9a-f]{32}\/\d+\.dsse\.json)$/.exec(line.trim());
+    if (m) out.set(m[2], m[1]);
+  }
+  return out;
+}
+
 // A DER TimeStampReq (RFC 3161) over SHA-256 of `bytes`, with a random nonce and certReq true.
 export function timeStampRequest(bytes) {
   const der = (tag, body) => {

package/lib/evidence/store.mjs

@@ -1,7 +1,8 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 // The evidence directory on disk: where it may be, how its files are opened (never through a
 // symbolic link, owner-only), the ledger lock, and reading a chain file back line by line.
-import { closeSync, constants, existsSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, realpathSync, statSync, unlinkSync, writeSync } from 'node:fs';
+import { randomBytes } from 'node:crypto';
+import { closeSync, constants, existsSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, realpathSync, renameSync, statSync, unlinkSync, writeSync } from 'node:fs';
 import { basename, dirname, join, resolve, sep } from 'node:path';
 
 const { O_WRONLY, O_CREAT, O_EXCL, O_APPEND, O_NOFOLLOW } = constants;
@@ -138,8 +139,22 @@ export function lastLine(path) {
 const pidAlive = (pid) => { try { process.kill(pid, 0); return true; } catch (e) { return e.code === 'EPERM'; } };
 const sleep = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 
-// Takes ledger.lock, breaking one that is older than staleMs and whose holder is gone. Returns
-// { release, broken } or null when the lock could not be had within waitMs.
+// Moves the stale lock `seen` aside before removing it, so a lock a peer took after it was read is
+// put back instead of removed. Returns whether the stale lock was the one broken.
+export function breakStale(path, seen) {
+  const aside = `${path}.${process.pid}.${randomBytes(4).toString('hex')}`;
+  try { renameSync(path, aside); } catch { return false; }
+  let same = false;
+  try { same = statSync(aside).ino === seen.ino && readFileSync(aside, 'utf8') === seen.text; } catch { /* not the same */ }
+  if (!same) { try { linkSync(aside, path); } catch { /* a newer lock is in place */ } }
+  try { unlinkSync(aside); } catch { /* already gone */ }
+  return same;
+}
+
+// Takes ledger.lock, breaking one that is older than staleMs and whose holder is gone. A lock whose
+// pid and time cannot be read was left by a writer that died between creating it and writing them;
+// it is aged from its modification time. Returns { release, broken } or null when the lock could
+// not be had within waitMs.
 export function takeLock(path, { waitMs = 5000, staleMs = 60000, now = Date.now } = {}) {
   const deadline = now() + waitMs;
   let broken = null;
@@ -152,17 +167,18 @@ export function takeLock(path, { waitMs = 5000, staleMs = 60000, now = Date.now
     } catch (e) {
       if (e.code !== 'EEXIST') throw e;
     }
-    let pid = null;
-    let since = null;
-    try {
-      const [p, t] = readFileSync(path, 'utf8').trim().split(/\s+/).map(Number);
-      pid = Number.isSafeInteger(p) ? p : null;
-      since = Number.isSafeInteger(t) ? t : null;
-    } catch { /* removed between the open and the read */ }
-    const age = since === null ? null : now() - since;
-    if (pid !== null && age !== null && age > staleMs && !pidAlive(pid)) {
-      try { unlinkSync(path); broken = { holderPid: pid, ageMs: Math.max(0, Math.trunc(age)) }; } catch { /* a peer broke it first */ }
-      continue;
+    let st = null;
+    let text = null;
+    try { st = statSync(path); text = readFileSync(path, 'utf8'); } catch { /* removed between the open and the read */ }
+    if (text !== null) {
+      const [p, t] = text.trim().split(/\s+/).map(Number);
+      const pid = Number.isSafeInteger(p) && p > 0 ? p : null;
+      const since = Number.isSafeInteger(t) && t > 0 ? t : null;
+      const age = pid !== null && since !== null ? now() - since : now() - st.mtimeMs;
+      if (age > staleMs && (pid === null || !pidAlive(pid)) && breakStale(path, { text, ino: st.ino })) {
+        broken = { holderPid: pid, ageMs: Math.max(0, Math.trunc(age)) };
+        continue;
+      }
     }
     if (now() >= deadline) return null;
     sleep(25);

package/lib/evidence/timestamp.mjs

@@ -0,0 +1,83 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// RFC 3161 as the git witness's sibling (docs/spec/evidence.md §8): the request `anchor --tsq`
+// keeps beside a seal, and the facts of a time-stamp response cobolwork checks itself, its status,
+// message imprint, nonce and time. The TSA's signature is OpenSSL's to check.
+
+const SHA256_OID = Buffer.from([0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01]);
+
+// One DER element at `at`: its tag and where its contents start and end.
+function element(buf, at, end = buf.length) {
+  if (at + 2 > end) throw new Error('a DER element runs past the end');
+  const tag = buf[at];
+  let length = buf[at + 1];
+  let start = at + 2;
+  if (length & 0x80) {
+    const n = length & 0x7f;
+    if (n < 1 || n > 4 || start + n > end) throw new Error('a DER length is not one this reads');
+    length = 0;
+    for (let i = 0; i < n; i++) length = length * 256 + buf[start + i];
+    start += n;
+  }
+  if (start + length > end) throw new Error('a DER element runs past the end');
+  return { tag, start, end: start + length };
+}
+
+function children(buf, parent) {
+  const out = [];
+  for (let at = parent.start; at < parent.end;) {
+    const c = element(buf, at, parent.end);
+    out.push(c);
+    at = c.end;
+  }
+  return out;
+}
+
+const contents = (buf, el) => buf.subarray(el.start, el.end);
+const expect = (el, tag, what) => {
+  if (!el || el.tag !== tag) throw new Error(`${what} is not where RFC 3161 puts it`);
+  return el;
+};
+// An INTEGER's magnitude as hex, leading zero bytes dropped, so 00 80 and 80 compare equal.
+const integerHex = (bytes) => {
+  let i = 0;
+  while (i < bytes.length - 1 && bytes[i] === 0) i++;
+  return Buffer.from(bytes.subarray(i)).toString('hex');
+};
+
+function imprintOf(buf, el, what) {
+  const [algorithm, hashed] = children(buf, expect(el, 0x30, `${what}'s message imprint`));
+  const oid = expect(children(buf, expect(algorithm, 0x30, `${what}'s hash algorithm`))[0], 0x06, `${what}'s hash algorithm`);
+  if (!contents(buf, oid).equals(SHA256_OID)) throw new Error(`${what} is not over SHA-256`);
+  return Buffer.from(contents(buf, expect(hashed, 0x04, `${what}'s hashed message`))).toString('hex');
+}
+
+// The message imprint and nonce of a TimeStampReq that `anchor --tsq` wrote.
+export function readRequest(der) {
+  const [version, imprint, ...rest] = children(der, expect(element(der, 0), 0x30, 'the request'));
+  expect(version, 0x02, "the request's version");
+  const nonce = rest.find((e) => e.tag === 0x02);
+  return { digest: imprintOf(der, imprint, 'the request'), nonce: nonce ? integerHex(contents(der, nonce)) : null };
+}
+
+// status, digest (hex), nonce (hex or null) and genTime of a TimeStampResp; throws on a response
+// whose shape is not RFC 3161's.
+export function readResponse(der) {
+  const [statusInfo, token] = children(der, expect(element(der, 0), 0x30, 'the response'));
+  const status = parseInt(integerHex(contents(der, expect(children(der, expect(statusInfo, 0x30, 'the status'))[0], 0x02, 'the status'))), 16);
+  if (status > 1 || !token) return { status, digest: null, nonce: null, genTime: null };
+  const [, signedWrapper] = children(der, expect(token, 0x30, 'the time-stamp token'));
+  const signedData = children(der, expect(signedWrapper, 0xa0, 'the signed data'))[0];
+  const encapsulated = children(der, expect(signedData, 0x30, 'the signed data'))[2];
+  const [, contentWrapper] = children(der, expect(encapsulated, 0x30, 'the encapsulated content'));
+  const octets = children(der, expect(contentWrapper, 0xa0, 'the TSTInfo'))[0];
+  const tst = element(der, expect(octets, 0x04, 'the TSTInfo').start, octets.end);
+  const fields = children(der, expect(tst, 0x30, 'the TSTInfo'));
+  const genTime = expect(fields[4], 0x18, 'genTime');
+  const nonce = fields.slice(5).find((e) => e.tag === 0x02);
+  return {
+    status,
+    digest: imprintOf(der, fields[2], 'the response'),
+    nonce: nonce ? integerHex(contents(der, nonce)) : null,
+    genTime: contents(der, genTime).toString('latin1'),
+  };
+}

package/lib/evidence/verify.mjs

@@ -1,14 +1,16 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 // Verifies an evidence directory and reports verified, broken, unrecorded, open, anchored, sealed,
 // unsealedTail and signatures as separate facts. docs/spec/evidence.md §9.
+import { spawnSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { JOURNAL_KINDS, LEDGER_KINDS, checkLine } from './record.mjs';
 import { readLines } from './store.mjs';
 import { LEDGER } from './journal.mjs';
-import { NAMESPACE, PAYLOAD_TYPE, SEAL_PREDICATE, STATEMENT_TYPE, listWitnessed, pae, readWitnessed, resolveRef, sealFiles } from './seal.mjs';
+import { NAMESPACE, PAYLOAD_TYPE, SEAL_PREDICATE, STATEMENT_TYPE, isAncestor, listWitnessed, pae, readWitnessed, resolveRef, sealFiles, witnessedBlobs } from './seal.mjs';
 import { verifySshsig } from './sshsig.mjs';
+import { readRequest, readResponse } from './timestamp.mjs';
 
 const sha256 = (b) => createHash('sha256').update(b).digest('hex');
 
@@ -68,7 +70,108 @@ function signaturesOf(seal, allowed) {
   });
 }
 
-export function verifyEvidence(dir, { allowed = null, anchorGit = null, anchorRef = null, maxUnsealed = 0, env = process.env } = {}) {
+// With a pinned commit, the witness's history since then: the pin must still be an ancestor of the
+// ref, and every seal it held must be at the ref unchanged. A rewritten branch or a later commit
+// that deletes seals is a contradiction, which a fresh reading of the ref alone cannot see.
+function pinProblem(repo, pin, ref, env) {
+  const pinned = resolveRef(repo, pin, env);
+  if (!pinned) return `the pinned commit ${pin} is not in the witness`;
+  const at = resolveRef(repo, ref, env);
+  if (!isAncestor(repo, pinned, at, env)) return `the witness was rewritten: the pinned commit ${pinned.slice(0, 12)} is not in the history of ${ref}`;
+  const now = witnessedBlobs(repo, at, env);
+  for (const [path, blob] of witnessedBlobs(repo, pinned, env)) {
+    if (now.get(path) !== blob) return `the witness held ${path} at the pinned commit, and ${now.has(path) ? 'holds another' : 'no longer holds it'} at ${ref}`;
+  }
+  return null;
+}
+
+// A seal a witness vouches for counts when the ledger holds the state it names and an allowed
+// signer signed it.
+function accepting(recs, allowed) {
+  return (ws, name) => {
+    const a = agrees(ws, recs);
+    if (!a.ok) return { sealed: false, reason: `${name}: ${a.why}` };
+    const sigs = signaturesOf(ws, allowed);
+    if (sigs.some((x) => x.valid === true)) return { sealed: true, seal: ws };
+    if (sigs.every((x) => x.valid === false)) return { sealed: false, unsigned: true, reason: `${name} carries no signature from an allowed signer` };
+    return { sealed: null, reason: allowed ? `${name} carries no valid signature` : 'no allowed signers were given' };
+  };
+}
+
+const firstLine = (text) => String(text || '').trim().split('\n')[0].slice(0, 300);
+const BOUNDED = { timeout: 30000, maxBuffer: 1 << 20, windowsHide: true };
+
+// The git witness is the authority for its ledger: every seal it holds is checked, whether or not
+// the directory still has its copy, so deleting local seals cannot hide a cut tail.
+function gitWitness({ repo, ref, pin, recs, local, accept, allowed, verdict, env }) {
+  const witnessCommit = resolveRef(repo, ref, env);
+  if (!witnessCommit) return { sealed: null, reason: `${ref} does not resolve in ${repo}` };
+  verdict.witnessCommit = witnessCommit;
+  const rewritten = pin ? pinProblem(repo, pin, ref, env) : null;
+  if (rewritten) return { sealed: false, reason: rewritten };
+  const held = listWitnessed(repo, ref, env);
+  const chain = recs.length ? recs[0].chain : null;
+  const seqs = chain ? held.get(chain) || [] : [];
+  const localSeqs = new Set(local.filter((s) => s.chain === chain).map((s) => s.seq));
+  let result = null;
+  let newest = null;
+  if (!seqs.length && held.size) result = { sealed: false, reason: `the witness holds seals for ledger ${[...held.keys()].join(', ')}, and this directory holds ledger ${chain || 'none'}` };
+  else if (!seqs.length) result = { sealed: null, reason: `not on ${ref}: the witness holds no seal for ledger ${chain || 'none'}` };
+  for (const seq of result ? [] : seqs) {
+    const name = `${seq}.dsse.json`;
+    let ws;
+    try { ws = decodeSeal(readWitnessed(repo, ref, `${chain}/${name}`, env).text); } catch (e) { result = { sealed: false, reason: `the witnessed ${name} is not a seal: ${e.message}` }; break; }
+    const r = accept(ws, `witnessed ${name}`);
+    if (r.sealed === false && !r.unsigned) { result = r; break; }
+    verdict.seals.push({ seal: name, witnessed: true, local: localSeqs.has(seq), length: ws.length, signed: r.sealed === true });
+    if (r.sealed === false) { result = r; break; }
+    if (r.sealed === true) newest = ws;
+  }
+  for (const s of local) if (s.chain === chain && !seqs.includes(s.seq)) verdict.seals.push({ seal: s.name, witnessed: false, reason: `not on ${ref}` });
+  if (result) return result;
+  if (newest) return { sealed: true, seal: newest };
+  return { sealed: null, reason: allowed ? 'no witnessed seal carries a valid signature' : 'no allowed signers were given' };
+}
+
+// An RFC 3161 response: its imprint names a seal, its nonce is the kept request's, and OpenSSL
+// verifies the authority's signature against --tsa-ca.
+function tsrWitness({ dir, tsr, ca, local, accept, verdict, env }) {
+  let resp;
+  try { resp = readResponse(readFileSync(tsr)); } catch (e) { return { sealed: null, reason: `--tsr ${tsr} is not a time-stamp response (${e.message})` }; }
+  if (resp.status > 1) return { sealed: null, reason: `the time-stamp authority refused the request (status ${resp.status})` };
+  const s = local.find((x) => sha256(x.text) === resp.digest);
+  if (!s) return { sealed: false, reason: `the time-stamp response's message imprint ${resp.digest.slice(0, 12)} matches no seal in seals/` };
+  verdict.timeStamp = { seal: s.name, genTime: resp.genTime };
+  const kept = join(dir, 'seals', `${s.seq}.tsq`);
+  if (!existsSync(kept)) return { sealed: null, reason: `seals/${s.seq}.tsq, the request for ${s.name}, is not kept, so the response's nonce cannot be checked` };
+  let req;
+  try { req = readRequest(readFileSync(kept)); } catch (e) { return { sealed: null, reason: `seals/${s.seq}.tsq is not a time-stamp request (${e.message})` }; }
+  if (req.digest !== resp.digest || !resp.nonce || req.nonce !== resp.nonce) return { sealed: false, reason: `the time-stamp response's nonce is not that of the request kept for ${s.name}` };
+  if (!ca) return { sealed: null, reason: '--tsr needs --tsa-ca, the certificate the time-stamp authority chains to' };
+  const r = spawnSync('openssl', ['ts', '-verify', '-in', tsr, '-data', s.path, '-CAfile', ca], { ...BOUNDED, env });
+  if (r.error) return { sealed: null, reason: `OpenSSL could not be run (${r.error.code || r.error.message}), so the authority's signature is unchecked` };
+  if (r.status !== 0) return { sealed: false, reason: `OpenSSL does not verify the time-stamp response: ${firstLine(r.stderr) || firstLine(r.stdout)}` };
+  return accept(s, `the time-stamped ${s.name}`);
+}
+
+// A transparency-log bundle, checked by cosign against each local seal, newest first.
+function cosignWitness({ bundle, key, identity, issuer, trustedRoot, ignoreTlog, local, accept, verdict, env }) {
+  if (!key && !(identity && issuer)) return { sealed: null, reason: '--cosign-bundle needs --cosign-key, or --certificate-identity with --certificate-oidc-issuer' };
+  let last = '';
+  for (const s of [...local].reverse()) {
+    const who = key ? ['--key', key] : ['--certificate-identity', identity, '--certificate-oidc-issuer', issuer];
+    const r = spawnSync('cosign', ['verify-blob', '--bundle', bundle, ...who, ...(trustedRoot ? ['--trusted-root', trustedRoot] : []), ...(ignoreTlog ? ['--insecure-ignore-tlog=true'] : []), s.path], { ...BOUNDED, env });
+    if (r.error) return { sealed: null, reason: `cosign could not be run (${r.error.code || r.error.message})` };
+    if (r.status === 0) {
+      verdict.transparencyLog = { seal: s.name, tlogChecked: !ignoreTlog };
+      return accept(s, `the cosign-witnessed ${s.name}`);
+    }
+    last = firstLine(r.stderr);
+  }
+  return { sealed: false, reason: `the cosign bundle verifies against no seal in seals/${last ? ` (cosign: ${last})` : ''}` };
+}
+
+export function verifyEvidence(dir, { allowed = null, anchorGit = null, anchorRef = null, anchorPin = null, tsr = null, tsaCa = null, cosign = null, maxUnsealed = 0, env = process.env } = {}) {
   const verdict = { verified: true, broken: [], unrecorded: [], open: [], anchored: null, sealed: null, sealedReason: null, unsealedTail: null, signatures: [], seals: [] };
   const ledger = verifyChain(join(dir, LEDGER), LEDGER);
   verdict.broken.push(...ledger.broken);
@@ -107,7 +210,7 @@ export function verifyEvidence(dir, { allowed = null, anchorGit = null, anchorRe
     try { s = decodeSeal(text); } catch (e) { verdict.broken.push({ file: `seals/${f.name}`, line: 1, check: 'seal', reason: e.message }); prevDigest = sha256(text); continue; }
     if (s.previous !== prevDigest) verdict.broken.push({ file: `seals/${f.name}`, line: 1, check: 'seal-chain' });
     prevDigest = sha256(text);
-    local.push({ ...s, seq: f.seq, name: f.name, text });
+    local.push({ ...s, seq: f.seq, name: f.name, path: f.path, text });
   }
   if (local.length) {
     const newest = local[local.length - 1];
@@ -120,45 +223,20 @@ export function verifyEvidence(dir, { allowed = null, anchorGit = null, anchorRe
     verdict.signatures.push({ seal: s.name, results: sigs });
   }
 
-  if (anchorGit) {
-    const ref = anchorRef || '@{upstream}';
-    if (!resolveRef(anchorGit, ref, env)) {
-      verdict.sealedReason = `${ref} does not resolve in ${anchorGit}`;
-    } else {
-      // The witness is the authority: every seal it holds for this ledger is checked, whether or
-      // not the directory still has its copy, so deleting local seals cannot hide a cut tail.
-      const held = listWitnessed(anchorGit, ref, env);
-      const chain = recs.length ? recs[0].chain : null;
-      const seqs = chain ? held.get(chain) || [] : [];
-      const localSeqs = new Set(local.filter((s) => s.chain === chain).map((s) => s.seq));
-      let newestOk = null;
-      if (!seqs.length && held.size) {
-        verdict.sealed = false;
-        verdict.sealedReason = `the witness holds seals for ledger ${[...held.keys()].join(', ')}, and this directory holds ledger ${chain || 'none'}`;
-      } else if (!seqs.length) verdict.sealedReason = `not on ${ref}: the witness holds no seal for ledger ${chain || 'none'}`;
-      for (const seq of verdict.sealed === false ? [] : seqs) {
-        const name = `${seq}.dsse.json`;
-        const w = readWitnessed(anchorGit, ref, `${chain}/${name}`, env);
-        let ws;
-        try { ws = decodeSeal(w.text); } catch (e) { verdict.sealed = false; verdict.sealedReason = `the witnessed ${name} is not a seal: ${e.message}`; break; }
-        const a = agrees(ws, recs);
-        if (!a.ok) { verdict.sealed = false; verdict.sealedReason = `witnessed ${name}: ${a.why}`; break; }
-        const sigs = signaturesOf(ws, allowed);
-        const good = sigs.some((x) => x.valid === true);
-        const bad = sigs.every((x) => x.valid === false);
-        verdict.seals.push({ seal: name, witnessed: true, local: localSeqs.has(seq), length: ws.length, signed: good });
-        if (bad) { verdict.sealed = false; verdict.sealedReason = `witnessed ${name} carries no signature from an allowed signer`; break; }
-        if (good) newestOk = ws;
-      }
-      for (const s of local) if (s.chain === chain && !seqs.includes(s.seq)) verdict.seals.push({ seal: s.name, witnessed: false, reason: `not on ${ref}` });
-      if (verdict.sealed !== false) {
-        if (newestOk) {
-          verdict.sealed = true;
-          verdict.unsealedTail = recs.length - newestOk.length;
-        } else if (!verdict.sealedReason) verdict.sealedReason = allowed ? 'no witnessed seal carries a valid signature' : 'no allowed signers were given';
-      }
-    }
-  } else verdict.sealedReason = 'no witness was named';
+  const accept = accepting(recs, allowed);
+  const results = [];
+  if (anchorGit) results.push(gitWitness({ repo: anchorGit, ref: anchorRef || '@{upstream}', pin: anchorPin, recs, local, accept, allowed, verdict, env }));
+  if (tsr) results.push(tsrWitness({ dir, tsr, ca: tsaCa, local, accept, verdict, env }));
+  if (cosign) results.push(cosignWitness({ ...cosign, local, accept, verdict, env }));
+  const contradicted = results.find((r) => r.sealed === false);
+  const confirmed = results.filter((r) => r.sealed === true);
+  if (contradicted) {
+    verdict.sealed = false;
+    verdict.sealedReason = contradicted.reason;
+  } else if (confirmed.length) {
+    verdict.sealed = true;
+    verdict.unsealedTail = recs.length - Math.max(...confirmed.map((r) => r.seal.length));
+  } else verdict.sealedReason = results.length ? results.map((r) => r.reason).join('; ') : 'no witness was named';
 
   verdict.verified = verdict.broken.length === 0;
   verdict.exit = !verdict.verified || verdict.sealed === false ? 1