@rightkit/release 0.2.100 → 0.2.102

package/direct-bootstrap.mjs

@@ -273,6 +273,7 @@ export function renderPowerShellBootstrap({
     "$NextLink = Join-Path $InstallRoot '.current-next'",
     "$Journal = Join-Path $InstallRoot 'integration-journal.json'",
     "function Expand-BootstrapArgs($Values, $ActiveVersionRoot, $ActiveVersion) { foreach ($Value in $Values) { ([string]$Value).Replace('{current}', $Current).Replace('{installRoot}', $InstallRoot).Replace('{versionRoot}', $ActiveVersionRoot).Replace('{version}', $ActiveVersion) } }",
+    "function Remove-StableJunction([string]$Path) { $Item = Get-Item -LiteralPath $Path -Force -ErrorAction SilentlyContinue; if ($null -eq $Item) { return }; if ($Item.LinkType -ne 'Junction') { throw ('Stable pointer path is not a junction: ' + $Path) }; [IO.Directory]::Delete($Path) }",
     "function Resolve-HealthPath($Value, [string]$JsonPath) { $CurrentValue = $Value; foreach ($Segment in $JsonPath.Split('.')) { if ($Segment -match '^\\d+$') { $Index = [int]$Segment; if ($null -eq $CurrentValue -or $Index -ge @($CurrentValue).Count) { throw ('Health path is missing: ' + $JsonPath) }; $CurrentValue = @($CurrentValue)[$Index] } else { $Property = $CurrentValue.PSObject.Properties[$Segment]; if ($null -eq $Property) { throw ('Health path is missing: ' + $JsonPath) }; $CurrentValue = $Property.Value } }; return $CurrentValue }",
     "function Assert-Health($Health, [string]$ActiveVersion) { foreach ($Assertion in $Contract.healthAssertions) { $Actual = Resolve-HealthPath $Health ([string]$Assertion.path); if ($Assertion.PSObject.Properties.Name -contains 'equals') { $Expected = $Assertion.equals; if ($Expected -is [string]) { $Expected = $Expected.Replace('{version}', $ActiveVersion).Replace('{current}', $Current).Replace('{installRoot}', $InstallRoot) }; if ($Actual -ne $Expected) { throw ('Health assertion failed: ' + $Assertion.path) } } elseif ($Assertion.nonempty -eq $true) { if ($null -eq $Actual -or ([string]$Actual).Trim().Length -eq 0) { throw ('Health assertion failed: ' + $Assertion.path) } } elseif (@($Actual).Count -lt [int]$Assertion.minCount) { throw ('Health assertion failed: ' + $Assertion.path) } } }",
     ...(allowLocalReleaseRoot ? [
@@ -301,7 +302,7 @@ export function renderPowerShellBootstrap({
       "Invoke-WebRequest ($ReleaseBase + '/release-manifest.json') -OutFile $ManifestPath",
       "Invoke-WebRequest ($ReleaseBase + '/release-manifest.cat') -OutFile $SignaturePath",
     ]),
-    "$ManifestBytes = [IO.File]::ReadAllBytes($ManifestPath); Import-Module Microsoft.PowerShell.Security -ErrorAction Stop",
+    "$ManifestBytes = [IO.File]::ReadAllBytes($ManifestPath); Import-Module Microsoft.PowerShell.Security -ErrorAction SilentlyContinue",
     "$Catalog = Test-FileCatalog -CatalogFilePath $SignaturePath -Path $ManifestPath -Detailed; if ([string]$Catalog.Status -ne 'Valid') { throw 'Release manifest catalog binding is invalid' }",
     "$CatalogSignature = Get-AuthenticodeSignature -FilePath $SignaturePath; if ([string]$CatalogSignature.Status -ne 'Valid' -or -not $CatalogSignature.SignerCertificate) { throw 'Release manifest signature is invalid' }; $SignerCertificate = $CatalogSignature.SignerCertificate",
     "$SignerSubject = 'CN=' + $SignerCertificate.GetNameInfo([Security.Cryptography.X509Certificates.X509NameType]::SimpleName, $false)",
@@ -352,11 +353,11 @@ export function renderPowerShellBootstrap({
     "$PriorStatus = $null; if ($PriorTarget) { $PriorExe = Join-Path $Current " + psQuote(executablePath.replaceAll("/", "\\")) + "; $PriorStatusArgs = @(Expand-BootstrapArgs $StatusArgsTemplate ([string]$PriorTarget) $PriorVersion); try { $PriorStatus = (& $PriorExe @PriorStatusArgs | Out-String).Trim() } catch {} }",
     "@{ schemaVersion=1; priorTarget=$PriorTarget; priorVersion=$PriorVersion; targetVersion=$Version; priorStatus=$PriorStatus } | ConvertTo-Json -Depth 8 | Set-Content -Encoding UTF8 $Journal",
     "if ($PreflightArgs.Count) { & $VersionExe @PreflightArgs; if ($LASTEXITCODE -ne 0) { throw 'Activation preflight failed' } }",
-    "if (Test-Path $NextLink) { Remove-Item -Force $NextLink }; if (Test-Path $PreviousLink) { Remove-Item -Force $PreviousLink }",
+    "Remove-StableJunction $NextLink; Remove-StableJunction $PreviousLink",
     "New-Item -ItemType Junction -Path $NextLink -Target $VersionRoot | Out-Null",
     "$Switched = $false; $PriorDetached = $false",
     "try {",
-    "  if (Test-Path $Current) { [IO.Directory]::Move($Current, $PreviousLink); $PriorDetached = $true }; [IO.Directory]::Move($NextLink, $Current); $Switched = $true",
+    "  if (Test-Path $Current) { Rename-Item -LiteralPath $Current -NewName (Split-Path -Leaf $PreviousLink); $PriorDetached = $true }; Rename-Item -LiteralPath $NextLink -NewName (Split-Path -Leaf $Current); $Switched = $true",
     "  $StableExe = Join-Path $Current " + psQuote(executablePath.replaceAll("/", "\\")),
     "  $ActivationArgs = @(Expand-BootstrapArgs $ActivationArgsTemplate $VersionRoot $Version); $StatusArgs = @(Expand-BootstrapArgs $StatusArgsTemplate $VersionRoot $Version)",
     "  & $StableExe @ActivationArgs; if ($LASTEXITCODE -ne 0) { throw 'Activation failed' }",
@@ -365,9 +366,9 @@ export function renderPowerShellBootstrap({
     "  $StableBin = Split-Path $StableExe -Parent; $UserPath = [Environment]::GetEnvironmentVariable('Path','User'); if (-not (($UserPath -split ';') -contains $StableBin)) { [Environment]::SetEnvironmentVariable('Path', (($UserPath.TrimEnd(';') + ';' + $StableBin).Trim(';')), 'User') }",
     // Journal cleanup must succeed before discarding the prior pointer. If
     // cleanup fails, catch still has a rollback anchor to restore.
-    "  Remove-Item -Force $Journal; if (Test-Path $PreviousLink) { Remove-Item -Force $PreviousLink }; Write-Output (" + psQuote(product + " ") + " + $Version + ' installed')",
+    "  Remove-Item -Force $Journal; Remove-StableJunction $PreviousLink; Write-Output (" + psQuote(product + " ") + " + $Version + ' installed')",
     "} catch {",
-    "  if (($Switched -or $PriorDetached) -and (Test-Path $Current)) { Remove-Item -Force $Current }; if ($PriorDetached -and (Test-Path $PreviousLink)) { [IO.Directory]::Move($PreviousLink, $Current) }",
+    "  if ($Switched -or $PriorDetached) { Remove-StableJunction $Current }; if ($PriorDetached -and (Test-Path $PreviousLink)) { Rename-Item -LiteralPath $PreviousLink -NewName (Split-Path -Leaf $Current) }",
     "  if ($PriorTarget -and (Test-Path $Current)) { $PriorExe = Join-Path $Current " + psQuote(executablePath.replaceAll("/", "\\")) + "; $PriorActivationArgs = @(Expand-BootstrapArgs $ActivationArgsTemplate ([string]$PriorTarget) $PriorVersion); $PriorStatusArgs = @(Expand-BootstrapArgs $StatusArgsTemplate ([string]$PriorTarget) $PriorVersion); & $PriorExe @PriorActivationArgs; if ($LASTEXITCODE -ne 0) { throw 'Rollback activation failed' }; $PriorHealthText = (& $PriorExe @PriorStatusArgs | Out-String).Trim(); if ($LASTEXITCODE -ne 0) { throw 'Rollback health failed' }; $PriorHealth = $PriorHealthText | ConvertFrom-Json; try { Assert-Health $PriorHealth $PriorVersion } catch { throw 'Prior health was not restored' } }",
     "  if (Test-Path $VersionRoot) { Remove-Item -Recurse -Force $VersionRoot }; throw",
     "} finally { if (Test-Path $Work) { Remove-Item -Recurse -Force $Work } }",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.100",
+  "version": "0.2.102",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/rightkit-versions.json

@@ -22,7 +22,7 @@
     "@rightkit/logs": "0.1.4",
     "@rightkit/platform-ui": "0.1.1",
     "@rightkit/qa": "0.2.1",
-    "@rightkit/release": "0.2.100",
+    "@rightkit/release": "0.2.102",
     "@rightkit/tauri": "0.1.1",
     "@rightkit/updates": "0.2.4"
   },

package/verifier.mjs

@@ -0,0 +1,148 @@
+#!/usr/bin/env node
+/**
+ * Deterministic release verifier (Gate 6).
+ *
+ * Three capability grants exist so that no single stage can authorize the next
+ * one for itself: BUILD_AUTHORIZED admits compilation, SIGNING_AUTHORIZED
+ * admits production signing of exact package digests, and RELEASE_AUTHORIZED
+ * admits public promotion of exact qualified bytes.
+ *
+ * The verifier is a pure function of receipts. It never reads a `decision`
+ * field supplied by its caller: an input that already claims AUTHORIZED is
+ * rejected outright, because the whole point of the gate is that neither a
+ * human nor a model can hand-edit its way to a grant.
+ */
+import { createHash } from "node:crypto";
+
+export const GRANTS = Object.freeze(["BUILD_AUTHORIZED", "SIGNING_AUTHORIZED", "RELEASE_AUTHORIZED"]);
+
+const SHA1_40 = /^[a-f0-9]{40}$/;
+const SHA256_64 = /^[a-f0-9]{64}$/;
+
+/** Receipts each grant requires, in the order the pipeline produces them. */
+export const REQUIRED_RECEIPTS = Object.freeze({
+  BUILD_AUTHORIZED: Object.freeze([
+    "source_sha",
+    "verifier_sha",
+    "obligation_schema_digest",
+    "ci_receipt",
+    "static_source_closure_receipt",
+    "platform_preflight_receipt",
+  ]),
+  SIGNING_AUTHORIZED: Object.freeze([
+    "build_input_digest",
+    "windows_candidate_sha256",
+    "macos_candidate_sha256",
+    "unsigned_transaction_receipt",
+  ]),
+  RELEASE_AUTHORIZED: Object.freeze([
+    "signing_authorization_receipt",
+    "windows_signed_sha256",
+    "macos_notarized_sha256",
+    "windows_install_receipt",
+    "macos_install_receipt",
+    "compatibility_matrix_receipt",
+    "real_client_contract_receipt",
+    "channel_stage_receipt",
+  ]),
+});
+
+/** Fields that must look like a 64-character lowercase SHA-256. */
+const DIGEST_FIELDS = new Set([
+  "obligation_schema_digest",
+  "build_input_digest",
+  "windows_candidate_sha256",
+  "macos_candidate_sha256",
+  "windows_signed_sha256",
+  "macos_notarized_sha256",
+]);
+
+/** A grant only carries the receipts it and its predecessors require. */
+export function receiptsFor(grant) {
+  const order = GRANTS.slice(0, GRANTS.indexOf(grant) + 1);
+  return order.flatMap((each) => REQUIRED_RECEIPTS[each]);
+}
+
+function receiptIssues(receipts, names) {
+  const issues = [];
+  for (const name of names) {
+    const value = receipts[name];
+    if (value === undefined || value === null || value === "") {
+      issues.push(`missing receipt: ${name}`);
+      continue;
+    }
+    if (typeof value !== "string") {
+      issues.push(`receipt must be a string: ${name}`);
+      continue;
+    }
+    if (name === "source_sha" && !SHA1_40.test(value)) issues.push("source_sha must be a 40-character lowercase commit SHA");
+    if (name === "verifier_sha" && !SHA1_40.test(value)) issues.push("verifier_sha must be a 40-character lowercase commit SHA");
+    if (DIGEST_FIELDS.has(name) && !SHA256_64.test(value)) issues.push(`${name} must be a 64-character lowercase SHA-256`);
+  }
+  return issues;
+}
+
+/**
+ * Computes one grant. Returns a decision object; never throws for an ordinary
+ * refusal, because a refusal is a normal, expected outcome that must be
+ * reportable rather than exceptional.
+ */
+export function computeGrant(grant, input = {}, { now = Date.now(), maxAgeSeconds = 3600 } = {}) {
+  if (!GRANTS.includes(grant)) throw new Error(`unknown grant: ${grant}`);
+
+  const issues = [];
+  // A caller-supplied decision is an attempt to skip the gate.
+  if (Object.hasOwn(input, "decision")) issues.push("input must not supply a decision; the verifier computes it");
+  if (Object.hasOwn(input, "grant")) issues.push("input must not supply a grant; the verifier computes it");
+
+  const receipts = input.receipts ?? {};
+  if (typeof receipts !== "object" || receipts === null || Array.isArray(receipts)) {
+    return decision(grant, false, ["receipts must be an object"], input);
+  }
+  issues.push(...receiptIssues(receipts, receiptsFor(grant)));
+
+  // Short-lived: a stale authorization must not be replayable against bytes
+  // that were rebuilt or re-signed after it was issued.
+  const issuedAt = input.issuedAt;
+  if (typeof issuedAt !== "string" || Number.isNaN(Date.parse(issuedAt))) {
+    issues.push("issuedAt must be an ISO-8601 timestamp");
+  } else {
+    const ageSeconds = (now - Date.parse(issuedAt)) / 1000;
+    if (ageSeconds < 0) issues.push("issuedAt is in the future");
+    else if (ageSeconds > maxAgeSeconds) issues.push(`authorization input is stale: ${Math.round(ageSeconds)}s old, limit ${maxAgeSeconds}s`);
+  }
+
+  return decision(grant, issues.length === 0, issues, input);
+}
+
+function decision(grant, granted, issues, input) {
+  const receipts = input.receipts ?? {};
+  const bound = {};
+  for (const name of receiptsFor(grant)) if (typeof receipts[name] === "string") bound[name] = receipts[name];
+  const body = {
+    schemaVersion: 1,
+    kind: "rightkit-release-authorization",
+    grant,
+    decision: granted ? "AUTHORIZED" : "REFUSED",
+    issues,
+    boundReceipts: bound,
+    issuedAt: typeof input.issuedAt === "string" ? input.issuedAt : null,
+  };
+  // The digest covers the bound receipts, so an authorization cannot be moved
+  // onto a different source revision or different artifact bytes.
+  body.authorizationDigest = createHash("sha256")
+    .update(JSON.stringify({ grant: body.grant, decision: body.decision, boundReceipts: bound, issuedAt: body.issuedAt }))
+    .digest("hex");
+  return body;
+}
+
+const invokedDirectly = process.argv[1] && process.argv[1].endsWith("verifier.mjs");
+if (invokedDirectly) {
+  const grant = process.argv[2];
+  let input = {};
+  try { input = JSON.parse(process.argv[3] ?? "{}"); }
+  catch (error) { process.stderr.write(`verifier: input is not JSON: ${error.message}\n`); process.exit(2); }
+  const result = computeGrant(grant, input);
+  process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+  process.exitCode = result.decision === "AUTHORIZED" ? 0 : 1;
+}