@serve.zone/interfaces 31.8.0 → 32.0.0

package/ts/runtime.workloadinit.ts

@@ -1,5 +1,6 @@
 import type { TSha256Digest, TImmutableContainerPlatform } from './data/immutableimage.js';
 import { isSha256Digest } from './data/immutableimage.js';
+import { hasExactKeys } from './private/dataproperties.js';
 
 export const workloadInitReleaseContract = Object.freeze({
   packageName: '@serve.zone/workloadinit',
@@ -9,20 +10,20 @@ export const workloadInitReleaseContract = Object.freeze({
   imageIndexMediaType: 'application/vnd.oci.image.index.v1+json',
   statementType: 'https://in-toto.io/Statement/v1',
   predicateType: 'https://slsa.dev/provenance/v1',
-  buildType: 'https://serve.zone/buildtypes/workloadinit-gitzone-tsdocker/v1',
-  builderId: 'https://serve.zone/builders/workloadinit-manual-release/v1',
+  buildType: 'https://serve.zone/buildtypes/workloadinit-gitzone-tsdocker',
+  builderId: 'https://serve.zone/builders/workloadinit-manual-release',
   signatureFormat: 'cosign-dsse-bundle-v0.3',
   signatureAlgorithm: 'ecdsa-p256-sha256',
 } as const);
 
-export interface IWorkloadInitBuildToolVersionsV1 {
+export interface IWorkloadInitBuildToolVersions {
   dockerBuildx: string;
   gitzone: string;
   tsdocker: string;
   tsrust: string;
 }
 
-export interface IWorkloadInitReleaseIdentityV1 {
+export interface IWorkloadInitReleaseIdentity {
   packageName: typeof workloadInitReleaseContract.packageName;
   version: string;
   sourceRepository: typeof workloadInitReleaseContract.sourceRepository;
@@ -34,7 +35,7 @@ export interface IWorkloadInitReleaseIdentityV1 {
   imageTag: string;
 }
 
-export interface IWorkloadInitReleaseAttestationStatementV1 {
+export interface IWorkloadInitReleaseAttestationStatement {
   _type: typeof workloadInitReleaseContract.statementType;
   subject: [{
     name: string;
@@ -69,7 +70,7 @@ export interface IWorkloadInitReleaseAttestationStatementV1 {
     runDetails: {
       builder: {
         id: typeof workloadInitReleaseContract.builderId;
-        version: IWorkloadInitBuildToolVersionsV1;
+        version: IWorkloadInitBuildToolVersions;
       };
     };
   };
@@ -79,7 +80,7 @@ export interface IWorkloadInitReleaseAttestationStatementV1 {
  * Cloudly-created summary of a private DSSE verification. Shape and digest
  * validation do not independently prove the signature or its trust policy.
  */
-export interface IWorkloadInitCloudlyVerificationSummaryV1 {
+export interface IWorkloadInitCloudlyVerificationSummary {
   signatureFormat: typeof workloadInitReleaseContract.signatureFormat;
   signatureAlgorithm: typeof workloadInitReleaseContract.signatureAlgorithm;
   signerKeyId: TSha256Digest;
@@ -92,32 +93,31 @@ export interface IWorkloadInitCloudlyVerificationSummaryV1 {
   verifiedAt: number;
 }
 
-export interface IWorkloadInitApprovedArtifactV1 {
+export interface IWorkloadInitApprovedArtifact {
   platform: TImmutableContainerPlatform;
   workloadInitPlatformManifestDigest: TSha256Digest;
   workloadInitExecutableDigest: TSha256Digest;
 }
 
-export interface IWorkloadInitReleaseApprovalV1 {
-  schemaVersion: 1;
-  release: IWorkloadInitReleaseIdentityV1;
+export interface IWorkloadInitReleaseApproval {
+  release: IWorkloadInitReleaseIdentity;
   imageIndexMediaType: typeof workloadInitReleaseContract.imageIndexMediaType;
   workloadInitImageIndexDigest: TSha256Digest;
-  artifacts: [IWorkloadInitApprovedArtifactV1, IWorkloadInitApprovedArtifactV1];
-  verificationSummary: IWorkloadInitCloudlyVerificationSummaryV1;
+  artifacts: [IWorkloadInitApprovedArtifact, IWorkloadInitApprovedArtifact];
+  verificationSummary: IWorkloadInitCloudlyVerificationSummary;
   approvedAt: number;
   approvalDigest: TSha256Digest;
 }
 
-export interface IWorkloadInitApprovalAuthorityReferenceV1 {
-  authorityVersion: 1;
+export interface IWorkloadInitApprovalAuthorityReference {
+  /** Counts Cloudly's approval decisions; a later generation supersedes an earlier one. */
   authorityGeneration: number;
   approvalDigest: TSha256Digest;
 }
 
-export interface IWorkloadInitActiveApprovalAuthorityV1
-extends IWorkloadInitApprovalAuthorityReferenceV1 {
-  approval: IWorkloadInitReleaseApprovalV1;
+export interface IWorkloadInitActiveApprovalAuthority
+extends IWorkloadInitApprovalAuthorityReference {
+  approval: IWorkloadInitReleaseApproval;
 }
 
 const semanticVersionRegex = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;
@@ -129,11 +129,6 @@ const isRecord = (valueArg: unknown): valueArg is Record<string, unknown> => (
   Boolean(valueArg) && typeof valueArg === 'object' && !Array.isArray(valueArg)
 );
 
-const hasExactKeys = (
-  valueArg: Record<string, unknown>,
-  keysArg: string[],
-): boolean => JSON.stringify(Object.keys(valueArg).sort()) === JSON.stringify([...keysArg].sort());
-
 const isPositiveSafeInteger = (valueArg: unknown): valueArg is number => (
   Number.isSafeInteger(valueArg) && (valueArg as number) > 0
 );
@@ -187,8 +182,8 @@ export const validateWorkloadInitReleaseIdentity = (
 };
 
 const canonicalToolVersions = (
-  versionsArg: IWorkloadInitBuildToolVersionsV1,
-): IWorkloadInitBuildToolVersionsV1 => ({
+  versionsArg: IWorkloadInitBuildToolVersions,
+): IWorkloadInitBuildToolVersions => ({
   dockerBuildx: versionsArg.dockerBuildx,
   gitzone: versionsArg.gitzone,
   tsdocker: versionsArg.tsdocker,
@@ -196,10 +191,10 @@ const canonicalToolVersions = (
 });
 
 export const createWorkloadInitReleaseAttestationStatement = (inputArg: {
-  release: IWorkloadInitReleaseIdentityV1;
+  release: IWorkloadInitReleaseIdentity;
   workloadInitImageIndexDigest: TSha256Digest;
-  toolVersions: IWorkloadInitBuildToolVersionsV1;
-}): IWorkloadInitReleaseAttestationStatementV1 => ({
+  toolVersions: IWorkloadInitBuildToolVersions;
+}): IWorkloadInitReleaseAttestationStatement => ({
   _type: workloadInitReleaseContract.statementType,
   subject: [{
     name: `${inputArg.release.imageRegistry}/${inputArg.release.imageRepository}:${
@@ -243,11 +238,11 @@ export const createWorkloadInitReleaseAttestationStatement = (inputArg: {
 });
 
 export const createWorkloadInitReleaseAttestationPayload = (
-  statementArg: IWorkloadInitReleaseAttestationStatementV1,
+  statementArg: IWorkloadInitReleaseAttestationStatement,
 ): Uint8Array => new TextEncoder().encode(JSON.stringify(statementArg));
 
 export const computeWorkloadInitReleaseAttestationStatementDigest = async (
-  statementArg: IWorkloadInitReleaseAttestationStatementV1,
+  statementArg: IWorkloadInitReleaseAttestationStatement,
 ): Promise<TSha256Digest> => computeSha256(
   createWorkloadInitReleaseAttestationPayload(statementArg),
 );
@@ -396,8 +391,8 @@ export const validateWorkloadInitCloudlyVerificationSummary = (
 };
 
 const canonicalReleaseIdentity = (
-  releaseArg: IWorkloadInitReleaseIdentityV1,
-): IWorkloadInitReleaseIdentityV1 => ({
+  releaseArg: IWorkloadInitReleaseIdentity,
+): IWorkloadInitReleaseIdentity => ({
   packageName: releaseArg.packageName,
   version: releaseArg.version,
   sourceRepository: releaseArg.sourceRepository,
@@ -410,16 +405,16 @@ const canonicalReleaseIdentity = (
 });
 
 const canonicalApprovedArtifact = (
-  artifactArg: IWorkloadInitApprovedArtifactV1,
-): IWorkloadInitApprovedArtifactV1 => ({
+  artifactArg: IWorkloadInitApprovedArtifact,
+): IWorkloadInitApprovedArtifact => ({
   platform: artifactArg.platform,
   workloadInitPlatformManifestDigest: artifactArg.workloadInitPlatformManifestDigest,
   workloadInitExecutableDigest: artifactArg.workloadInitExecutableDigest,
 });
 
 const canonicalVerificationSummary = (
-  summaryArg: IWorkloadInitCloudlyVerificationSummaryV1,
-): IWorkloadInitCloudlyVerificationSummaryV1 => ({
+  summaryArg: IWorkloadInitCloudlyVerificationSummary,
+): IWorkloadInitCloudlyVerificationSummary => ({
   signatureFormat: summaryArg.signatureFormat,
   signatureAlgorithm: summaryArg.signatureAlgorithm,
   signerKeyId: summaryArg.signerKeyId,
@@ -433,9 +428,8 @@ const canonicalVerificationSummary = (
 });
 
 export const createWorkloadInitReleaseApprovalDigestInput = (
-  approvalArg: IWorkloadInitReleaseApprovalV1,
+  approvalArg: IWorkloadInitReleaseApproval,
 ): string => JSON.stringify({
-  schemaVersion: approvalArg.schemaVersion,
   purpose: 'serve.zone/workloadinit-release-approval',
   release: canonicalReleaseIdentity(approvalArg.release),
   imageIndexMediaType: approvalArg.imageIndexMediaType,
@@ -446,7 +440,7 @@ export const createWorkloadInitReleaseApprovalDigestInput = (
 });
 
 export const computeWorkloadInitReleaseApprovalDigest = async (
-  approvalArg: IWorkloadInitReleaseApprovalV1,
+  approvalArg: IWorkloadInitReleaseApproval,
 ): Promise<TSha256Digest> => computeSha256(
   new TextEncoder().encode(createWorkloadInitReleaseApprovalDigestInput(approvalArg)),
 );
@@ -457,7 +451,6 @@ export const validateWorkloadInitReleaseApproval = async (
   try {
     if (!isRecord(approvalArg)
       || !hasExactKeys(approvalArg, [
-        'schemaVersion',
         'release',
         'imageIndexMediaType',
         'workloadInitImageIndexDigest',
@@ -472,8 +465,7 @@ export const validateWorkloadInitReleaseApproval = async (
       ...validateWorkloadInitReleaseIdentity(approvalArg.release),
       ...validateWorkloadInitCloudlyVerificationSummary(approvalArg.verificationSummary),
     ];
-    if (approvalArg.schemaVersion !== 1
-      || approvalArg.imageIndexMediaType !== workloadInitReleaseContract.imageIndexMediaType
+    if (approvalArg.imageIndexMediaType !== workloadInitReleaseContract.imageIndexMediaType
       || typeof approvalArg.workloadInitImageIndexDigest !== 'string'
       || !isSha256Digest(approvalArg.workloadInitImageIndexDigest)
       || !isPositiveSafeInteger(approvalArg.approvedAt)
@@ -522,7 +514,7 @@ export const validateWorkloadInitReleaseApproval = async (
     }
     if (errors.length === 0
       && approvalArg.approvalDigest !== await computeWorkloadInitReleaseApprovalDigest(
-        approvalArg as unknown as IWorkloadInitReleaseApprovalV1,
+        approvalArg as unknown as IWorkloadInitReleaseApproval,
       )) {
       errors.push('WorkloadInit release approval digest does not match');
     }
@@ -537,15 +529,13 @@ export const validateWorkloadInitApprovalAuthorityReference = (
 ): string[] => {
   if (!isRecord(referenceArg)
     || !hasExactKeys(referenceArg, [
-      'authorityVersion',
       'authorityGeneration',
       'approvalDigest',
     ])) {
     return ['WorkloadInit approval authority reference must use its exact schema'];
   }
   const errors: string[] = [];
-  if (referenceArg.authorityVersion !== 1
-    || !isPositiveSafeInteger(referenceArg.authorityGeneration)
+  if (!isPositiveSafeInteger(referenceArg.authorityGeneration)
     || typeof referenceArg.approvalDigest !== 'string'
     || !isSha256Digest(referenceArg.approvalDigest)) {
     errors.push('WorkloadInit approval authority reference fields must be canonical');
@@ -558,7 +548,6 @@ export const validateWorkloadInitActiveApprovalAuthority = async (
 ): Promise<string[]> => {
   if (!isRecord(authorityArg)
     || !hasExactKeys(authorityArg, [
-      'authorityVersion',
       'authorityGeneration',
       'approvalDigest',
       'approval',
@@ -566,7 +555,6 @@ export const validateWorkloadInitActiveApprovalAuthority = async (
     return ['active WorkloadInit approval authority must use its exact schema'];
   }
   const reference = {
-    authorityVersion: authorityArg.authorityVersion,
     authorityGeneration: authorityArg.authorityGeneration,
     approvalDigest: authorityArg.approvalDigest,
   };