@xemahq/xema 0.40.3 → 0.41.0

package/edition/verify-image-evidence.mjs

@@ -12,6 +12,9 @@
 //   * the data root and the editions root are clean git checkouts at an exact
 //     HEAD with every file read from them bound to its HEAD blob.
 //
+// A second mode, `catalogue-evidence arming|verify` (verify-catalogue-evidence.mjs), judges a release catalogue's E4
+// statement for a customer before the catalogue's kernel is adopted; it is selected by the first argument.
+//
 // usage: verify-image-evidence <distributionId> --evidence-root <dir>
 //   --descriptor <absolute-path> --state <absolute-path> --cosign <absolute-path> --git <absolute-path>
 //   [--evidence-set <relative-path>] --data-root <dir> --editions-root <dir>
@@ -65,6 +68,10 @@ import {
   readRunningVerifier,
 } from './verifier-binding.mjs';
 import { loadVerifierKernelSchemas } from './verifier-kernel-schemas.mjs';
+import {
+  CATALOGUE_EVIDENCE_MODE,
+  runCatalogueEvidenceEntry,
+} from './verify-catalogue-evidence.mjs';
 
 const USAGE =
   'usage: verify-image-evidence <distributionId> --evidence-root <dir> --descriptor <absolute-path> --state <absolute-path> ' +
@@ -445,7 +452,14 @@ export async function verifyEvidence({ argv, env, bundlePath }) {
   }
 }
 
-if (isEntryModule(import.meta.url)) {
+if (isEntryModule(import.meta.url) && process.argv[2] === CATALOGUE_EVIDENCE_MODE) {
+  // The customer's pre-adoption mode: the E4 statement of a catalogue, judged with this bundle's own embedded kernel.
+  await runCatalogueEvidenceEntry({
+    argv: process.argv.slice(2),
+    env: process.env,
+    bundlePath: process.argv[1],
+  });
+} else if (isEntryModule(import.meta.url)) {
   await verifyEvidence({
     argv: process.argv.slice(2),
     env: process.env,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.40.3",
+  "version": "0.41.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-cli.git",
@@ -92,6 +92,6 @@
     "typecheck": "tsc --noEmit"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:55a458c54ff157ee053b4f074068c355fb35d28f54a01b0a2662bf14b07b8323"
+    "sourceDigest": "sha256:322929ee2999d155d5d612f17bb786adef52f44c46cee82b9bc9b11ecc792758"
   }
 }

package/edition/develop-customer-edition.mjs

@@ -1,149 +0,0 @@
-// develop-customer-edition — a DEVELOP customer edition: a customer definition
-// resolved against a catalogue, frozen at the customer's OWN repository pins.
-//
-// The pins file holds one `sources/<name>` commit per source the definition
-// declares and nothing else (the vendor repositories are the catalogue's, not
-// the customer's). The digest of the catalogue artifact the edition was
-// resolved against is frozen into the descriptor's provenance pins as
-// `catalogue`; the artifact tag (developEditionTag) covers it. The vendor image
-// rows arrive sealed from the catalogue; only the customer's own image rows are
-// sealed against the develop image repositories.
-
-import { join } from 'node:path';
-
-import { sealLock } from './biome-content.mjs';
-import { parseCatalogueRef } from './catalogue-fetch.mjs';
-import { readCataloguePin } from './catalogue-pin.mjs';
-import { developImageRef } from './develop-image-coordinate.mjs';
-import { sealDevelopImageSubjects } from './develop-seal.mjs';
-import { assertCanonicalDistributionId } from './distribution-paths.mjs';
-import { CATALOGUE_PIN_KEY, EditionChannel, EditionLockFile } from './edition-constants.mjs';
-import { loadKernelDistributionSchemas } from './lib.mjs';
-import { isSourcePinKey, sortedSnapshotPins, sourcePinKey } from './pin-source.mjs';
-import { resolveCustomerEdition } from './resolve-customer-edition.mjs';
-import { externalSourceTrees, imageRefForSubject, sourceTreeLocator } from './resolve-images.mjs';
-import { readStrictJsonFile } from './strict-json.mjs';
-
-const SHA_PATTERN = /^[0-9a-f]{40}$/;
-
-export class CustomerDevelopPinsError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = 'CustomerDevelopPinsError';
-  }
-}
-
-/**
- * The pins of a develop customer edition: `sources/<name>` commits for exactly
- * the definition's declared sources, plus `catalogue` = the digest of the
- * catalogue artifact. A `catalogue` entry in the file must equal that digest.
- */
-export function customerDevelopPins({ pins, declaredSourceNames, catalogueDigest }) {
-  if (pins === null || typeof pins !== 'object' || Array.isArray(pins)) {
-    throw new CustomerDevelopPinsError('--pins must be an object mapping sources/<name> -> 40-hex commit');
-  }
-  const own = {};
-  for (const [key, value] of Object.entries(pins)) {
-    if (key === CATALOGUE_PIN_KEY) {
-      if (value !== catalogueDigest) {
-        throw new CustomerDevelopPinsError(`--pins "${CATALOGUE_PIN_KEY}" is ${JSON.stringify(value)}, but the pinned develop catalogue is ${catalogueDigest}`);
-      }
-      continue;
-    }
-    if (!isSourcePinKey(key)) {
-      throw new CustomerDevelopPinsError(`--pins "${key}" is not one of the customer's own repositories: a customer develop pins only sources/<name> (the vendor's pins are the catalogue's)`);
-    }
-    if (typeof value !== 'string' || !SHA_PATTERN.test(value)) {
-      throw new CustomerDevelopPinsError(`--pins "${key}" is not a 40-hex commit SHA: ${JSON.stringify(value)}`);
-    }
-    own[key] = value;
-  }
-  const declared = new Set(declaredSourceNames.map(sourcePinKey));
-  for (const key of declared) {
-    if (!(key in own)) {throw new CustomerDevelopPinsError(`--pins is missing "${key}": the definition declares that source`);}
-  }
-  for (const key of Object.keys(own)) {
-    if (!declared.has(key)) {throw new CustomerDevelopPinsError(`--pins names "${key}", but the definition declares no such source`);}
-  }
-  return sortedSnapshotPins({ ...own, [CATALOGUE_PIN_KEY]: catalogueDigest });
-}
-
-/** The source names a raw definition declares (the pins are checked before the definition is composed). */
-export function declaredSourceNamesOf(rawDefinition) {
-  const sources = rawDefinition?.sources;
-  return Array.isArray(sources) ? sources.map((source) => source?.name) : [];
-}
-
-/** Resolve and seal the develop customer edition; returns the four locks and the frozen provenance pins. */
-export async function resolveCustomerDevelopEdition({ rawDefinition, catalogue, catalogueDigest, pins, sourceImages, env = process.env, sealOptions = {}, adoptKernel, materialize }) {
-  const frozen = customerDevelopPins({ pins, declaredSourceNames: declaredSourceNamesOf(rawDefinition), catalogueDigest });
-  const resolved = await resolveCustomerEdition({
-    rawDefinition,
-    catalogue,
-    channel: EditionChannel.Develop,
-    sourceImages,
-    pins: frozen,
-    catalogueDigest,
-    ...(adoptKernel === undefined ? {} : { adoptKernel }),
-    ...(materialize === undefined ? {} : { materialize }),
-    sealOwn: ({ distributionId, subjects }) => sealDevelopImageSubjects({ distributionId, subjects, env, ...sealOptions }),
-  });
-  // The customer edition is sealed here: every biomeContentHash is recomputed through the
-  // same code as the vendor's, vendor biomes on the CATALOGUE's authority (biome-content.mjs).
-  const schemas = await loadKernelDistributionSchemas();
-  const distributionLock = await sealLock({
-    schemas,
-    unsealed: resolved.distributionLock,
-    imageLock: resolved.imageLock,
-    locate: sourceTreeLocator(externalSourceTrees(resolved.distributionLock)),
-    vendoredCommit: (repo) => {
-      throw new Error(`customer biome source "${repo}" is first-party to no checkout; vendor biomes are taken from the catalogue`);
-    },
-    catalogue,
-    catalogueDigest,
-    storePublisherAnchorKeys: resolved.storePublisherAnchorKeys,
-  });
-  return { ...resolved, distributionLock, pins: frozen };
-}
-
-/**
- * What a develop verb of a customer edition derives from its definition file and its `--pins` file with no
- * network: the id (the definition's), the pinned develop catalogue reference and digest, and the frozen
- * provenance pins (the customer's `sources/<name>` commits plus that digest).
- */
-export function customerDevelopFrame({ definitionFile, pinsFile }) {
-  const rawDefinition = readStrictJsonFile(definitionFile);
-  assertCanonicalDistributionId(rawDefinition?.id);
-  const catalogueRef = readCataloguePin({ definitionFile, channel: EditionChannel.Develop });
-  const { digest } = parseCatalogueRef(catalogueRef);
-  const pins = customerDevelopPins({ pins: readStrictJsonFile(pinsFile), declaredSourceNames: declaredSourceNamesOf(rawDefinition), catalogueDigest: digest });
-  return { id: rawDefinition.id, rawDefinition, catalogueRef, catalogueDigest: digest, pins };
-}
-
-/**
- * The own image rows of an existing customer develop artifact are the rows this `--source-image` map composes:
- * every subject owned by a biome drawn from a declared source is `<registry>/<prefix><subject>` mapped to its
- * develop repository. The tag covers the map, but a tag is mutable registry state, so the pulled bytes are
- * compared too. Throws naming the first row that differs.
- */
-export function assertOwnImageRowsMatch({ artifactDir, sourceImages }) {
-  const lock = readStrictJsonFile(join(artifactDir, EditionLockFile.Distribution));
-  const imageLock = readStrictJsonFile(join(artifactDir, EditionLockFile.Images));
-  const sourceOf = new Map((lock.biomes ?? []).filter((biome) => biome.source !== undefined).map((biome) => [biome.id, biome.source.name]));
-  for (const subject of imageLock.subjects ?? []) {
-    const biomeId = (subject.owners ?? []).find((owner) => sourceOf.has(owner.biomeId))?.biomeId;
-    if (biomeId === undefined) {continue;}
-    const name = sourceOf.get(biomeId);
-    const image = sourceImages.get(name);
-    if (image === undefined) {
-      throw new Error(`the existing artifact draws biome "${biomeId}" from source "${name}", which has no --source-image; refusing to reuse it`);
-    }
-    const expected = developImageRef(imageRefForSubject(subject.id, image.imageRegistry, image.imageNamePrefix));
-    if (subject.imageRef !== expected) {
-      throw new Error(
-        `the existing artifact's own image row ${subject.kind}:${subject.id} is ${subject.imageRef}, not ${expected} ` +
-          '(the --source-image map differs); refusing to reuse it',
-      );
-    }
-  }
-}