@rightkit/release 0.2.80 → 0.2.82

package/build-release.mjs

@@ -168,7 +168,15 @@ try {
     // outlived the change that was supposed to retire them.
     pipeline: PIPELINE_FINGERPRINT,
     configSha256: hashFile(configPath),
-    receiptInputs: ["raw-exe", "installer", "embedding"].map((phase) => path.join(receiptRoot, `windows-${phase}.json`)),
+    // Resolve each phase receipt the same way signing does: the config's
+    // sign.receipt / sign.installerReceipt override wins, the default
+    // windows-<phase>.json name is only the fallback. Hardcoding the default
+    // here made the seal read a path the signer never wrote whenever a config
+    // (e.g. an architecture-qualified receipt) overrode it.
+    receiptInputs: ["raw-exe", "installer", "embedding"].map((phase) => {
+      const configured = phase === "raw-exe" ? target.sign?.receipt : phase === "installer" ? target.sign?.installerReceipt : undefined;
+      return configured ? path.resolve(appRoot, configured) : path.join(receiptRoot, `windows-${phase}.json`);
+    }),
   } : null;
   if (signingIdentity) inputHashes[".right-release/signing-identity.json"] = hashFileText(JSON.stringify(signingIdentity));
   const cargoLock = nativeLayout.lockPath;
@@ -435,7 +443,15 @@ function sealRelease({ configRoot, managedCargoTarget, nativeLayout, sealedDir,
     commit,
     platform,
     cacheKey,
-    signing: signingIdentity ? { ...signingIdentity, receipts: signingIdentity.receiptInputs.map((file) => ({ file, sha256: hashFile(file) })) } : null,
+    // Portable contracts sign only raw executables — installer/embedding
+    // receipts legitimately never exist there. Seal every receipt that was
+    // produced, but never zero: a signed platform with no receipt at all is
+    // an unsound seal, not a portable release.
+    signing: signingIdentity ? { ...signingIdentity, receipts: (() => {
+      const present = signingIdentity.receiptInputs.filter((file) => existsSync(file));
+      if (present.length === 0) throw new Error(`no signing receipts found to seal; expected at least ${signingIdentity.receiptInputs[0]}`);
+      return present.map((file) => ({ file, sha256: hashFile(file) }));
+    })() } : null,
     files,
     routes,
     inputs: inputHashes,

package/hardeningscan.mjs

@@ -1,139 +1,144 @@
-#!/usr/bin/env node
-import { createHash } from "node:crypto";
-import { createReadStream, readFileSync, realpathSync } from "node:fs";
-import { lstat, readdir } from "node:fs/promises";
-import path from "node:path";
-import { HARDENING_RULES } from "./hardening-evidence.mjs";
-
-const rawArgs = process.argv.slice(2);
-if (rawArgs.length === 0 || rawArgs.includes("-h") || rawArgs.includes("--help")) {
-  console.error("usage: node hardeningscan.mjs [--allow-evidence <json>] <artifact-path>...");
-  process.exit(rawArgs.length === 0 ? 2 : 0);
-}
-const allowIndex = rawArgs.indexOf("--allow-evidence");
-const allowEvidencePath = allowIndex >= 0 ? rawArgs[allowIndex + 1] : null;
-if (allowIndex >= 0 && !allowEvidencePath) throw new Error("--allow-evidence requires a JSON path");
-const args = rawArgs.filter((_, index) => index !== allowIndex && index !== allowIndex + 1);
-if (!args.length) throw new Error("at least one artifact path is required");
-
-const root = realpathSync(process.cwd());
-const findings = [];
-const evidence = allowEvidencePath ? JSON.parse(readFileSync(allowEvidencePath, "utf8")) : { allowances: [] };
-if (allowEvidencePath && (evidence.schemaVersion !== 1 || evidence.kind !== "rightkit-hardening-evidence")) {
-  throw new Error("invalid hardening evidence");
-}
-const allowances = evidence.allowances ?? [];
-for (const allowance of allowances) {
-  const sourceMatch = typeof allowance.sourceEvidence === "string" ? /^(.*):([1-9]\d*)$/.exec(allowance.sourceEvidence) : null;
-  const knownRule = HARDENING_RULES[allowance.rule];
-  if (!knownRule || allowance.exact !== knownRule.exact || !sourceMatch || !/^[a-f0-9]{64}$/.test(allowance.artifactSha256 ?? "") || !/^[a-f0-9]{64}$/.test(allowance.sourceSha256 ?? "") || allowance.sourceLine !== Number(sourceMatch[2]) || typeof allowance.rationale !== "string" || allowance.rationale.trim().length < 12) {
-    throw new Error("invalid hardening allowance source binding");
-  }
-  const sourcePath = realpathSync(path.resolve(root, sourceMatch[1]));
-  const sourceRelative = path.relative(root, sourcePath);
-  if (sourceRelative === ".." || sourceRelative.startsWith("../") || sourceRelative.startsWith("..\\") || path.isAbsolute(sourceRelative)) {
-    throw new Error("hardening allowance source escapes release root");
-  }
-  const sourceBytes = readFileSync(sourcePath);
-  if (createHash("sha256").update(sourceBytes).digest("hex") !== allowance.sourceSha256) throw new Error("hardening allowance source digest mismatch");
-  const line = sourceBytes.toString("utf8").split(/\r?\n/)[allowance.sourceLine - 1];
-  if (typeof line !== "string" || !line.includes(allowance.exact)) throw new Error("hardening allowance source token mismatch");
-}
-
-const fileNameRules = [
-  [/\.map$/i, "source map shipped"],
-  [/\.pdb$/i, "Windows debug symbols shipped"],
-  [/\.dSYM(?:$|[/\\])/i, "macOS debug symbols shipped"],
-  [/\.mlpackage(?:$|[/\\])/i, "raw CoreML package shipped"],
-  [/[/\\]docs[/\\]experiments(?:$|[/\\])/i, "experiment docs shipped"],
-  [/[/\\]\.scratch(?:$|[/\\])/i, "scratch directory shipped"],
-  [/[/\\]\.git(?:$|[/\\])/i, "git metadata shipped"],
-  [/[/\\]node_modules(?:$|[/\\])/i, "node_modules shipped"],
-  [/[/\\](?:src|tests?|benches|benchmarks)(?:$|[/\\])/i, "source/test tree shipped"],
-  [/[/\\]tdt_w15_p6(?:$|[/\\])/i, "stale TDT p6 model shipped"],
-];
-
-const contentRules = [
-  ["local-source-path", /\/Users\/adrdsouza\/claude/gi, "local source path leaked"],
-  ["local-cargo-path", /\/Users\/adrdsouza\/\.cargo/gi, "local cargo path leaked"],
-  ["local-windows-path", /C:\\Users\\adrdsouza\\(?:claude|\.cargo)/gi, "local Windows source path leaked"],
-  ["experiment-path", /docs\/experiments/gi, "experiment path leaked"],
-  ["cleanup-prompt-marker", /l3_cleanup_prompt/gi, "L3 cleanup prompt marker leaked"],
-  ["system-prompt-marker", /SYSTEM_PROMPT/gi, "system prompt marker leaked"],
-  ["secret-env-name", /OPENAI_API_KEY|ANTHROPIC_API_KEY|APPLE_PASSWORD|NOTARY_PROFILE/gi, "secret/env key name leaked"],
-  ["gpl-flag", /--enable-gpl|--enable-nonfree/gi, "GPL/nonfree ffmpeg flag leaked"],
-  ["stale-model", /tdt_w15_p6/gi, "stale TDT p6 string leaked"],
-  ["experiment-model", /Canary-Qwen|Nemotron|dqlstm|bias-experiments/gi, "experiment/model-history marker leaked"],
-];
-
-const maxPatternLen = Math.max(...contentRules.map(([, rule]) => String(rule).length), 256);
-
-function add(kind, file, message, detail = "") {
-  findings.push({ kind, file: path.relative(root, file) || file, message, detail });
-}
-
-async function walk(target) {
-  const st = await lstat(target);
-  const normalized = target.split(path.sep).join("/");
-  for (const [rule, message] of fileNameRules) if (rule.test(normalized)) add("path", target, message);
-  if (st.isDirectory()) {
-    const entries = await readdir(target);
-    await Promise.all(entries.map((name) => walk(path.join(target, name))));
-    return;
-  }
-  if (st.isFile()) await scanFile(target);
-}
-
-function scanFile(file) {
-  return new Promise((resolveScan) => {
-    const artifactSha256 = createHash("sha256").update(readFileSync(file)).digest("hex");
-    const stream = createReadStream(file, { highWaterMark: 256 * 1024 });
-    let tail = "";
-    stream.on("data", (chunk) => {
-      const text = tail + chunk.toString("latin1");
-      for (const [ruleId, rule, message] of contentRules) {
-        if (/ffmpeg-LICENSE\.txt$/i.test(file) && ruleId === "gpl-flag") continue;
-        rule.lastIndex = 0;
-        for (const match of text.matchAll(rule)) {
-          const allowed = allowances.some((allowance) =>
-            allowance.rule === ruleId &&
-            allowance.artifactSha256 === artifactSha256 &&
-            allowance.exact === match[0] &&
-            typeof allowance.sourceEvidence === "string" &&
-            typeof allowance.rationale === "string"
-          );
-          if (!allowed) add("content", file, message, rule.source);
-        }
-      }
-      tail = text.slice(-maxPatternLen);
-    });
-    stream.on("error", (error) => {
-      add("read", file, "could not scan file", error.message);
-      resolveScan();
-    });
-    stream.on("end", resolveScan);
-  });
-}
-
-for (const arg of args) {
-  const target = path.resolve(arg);
-  try {
-    await walk(target);
-  } catch (error) {
-    add("target", target, "could not scan target", error.message);
-  }
-}
-
-const unique = new Map();
-for (const finding of findings) unique.set([finding.kind, finding.file, finding.message].join("\0"), finding);
-const deduped = [...unique.values()].sort((left, right) =>
-  (left.file + " " + left.message).localeCompare(right.file + " " + right.message),
-);
-
-if (deduped.length) {
-  console.error("hardeningscan: " + deduped.length + " finding(s)");
-  for (const finding of deduped) console.error("- [" + finding.kind + "] " + finding.file + ": " + finding.message);
-  process.exit(1);
-}
-
-console.log("hardeningscan: clean");
+#!/usr/bin/env node
+import { createHash } from "node:crypto";
+import { createReadStream, readFileSync, realpathSync } from "node:fs";
+import { lstat, readdir } from "node:fs/promises";
+import path from "node:path";
+import { HARDENING_RULES } from "./hardening-evidence.mjs";
+
+const rawArgs = process.argv.slice(2);
+if (rawArgs.length === 0 || rawArgs.includes("-h") || rawArgs.includes("--help")) {
+  console.error("usage: node hardeningscan.mjs [--allow-evidence <json>] <artifact-path>...");
+  process.exit(rawArgs.length === 0 ? 2 : 0);
+}
+const allowIndex = rawArgs.indexOf("--allow-evidence");
+const allowEvidencePath = allowIndex >= 0 ? rawArgs[allowIndex + 1] : null;
+if (allowIndex >= 0 && !allowEvidencePath) throw new Error("--allow-evidence requires a JSON path");
+// Only strip the flag pair when the flag is present: with allowIndex = -1,
+// filtering out index `allowIndex + 1` would silently drop the first
+// artifact path (a lone artifact arg then failed as "no artifact path").
+const args = allowIndex >= 0
+  ? rawArgs.filter((_, index) => index !== allowIndex && index !== allowIndex + 1)
+  : rawArgs;
+if (!args.length) throw new Error("at least one artifact path is required");
+
+const root = realpathSync(process.cwd());
+const findings = [];
+const evidence = allowEvidencePath ? JSON.parse(readFileSync(allowEvidencePath, "utf8")) : { allowances: [] };
+if (allowEvidencePath && (evidence.schemaVersion !== 1 || evidence.kind !== "rightkit-hardening-evidence")) {
+  throw new Error("invalid hardening evidence");
+}
+const allowances = evidence.allowances ?? [];
+for (const allowance of allowances) {
+  const sourceMatch = typeof allowance.sourceEvidence === "string" ? /^(.*):([1-9]\d*)$/.exec(allowance.sourceEvidence) : null;
+  const knownRule = HARDENING_RULES[allowance.rule];
+  if (!knownRule || allowance.exact !== knownRule.exact || !sourceMatch || !/^[a-f0-9]{64}$/.test(allowance.artifactSha256 ?? "") || !/^[a-f0-9]{64}$/.test(allowance.sourceSha256 ?? "") || allowance.sourceLine !== Number(sourceMatch[2]) || typeof allowance.rationale !== "string" || allowance.rationale.trim().length < 12) {
+    throw new Error("invalid hardening allowance source binding");
+  }
+  const sourcePath = realpathSync(path.resolve(root, sourceMatch[1]));
+  const sourceRelative = path.relative(root, sourcePath);
+  if (sourceRelative === ".." || sourceRelative.startsWith("../") || sourceRelative.startsWith("..\\") || path.isAbsolute(sourceRelative)) {
+    throw new Error("hardening allowance source escapes release root");
+  }
+  const sourceBytes = readFileSync(sourcePath);
+  if (createHash("sha256").update(sourceBytes).digest("hex") !== allowance.sourceSha256) throw new Error("hardening allowance source digest mismatch");
+  const line = sourceBytes.toString("utf8").split(/\r?\n/)[allowance.sourceLine - 1];
+  if (typeof line !== "string" || !line.includes(allowance.exact)) throw new Error("hardening allowance source token mismatch");
+}
+
+const fileNameRules = [
+  [/\.map$/i, "source map shipped"],
+  [/\.pdb$/i, "Windows debug symbols shipped"],
+  [/\.dSYM(?:$|[/\\])/i, "macOS debug symbols shipped"],
+  [/\.mlpackage(?:$|[/\\])/i, "raw CoreML package shipped"],
+  [/[/\\]docs[/\\]experiments(?:$|[/\\])/i, "experiment docs shipped"],
+  [/[/\\]\.scratch(?:$|[/\\])/i, "scratch directory shipped"],
+  [/[/\\]\.git(?:$|[/\\])/i, "git metadata shipped"],
+  [/[/\\]node_modules(?:$|[/\\])/i, "node_modules shipped"],
+  [/[/\\](?:src|tests?|benches|benchmarks)(?:$|[/\\])/i, "source/test tree shipped"],
+  [/[/\\]tdt_w15_p6(?:$|[/\\])/i, "stale TDT p6 model shipped"],
+];
+
+const contentRules = [
+  ["local-source-path", /\/Users\/adrdsouza\/claude/gi, "local source path leaked"],
+  ["local-cargo-path", /\/Users\/adrdsouza\/\.cargo/gi, "local cargo path leaked"],
+  ["local-windows-path", /C:\\Users\\adrdsouza\\(?:claude|\.cargo)/gi, "local Windows source path leaked"],
+  ["experiment-path", /docs\/experiments/gi, "experiment path leaked"],
+  ["cleanup-prompt-marker", /l3_cleanup_prompt/gi, "L3 cleanup prompt marker leaked"],
+  ["system-prompt-marker", /SYSTEM_PROMPT/gi, "system prompt marker leaked"],
+  ["secret-env-name", /OPENAI_API_KEY|ANTHROPIC_API_KEY|APPLE_PASSWORD|NOTARY_PROFILE/gi, "secret/env key name leaked"],
+  ["gpl-flag", /--enable-gpl|--enable-nonfree/gi, "GPL/nonfree ffmpeg flag leaked"],
+  ["stale-model", /tdt_w15_p6/gi, "stale TDT p6 string leaked"],
+  ["experiment-model", /Canary-Qwen|Nemotron|dqlstm|bias-experiments/gi, "experiment/model-history marker leaked"],
+];
+
+const maxPatternLen = Math.max(...contentRules.map(([, rule]) => String(rule).length), 256);
+
+function add(kind, file, message, detail = "") {
+  findings.push({ kind, file: path.relative(root, file) || file, message, detail });
+}
+
+async function walk(target) {
+  const st = await lstat(target);
+  const normalized = target.split(path.sep).join("/");
+  for (const [rule, message] of fileNameRules) if (rule.test(normalized)) add("path", target, message);
+  if (st.isDirectory()) {
+    const entries = await readdir(target);
+    await Promise.all(entries.map((name) => walk(path.join(target, name))));
+    return;
+  }
+  if (st.isFile()) await scanFile(target);
+}
+
+function scanFile(file) {
+  return new Promise((resolveScan) => {
+    const artifactSha256 = createHash("sha256").update(readFileSync(file)).digest("hex");
+    const stream = createReadStream(file, { highWaterMark: 256 * 1024 });
+    let tail = "";
+    stream.on("data", (chunk) => {
+      const text = tail + chunk.toString("latin1");
+      for (const [ruleId, rule, message] of contentRules) {
+        if (/ffmpeg-LICENSE\.txt$/i.test(file) && ruleId === "gpl-flag") continue;
+        rule.lastIndex = 0;
+        for (const match of text.matchAll(rule)) {
+          const allowed = allowances.some((allowance) =>
+            allowance.rule === ruleId &&
+            allowance.artifactSha256 === artifactSha256 &&
+            allowance.exact === match[0] &&
+            typeof allowance.sourceEvidence === "string" &&
+            typeof allowance.rationale === "string"
+          );
+          if (!allowed) add("content", file, message, rule.source);
+        }
+      }
+      tail = text.slice(-maxPatternLen);
+    });
+    stream.on("error", (error) => {
+      add("read", file, "could not scan file", error.message);
+      resolveScan();
+    });
+    stream.on("end", resolveScan);
+  });
+}
+
+for (const arg of args) {
+  const target = path.resolve(arg);
+  try {
+    await walk(target);
+  } catch (error) {
+    add("target", target, "could not scan target", error.message);
+  }
+}
+
+const unique = new Map();
+for (const finding of findings) unique.set([finding.kind, finding.file, finding.message].join("\0"), finding);
+const deduped = [...unique.values()].sort((left, right) =>
+  (left.file + " " + left.message).localeCompare(right.file + " " + right.message),
+);
+
+if (deduped.length) {
+  console.error("hardeningscan: " + deduped.length + " finding(s)");
+  for (const finding of deduped) console.error("- [" + finding.kind + "] " + finding.file + ": " + finding.message);
+  process.exit(1);
+}
+
+console.log("hardeningscan: clean");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.80",
+  "version": "0.2.82",
   "description": "Portable Right Suite release CLI/SDK: signed native archives, direct bootstrap transactions, immutable GitHub Release upload, R2 bootstrap publication, and add-on adoption.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/release.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { access, readFile, readdir } from "node:fs/promises";
 import { createHash } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, realpathSync, unlinkSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, realpathSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { spawn, spawnSync } from "node:child_process";
@@ -378,6 +378,12 @@ async function runNativeFinalizer({ finalizer, nativeAssembly, target, root, sig
     ...finalizer,
     args: finalizer.args.map((arg) => expandFinalizerToken(arg, { provenance, outputPath, packageIdentity })),
   };
+  // A finalization receipt at outputPath from a PREVIOUS run must not
+  // survive into this one: the file is preferred over the finalizer's
+  // stdout below, and a stale receipt carries the prior run's provenance,
+  // which fails the identity check against this run's mint. Any file
+  // present after the finalizer returns was written by this run.
+  if (!opts.dryRun) rmSync(outputPath, { force: true });
   const stdout = await runCommand(finalizerCommand, root, {
     captureStdout: true,
     env: {

package/rightkit-versions.json

@@ -22,7 +22,7 @@
     "@rightkit/logs": "0.1.4",
     "@rightkit/platform-ui": "0.1.1",
     "@rightkit/qa": "0.2.1",
-    "@rightkit/release": "0.2.80",
+    "@rightkit/release": "0.2.82",
     "@rightkit/tauri": "0.1.1",
     "@rightkit/updates": "0.2.4"
   },