@supacloud/admin 0.7.4 → 0.7.5

package/dist/index.js

@@ -25951,11 +25951,46 @@ supacloud_record_integrity_mode() {
     chmod 600 "$record_file" 2>/dev/null || true
 }
 
-supacloud_verify_attestation() {
+supacloud_fetch_attestation_bundle() {
+    local artifact_file="$1"
+    local bundle_file="$2"
+    local digest response
+    digest=$(sha256sum "$artifact_file" | awk '{print $1}') || return 1
+    [[ "$digest" =~ ^[0-9a-fA-F]{64}$ ]] || {
+        echo "Unable to calculate the artifact digest for attestation lookup" >&2
+        return 1
+    }
+    digest=$(printf '%s' "$digest" | tr '[:upper:]' '[:lower:]')
+    response=$(supacloud_fetch_release_json \\
+        "https://api.github.com/repos/\${SUPACLOUD_GITHUB_REPOSITORY}/attestations/sha256:\${digest}") || {
+        echo "Unable to download the public GitHub artifact attestation bundle" >&2
+        return 1
+    }
+    if ! jq -ce '
+        .attestations
+        | if type != "array" or length == 0 or any(.[]; (.bundle | type) != "object")
+          then error("no valid attestation bundles returned")
+          else .[].bundle
+          end
+    ' <<< "$response" > "$bundle_file"; then
+        echo "GitHub artifact attestation response did not contain a valid bundle" >&2
+        return 1
+    fi
+}
+
+supacloud_verify_attestation() (
     local artifact_file="$1"
     if supacloud_attestation_verifier_available; then
-        local verification_output
+        local verification_output bundle_dir bundle_file
+        bundle_dir=$(mktemp -d "\${TMPDIR:-/tmp}/supacloud-attestation.XXXXXX") || return 1
+        trap 'rm -rf -- "$bundle_dir"' EXIT
+        trap 'trap - EXIT HUP INT TERM; rm -rf -- "$bundle_dir"; exit 1' HUP INT TERM
+        bundle_file="\${bundle_dir}/bundle.jsonl"
+        if ! supacloud_fetch_attestation_bundle "$artifact_file" "$bundle_file"; then
+            return 1
+        fi
         if ! verification_output=$(gh attestation verify "$artifact_file" \\
+            --bundle "$bundle_file" \\
             --repo "$SUPACLOUD_GITHUB_REPOSITORY" \\
             --signer-workflow "$SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW" 2>&1); then
             echo "GitHub artifact attestation verification failed: \${verification_output}" >&2
@@ -25973,7 +26008,7 @@ supacloud_verify_attestation() {
 
     echo "Artifact attestation verification is required, but gh attestation verify is unavailable. Install GitHub CLI or explicitly set SUPACLOUD_ALLOW_UNVERIFIED_RELEASE=true for emergency break-glass use." >&2
     return 1
-}
+)
 
 supacloud_attestation_verifier_available() {
     local version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/admin",
-  "version": "0.7.4",
+  "version": "0.7.5",
   "description": "Platform administration CLI for SupaCloud operators",
   "type": "module",
   "main": "./dist/index.js",