@rightkit/release 0.6.6 → 0.6.7

package/build-release.mjs

@@ -52,7 +52,7 @@ import { macosCodesignEnvironment } from "./codesign-environment.mjs";
 import { ANDROID_RECEIPT_NAME, androidSealEntry, validateAndroidTarget, verifyAndroidReceipt } from "./android-release.mjs";
 import { IOS_RECEIPT_NAME, iosSealEntry, verifyIosReceipt } from "./ios-package-recipe.mjs";
 import { expandIosPackageTarget } from "./package-recipe-targets.mjs";
-import { assertUpdaterSignature } from "./github-updater-release.mjs";
+import { assertUpdaterKeyId, assertUpdaterSignature, isSuiteUpdaterApp, resolveUpdaterTrust } from "./github-updater-release.mjs";
 
 // The iOS lane's own packaging code, kept out of the win/mac fingerprint for the same reason as the Android one.
 const IOS_PIPELINE_FINGERPRINT = createHash("sha256")
@@ -688,17 +688,24 @@ function sealRelease({ configRoot, managedCargoTarget, androidTarget, iosSpec, n
   }
   if (sources.size === 0) fail(`nothing to seal: declare installer.artifacts, updater.artifacts or artifacts for the ${platform} target`);
   for (const file of sources.keys()) if (!existsSync(file)) fail(`cannot seal missing artifact: ${file}`);
-  // Every minisign updater requires an explicit trust root & full-byte signature
-  // verification before any seal directory or artifact copy is created.
+  // Every minisign updater is checked against a trust root, by key id and over the full bytes, before any seal directory or
+  // artifact copy is created. A Right Suite app's root is the Right Suite contract's; any other app must declare its own key.
   const updaterPublicKey = config.distribution?.updaterPublicKey ?? config.distribution?.updaterPubkey ?? target?.updater?.pubkey ?? target?.updater?.publicKey;
   if ((target.updater?.artifacts?.length ?? 0) > 0 && target.updater?.kind !== "appinstaller") {
-    if (typeof updaterPublicKey !== "string" || !updaterPublicKey.trim()) fail("updater public key is required to verify updater artifacts before sealing");
+    if (!isSuiteUpdaterApp(config.app) && (typeof updaterPublicKey !== "string" || !updaterPublicKey.trim())) fail("updater public key is required to verify updater artifacts before sealing");
+    let trust;
+    try { trust = resolveUpdaterTrust({ app: config.app, configuredPublicKey: updaterPublicKey, configuredKeyId: config.distribution?.updaterKeyId }); }
+    catch (error) { fail(`updater trust rejected at seal: ${error.message}`); }
     for (const artifact of target.updater?.artifacts ?? []) {
       const source = resolveArtifactPath(artifact.file);
       const signature = readFileSync(resolveArtifactPath(artifact.signature), "utf8").trim();
       if (!signature) fail(`updater signature is empty, refusing to seal: ${artifact.signature}`);
-      try { assertUpdaterSignature(readFileSync(source), signature, updaterPublicKey, `signature of ${path.basename(artifact.file)}`); }
-      catch (error) { fail(`updater signature rejected at seal: ${error.message}`); }
+      const label = `signature of ${path.basename(artifact.file)}`;
+      // The id comes first: a signature by another key would otherwise fail verification without saying whose it is.
+      try {
+        assertUpdaterKeyId(signature, trust.keyId, label, { app: config.app });
+        assertUpdaterSignature(readFileSync(source), signature, trust.publicKey, label);
+      } catch (error) { fail(`updater signature rejected at seal: ${error.message}`); }
     }
   }
   // Android: the build receipt must describe exactly the AAB being sealed (bytes re-hashed) and its signer must be the pinned

package/cli/right-release.mjs

@@ -57,8 +57,27 @@ const args = process.argv.slice(2);
 const first = args[0];
 // The commands that compile, package, sign, ship or inspect a release run the app check (../app-check.mjs, CHECKED_COMMANDS) in this
 // process before they start a child. A red check prints its findings and exits 1; there is no flag that skips it.
+const WORKTREE_COMPILES = new Set(["dev", "test", "stage-sidecar"]);
 async function requireGreenCheck() {
-  const { guardCommand } = await import("../app-check.mjs");
+  const { guardCommand, checkedCommandOf, checkModeFor, appDirectory } = await import("../app-check.mjs");
+  // One door (Adrian, 2026-10-25): a commit-bound command (build, package, release, qa, upload, publish, signing) runs only when
+  // rightkit-gate --to launched it for HEAD, after class A and the compile stage passed.
+  const checked = checkedCommandOf(args);
+  // dev, test and stage-sidecar work on the uncommitted tree but compile, so they too run only under a door run
+  // (rightkit-gate --to dev|test, class A on the working tree first).
+  // Gate on the mode, not the key: a flag-first call (`right-release --platform mac`) is a build with no command word.
+  if (checkModeFor(args) === "commit" || (checked && WORKTREE_COMPILES.has(checked))) {
+    const { requireDoorRun } = await import("../gate-stages.mjs");
+    const { spawnSync } = await import("../background-process.mjs");
+    const cwd = appDirectory(args, process.cwd());
+    const gitOut = (a) => { const r = spawnSync("git", a, { cwd, encoding: "utf8" }); return r.status === 0 ? r.stdout.trim() : ""; };
+    const common = gitOut(["rev-parse", "--git-common-dir"]);
+    // Outside a git repository the app check below refuses (nothing can be bound to a commit); inside one, only a door run admits.
+    if (common) {
+      const refusal = requireDoorRun({ commonDir: path.resolve(cwd, common), commit: gitOut(["rev-parse", "HEAD"]), command: `right-release ${checked ?? args.join(" ")}`.trim() });
+      if (refusal) { console.error(`right-release: ${refusal}`); process.exit(2); }
+    }
+  }
   const refused = guardCommand({ args });
   if (!refused) return;
   for (const line of refused.lines) console.error(line);
@@ -103,9 +122,11 @@ if (first === "--version" || first === "-v") {
     run("release.mjs", ["--doctor", ...args.slice(1)]);
   }
 } else if (first === "check") {
-  // The same offline check as `rightkit-gate check`; the repository is the git top-level of --config's folder, else the cwd.
-  const { appDirectory, main } = await import("../app-check.mjs");
-  process.exit(await main(args.slice(1), { label: "check", cwd: appDirectory(args, process.cwd()) }));
+  // Exactly `rightkit-gate check` (one door): the app check, then every class A scan over the whole commit. The repository is the git
+  // top-level of --config's folder, else the cwd.
+  const { appDirectory } = await import("../app-check.mjs");
+  const { main } = await import("../bin/rightkit-gate.mjs");
+  process.exit(await main(["check", ...args.slice(1)], { cwd: appDirectory(args, process.cwd()) }));
 } else if (first === "hooks" && args[1] === "install") {
   // One installer: `hooks install` is `rightkit-gate install-hook` (pre-push check and gate, ownership pre-commit step) run in the app.
   const app = args.indexOf("--app");
@@ -373,8 +394,10 @@ Commands:
   disk check [--json]                                Per-writer sizes vs caps and free-space floor (exit 3 on warning)
   disk sweep [--dry-run] [--days N] [--delete] [--json]
                                                       Move stale idle heavy data to the heavy volume (delete only with --delete)
-  disk run                                           self-check, check, dry-run sweep, move sweep, warn (the scheduled job)
-  disk schedule install|uninstall|status             Daily launchd job (Mac) / hidden Task Scheduler entry (Windows), bound to the stable per-user copy
+  disk run [--auto|--light]                          self-check, then the full pass (check, sweep, purge, daily report); --light is the stat-only hourly pass (floors, temp-like writers, scratch; purges only below the agent volume's soft floor); --auto picks full once a day after 03:30, else light (the scheduled job)
+  disk run-root <name> [--days N] [--json]           Lease a run directory under the scratch root (default 3 days): the sweep skips it until the lease ends
+  disk run-root --release <name>                     End a run-root lease
+  disk schedule install|uninstall|status             Hourly launchd job (Mac) / hidden Task Scheduler entry (Windows) running "disk run --auto", bound to the stable per-user copy; status fails when no full pass finished in 26 h
   deps --check|--audit|--update                      Shared dependency lane
   update check|apply|gate|land|discard|run|schedule [--repo <path>]
                                                       Run the pinned @rightkit/outdated updater (right-update) that moves stale pins; reads .rightkit/update.json

package/compile-inputs.mjs

@@ -0,0 +1,66 @@
+// The declared compile inputs a RustRight broker captured for a compile (RIGHTKIT_COMPILE_INPUTS): the gate judges exactly
+// those bytes, where the broker copied them, so what is checked is what the compile reads. The tree's tracked files are
+// judged from the commit as always; the declared inputs are the ignored paths (a built `dist`, generated assets) the
+// commit does not hold, listed in the captured tree's `.rightkit/compile-inputs.json`.
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "./background-process.mjs";
+import { SECRET_PATTERNS } from "./publish-cargo.mjs";
+
+export const COMPILE_INPUTS_FILE = ".rightkit/compile-inputs.json";
+
+/** Files of one declared input in the broker's order (children by name), refusing links; [{ name, abs }]. */
+function inputFiles(root, input) {
+  const out = [];
+  const walk = (abs, name) => {
+    const st = fs.lstatSync(abs);
+    if (st.isSymbolicLink()) throw new Error(`declared compile input holds a symbolic link at ${name}`);
+    if (st.isDirectory()) {
+      for (const child of fs.readdirSync(abs).sort((a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b)))) walk(path.join(abs, child), `${name}/${child}`);
+    } else if (st.isFile()) out.push({ name, abs });
+  };
+  walk(path.join(root, input), input);
+  return out;
+}
+
+/**
+ * Judges the captured declared inputs under `root`: each declared path must exist without links; every `.js/.mjs/.cjs`
+ * file parses (`node --check`), every `.json` file parses, and no file carries a secret. Returns { inputs: [{ path, sha256,
+ * files }], findings: [string] }; `sha256` is computed as the broker records it (name, NUL, bytes, NUL per file, in order),
+ * so the receipt and the gate name the same bytes.
+ */
+export function judgeCompileInputs(root, { spawn = spawnSync, execPath = process.execPath } = {}) {
+  const findings = [];
+  let declared = [];
+  const file = path.join(root, COMPILE_INPUTS_FILE);
+  if (!fs.existsSync(file)) return { inputs: [], findings };
+  try {
+    declared = JSON.parse(fs.readFileSync(file, "utf8")).inputs;
+    if (!Array.isArray(declared) || declared.some((p) => typeof p !== "string")) throw new Error("`inputs` must be a list of paths");
+  } catch (e) {
+    return { inputs: [], findings: [`${COMPILE_INPUTS_FILE}: ${e.message}`] };
+  }
+  const inputs = [];
+  for (const input of declared) {
+    if (path.isAbsolute(input) || input.split(/[\\/]/).some((part) => part === ".." || part === "." || part === "")) { findings.push(`${input}: not a plain relative path`); continue; }
+    let files;
+    try { files = inputFiles(root, input); } catch (e) { findings.push(`${input}: ${e.code === "ENOENT" ? "missing from the captured tree" : e.message}`); continue; }
+    const hash = crypto.createHash("sha256");
+    for (const f of files) {
+      const bytes = fs.readFileSync(f.abs);
+      hash.update(f.name); hash.update(Buffer.from([0])); hash.update(bytes); hash.update(Buffer.from([0]));
+      const text = bytes.toString("utf8");
+      if (SECRET_PATTERNS.some((pattern) => pattern.test(text))) findings.push(`${f.name}: holds a secret (token or private key pattern)`);
+      if (/\.(m|c)?js$/.test(f.name)) {
+        const r = spawn(execPath, ["--check", f.abs], { encoding: "utf8" });
+        if (r.status !== 0) findings.push(`${f.name}: does not parse (${String(r.stderr ?? "").split("\n").find((l) => /Error/.test(l))?.trim() ?? `node --check exit ${r.status}`})`);
+      }
+      if (/\.json$/.test(f.name)) {
+        try { JSON.parse(text); } catch (e) { findings.push(`${f.name}: invalid JSON (${e.message})`); }
+      }
+    }
+    inputs.push({ path: input, sha256: hash.digest("hex"), files: files.length });
+  }
+  return { inputs, findings };
+}