@pumpkin-plugins/build 0.0.0-stage → 0.1.0

package/runtime/provenance.mjs

@@ -0,0 +1,154 @@
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { release as osRelease } from 'node:os';
+import { join, resolve } from 'node:path';
+import { Argument, Command } from 'commander';
+
+const runtimeDir = import.meta.dirname;
+const expected = JSON.parse(readFileSync(join(runtimeDir, 'provenance.json'), 'utf8'));
+const patchPath = join(runtimeDir, 'componentize-qjs-bigint.patch');
+const artifactName = 'quickjs-runtime-bigint.wasm';
+const hash = (path) => createHash('sha256').update(readFileSync(path)).digest('hex');
+const run = (command, args) =>
+    execFileSync(command, args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+const requireMatch = (actual, wanted, message) => {
+    if (actual !== wanted) throw new Error(message);
+};
+
+function checkPatch() {
+    requireMatch(hash(patchPath), expected.patchSha256, 'Patch hash mismatch');
+}
+
+function checkInputs(sourceDir, sdkDir) {
+    checkPatch();
+    const git = (...args) => run('git', ['-C', sourceDir, ...args]);
+    requireMatch(
+        git('rev-parse', 'HEAD'),
+        expected.sourceCommit,
+        `Expected componentize-qjs at ${expected.sourceCommit}`,
+    );
+    requireMatch(hash(join(sourceDir, 'Cargo.lock')), expected.cargoLockSha256, 'Cargo.lock hash mismatch');
+    // Include ignored files: .cargo/config and local source overrides are also build inputs.
+    if (
+        git('ls-files', '--others', '--exclude-standard') ||
+        git('ls-files', '--others', '--ignored', '--exclude-standard')
+    ) {
+        throw new Error('Untracked source inputs');
+    }
+    const diff = git(
+        'diff',
+        '--no-ext-diff',
+        '--no-textconv',
+        '--binary',
+        '--src-prefix=a/',
+        '--dst-prefix=b/',
+        'HEAD',
+    );
+    // Git writes a space on empty context lines; the checked-in patch omits it.
+    const normalize = (text) => text.replace(/^ $/gm, '').trim();
+    if (diff && normalize(diff) !== normalize(readFileSync(patchPath, 'utf8'))) {
+        throw new Error('Source changes differ from the declared patch');
+    }
+    requireMatch(run('rustc', ['--version']), expected.rustVersion, 'Rust version mismatch');
+    requireMatch(run('cargo', ['--version']), expected.cargoVersion, 'Cargo version mismatch');
+    requireMatch(
+        readFileSync(join(sdkDir, 'VERSION'), 'utf8').trim(),
+        expected.sdkVersion,
+        'wasi-sdk version mismatch',
+    );
+    requireMatch(
+        run(join(sdkDir, 'bin/clang'), ['--version']).split('\n')[0],
+        expected.clangVersion,
+        'Clang version mismatch',
+    );
+    const targetLib = run('rustc', ['--print', 'target-libdir', '--target', expected.target]);
+    if (!existsSync(targetLib)) throw new Error(`Rust target ${expected.target} is not installed`);
+}
+
+function checkArtifact(outputDir, wanted = expected.outputSha256) {
+    const actual = hash(join(outputDir, artifactName));
+    requireMatch(actual, wanted, `Runtime output hash mismatch: expected ${wanted}, got ${actual}`);
+}
+
+function verifyShipped(outputDir) {
+    const manifest = JSON.parse(readFileSync(join(outputDir, 'provenance.json'), 'utf8'));
+    if ('buildHost' in manifest || 'buildHostRelease' in manifest) {
+        throw new Error('Candidate provenance cannot verify as shipped runtime');
+    }
+    for (const [key, value] of Object.entries(expected)) {
+        requireMatch(manifest[key], value, `Provenance mismatch: ${key}`);
+    }
+    checkArtifact(outputDir);
+}
+
+function verifyCandidate(outputDir) {
+    const manifest = JSON.parse(readFileSync(join(outputDir, 'provenance.json'), 'utf8'));
+    for (const [key, value] of Object.entries(expected)) {
+        if (key !== 'outputSha256') requireMatch(manifest[key], value, `Provenance mismatch: ${key}`);
+    }
+    if (typeof manifest.outputSha256 !== 'string' || !/^[a-f0-9]{64}$/.test(manifest.outputSha256)) {
+        throw new Error('Invalid runtime candidate output SHA-256');
+    }
+    if (typeof manifest.buildHost !== 'string' || !manifest.buildHost.trim()) {
+        throw new Error('Missing runtime candidate build host');
+    }
+    if (typeof manifest.buildHostRelease !== 'string' || !manifest.buildHostRelease.trim()) {
+        throw new Error('Missing runtime candidate host release');
+    }
+    checkArtifact(outputDir, manifest.outputSha256);
+}
+
+try {
+    const program = new Command().name('provenance.mjs').description('Inspect and record QuickJS runtime provenance.');
+    program
+        .command('value')
+        .description('Print one pinned build value.')
+        .addArgument(new Argument('<name>', 'Pinned value name').choices(['target', 'features', 'rustFlags', 'cFlags']))
+        .action((name) => process.stdout.write(`${expected[name]}\n`));
+    program
+        .command('inputs')
+        .description('Verify the pinned source tree and WASI SDK inputs.')
+        .argument('<source>', 'QuickJS source directory')
+        .argument('<sdk>', 'WASI SDK directory')
+        .action((source, sdk) => checkInputs(resolve(source), resolve(sdk)));
+    program
+        .command('record')
+        .description('Verify inputs and record the generated runtime candidate hash.')
+        .argument('<source>', 'QuickJS source directory')
+        .argument('<sdk>', 'WASI SDK directory')
+        .argument('<output>', 'Runtime output directory')
+        .action((source, sdk, output) => {
+            checkInputs(resolve(source), resolve(sdk));
+            const outputSha256 = hash(join(resolve(output), artifactName));
+            const buildHost = `${process.platform}-${process.arch}`;
+            const buildHostRelease = osRelease();
+            writeFileSync(
+                join(output, 'provenance.json'),
+                `${JSON.stringify({ ...expected, outputSha256, buildHost, buildHostRelease }, null, 4)}\n`,
+            );
+            process.stdout.write(
+                `Runtime candidate output SHA-256: ${outputSha256} (${buildHost}, ${buildHostRelease})\n`,
+            );
+        });
+    program
+        .command('verify')
+        .description('Verify a shipped runtime directory against the pinned provenance.')
+        .argument('<output>', 'Shipped runtime directory')
+        .action((output) => {
+            checkPatch();
+            verifyShipped(resolve(output));
+        });
+    program
+        .command('verify-candidate')
+        .description('Verify a build candidate directory and its recorded host hash.')
+        .argument('<output>', 'Runtime candidate directory')
+        .action((output) => {
+            checkPatch();
+            verifyCandidate(resolve(output));
+        });
+    await program.parseAsync(process.argv);
+} catch (error) {
+    process.stderr.write(`${error instanceof Error ? error.message : error}\n`);
+    process.exitCode = 1;
+}

package/wasi-wit.lock.json

@@ -0,0 +1,34 @@
+{
+    "version": "0.2.3",
+    "files": {
+        "clocks/monotonic-clock.wit": "ffb4d4e52b0b3fbce90efa365fcbd1b63f724696dac9f269ed70d798b64b0f47",
+        "clocks/timezone.wit": "661469d5c0d1bd943c8e07e37927ba569c9d2813ff2de9823f089e3802af0848",
+        "clocks/wall-clock.wit": "1e8e6bf52e76aaebd471112bb8eaa70ef1e11c183cd28b9eb012de5382370cc9",
+        "clocks/world.wit": "4ac7cd7eae10eaaf98b93d760350eece7cd4e30cc7d23d1a029b0fc4cd417925",
+        "filesystem/preopens.wit": "0e838ee8abba3bdc0a7be20549312514ca8a28770fd3997d1f1f1407acf6f1fc",
+        "filesystem/types.wit": "26e069bade72e3c98da948fe9668d9fc43e9f8e465a3e0cde61f2c6dfaf01110",
+        "filesystem/world.wit": "04f42e76fb1322db234f394f427b3ee2bd777f0378ee4a642f888aa424387b50",
+        "io/error.wit": "910ed309534a26ac004ae882fbb3be82ccb05d16ae646ae351fde66bbf14e4bd",
+        "io/poll.wit": "e8069d860b0e837a81f820ab13c700a90bd71da9e1f774bbfaeca31daf920371",
+        "io/streams.wit": "b8cc539eb831695e3340243d7f0dd643c47d9adbbd355866bc604a25a5765dff",
+        "io/world.wit": "acc9fc0d7f96658d7bdf88e0a8c01d51db3ee35d5cff07f9f4b2f4a5c47d83b1",
+        "sockets/instance-network.wit": "1e4a5d97df44421503a169e1d514eca2cf160f545c44d320ce8a82f726a40cf8",
+        "sockets/ip-name-lookup.wit": "2b9db4b6c6eae692c8285ae57adb318750061a02a850e37410bef87d5909e69c",
+        "sockets/network.wit": "bdcf7ba3a0d04c0a071f06cba8a4072eca884d30f6d89c2e55e6047f657694cf",
+        "sockets/tcp-create-socket.wit": "96a6a1a93b859127ee60273f0a77cda8d60930f7952174fb22469293b5da6a3a",
+        "sockets/tcp.wit": "2ec54e09277bd8f917154696c812a943f0f2ea365feb6e32d88c65871362f1dd",
+        "sockets/udp-create-socket.wit": "c52b9bf91ef4e30e7ec08ad1fc9e77ef005a0a87648c5d2e416dd6e35369f08c",
+        "sockets/udp.wit": "63ea1696a3c9dd500ba8d0f518c526ff0e04e5cbeca4f56950756b0b217487c2",
+        "sockets/world.wit": "6e2bd764df0037ebcec03c63f92bd47f4e69679cf608f6b3d2073cf10fb3672f",
+        "http/handler.wit": "1f66174b4058b102367e69ce8aa657b3e9dbc767f6ade960108faaa1731f0945",
+        "http/package.wit": "03af060b69ccf1d6ac5cbe1ff626b3ed734214cf2829a3d6d23d5c6223633119",
+        "http/types.wit": "a5501f024e9ced633153b5247d67d5d50a621c3cc09abc348d997040fd7355b3"
+    },
+    "sources": {
+        "http/handler.wit": "https://raw.githubusercontent.com/WebAssembly/wasi-http/v0.2.3/wit/handler.wit",
+        "http/types.wit": "https://raw.githubusercontent.com/WebAssembly/wasi-http/v0.2.3/wit/types.wit"
+    },
+    "generatedFiles": {
+        "http/package.wit": "package wasi:http@0.2.3;\n"
+    }
+}