@supacloud/admin 0.7.4 → 0.7.6

package/dist/index.js

@@ -25622,7 +25622,7 @@ SUPACLOUD_GITHUB_REPOSITORY="\${SUPACLOUD_GITHUB_REPOSITORY:-zuohuadong/supaclou
 SUPACLOUD_RELEASES_API="\${SUPACLOUD_RELEASES_API:-https://api.github.com/repos/\${SUPACLOUD_GITHUB_REPOSITORY}/releases}"
 SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW="\${SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW:-\${SUPACLOUD_GITHUB_REPOSITORY}/.github/workflows/release-please.yml}"
 SUPACLOUD_GH_VERSION="\${SUPACLOUD_GH_VERSION:-2.96.0}"
-SUPACLOUD_GH_MIN_VERSION="\${SUPACLOUD_GH_MIN_VERSION:-2.51.0}"
+SUPACLOUD_GH_MIN_VERSION="\${SUPACLOUD_GH_MIN_VERSION:-2.68.0}"
 SUPACLOUD_GH_AMD64_SHA256="\${SUPACLOUD_GH_AMD64_SHA256:-83d5c2ccad5498f58bf6368acb1ab32588cf43ab3a4b1c301bf36328b1c8bd60}"
 SUPACLOUD_GH_ARM64_SHA256="\${SUPACLOUD_GH_ARM64_SHA256:-06f86ec7103d41993b76cd78072f43595c34aaa56506d971d9860e67140bf909}"
 
@@ -25951,13 +25951,49 @@ supacloud_record_integrity_mode() {
     chmod 600 "$record_file" 2>/dev/null || true
 }
 
-supacloud_verify_attestation() {
+supacloud_fetch_attestation_bundle() {
+    local artifact_file="$1"
+    local bundle_file="$2"
+    local digest response
+    digest=$(sha256sum "$artifact_file" | awk '{print $1}') || return 1
+    [[ "$digest" =~ ^[0-9a-fA-F]{64}$ ]] || {
+        echo "Unable to calculate the artifact digest for attestation lookup" >&2
+        return 1
+    }
+    digest=$(printf '%s' "$digest" | tr '[:upper:]' '[:lower:]')
+    response=$(supacloud_fetch_release_json \\
+        "https://api.github.com/repos/\${SUPACLOUD_GITHUB_REPOSITORY}/attestations/sha256:\${digest}") || {
+        echo "Unable to download the public GitHub artifact attestation bundle" >&2
+        return 1
+    }
+    if ! jq -ce '
+        .attestations
+        | if type != "array" or length == 0 or any(.[]; (.bundle | type) != "object")
+          then error("no valid attestation bundles returned")
+          else .[].bundle
+          end
+    ' <<< "$response" > "$bundle_file"; then
+        echo "GitHub artifact attestation response did not contain a valid bundle" >&2
+        return 1
+    fi
+}
+
+supacloud_verify_attestation() (
     local artifact_file="$1"
     if supacloud_attestation_verifier_available; then
-        local verification_output
+        local verification_output bundle_dir bundle_file
+        bundle_dir=$(mktemp -d "\${TMPDIR:-/tmp}/supacloud-attestation.XXXXXX") || return 1
+        trap 'rm -rf -- "$bundle_dir"' EXIT
+        trap 'trap - EXIT HUP INT TERM; rm -rf -- "$bundle_dir"; exit 1' HUP INT TERM
+        bundle_file="\${bundle_dir}/bundle.jsonl"
+        if ! supacloud_fetch_attestation_bundle "$artifact_file" "$bundle_file"; then
+            return 1
+        fi
         if ! verification_output=$(gh attestation verify "$artifact_file" \\
+            --bundle "$bundle_file" \\
             --repo "$SUPACLOUD_GITHUB_REPOSITORY" \\
-            --signer-workflow "$SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW" 2>&1); then
+            --signer-workflow "$SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW" \\
+            --source-ref "refs/heads/main" 2>&1); then
             echo "GitHub artifact attestation verification failed: \${verification_output}" >&2
             return 1
         fi
@@ -25973,15 +26009,18 @@ supacloud_verify_attestation() {
 
     echo "Artifact attestation verification is required, but gh attestation verify is unavailable. Install GitHub CLI or explicitly set SUPACLOUD_ALLOW_UNVERIFIED_RELEASE=true for emergency break-glass use." >&2
     return 1
-}
+)
 
 supacloud_attestation_verifier_available() {
-    local version
+    local version help
     command -v gh >/dev/null 2>&1 || return 1
     version=$(supacloud_gh_version)
     [[ -n "$version" ]] || return 1
     supacloud_version_at_least "$version" "$SUPACLOUD_GH_MIN_VERSION" || return 1
-    gh attestation verify --help 2>&1 | grep -q -- '--signer-workflow'
+    help=$(gh attestation verify --help 2>&1) || return 1
+    grep -Eq -- '(^|[[:space:]])--bundle([=[:space:]]|$)' <<< "$help" || return 1
+    grep -Eq -- '(^|[[:space:]])--signer-workflow([=[:space:]]|$)' <<< "$help" || return 1
+    grep -Eq -- '(^|[[:space:]])--source-ref([=[:space:]]|$)' <<< "$help"
 }
 
 supacloud_download_release_asset() (
@@ -26136,6 +26175,12 @@ function componentPreflightCommands(request) {
     `test "$EDGE_RUNTIME_MODE_VALUE" = external || { echo 'Edge Runtime component upgrade supports persisted external mode only' >&2; exit 1; }`
   ] : [];
 }
+function signalSafeCleanupTraps(cleanupCommand) {
+  return [
+    `trap '${cleanupCommand}' EXIT`,
+    `trap 'trap - EXIT HUP INT TERM; ${cleanupCommand}; exit 1' HUP INT TERM`
+  ];
+}
 function buildRootUpgradeScript(request) {
   const envAssignments = upgradeEnvAssignments(request);
   return [
@@ -26144,12 +26189,12 @@ function buildRootUpgradeScript(request) {
     "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
     "export PATH",
     "unset SUPACLOUD_ALLOW_UNVERIFIED_RELEASE SUPACLOUD_GITHUB_REPOSITORY SUPACLOUD_RELEASES_API SUPACLOUD_ATTESTATION_SIGNER_WORKFLOW SUPACLOUD_GH_VERSION SUPACLOUD_GH_MIN_VERSION SUPACLOUD_GH_AMD64_SHA256 SUPACLOUD_GH_ARM64_SHA256 GH_PROXY",
-    request.githubProxy ? `export SUPACLOUD_GITHUB_PROXY=${quoteEnvValue(request.githubProxy)}` : "unset SUPACLOUD_GITHUB_PROXY",
+    request.githubProxy ? `export SUPACLOUD_GITHUB_PROXY=${quoteEnvValue(request.githubProxy)}` : "unset SUPACLOUD_GITHUB_PROXY SUPACLOUD_GITHUB_PROXIES",
     'for tool in curl jq file sha256sum tar; do command -v "$tool" >/dev/null 2>&1 || { echo "Required upgrade tool is missing: $tool" >&2; exit 127; }; done',
     "test -x /usr/local/bin/supacloud || { echo 'SupaCloud binary not found at /usr/local/bin/supacloud; run ssh install first.' >&2; exit 127; }",
     ...componentPreflightCommands(request),
     "STAGED_MANAGEMENT=''",
-    `trap 'test -z "$STAGED_MANAGEMENT" || rm -f "$STAGED_MANAGEMENT"' EXIT HUP INT TERM`,
+    ...signalSafeCleanupTraps('test -z "$STAGED_MANAGEMENT" || rm -f "$STAGED_MANAGEMENT"'),
     `source ${quoteEnvValue(request.helperPath)}`,
     "if ! supacloud_attestation_verifier_available; then supacloud_install_pinned_gh /usr/local/bin/gh; fi",
     "supacloud_attestation_verifier_available || { echo 'Pinned GitHub attestation verifier is unavailable' >&2; exit 1; }",
@@ -26160,7 +26205,11 @@ function buildRootUpgradeScript(request) {
 }
 function buildOfficialUpgradeCommand(request) {
   const rootScript = buildRootUpgradeScript(request);
-  return `set -e; trap 'rm -f ${request.helperPath}' EXIT HUP INT TERM; ` + 'if [ "$(id -u)" -eq 0 ]; then ' + `bash -c ${quoteEnvValue(rootScript)}; ` + "else sudo -n true; " + `sudo -n bash -c ${quoteEnvValue(rootScript)}; fi`;
+  return [
+    "set -e",
+    ...signalSafeCleanupTraps(`rm -f ${request.helperPath}`),
+    'if [ "$(id -u)" -eq 0 ]; then ' + `bash -c ${quoteEnvValue(rootScript)}; ` + "else sudo -n true; " + `sudo -n bash -c ${quoteEnvValue(rootScript)}; fi`
+  ].join("; ");
 }
 async function removeRemoteUpgradeHelper(ssh, helperPath) {
   const cleanup = await ssh.exec(`rm -f ${quoteEnvValue(helperPath)}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/admin",
-  "version": "0.7.4",
+  "version": "0.7.6",
   "description": "Platform administration CLI for SupaCloud operators",
   "type": "module",
   "main": "./dist/index.js",