@rightkit/release 0.6.8 → 0.6.11

package/broker-pins.mjs

@@ -0,0 +1,152 @@
+// The gate's own record of the broker it trusts on this host (Sage decision A, item 7 row 7.21; AR 256-258: pins come from the
+// consumer's own enrollment, "never from the receipt, request or project").
+//
+//   record   `<managed data root>/pins/broker-<platform>.json`, `{schema, platform, host, keyId, publicKey, brokerDigest, enrolledAt}`,
+//            outside every repository and snapshot, written only by `enrollBrokerPins` (an explicit operation; a second enrollment
+//            for the same platform is a rotation and says so).
+//   fallback RightKit's own checkout only: `ci/rk-pipeline.json` `attestation.<platform>`, read from the revision of the RUNNING gate
+//            (`git show <gate repository HEAD>:ci/rk-pipeline.json`), never from the selected commit, the snapshot or the working tree.
+//
+// Never read here: the broker's control root, its runtime manifest, `attestation/key.json` (it holds the SECRET key), an environment
+// variable, a flag, the snapshot or a receipt. A missing record in any repository but RightKit refuses the snapshot compile; nothing
+// is enrolled automatically.
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "./background-process.mjs";
+import { fileURLToPath } from "node:url";
+
+export const PINS_SCHEMA = "rightkit.broker-pins/1";
+export const PINS_DIR = "pins";
+export const PIPELINE_FILE = "ci/rk-pipeline.json";
+export const PIPELINE_SCHEMA = "rk-pipeline.v1";
+
+export class BrokerPinsError extends Error {
+  constructor(code, message) { super(message); this.name = "BrokerPinsError"; this.code = code; }
+}
+const fail = (code, message) => { throw new BrokerPinsError(code, message); };
+const sha256 = (data) => crypto.createHash("sha256").update(data).digest("hex");
+const HEX = /^(?:[0-9a-f]{2})+$/;
+
+/** The pin record of one platform under the managed data root. */
+export const pinsFile = ({ dataRoot, platform = process.platform }) => {
+  if (!dataRoot || !path.isAbsolute(dataRoot)) fail("RK_BROKER_PINS_ROOT", "the managed data root must be an absolute path");
+  if (!["darwin", "win32"].includes(platform)) fail("RK_BROKER_PINS_PLATFORM", `${platform} is not a broker host (darwin and win32 only)`);
+  return path.join(dataRoot, PINS_DIR, `broker-${platform}.json`);
+};
+
+/** `{host, keyId, publicKey, brokerDigest}` or a throw naming what is wrong. The key must be an uncompressed P-256 point whose sha256 is the key id. */
+export function validatePins(pins, label = "the broker pins") {
+  const bad = (why) => fail("RK_BROKER_PINS_INVALID", `${label}: ${why}`);
+  if (pins === null || typeof pins !== "object" || Array.isArray(pins)) bad("not an object");
+  const { host, keyId, publicKey, brokerDigest } = pins;
+  if (typeof host !== "string" || !host.trim()) bad("host is missing");
+  if (typeof publicKey !== "string" || !HEX.test(publicKey) || publicKey.length !== 130 || !publicKey.startsWith("04")) bad("publicKey is not an uncompressed SEC1 P-256 point in lowercase hex");
+  if (typeof keyId !== "string" || keyId !== sha256(Buffer.from(publicKey, "hex"))) bad("keyId is not the sha256 of the public key");
+  if (typeof brokerDigest !== "string" || !/^[0-9a-f]{64}$/.test(brokerDigest)) bad("brokerDigest is not a sha256 in lowercase hex");
+  return { host, keyId, publicKey, brokerDigest };
+}
+
+const isLink = (meta) => meta.isSymbolicLink();
+
+/** The enrolled record, or null when none exists. A link, a non-file, another platform's record or a malformed one is a refusal, never null. */
+export function readEnrolledPins({ dataRoot, platform = process.platform }) {
+  const file = pinsFile({ dataRoot, platform });
+  let meta;
+  try { meta = fs.lstatSync(file); } catch (e) { if (e.code === "ENOENT") return null; throw e; }
+  if (isLink(meta) || !meta.isFile()) fail("RK_BROKER_PINS_INVALID", `${file} is not a regular file`);
+  const dir = fs.lstatSync(path.dirname(file));
+  if (isLink(dir) || !dir.isDirectory()) fail("RK_BROKER_PINS_INVALID", `${path.dirname(file)} is not a real directory`);
+  if (process.platform !== "win32" && (meta.mode & 0o022 || dir.mode & 0o022)) fail("RK_BROKER_PINS_INVALID", `${file} or its directory is writable by group or others`);
+  let record;
+  try { record = JSON.parse(fs.readFileSync(file, "utf8")); } catch (e) { fail("RK_BROKER_PINS_INVALID", `${file} is not JSON (${e.message})`); }
+  if (record?.schema !== PINS_SCHEMA) fail("RK_BROKER_PINS_INVALID", `${file} is not a ${PINS_SCHEMA} record`);
+  if (record.platform !== platform) fail("RK_BROKER_PINS_INVALID", `${file} is the record of ${record.platform}, not ${platform}`);
+  return { ...validatePins(record, file), source: "enrolled", file };
+}
+
+const git = (spawn, cwd, args) => {
+  const r = spawn("git", args, { cwd, encoding: "utf8" });
+  if (r.error || r.status !== 0) return null;
+  return String(r.stdout ?? "").trim();
+};
+
+/**
+ * RightKit's own pins, from the revision of the running gate: the repository that holds `gateFile` and its HEAD commit, only when
+ * that repository IS the checkout being compiled (RightKit itself). Null when the gate is not run from a RightKit checkout.
+ */
+export function readGateRevisionPins({ gateFile, checkout, platform = process.platform, spawn = spawnSync, realpath = (p) => fs.realpathSync.native(p) }) {
+  const here = path.dirname(gateFile);
+  const top = git(spawn, here, ["rev-parse", "--show-toplevel"]);
+  if (!top) return null;
+  let same = false;
+  try { same = realpath(top) === realpath(checkout); } catch { same = false; }
+  if (!same) return null;
+  const revision = git(spawn, here, ["rev-parse", "--verify", "HEAD^{commit}"]);
+  if (!revision || !/^[0-9a-f]{40,64}$/.test(revision)) fail("RK_BROKER_PINS_INVALID", "the running gate's revision cannot be read");
+  const blob = spawn("git", ["show", `${revision}:${PIPELINE_FILE}`], { cwd: here, encoding: "utf8", maxBuffer: 16 * 1024 * 1024 });
+  if (blob.error || blob.status !== 0) return null;
+  let pipeline;
+  try { pipeline = JSON.parse(String(blob.stdout)); } catch (e) { fail("RK_BROKER_PINS_INVALID", `${PIPELINE_FILE} at the gate's revision ${revision.slice(0, 12)} is not JSON (${e.message})`); }
+  if (pipeline?.schema !== PIPELINE_SCHEMA) fail("RK_BROKER_PINS_INVALID", `${PIPELINE_FILE} at the gate's revision is not ${PIPELINE_SCHEMA}`);
+  const entry = pipeline.attestation?.[platform];
+  if (!entry) return null;
+  return { ...validatePins(entry, `${PIPELINE_FILE} (${platform}) at the gate's revision ${revision.slice(0, 12)}`), source: "rk-pipeline", revision };
+}
+
+/**
+ * The pins this gate verifies broker receipts against: the enrolled record, else (RightKit only) the running gate's own revision.
+ * Throws RK_BROKER_PINS_MISSING when neither exists: an app repository without an enrollment compiles nothing through a broker.
+ */
+export function loadBrokerPins({ dataRoot, platform = process.platform, gateFile, checkout, spawn, realpath }) {
+  const enrolled = readEnrolledPins({ dataRoot, platform });
+  if (enrolled) return enrolled;
+  const fallback = gateFile && checkout ? readGateRevisionPins({ gateFile, checkout, platform, spawn, realpath }) : null;
+  if (fallback) return fallback;
+  return fail("RK_BROKER_PINS_MISSING", `no broker enrollment for ${platform} (${pinsFile({ dataRoot, platform })}), and this is not the RightKit checkout whose gate revision carries ${PIPELINE_FILE} pins; enroll the host's broker explicitly, the gate never enrolls one itself`);
+}
+
+/**
+ * The explicit enroll operation. Values come from the caller (the output of `rustright-broker --generate-attestation-key` and the
+ * installed runtime's `brokerDigest`); nothing is read from the broker, its key file or the environment. An existing record is
+ * replaced only with `rotate: true`.
+ */
+export function enrollBrokerPins({ dataRoot, platform = process.platform, host, keyId, publicKey, brokerDigest, rotate = false, now = () => new Date() }) {
+  const pins = validatePins({ host, keyId, publicKey, brokerDigest }, "the enrollment");
+  const file = pinsFile({ dataRoot, platform });
+  const dir = path.dirname(file);
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const meta = fs.lstatSync(dir);
+  if (isLink(meta) || !meta.isDirectory()) fail("RK_BROKER_PINS_INVALID", `${dir} is not a real directory`);
+  let existing = null;
+  try { existing = readEnrolledPins({ dataRoot, platform }); } catch (e) { if (!rotate) throw e; }
+  if (existing && !rotate) fail("RK_BROKER_PINS_EXISTS", `${file} already enrolls key ${existing.keyId.slice(0, 12)}; replacing it is a rotation (pass rotate: true)`);
+  const record = { schema: PINS_SCHEMA, platform, ...pins, enrolledAt: now().toISOString(), ...(existing ? { rotatedFrom: { keyId: existing.keyId, brokerDigest: existing.brokerDigest } } : {}) };
+  const tmp = `${file}.${crypto.randomUUID()}.tmp`;
+  fs.writeFileSync(tmp, `${JSON.stringify(record, null, 2)}\n`, { flag: "wx", mode: 0o600 });
+  try { fs.renameSync(tmp, file); } finally { fs.rmSync(tmp, { force: true }); }
+  return { file, record, rotated: Boolean(existing) };
+}
+
+/** `node broker-pins.mjs enroll --platform <darwin|win32> --data-root <dir> --host H --key-id K --public-key P --broker-digest D [--rotate]` or `show`. */
+export function main(argv, { out = (m) => process.stdout.write(`${m}\n`), err = (m) => process.stderr.write(`${m}\n`) } = {}) {
+  const [command, ...rest] = argv;
+  const opt = (name) => { const i = rest.indexOf(name); return i < 0 ? undefined : rest[i + 1]; };
+  try {
+    const dataRoot = opt("--data-root"); const platform = opt("--platform") ?? process.platform;
+    if (command === "enroll") {
+      const r = enrollBrokerPins({ dataRoot, platform, host: opt("--host"), keyId: opt("--key-id"), publicKey: opt("--public-key"), brokerDigest: opt("--broker-digest"), rotate: rest.includes("--rotate") });
+      out(`enrolled ${r.record.platform} ${r.record.host} key ${r.record.keyId} in ${r.file}${r.rotated ? " (rotation)" : ""}`);
+      return 0;
+    }
+    if (command === "show") {
+      const pins = readEnrolledPins({ dataRoot, platform });
+      out(pins ? JSON.stringify(pins) : "no enrollment");
+      return pins ? 0 : 1;
+    }
+    err("usage: broker-pins.mjs enroll|show --platform <darwin|win32> --data-root <dir> [--host H --key-id K --public-key P --broker-digest D [--rotate]]");
+    return 2;
+  } catch (e) { err(`${e.code ?? "error"}: ${e.message}`); return 1; }
+}
+
+if (process.argv[1] && (() => { try { return fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url)); } catch { return false; } })()) process.exit(main(process.argv.slice(2)));

package/build-launch.mjs

@@ -0,0 +1,88 @@
+// The one door for the build and test commands RightKit launches for an app or a unit (rightkit#1241): on a broker-managed host
+// every such command is a broker job, so class A admission, the one-build-per-app claim, the in-place freeze and the host's
+// resource limits apply to it as they do to a cargo build; on a host without a broker it runs directly, as before.
+//
+// - pnpm <args>                 -> <rustright> run rightkit-pnpm -- <args>   (the broker's pnpm adapter; compile-flagged on the broker)
+// - node <script> <args>        -> <rustright> run rightkit-node -- <script> <args>   (a script inside the job's workspace, relative path)
+// - cargo <args>               -> <rustright> cargo <args>   (by the resolved broker client, whatever path the caller named: a real
+//                                  cargo binary is never launched around the broker)
+// - rustright <args>           -> <rustright> <args>         (the resolved broker client)
+// - rightkit-qa <args>         -> <rustright> run rightkit-qa -- <args>   (the whole QA run, its test binaries included, is one broker
+//                                  job holding the app's claim; its own `rustright cargo test --no-run` runs nested under that job)
+// - this package's right-release -> unchanged (same NODE_OPTIONS as this process): it orchestrates, and every build it starts comes back
+//                                  through this door
+// - anything else               -> refused on a managed host: no broker adapter runs it yet, and running it directly would bypass the
+//                                  broker (fail closed; the per-app impact is mapped in rightkit#1241)
+// A launch from inside a broker job is routed the same way: the broker attributes it to its parent job by the parent's own
+// capability token (never by an environment marker this module reads), so no launch here decides to skip the broker.
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { resolveExecutor } from "./gate-executor.mjs";
+import { resolveExecutable } from "./admission-host.mjs";
+
+export const BUILD_LAUNCH_REFUSED = "RK_BUILD_LAUNCH_REFUSED";
+const OWN_RIGHT_RELEASE = fileURLToPath(new URL("./cli/right-release.mjs", import.meta.url));
+// Node flags that change no code path; everything else before the script (-e, --eval, -p, --import, -r, --require, --loader, …) refuses.
+const NODE_FLAGS = /^--(?:disable-warning=[A-Za-z0-9_-]+|no-experimental-webstorage|no-warnings|enable-source-maps|max-old-space-size=\d+|stack-size=\d+)$/;
+const name = (program) => path.basename(String(program ?? "").replaceAll("\\", "/")).replace(/\.(exe|cmd|bat)$/i, "").toLowerCase();
+
+function refuse(message) {
+  const error = new Error(message);
+  error.code = BUILD_LAUNCH_REFUSED;
+  throw error;
+}
+
+/**
+ * `{ command, args }` to launch for a build or test command, or a refusal. `host` carries env, platform, exists, which and readFile
+ * (resolveExecutor's inputs); `which` defaults to a PATH lookup over `env`.
+ */
+export function buildLaunch(command, args = [], host = {}) {
+  const env = host.env ?? process.env;
+  const platform = host.platform ?? process.platform;
+  const exists = host.exists;
+  const lookup = (cmd) => { const found = resolveExecutable(cmd, { env, hostPlatform: platform, exists: exists ?? (() => false) }); return found ? [found] : []; };
+  const executor = resolveExecutor({ env, platform, exists, which: host.which ?? lookup, readFile: host.readFile ?? ((file) => readFileSync(file, "utf8")) });
+  if (executor.kind === "refuse") refuse(`${name(command)} ${args.join(" ")}: ${executor.problem}`);
+  // A direct (Linux) host: the real toolchain, RustRight shim directories off PATH (`env`, to merge into the launch env); a configured
+  // `rustright cargo|rustc|rustdoc …` runs that tool directly; any other `rustright` command has no direct form and is refused.
+  if (executor.kind === "direct") {
+    const extra = executor.env ? { env: executor.env } : {};
+    if (name(command) === "rustright") {
+      if (!["cargo", "rustc", "rustdoc"].includes(String(args[0]))) refuse(`rustright ${args.join(" ")}: no broker on this ${platform} host, and only rustright cargo|rustc|rustdoc map to the toolchain`);
+      return { command: String(args[0]), args: args.slice(1).map(String), ...extra };
+    }
+    return { command, args, ...extra };
+  }
+  const program = name(command);
+  const client = () => lookup("rustright")[0] ?? refuse(`rustright is not on PATH: on a broker-managed host ${program} runs only as a broker job`);
+  if (program === "cargo") return { command: client(), args: ["cargo", ...args.map(String)] };
+  if (program === "rustright") return { command: client(), args: args.map(String) };
+  if (program === "rightkit-qa") return { command: client(), args: ["run", "rightkit-qa", "--", ...args.map(String)] };
+  if (program === "swift") return { command: client(), args: ["run", "rightkit-swift", "--", ...args.map(String)] };
+  // This package's own right-release, run by this very Node binary (not any executable named node), with no startup code added by
+  // the caller: NODE_OPTIONS is empty or exactly this process's own string (a hook's env could otherwise --import code that builds
+  // outside the broker; reordered tokens can re-pair an option with another value, so nothing short of equality is accepted).
+  if (command === process.execPath && path.resolve(String(args[0] ?? "")) === OWN_RIGHT_RELEASE) {
+    const options = String(env.NODE_OPTIONS ?? "");
+    if (options.trim() !== "" && options !== String(process.env.NODE_OPTIONS ?? "")) refuse(`right-release ${args.slice(1).join(" ")}: NODE_OPTIONS is neither empty nor exactly this process's own; on a broker-managed host the door's own right-release runs with no added startup code (rightkit#1241)`);
+    return { command, args };
+  }
+  if (program === "node") {
+    // Leading node flags are limited to ones that change no code path (warnings, web storage, heap/stack size); an eval, import,
+    // require or loader flag would run code that is not the script, so it is refused. The adapter takes the script as a path
+    // relative to the job's workspace (its cwd); an absolute or escaping path is refused here and by the broker's relpath check.
+    const at = args.findIndex((a) => !String(a).startsWith("-"));
+    const flags = (at < 0 ? args : args.slice(0, at)).map(String);
+    const bad = flags.find((f) => !NODE_FLAGS.test(f));
+    if (at < 0 || bad !== undefined) refuse(`node ${args.join(" ")}: ${bad !== undefined ? `node flag ${bad} is not allowed` : "no script"}; on a broker-managed host node runs only a workspace script as a broker job (rightkit-node, rightkit#1241)`);
+    const cwd = host.cwd ?? process.cwd();
+    const script = path.isAbsolute(String(args[at])) ? path.relative(cwd, String(args[at])) : String(args[at]);
+    if (!script || script.startsWith("..") || path.isAbsolute(script)) refuse(`node ${args[0]}: the script is outside the job's workspace (${cwd}); on a broker-managed host node runs only workspace scripts as broker jobs (rightkit-node, rightkit#1241)`);
+    return { command: client(), args: ["run", "rightkit-node", "--", ...flags, script.replaceAll("\\", "/"), ...args.slice(at + 1).map(String)] };
+  }
+  if (program === "pnpm") {
+    return { command: client(), args: ["run", "rightkit-pnpm", "--", ...args.map(String)] };
+  }
+  return refuse(`${program} ${args.join(" ")}: no broker adapter runs this command yet, and on a broker-managed host a build or test command never runs around the broker (rightkit#1241)`);
+}