@xemahq/biome-supply-chain 0.1.2 → 0.1.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/biome-supply-chain",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Shared cosign supply-chain verification for Xema biomes: the single cosign CLI exec + the signature/provenance verdict enums used by biome-fetcher-api (OCI bundle verification) and xema-store-api. Node-builtins only.",
   "license": "LicenseRef-Xema-BSL-1.1",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
@@ -29,8 +29,7 @@
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [
-    "dist",
-    "src"
+    "dist"
   ],
   "devDependencies": {
     "@types/node": "25.2.3",

package/src/index.ts

@@ -1,2 +0,0 @@
-export * from './lib/verdicts';
-export * from './lib/cosign-exec';

package/src/lib/cosign-exec.ts

@@ -1,188 +0,0 @@
-import { spawn } from 'node:child_process';
-
-import { CosignVerifyOutcome } from './verdicts';
-
-/** Default cosign binary name (overridable per call). */
-const DEFAULT_COSIGN_BIN = 'cosign';
-
-interface CosignRunResult {
-  readonly code: number;
-  readonly stderr: string;
-}
-
-/**
- * The single canonical cosign invocation. Spawns the binary, captures stderr,
- * and resolves with the exit code (never rejects on a non-zero exit — the
- * caller decides whether a non-zero code is an error or a "failed" verdict).
- * Rejects only when the process cannot be spawned at all.
- */
-function runCosign(
-  bin: string,
-  args: readonly string[],
-): Promise<CosignRunResult> {
-  return new Promise((resolve, reject) => {
-    const child = spawn(bin, [...args], {
-      stdio: ['ignore', 'pipe', 'pipe'],
-    });
-    let stderr = '';
-    child.stderr?.on('data', (chunk: Buffer) => {
-      stderr += chunk.toString();
-    });
-    child.on('error', reject);
-    child.on('close', (code) => {
-      resolve({ code: code ?? 1, stderr });
-    });
-  });
-}
-
-/** Throws if the cosign CLI is not available on PATH. */
-export async function ensureCosignAvailable(
-  bin: string = DEFAULT_COSIGN_BIN,
-): Promise<void> {
-  try {
-    const { code, stderr } = await runCosign(bin, ['version']);
-    if (code !== 0) {
-      throw new Error(`\`${bin} version\` exited ${code}: ${stderr.slice(-200)}`);
-    }
-  } catch (cause) {
-    throw new Error(
-      `cosign CLI is not on PATH — install from https://github.com/sigstore/cosign ` +
-        `(${cause instanceof Error ? cause.message : String(cause)})`,
-    );
-  }
-}
-
-export interface VerifyCosignSignatureInput {
-  readonly ociRef: string;
-  /** Exact keyless certificate-identity URIs (any one may match). */
-  readonly trustedIdentities: readonly string[];
-  readonly oidcIssuer?: string | undefined;
-  /** Keyed verification: path to the public key (mutually exclusive w/ keyless). */
-  readonly keyPath?: string | undefined;
-  readonly bin?: string | undefined;
-}
-
-/**
- * Verify a signature on an OCI ref (keyless identity allowlist OR keyed).
- * Throws on non-verification; resolves on success. Mirrors the fetcher's
- * former inline behaviour.
- */
-export async function verifyCosignSignature(
-  input: VerifyCosignSignatureInput,
-): Promise<void> {
-  const bin = input.bin ?? DEFAULT_COSIGN_BIN;
-  const args: string[] = ['verify'];
-  if (input.keyPath) {
-    args.push('--key', input.keyPath);
-  } else {
-    if (input.trustedIdentities.length === 0) {
-      throw new Error(
-        'verifyCosignSignature: keyless mode requires at least one trusted identity',
-      );
-    }
-    for (const id of input.trustedIdentities) {
-      args.push('--certificate-identity', id);
-    }
-    if (input.oidcIssuer) {
-      args.push('--certificate-oidc-issuer', input.oidcIssuer);
-    }
-  }
-  args.push(input.ociRef);
-  const { code, stderr } = await runCosign(bin, args);
-  if (code !== 0) {
-    throw new Error(`${bin} verify failed (code=${code}): ${stderr.slice(-200)}`);
-  }
-}
-
-export interface VerifyCosignAttestationInput {
-  readonly ociRef: string;
-  readonly predicateType: string;
-  readonly trustedIdentities: readonly string[];
-  readonly oidcIssuer?: string | undefined;
-  readonly keyPath?: string | undefined;
-  readonly bin?: string | undefined;
-}
-
-/**
- * Verify an in-toto/SLSA attestation on an OCI ref. Throws on
- * non-verification; resolves on success.
- */
-export async function verifyCosignAttestation(
-  input: VerifyCosignAttestationInput,
-): Promise<void> {
-  const bin = input.bin ?? DEFAULT_COSIGN_BIN;
-  const args: string[] = ['verify-attestation', '--type', input.predicateType];
-  if (input.keyPath) {
-    args.push('--key', input.keyPath);
-  } else {
-    if (input.trustedIdentities.length === 0) {
-      throw new Error(
-        'verifyCosignAttestation: keyless mode requires at least one trusted identity',
-      );
-    }
-    for (const id of input.trustedIdentities) {
-      args.push('--certificate-identity', id);
-    }
-    if (input.oidcIssuer) {
-      args.push('--certificate-oidc-issuer', input.oidcIssuer);
-    }
-  }
-  args.push(input.ociRef);
-  const { code, stderr } = await runCosign(bin, args);
-  if (code !== 0) {
-    throw new Error(
-      `${bin} verify-attestation failed (code=${code}): ${stderr.slice(-200)}`,
-    );
-  }
-}
-
-export interface VerifyCosignBlobInput {
-  /** Path to the artifact bytes on disk (caller owns fetch/temp-file lifecycle). */
-  readonly artifactPath: string;
-  /** Path to the detached signature bundle on disk. */
-  readonly bundlePath: string;
-  /** Keyless certificate-identity REGEXPS (any one may match). */
-  readonly trustedIdentityRegexps: readonly string[];
-  readonly oidcIssuer?: string | undefined;
-  readonly bin?: string | undefined;
-}
-
-export interface VerifyCosignBlobResult {
-  readonly outcome: CosignVerifyOutcome;
-  /** The identity regexp that matched, when Verified. */
-  readonly matchedIdentity?: string | undefined;
-}
-
-/**
- * Verify a detached signature over a blob (`cosign verify-blob --bundle`).
- * Tries each trusted identity regexp; the first that verifies wins. Returns a
- * neutral {@link CosignVerifyOutcome} (never throws on a failed verification —
- * an empty trust list or all-mismatch resolves to `Failed`). The caller owns
- * artifact/bundle materialisation on disk.
- */
-export async function verifyCosignBlob(
-  input: VerifyCosignBlobInput,
-): Promise<VerifyCosignBlobResult> {
-  const bin = input.bin ?? DEFAULT_COSIGN_BIN;
-  if (input.trustedIdentityRegexps.length === 0) {
-    return { outcome: CosignVerifyOutcome.Failed };
-  }
-  for (const identity of input.trustedIdentityRegexps) {
-    const args: string[] = [
-      'verify-blob',
-      '--bundle',
-      input.bundlePath,
-      '--certificate-identity-regexp',
-      identity,
-    ];
-    if (input.oidcIssuer) {
-      args.push('--certificate-oidc-issuer', input.oidcIssuer);
-    }
-    args.push(input.artifactPath);
-    const { code } = await runCosign(bin, args);
-    if (code === 0) {
-      return { outcome: CosignVerifyOutcome.Verified, matchedIdentity: identity };
-    }
-  }
-  return { outcome: CosignVerifyOutcome.Failed };
-}

package/src/lib/verdicts.ts

@@ -1,57 +0,0 @@
-/**
- * Shared cosign supply-chain verdict vocabulary.
- *
- * This is the single source of truth for the lowercase verdict/error enums
- * that `biome-fetcher-api` (OCI bundle verification) previously duplicated
- * locally. They are value-identical to that former copy, so adopting this
- * package is a pure de-duplication with no wire/behaviour change.
- *
- * (`@xemahq/biome-package` was a second consumer until 2026-08-01, when it was
- * deleted: it emitted a 4-layer OCI artifact whose layers carry no
- * `org.opencontainers.image.title`, so the fetcher's `oras pull` skipped every
- * one of them and materialised nothing. `xema biome publish` is now the single
- * biome packager.)
- *
- * NOTE: `xema-store-api` keeps its OWN UPPERCASE `SignatureVerdict` /
- * `ProvenanceVerdict` (persisted + OpenAPI + cross-service event wire); it
- * consumes only the cosign EXEC + {@link CosignVerifyOutcome} from this
- * package, mapping the neutral outcome to its own wire enum.
- */
-
-/** Signature verification verdict. */
-export enum SignatureVerdict {
-  Valid = 'valid',
-  Invalid = 'invalid',
-  Unsigned = 'unsigned',
-}
-
-/** SLSA attestation / provenance verdict. */
-export enum ProvenanceVerdict {
-  Valid = 'valid',
-  Invalid = 'invalid',
-  Missing = 'missing',
-}
-
-/** Stable, typed reasons a cosign verification may reject an artifact. */
-export enum CosignErrorCode {
-  SignatureMissing = 'BIOME_SIGNATURE_MISSING',
-  SignatureInvalid = 'BIOME_SIGNATURE_INVALID',
-  IdentityNotTrusted = 'BIOME_SIGNATURE_IDENTITY_NOT_TRUSTED',
-  ProvenanceMissing = 'BIOME_PROVENANCE_MISSING',
-  ProvenanceInvalid = 'BIOME_PROVENANCE_INVALID',
-  CosignUnavailable = 'BIOME_COSIGN_UNAVAILABLE',
-}
-
-/**
- * Casing-neutral internal outcome of a detached-blob verification. The blob
- * path (store) maps this to its own UPPERCASE wire verdict; it deliberately
- * does not leak the wire casing into the shared exec layer.
- */
-export enum CosignVerifyOutcome {
-  Verified = 'verified',
-  Failed = 'failed',
-}
-
-/** Canonical SLSA provenance predicate type. */
-export const SLSA_PROVENANCE_PREDICATE_TYPE =
-  'https://slsa.dev/provenance/v1' as const;