@xemahq/xema 0.25.1 → 0.27.0

package/edition/produce-image-source-evidence.mjs

@@ -0,0 +1,765 @@
+#!/usr/bin/env node
+// The image-source producer statement layer: build the canonical statement
+// bytes a producing workflow signs, and accept the signed bundles back.
+//
+// `xema edition evidence statement producer stage|accept`. This module never
+// signs: it holds no key and requests no OIDC token. `stage` writes the exact
+// bytes to sign and prints the signing plan; the caller runs
+// `cosign attest-blob`; `accept` re-derives the statements from the same
+// input, refuses staged bytes that differ, validates each bundle, verifies it
+// with cosign against the declared signer, and seals the evidence directory.
+//
+// The kernel contract authority every statement binds is the one the data
+// root's evidence-trust pin records (`evidence-trust-pin.mjs`): the data root's
+// `runtime-image-source-index.json` states it, and it is used only once it is
+// the pinned one. The verifier holds producer statements to the same pin.
+
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync,
+} from 'node:fs';
+import { isAbsolute, join, resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+import { editionWorkspaceConfig } from './edition-config.mjs';
+import {
+  WorkspaceRoot,
+  configureEditionWorkspaceFromArgv,
+  dataRoot,
+  isEntryModule,
+  kernelDistPath,
+  kernelRepoDir,
+} from './edition-workspace.mjs';
+import { COMMIT_PATTERN, GITHUB_REF_PATTERN, GITHUB_REPOSITORY_PATTERN, SHA256_DIGEST_PATTERN } from './evidence-grammars.mjs';
+import {
+  RUNTIME_IMAGE_SOURCE_INDEX_FILE,
+  loadPinnedDeclaredTrustPolicy,
+  readEvidenceTrustPin,
+  readPinnedKernelContractAuthority,
+} from './evidence-trust-pin.mjs';
+import {
+  canonicalJsonBytes,
+  decodeExactUtf8,
+  parseCanonicalJsonBytes,
+  sha256Digest,
+} from './image-evidence.mjs';
+import { assertKernelContractAuthorityEqual } from './kernel-contract-authority.mjs';
+import { serializeJson } from './lib.mjs';
+import { assertStagedExactly, reserveSealing, sealAccepted } from './sealed-evidence-accept.mjs';
+
+export const BUNDLE_MEDIA_TYPE =
+  'application/vnd.dev.sigstore.bundle.v0.3+json';
+const STAGED_STATEMENTS_DIRECTORY = 'statements';
+const STAGED_BUNDLES_DIRECTORY = 'bundles';
+
+/**
+ * Git, run under a fully sandboxed environment: no user/system config, no
+ * replace-objects rewriting, no credential prompt, no locale-dependent output.
+ *
+ * Exported because the producer-input assembler runs git against the SAME
+ * checkouts under the SAME guarantees — a second copy of this environment is a
+ * second security posture, and the two would drift silently (the assembler's
+ * copy WAS byte-for-byte identical, which is exactly how nobody noticed).
+ */
+export function sandboxedGit(repositoryRoot, args) {
+  return execFileSync('/usr/bin/git', ['-C', repositoryRoot, ...args], {
+    encoding: 'utf8',
+    env: {
+      GIT_CONFIG_GLOBAL: '/dev/null',
+      GIT_CONFIG_NOSYSTEM: '1',
+      GIT_NO_REPLACE_OBJECTS: '1',
+      GIT_OPTIONAL_LOCKS: '0',
+      GIT_TERMINAL_PROMPT: '0',
+      LANG: 'C',
+      LC_ALL: 'C',
+      PATH: '/usr/bin:/bin',
+    },
+    stdio: ['ignore', 'pipe', 'pipe'],
+  }).trim();
+}
+
+/** The data root's runtime image source index, unparsed: where the authority is read before any schema is loaded. */
+function readRawContractAuthority(root) {
+  if (!isAbsolute(root)) {
+    throw new Error('the data root must be an absolute path');
+  }
+  const authority = JSON.parse(
+    readFileSync(join(root, RUNTIME_IMAGE_SOURCE_INDEX_FILE), 'utf8'),
+  )?.contractAuthority;
+  if (
+    typeof authority?.repositoryUrl !== 'string' ||
+    !COMMIT_PATTERN.test(authority?.sourceCommit ?? '')
+  ) {
+    throw new Error(
+      `${RUNTIME_IMAGE_SOURCE_INDEX_FILE} at ${root} carries no kernel contract authority`,
+    );
+  }
+  return authority;
+}
+
+/**
+ * The kernel contract authority evidence of a data root is held to: the one its
+ * evidence-trust pin records. The runtime image source index states it; a
+ * stated authority that is not the pinned one, or a data root with no pin, is
+ * refused (`KernelContractAuthorityPinError`). `declaration` is the data root's
+ * `evidenceTrustPolicy`; it defaults to the configured workspace's.
+ */
+export function readPinnedContractAuthority({
+  dataRoot: root,
+  schemas,
+  declaration = editionWorkspaceConfig().evidenceTrustPolicy,
+}) {
+  return readPinnedKernelContractAuthority({ dataRoot: root, declaration, schemas });
+}
+
+/**
+ * The kernel schemas, loaded from a kernel checkout that is clean, has the
+ * authority's repository as its origin and is at exactly the PINNED authority
+ * commit. The pin is read before any kernel code is imported, so a checkout at
+ * a commit the data root did not pin is never loaded. Returns the schemas and
+ * the pinned authority they were held to.
+ */
+export async function loadProducerKernelSchemas({
+  dataRoot: root,
+  kernelRepositoryDirectory = kernelRepoDir(),
+  kernelDistributionModule = kernelDistPath('distribution', 'index.js'),
+  declaration = editionWorkspaceConfig().evidenceTrustPolicy,
+}) {
+  if (declaration.policy === null) {
+    // The coded refusal of a data root with no pin.
+    readPinnedKernelContractAuthority({ dataRoot: root, declaration, schemas: {} });
+  }
+  const expected = readRawContractAuthority(root);
+  const pinned = readEvidenceTrustPin({ dataRoot: root, declaration }).kernelContractAuthority;
+  if (expected.sourceCommit !== pinned.sourceCommit) {
+    throw new Error(
+      `${RUNTIME_IMAGE_SOURCE_INDEX_FILE} at ${root} states kernel contract authority commit ` +
+        `${expected.sourceCommit} but the evidence-trust pin records ${pinned.sourceCommit}`,
+    );
+  }
+  if (!isAbsolute(kernelRepositoryDirectory)) {
+    throw new Error('the kernel contracts checkout must be an absolute path');
+  }
+  if (
+    sandboxedGit(kernelRepositoryDirectory, ['remote', 'get-url', 'origin']) !==
+      expected.repositoryUrl ||
+    sandboxedGit(kernelRepositoryDirectory, ['rev-parse', '--verify', 'HEAD^{commit}']) !==
+      expected.sourceCommit ||
+    sandboxedGit(kernelRepositoryDirectory, [
+      'status',
+      '--porcelain=v1',
+      '--untracked-files=all',
+    ]) !== ''
+  ) {
+    throw new Error(
+      'kernel contracts checkout must be clean, canonical, and at the evidence authority commit',
+    );
+  }
+  let schemas;
+  try {
+    schemas = await import(pathToFileURL(kernelDistributionModule));
+  } catch (error) {
+    throw new Error(
+      `cannot load built kernel evidence schemas at ${expected.sourceCommit}: ${error.message}`,
+    );
+  }
+  return {
+    schemas,
+    contractAuthority: readPinnedContractAuthority({ dataRoot: root, schemas, declaration }),
+  };
+}
+
+function exactKeys(value, keys, label) {
+  if (
+    typeof value !== 'object' ||
+    value === null ||
+    Array.isArray(value) ||
+    JSON.stringify(Object.keys(value).sort()) !==
+      JSON.stringify([...keys].sort())
+  ) {
+    throw new Error(`${label} does not have the exact required fields`);
+  }
+  return value;
+}
+
+function subjectKey(subject) {
+  return `${subject.kind}:${subject.id}`;
+}
+
+function evidenceNonce(input, subject) {
+  return createHash('sha256')
+    .update('xema.image-source-evidence.nonce.v2\0')
+    .update(input.runId)
+    .update('\0')
+    .update(String(input.runAttempt))
+    .update('\0')
+    .update(subjectKey(subject))
+    .update('\0')
+    .update(subject.manifestDigest)
+    .digest('base64url');
+}
+
+function artifactStem(subject) {
+  return createHash('sha256').update(subjectKey(subject)).digest('hex');
+}
+
+function assertSigner(signer) {
+  exactKeys(
+    signer,
+    ['certificateIdentity', 'oidcIssuer', 'githubWorkflow'],
+    'image-source producer signer',
+  );
+  exactKeys(
+    signer.githubWorkflow,
+    ['repository', 'ref', 'path'],
+    'image-source producer GitHub workflow',
+  );
+  const { repository, ref, path } = signer.githubWorkflow;
+  if (
+    !GITHUB_REPOSITORY_PATTERN.test(repository) ||
+    !GITHUB_REF_PATTERN.test(ref) ||
+    typeof path !== 'string' ||
+    !path.startsWith('.github/workflows/') ||
+    path.split('/').some((segment) => !segment || segment === '..')
+  ) {
+    throw new Error('image-source producer GitHub workflow is not canonical');
+  }
+  const expectedIdentity = `https://github.com/${repository}/${path}@${ref}`;
+  if (
+    signer.certificateIdentity !== expectedIdentity ||
+    signer.oidcIssuer !== 'https://token.actions.githubusercontent.com'
+  ) {
+    throw new Error(
+      'image-source producer signer identity or OIDC issuer is not exact',
+    );
+  }
+  return signer;
+}
+
+export function assertGitHubProducerContext(input, context) {
+  exactKeys(
+    context,
+    ['repository', 'ref', 'sha', 'workflowRef'],
+    'GitHub producer context',
+  );
+  const signer = assertSigner(input.signer);
+  const expectedWorkflowRef =
+    `${signer.githubWorkflow.repository}/${signer.githubWorkflow.path}` +
+    `@${signer.githubWorkflow.ref}`;
+  if (
+    context.repository !== signer.githubWorkflow.repository ||
+    context.ref !== signer.githubWorkflow.ref ||
+    context.sha !== input.producerWorkflowSha ||
+    context.workflowRef !== expectedWorkflowRef
+  ) {
+    throw new Error(
+      'GitHub producer context does not exactly match the input signer and workflow SHA',
+    );
+  }
+  return context;
+}
+
+/**
+ * The producer input, exact. `expectedContractAuthority` is the data root's
+ * pinned authority ({@link readPinnedContractAuthority}); an input that binds any
+ * other authority is refused here, before a statement is built from it.
+ */
+export function assertProducerInput(input, expectedContractAuthority) {
+  if (!expectedContractAuthority) {
+    throw new Error('the expected kernel contract authority is required');
+  }
+  exactKeys(
+    input,
+    [
+      'schemaVersion',
+      'contractAuthority',
+      'sourceHashAlgorithm',
+      'producerWorkflowSha',
+      'signer',
+      'builder',
+      'runId',
+      'runAttempt',
+      'issuedAt',
+      'expiresAt',
+      'expectedSubjects',
+      'subjects',
+    ],
+    'image-source producer input',
+  );
+  if (input.schemaVersion !== 1) {
+    throw new Error('image-source producer input requires schemaVersion 1');
+  }
+  assertKernelContractAuthorityEqual(
+    input.contractAuthority,
+    expectedContractAuthority,
+    'image-source producer input',
+  );
+  if (!COMMIT_PATTERN.test(input.producerWorkflowSha)) {
+    throw new Error('producerWorkflowSha must be an exact 40-hex commit');
+  }
+  assertSigner(input.signer);
+  exactKeys(
+    input.builder,
+    ['builderId', 'buildType', 'buildDefinitionDigest', 'parametersDigest'],
+    'image-source producer builder',
+  );
+  if (
+    !SHA256_DIGEST_PATTERN.test(input.builder.buildDefinitionDigest) ||
+    !SHA256_DIGEST_PATTERN.test(input.builder.parametersDigest)
+  ) {
+    throw new Error(
+      'producer build definition and parameters require sha256 digests',
+    );
+  }
+  if (
+    !Array.isArray(input.expectedSubjects) ||
+    input.expectedSubjects.length === 0
+  ) {
+    throw new Error('image-source producer expected subject set is empty');
+  }
+  if (!Array.isArray(input.subjects) || input.subjects.length === 0) {
+    throw new Error('image-source producer subject set is empty');
+  }
+  for (const subject of input.subjects) {
+    exactKeys(
+      subject,
+      [
+        'kind',
+        'id',
+        'repositoryUrl',
+        'repo',
+        'path',
+        'sourceCommit',
+        'sourceManifestHash',
+        'sourceTreeHash',
+        'imageRepository',
+        'manifestDigest',
+        'manifestMediaType',
+        'platforms',
+        'sbomDigest',
+        'provenanceDigest',
+      ],
+      `image-source producer subject ${String(subject?.kind)}:${String(subject?.id)}`,
+    );
+  }
+  const expected = [...input.expectedSubjects];
+  const actual = input.subjects.map(subjectKey);
+  const sortedExpected = [...new Set(expected)].sort();
+  const sortedActual = [...new Set(actual)].sort();
+  if (
+    JSON.stringify(expected) !== JSON.stringify(sortedExpected) ||
+    JSON.stringify(actual) !== JSON.stringify(sortedActual) ||
+    JSON.stringify(expected) !== JSON.stringify(actual)
+  ) {
+    throw new Error(
+      `image-source producer requires the exact complete subject set; expected=${expected.join(',')} actual=${actual.join(',')}`,
+    );
+  }
+}
+
+export function buildImageSourceStatements(input, schemas, expectedContractAuthority) {
+  assertProducerInput(input, expectedContractAuthority);
+  return input.subjects.map((subject) => {
+    const statement = {
+      _type: 'https://in-toto.io/Statement/v1',
+      subject: [
+        {
+          name: subject.imageRepository,
+          digest: { sha256: subject.manifestDigest.slice('sha256:'.length) },
+        },
+      ],
+      predicateType: schemas.IMAGE_PRODUCER_PREDICATE_TYPE,
+      predicate: {
+        schemaVersion: 2,
+        contractAuthority: input.contractAuthority,
+        source: {
+          kind: subject.kind,
+          id: subject.id,
+          repositoryUrl: subject.repositoryUrl,
+          repo: subject.repo,
+          path: subject.path,
+          sourceCommit: subject.sourceCommit,
+          sourceManifestHash: subject.sourceManifestHash,
+          sourceHashAlgorithm: input.sourceHashAlgorithm,
+          sourceTreeHash: subject.sourceTreeHash,
+        },
+        build: {
+          ...input.builder,
+          platforms: subject.platforms,
+        },
+        artifact: {
+          imageRepository: subject.imageRepository,
+          manifestDigest: subject.manifestDigest,
+          manifestMediaType: subject.manifestMediaType,
+          sbom: {
+            predicateType: 'https://spdx.dev/Document',
+            digest: subject.sbomDigest,
+          },
+          provenance: {
+            predicateType: 'https://slsa.dev/provenance/v1',
+            digest: subject.provenanceDigest,
+          },
+        },
+        producerRun: {
+          producerWorkflowSha: input.producerWorkflowSha,
+          runId: input.runId,
+          runAttempt: input.runAttempt,
+          nonce: evidenceNonce(input, subject),
+          issuedAt: input.issuedAt,
+          expiresAt: input.expiresAt,
+        },
+      },
+    };
+    return schemas.parseImageProducerStatement(statement);
+  });
+}
+
+export function validateProducedBundle(statementBytes, bundleBytes) {
+  const bundle = parseCanonicalJsonBytes(
+    bundleBytes,
+    'produced Sigstore bundle',
+  );
+  if (
+    bundle.mediaType !== BUNDLE_MEDIA_TYPE ||
+    bundle.messageSignature !== undefined ||
+    typeof bundle.dsseEnvelope !== 'object' ||
+    bundle.dsseEnvelope === null ||
+    bundle.dsseEnvelope.payloadType !== 'application/vnd.in-toto+json' ||
+    !Array.isArray(bundle.dsseEnvelope.signatures) ||
+    bundle.dsseEnvelope.signatures.length !== 1 ||
+    typeof bundle.dsseEnvelope.payload !== 'string'
+  ) {
+    throw new Error('produced bundle is not one exact DSSE in-toto signature');
+  }
+  const payload = Buffer.from(bundle.dsseEnvelope.payload, 'base64');
+  if (
+    payload.toString('base64') !== bundle.dsseEnvelope.payload ||
+    !payload.equals(statementBytes)
+  ) {
+    throw new Error(
+      'produced bundle payload does not exactly match its statement',
+    );
+  }
+  return bundle;
+}
+
+/** The cosign that verifies is the version the data root's trust policy pins; the library names none. */
+function exactCosignVersion(output, policyCosignVersion) {
+  if (typeof policyCosignVersion !== 'string' || !/^v\d+\.\d+\.\d+$/.test(policyCosignVersion)) {
+    throw new Error("the trust policy's cosignVersion is required to accept signed evidence");
+  }
+  const match = /\bGitVersion:\s*(v\d+\.\d+\.\d+)\b/.exec(output);
+  if (!match || match[1] !== policyCosignVersion) {
+    throw new Error(`cosign version does not match pinned ${policyCosignVersion}`);
+  }
+  return match[1];
+}
+
+/**
+ * A cosign runner that can read the version and VERIFY, and nothing else: the
+ * edition library never signs, so any other subcommand is refused here. It
+ * passes no OIDC request variables to the child.
+ */
+export function createCosignVerifier(cosignBinary) {
+  if (typeof cosignBinary !== 'string' || !isAbsolute(cosignBinary)) {
+    throw new Error('cosign binary must be an absolute path');
+  }
+  return {
+    readCosignVersion: () =>
+      execFileSync(cosignBinary, ['version'], {
+        encoding: 'utf8',
+        env: { LANG: 'C', LC_ALL: 'C', PATH: '/usr/bin:/bin', TZ: 'UTC' },
+        stdio: ['ignore', 'pipe', 'pipe'],
+        timeout: 10_000,
+      }),
+    runCosign: (args) => {
+      if (args[0] !== 'verify-blob-attestation') {
+        throw new Error(
+          `the edition library only verifies with cosign; it does not run "cosign ${String(args[0])}"`,
+        );
+      }
+      return execFileSync(cosignBinary, args, {
+        env: {
+          HOME: process.env.HOME,
+          LANG: 'C',
+          LC_ALL: 'C',
+          PATH: '/usr/bin:/bin',
+          TZ: 'UTC',
+        },
+        stdio: ['ignore', 'ignore', 'pipe'],
+        timeout: 180_000,
+      });
+    },
+  };
+}
+
+/** The verification every accepted bundle must pass: the declared signer, at the exact workflow commit. */
+export function cosignVerifyAttestationArgs({ bundlePath, signer, certificateWorkflowSha, predicateType }) {
+  return [
+    'verify-blob-attestation',
+    '--check-claims=false',
+    '--new-bundle-format',
+    '--bundle',
+    bundlePath,
+    '--certificate-identity',
+    signer.certificateIdentity,
+    '--certificate-oidc-issuer',
+    signer.oidcIssuer,
+    '--certificate-github-workflow-repository',
+    signer.githubWorkflow.repository,
+    '--certificate-github-workflow-ref',
+    signer.githubWorkflow.ref,
+    '--certificate-github-workflow-sha',
+    certificateWorkflowSha,
+    '--type',
+    predicateType,
+  ];
+}
+
+/** The canonical bytes of a cosign-produced bundle, held to its statement. Reads; writes nothing. */
+export function canonicalSignedBundleBytes({ statementBytes, bundlePath }) {
+  let producedBundle;
+  try {
+    producedBundle = JSON.parse(
+      decodeExactUtf8(readFileSync(bundlePath), 'cosign-produced bundle'),
+    );
+  } catch (error) {
+    throw new Error(
+      `cosign-produced bundle is not exact UTF-8 JSON: ${error.message}`,
+    );
+  }
+  const bundleBytes = canonicalJsonBytes(producedBundle);
+  validateProducedBundle(statementBytes, bundleBytes);
+  return bundleBytes;
+}
+
+function stagedPaths(statement) {
+  const stem = artifactStem(statement.predicate.source);
+  return {
+    statementPath: `${STAGED_STATEMENTS_DIRECTORY}/${stem}.json`,
+    bundlePath: `${STAGED_BUNDLES_DIRECTORY}/${stem}.sigstore.json`,
+  };
+}
+
+/**
+ * Write the canonical statement bytes to sign into a NEW staging directory and
+ * return the signing plan: what to sign, where each bundle must be written,
+ * and the identity each bundle will be verified against.
+ */
+export function stageImageSourceEvidence({
+  input,
+  stagingDirectory,
+  schemas,
+  expectedContractAuthority,
+}) {
+  if (!isAbsolute(stagingDirectory)) {
+    throw new Error('the staging directory must be an absolute path');
+  }
+  if (existsSync(stagingDirectory)) {
+    throw new Error(`evidence staging directory already exists: ${stagingDirectory}`);
+  }
+  const statements = buildImageSourceStatements(input, schemas, expectedContractAuthority);
+  mkdirSync(join(stagingDirectory, STAGED_STATEMENTS_DIRECTORY), { recursive: true, mode: 0o700 });
+  mkdirSync(join(stagingDirectory, STAGED_BUNDLES_DIRECTORY), { mode: 0o700 });
+  const planned = [];
+  for (const statement of statements) {
+    const paths = stagedPaths(statement);
+    writeFileSync(join(stagingDirectory, paths.statementPath), canonicalJsonBytes(statement), {
+      flag: 'wx',
+      mode: 0o600,
+    });
+    planned.push({
+      subjectKind: statement.predicate.source.kind,
+      subjectId: statement.predicate.source.id,
+      ...paths,
+    });
+  }
+  return {
+    schemaVersion: 1,
+    kind: 'producer',
+    root: stagingDirectory,
+    predicateType: schemas.IMAGE_PRODUCER_PREDICATE_TYPE,
+    signer: input.signer,
+    certificateWorkflowSha: input.producerWorkflowSha,
+    statements: planned,
+  };
+}
+
+/**
+ * Accept the signed bundles of a staged directory and seal `outputDirectory`.
+ *
+ * The output is BUILT, never renamed from the staging: each statement is
+ * re-derived from `input` (a staged statement that is not byte-identical is
+ * refused, so nothing but what this library built can have been signed), each
+ * bundle is canonicalized and verified, and only those derived files are
+ * written. The staging must hold exactly what stage recorded.
+ *
+ * The staging does not outlive accept. A refused accept removes it together
+ * with the partial output, so no signed-but-unaccepted bundle is left for a
+ * later step to pick up; a successful accept removes it too. Only the argument
+ * refusals above the first read leave it in place.
+ *
+ * `cosignVersion` is the trust policy's pinned version.
+ */
+export function acceptImageSourceEvidence({
+  input,
+  stagingDirectory,
+  outputDirectory,
+  schemas,
+  expectedContractAuthority,
+  cosignVersion,
+  readCosignVersion,
+  runCosign,
+}) {
+  if (!isAbsolute(stagingDirectory) || !isAbsolute(outputDirectory)) {
+    throw new Error('the staging and output directories must be absolute paths');
+  }
+  if (typeof readCosignVersion !== 'function' || typeof runCosign !== 'function') {
+    throw new Error('cosign seams are required');
+  }
+  const sealing = reserveSealing(outputDirectory, 'evidence');
+  return sealAccepted({
+    stagingDirectory,
+    sealing,
+    outputDirectory,
+    build: () => {
+      exactCosignVersion(readCosignVersion(), cosignVersion);
+      const statements = buildImageSourceStatements(input, schemas, expectedContractAuthority);
+      assertStagedExactly(
+        stagingDirectory,
+        statements.flatMap((statement) => {
+          const { statementPath, bundlePath } = stagedPaths(statement);
+          return [statementPath, bundlePath];
+        }),
+      );
+      mkdirSync(join(sealing, STAGED_STATEMENTS_DIRECTORY), { recursive: true, mode: 0o755 });
+      mkdirSync(join(sealing, STAGED_BUNDLES_DIRECTORY), { mode: 0o755 });
+      const producerEvidence = [];
+      for (const statement of statements) {
+        const { statementPath, bundlePath } = stagedPaths(statement);
+        const statementBytes = canonicalJsonBytes(statement);
+        if (!readFileSync(join(stagingDirectory, statementPath)).equals(statementBytes)) {
+          throw new Error(
+            `staged statement ${statementPath} is not the statement this producer input builds`,
+          );
+        }
+        const bundleBytes = canonicalSignedBundleBytes({
+          statementBytes,
+          bundlePath: join(stagingDirectory, bundlePath),
+        });
+        writeFileSync(join(sealing, statementPath), statementBytes, { flag: 'wx', mode: 0o644 });
+        writeFileSync(join(sealing, bundlePath), bundleBytes, { flag: 'wx', mode: 0o644 });
+        // Verified where it is sealed: the bytes cosign accepts are the bytes kept.
+        runCosign(
+          cosignVerifyAttestationArgs({
+            bundlePath: join(sealing, bundlePath),
+            signer: input.signer,
+            certificateWorkflowSha: input.producerWorkflowSha,
+            predicateType: schemas.IMAGE_PRODUCER_PREDICATE_TYPE,
+          }),
+        );
+        producerEvidence.push({
+          subjectKind: statement.predicate.source.kind,
+          subjectId: statement.predicate.source.id,
+          evidence: {
+            statementPath,
+            statementDigest: sha256Digest(statementBytes),
+            bundlePath,
+            bundleDigest: sha256Digest(bundleBytes),
+            bundleMediaType: BUNDLE_MEDIA_TYPE,
+          },
+        });
+      }
+      writeFileSync(
+        join(sealing, 'producer-evidence.json'),
+        serializeJson({ schemaVersion: 1, producerEvidence }),
+        { flag: 'wx', mode: 0o644 },
+      );
+      return producerEvidence;
+    },
+  });
+}
+
+const USAGE =
+  'usage: xema edition evidence statement producer <stage|accept> --input <json> --staging <absolute-directory> ' +
+  '--github-repository <owner/repo> --github-ref <ref> --github-sha <commit> ' +
+  '--github-workflow-ref <owner/repo/path@ref> [accept: --output <absolute-directory> --cosign <absolute-binary>] ' +
+  '--data-root <dir> --kernel <dir>';
+
+function parseFlags(args, known) {
+  const flags = new Map();
+  for (let index = 0; index < args.length; index += 2) {
+    const flag = args[index];
+    const value = args[index + 1];
+    if (typeof flag !== 'string' || !flag.startsWith('--') || !known.includes(flag.slice(2))) {
+      throw new Error(USAGE);
+    }
+    if (value === undefined || value.startsWith('--') || flags.has(flag.slice(2))) {
+      throw new Error(USAGE);
+    }
+    flags.set(flag.slice(2), value);
+  }
+  for (const name of known) {
+    if (!flags.has(name)) {throw new Error(USAGE);}
+  }
+  return flags;
+}
+
+async function main() {
+  const [phase, ...args] = configureEditionWorkspaceFromArgv(process.argv.slice(2), [
+    WorkspaceRoot.Data,
+    WorkspaceRoot.Kernel,
+  ]);
+  const context = ['github-repository', 'github-ref', 'github-sha', 'github-workflow-ref'];
+  if (phase !== 'stage' && phase !== 'accept') {
+    throw new Error(USAGE);
+  }
+  const flags = parseFlags(
+    args,
+    phase === 'stage' ? ['input', 'staging', ...context] : ['input', 'staging', 'output', 'cosign', ...context],
+  );
+  const input = JSON.parse(readFileSync(resolve(flags.get('input')), 'utf8'));
+  const { schemas, contractAuthority } = await loadProducerKernelSchemas({ dataRoot: dataRoot() });
+  assertProducerInput(input, contractAuthority);
+  assertGitHubProducerContext(input, {
+    repository: flags.get('github-repository'),
+    ref: flags.get('github-ref'),
+    sha: flags.get('github-sha'),
+    workflowRef: flags.get('github-workflow-ref'),
+  });
+  if (phase === 'stage') {
+    const plan = stageImageSourceEvidence({
+      input,
+      stagingDirectory: flags.get('staging'),
+      schemas,
+      expectedContractAuthority: contractAuthority,
+    });
+    process.stdout.write(serializeJson(plan));
+    return;
+  }
+  const evidence = acceptImageSourceEvidence({
+    input,
+    stagingDirectory: flags.get('staging'),
+    outputDirectory: flags.get('output'),
+    schemas,
+    expectedContractAuthority: contractAuthority,
+    cosignVersion: loadPinnedDeclaredTrustPolicy({
+      dataRoot: dataRoot(),
+      declaration: editionWorkspaceConfig().evidenceTrustPolicy,
+      schemas,
+    }).cosignVersion,
+    ...createCosignVerifier(flags.get('cosign')),
+  });
+  process.stdout.write(serializeJson({ schemaVersion: 1, kind: 'producer', outputDirectory: flags.get('output'), producerEvidence: evidence }));
+}
+
+if (isEntryModule(import.meta.url)) {
+  main().catch((error) => {
+    console.error(`[image-source-evidence] ${error.message}`);
+    process.exitCode = 1;
+  });
+}