@xemahq/xema 0.29.0 → 0.29.1

package/dist/edition/verify-image-evidence.bundle.provenance.json

@@ -2119,193 +2119,193 @@
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.29.0",
+      "version": "0.29.1",
       "path": "edition/authorization-base.mjs",
       "sha256": "sha256:7ded47eadc194ebf11583f77c695bf1708e502c654420564d55be3b599ff770f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.29.0",
+      "version": "0.29.1",
       "path": "edition/connector-source-authority.mjs",
       "sha256": "sha256:ea94475f4324737673accd7de1303c44db1cbc4dac61a865a06cd83abe310164"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.29.0",
+      "version": "0.29.1",
       "path": "edition/distribution-paths.mjs",
       "sha256": "sha256:d78a5c8405bc6c25d36fcec61b0030e1fdacac7d528e698adb96f906f4b70279"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.29.0",
+      "version": "0.29.1",
       "path": "edition/edition-artifact.mjs",
       "sha256": "sha256:161f522eb39e3db705bc709f8512988dd3e6752851d972521354eeccffd8075d"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.29.0",
+      "version": "0.29.1",
       "path": "edition/edition-channel.mjs",
       "sha256": "sha256:9dcd7b09d4fee8c4d43338e4e418619aa3003a612823455310cad6f6c48a19c0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.29.0",
+      "version": "0.29.1",
       "path": "edition/edition-chart-set.mjs",
       "sha256": "sha256:fbda500315d45e35eb974f4701bbf36729c3b642a5d735bc1b07085c91d25b23"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.29.0",
+      "version": "0.29.1",
       "path": "edition/edition-config.mjs",
       "sha256": "sha256:e3997bd9a0082e02d01760868b2a4f41ed3081e904126b30fdf86e7938dc6137"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.29.0",
+      "version": "0.29.1",
       "path": "edition/edition-constants.mjs",
       "sha256": "sha256:71ae51028847ab3430ffec9b229b0516a7705b75a6de1fcfa665f5e1abf8e9bb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.29.0",
+      "version": "0.29.1",
       "path": "edition/edition-contract-parse.mjs",
       "sha256": "sha256:c575e96b70bda82899931eb0b18567988e2e13e664fa498bcbef96b571dcabb4"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.29.0",
+      "version": "0.29.1",
       "path": "edition/edition-contract.json",
       "sha256": "sha256:aa1a05f1728813a7bdb1e02d9305e9adf641d695e6767305210c67a1d81b38a7"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.29.0",
+      "version": "0.29.1",
       "path": "edition/edition-protocol.mjs",
       "sha256": "sha256:3a0d53d18718790ac32c92164e373f7f038675a3e9410e5ef3c139affcf42892"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.29.0",
+      "version": "0.29.1",
       "path": "edition/edition-workspace.mjs",
       "sha256": "sha256:a56e0441fc71e7cffa0e5990b219fbb03a7061fc3b5738c8b787b168ccb0d7c6"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.29.0",
+      "version": "0.29.1",
       "path": "edition/evidence-checkout.mjs",
       "sha256": "sha256:31fb669769b31de4c6f2b2501bb96959548172ef166e7568edbbfed7f5079a11"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.29.0",
+      "version": "0.29.1",
       "path": "edition/evidence-grammars.mjs",
       "sha256": "sha256:4dae22b61ade99219a482b971c9780d68a3d37d021e39cdfe860b245364b8b9f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.29.0",
+      "version": "0.29.1",
       "path": "edition/evidence-trust-pin.mjs",
       "sha256": "sha256:b9dd5c01903394436530783614efb0cd357d982ed2befd844a39328479773cbc"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.29.0",
+      "version": "0.29.1",
       "path": "edition/image-delivery-entitlement-descriptor.mjs",
       "sha256": "sha256:4726b66116f01bf2523fafe2b7a356591eca8fb5ca6bd8b154dd4821873e921b"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.29.0",
+      "version": "0.29.1",
       "path": "edition/image-evidence-replay-state.mjs",
       "sha256": "sha256:eba0cf1d38af0ab2f00c5099fa8bc2edc543136ce92f895544d4d284b3d6af0f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.29.0",
+      "version": "0.29.1",
       "path": "edition/image-evidence.mjs",
       "sha256": "sha256:93d91065b045092f2e3462ebe1db8cf041d8ecb66eead8da6c59ca8a377c38ea"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.29.0",
+      "version": "0.29.1",
       "path": "edition/kernel-contract-authority.mjs",
       "sha256": "sha256:20abdde62a7b037c01ea9bbe1ff1e6094e6b0efd0add2f656f1938a04409bf82"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.29.0",
+      "version": "0.29.1",
       "path": "edition/lib.mjs",
       "sha256": "sha256:4d5066b0b20906d789f8843010a9aa2c914d09f383dd93259270138ea898bef4"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.29.0",
+      "version": "0.29.1",
       "path": "edition/no-follow-file.mjs",
       "sha256": "sha256:c17bdf5e441f3c079aa06d4b48bbed05cad087855b9ad2a5e6dc43d5ee2b17c3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.29.0",
+      "version": "0.29.1",
       "path": "edition/pin-source.mjs",
       "sha256": "sha256:4e64d25b7aacec344253d1963f419f946998f36e8c269eea58b8c848e0f35e52"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.29.0",
+      "version": "0.29.1",
       "path": "edition/source-authority.mjs",
       "sha256": "sha256:2351d47a32ee865720a675f1ecd336b00cdce4aa34713219a1aa23920ac7b60f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.29.0",
+      "version": "0.29.1",
       "path": "edition/strict-json.mjs",
       "sha256": "sha256:f95778396df7f38b086f55d2ec4f3b6644a8aeff2b32282a62829145fb544562"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.29.0",
+      "version": "0.29.1",
       "path": "edition/string-order.mjs",
       "sha256": "sha256:b3210cd273e4b2e01fb8b1a91e28734cd211d4010c080d0ce95f5e5ff631cffb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.29.0",
+      "version": "0.29.1",
       "path": "edition/trusted-executable.mjs",
       "sha256": "sha256:37d46cdbc999ddd55d4ea8aeed4850ddd1efde89ed7b532f5a2ddec87105d796"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.29.0",
+      "version": "0.29.1",
       "path": "edition/verifier-binding.mjs",
       "sha256": "sha256:80732658617f5255258c538eeb2383331ec8553b44b58d552b567845a7b916aa"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.29.0",
+      "version": "0.29.1",
       "path": "edition/verifier-files.mjs",
       "sha256": "sha256:cdd14a20a63f0f194a8abb55680a5a7e3ced1f09f8b210a90d349e655f6de0c0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.29.0",
+      "version": "0.29.1",
       "path": "edition/verifier-provenance.mjs",
       "sha256": "sha256:3e2fb8e07cf1f66b8ad6c7ac2555fe3af64ec7abeb07cecbaf1939a18c2b3663"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.29.0",
+      "version": "0.29.1",
       "path": "edition/verify-image-evidence.mjs",
       "sha256": "sha256:b7412ea4609c32cecf8992a4d2db4bf27fbad95b2d26ab1eee10ddbf044d1a0e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.29.0",
+      "version": "0.29.1",
       "path": "edition/workspace-sections.mjs",
       "sha256": "sha256:058c849767434e9ba911d9310092bede42e3ef959c75bbd35ff8879dc21ce3ff"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.29.0",
+      "version": "0.29.1",
       "path": "scripts/build-evidence-verifier.mjs",
       "sha256": "sha256:decfa7ca6c340e51ddc06f4d30caac8e8e3c060c843c211586efc313dd9ace8e"
     },

package/edition/oras.mjs

@@ -20,8 +20,9 @@
 //   * before oras ever receives a credential, the registry's own `/v2/`
 //     challenge is probed and a token realm on another origin is refused;
 //   * a digest-addressed read whose bytes do not hash to the requested digest
-//     throws; a tag read is resolved to a descriptor first, then read by digest,
-//     so its bytes are always hash-checked;
+//     throws; a tag read and a digest read are both resolved to the registry's
+//     descriptor first, and the manifest media type is the descriptor's, never
+//     the manifest body's optional `mediaType` (Helm's has none);
 //   * descriptor sizes are checked BEFORE the fetch, actual lengths after it;
 //   * a registry status is read only from oras's own error forms; any other
 //     failure carries no status and is thrown as undecided;
@@ -554,11 +555,11 @@ export class OrasRegistry {
   }
 
   /**
-   * Fetch a manifest by TAG: resolve the descriptor, then read by digest, so the
-   * bytes are always hash-checked against what the registry said the tag is.
+   * The descriptor the registry reports for a manifest reference, refused when
+   * its media type is not an accepted manifest type or it declares more than
+   * the manifest size cap.
    */
-  async getManifestByTag(repository, tag) {
-    const ref = `${this.#ref(repository)}:${tag}`;
+  async #manifestDescriptor(ref) {
     const out = await this.#oras(['manifest', 'fetch'], ['--descriptor'], ref);
     const descriptor = this.#parseDescriptor(out, ref);
     if (!ACCEPTED_MANIFEST_MEDIA_TYPES.includes(descriptor.mediaType)) {
@@ -569,12 +570,33 @@ export class OrasRegistry {
     if (descriptor.size > MAX_MANIFEST_BYTES) {
       throw new Error(`${ref} declares ${descriptor.size} bytes, exceeding ${MAX_MANIFEST_BYTES}`);
     }
+    return descriptor;
+  }
+
+  /**
+   * Fetch a manifest by TAG: resolve the descriptor, then read by digest, so the
+   * bytes are always hash-checked against what the registry said the tag is.
+   */
+  async getManifestByTag(repository, tag) {
+    const descriptor = await this.#manifestDescriptor(`${this.#ref(repository)}:${tag}`);
     return this.#manifestByDigest(repository, descriptor.digest, descriptor.mediaType);
   }
 
-  /** Fetch a manifest by DIGEST; the bytes must hash to exactly that digest. */
+  /**
+   * Fetch a manifest by DIGEST: the media type is the one the registry reports
+   * for that digest (a manifest body's own `mediaType` is optional, and Helm's
+   * has none), and the bytes must hash to exactly that digest.
+   */
   async getManifestByDigest(repository, digest) {
-    return this.#manifestByDigest(repository, digest, null);
+    if (!SHA256_DIGEST_PATTERN.test(digest)) {
+      throw new Error(`"${digest}" is not a canonical lowercase sha256 digest`);
+    }
+    const ref = `${this.#ref(repository)}@${digest}`;
+    const descriptor = await this.#manifestDescriptor(ref);
+    if (descriptor.digest !== digest) {
+      throw new Error(`${ref} described ${descriptor.digest}, not the requested ${digest}`);
+    }
+    return this.#manifestByDigest(repository, digest, descriptor.mediaType);
   }
 
   async #manifestByDigest(repository, digest, expectedMediaType) {
@@ -629,10 +651,10 @@ function decodeManifest(bytes, expectedMediaType, ref) {
   if (typeof document !== 'object' || document === null || Array.isArray(document)) {
     throw new Error(`${ref} returned a manifest that is not a JSON object`);
   }
-  const mediaType = expectedMediaType ?? document.mediaType;
+  const mediaType = expectedMediaType;
   if (!ACCEPTED_MANIFEST_MEDIA_TYPES.includes(mediaType)) {
     throw new Error(
-      `${ref} returned unsupported manifest media type "${mediaType || '(none)'}"`,
+      `${ref} returned unsupported manifest media type "${mediaType}"`,
     );
   }
   if (typeof document.mediaType === 'string' && document.mediaType !== mediaType) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.29.0",
+  "version": "0.29.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-cli.git",
@@ -92,6 +92,6 @@
     "typecheck": "tsc --noEmit"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:a0dc6a3fdb7cce15b031dcd04476f19924d13d36924070b1527af1fa613b258e"
+    "sourceDigest": "sha256:82760f14feea4fe0626220e0f71344375964f15d36201d1e7000ebfb6b2e4ecd"
   }
 }