@xemahq/xema 0.48.0 → 0.49.1

package/edition/develop-select-records.mjs

@@ -21,179 +21,32 @@
 // the newest remaining valid one. The guard is deploy-latest's (part 07): its owner refuses a snapshot that goes
 // backwards. This verb checks nothing against current pins.
 
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import { canonicalPublicHttpsRepositoryUrl, repositoryOwnerName } from './canonical-repository-url.mjs';
-import { certificateConstraintArgs } from './cosign-certificate-constraints.mjs';
 import { writeOnce } from './customer-edition-verbs.mjs';
-import { basicAuthParts, defaultRunCosign } from './develop-coverage-readers.mjs';
 import { developGraphMembers } from './develop-graph.mjs';
 import { PublishedRecordMissingError, newestCommitOnDevelop } from './develop-record-ancestry.mjs';
+import {
+  cosignEnvironment,
+  listBuildRecordRuns,
+  loadVerifiedRecord,
+  recordSignerOrigin,
+  requireBuildRecordKernel,
+  withRecordVerifier,
+} from './develop-record-verify.mjs';
 import { editionWorkspaceConfig } from './edition-config.mjs';
-import { dataRoot } from './edition-workspace.mjs';
-import { loadDeclaredPinnedPolicy } from './evidence-trust-policy.mjs';
-import { COSIGN_ENV, prepareTrustedCosignBinary, validatePinnedTrustedRoot } from './image-evidence.mjs';
-import { compareStrings, loadKernelDistributionSchemas } from './lib.mjs';
+import { compareStrings } from './lib.mjs';
 import { RecordRefused } from './record-refused.mjs';
-import { loadRegistryCredentialDeclarations, resolveRegistryCredential, splitImageRef } from './registry-credentials.mjs';
-import { isNotPublishedYet } from './seal-image-digests.mjs';
 import { readStrictJsonFile } from './strict-json.mjs';
-import { assertPreparedExecutable } from './trusted-executable.mjs';
-import { registryClientsFor } from './verify-image-platforms.mjs';
-
-/** The repository segment, under the registry root, that holds a member's build records. */
-export const BUILD_RECORDS_SEGMENT = 'build-records';
-export const RECORD_SIGNER_WORKFLOW = '.github/workflows/record-build.yaml';
-export const RECORD_SIGNER_OIDC_ISSUER = 'https://token.actions.githubusercontent.com';
-/** The branches a record signer is declared for, each with the ref the record workflow runs at. */
-const RECORD_SIGNER_REFS = Object.freeze({ develop: 'refs/heads/develop' });
-/**
- * A cosign exit whose stderr shows the registry was not reached before any verdict. Only this, a cosign that
- * could not run, and a timeout are operational; every other non-zero exit of `cosign verify` is a verdict.
- */
-const COSIGN_TRANSPORT_FAILURE = /dial tcp|i\/o timeout|connection (refused|reset)|no such host|TLS handshake timeout|context deadline exceeded/i;
-const ISO_UTC = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$/;
-
-/** The record's producer is a kind this CLI has no claims for: a closed set, never guessed at. */
-export class UnknownBuildRecordProducerError extends RecordRefused {
-  constructor(repo, kind) {
-    super(repo, `the record's producer kind ${JSON.stringify(kind)} is not one select-records can verify`);
-    this.name = 'UnknownBuildRecordProducerError';
-  }
-}
-
-export class DataRootRepositoryUndeclaredError extends Error {
-  constructor() {
-    super('edition-workspace.json declares no dataRootRepositoryUrl; select-records cannot name the record signer');
-    this.name = 'DataRootRepositoryUndeclaredError';
-  }
-}
-
-export class KernelLacksBuildRecordSchemaError extends Error {
-  constructor(missing) {
-    super(`the kernel's distribution module does not export ${missing.join(', ')}; select-records needs a kernel with the build-record contract`);
-    this.name = 'KernelLacksBuildRecordSchemaError';
-  }
-}
-
-/** The data root's `owner/name`, from the workspace declaration; refused by name when it declares none. */
-export function declaredDataRootRepositoryUrl() {
-  const url = editionWorkspaceConfig().dataRootRepositoryUrl;
-  if (url === undefined) {throw new DataRootRepositoryUndeclaredError();}
-  return url;
-}
-
-/** The kernel's build-record exports, refused as a set when any is absent. */
-export function requireBuildRecordKernel(schemas) {
-  const names = ['BUILD_RECORD_MEDIA_TYPE', 'BuildRecordSchema', 'buildRecordTag', 'parseBuildRecordTag', 'compareBuildRecordRuns'];
-  const missing = names.filter((name) => schemas?.[name] === undefined);
-  if (missing.length > 0 || typeof schemas.BuildRecordSchema?.safeParse !== 'function') {
-    throw new KernelLacksBuildRecordSchemaError(missing.length > 0 ? missing : ['a BuildRecordSchema with safeParse']);
-  }
-  return schemas;
-}
-
-/** The ref and data-root repository a branch's records are signed by; refused before any network call. */
-export function recordSignerOrigin({ branch, dataRootRepositoryUrl }) {
-  const ref = Object.hasOwn(RECORD_SIGNER_REFS, branch) ? RECORD_SIGNER_REFS[branch] : undefined;
-  if (ref === undefined) {throw new Error(`no record signer declared for branch ${branch}`);}
-  if (dataRootRepositoryUrl === undefined) {throw new DataRootRepositoryUndeclaredError();}
-  const dataRepository = repositoryOwnerName(canonicalPublicHttpsRepositoryUrl(dataRootRepositoryUrl, 'dataRootRepositoryUrl'), 'dataRootRepositoryUrl');
-  return { ref, dataRepository };
-}
-
-/**
- * The signer of the branch's records: the data root's record workflow at the branch, as the certificate states
- * it, with the repository that CALLED the workflow (the member) as the workflow-repository claim.
- */
-export function recordSigner({ branch, dataRootRepositoryUrl, memberRepositoryUrl }) {
-  const { ref, dataRepository } = recordSignerOrigin({ branch, dataRootRepositoryUrl });
-  const member = repositoryOwnerName(canonicalPublicHttpsRepositoryUrl(memberRepositoryUrl, 'repositoryUrl'), 'repositoryUrl');
-  return {
-    certificateIdentity: `https://github.com/${dataRepository}/${RECORD_SIGNER_WORKFLOW}@${ref}`,
-    oidcIssuer: RECORD_SIGNER_OIDC_ISSUER,
-    githubWorkflow: { repository: member, ref },
-    memberRepository: member,
-  };
-}
-
-/**
- * What a record's producer says, read through the ONE switch over its kind: the repository that called the
- * record workflow (the cosign caller claim, held equal to the member's) and the run the snapshot names.
- */
-export function producerClaims({ record, repo, memberRepository }) {
-  switch (record.producer?.kind) {
-    case 'github-actions': {
-      const { repository, runNumber, runAttempt } = record.producer;
-      if (repository !== memberRepository) {throw new RecordRefused(repo, `record is produced by repository ${repository}, not ${memberRepository}`);}
-      return { repository, snapshot: `${runNumber}.${runAttempt}` };
-    }
-    default:
-      throw new UnknownBuildRecordProducerError(repo, record.producer?.kind);
-  }
-}
 
-/** Run one registry client call; ONLY a failure of the client itself is "the registry did not answer". */
-async function fromRegistry(repo, what, call) {
-  try {
-    return await call();
-  } catch (error) {
-    throw new Error(`select-records: ${repo}: the registry did not answer for ${what}: ${error.message}`);
-  }
-}
+// The record-verification names this verb's tests and callers read from here, owned by the shared core.
+export {
+  DataRootRepositoryUndeclaredError,
+  KernelLacksBuildRecordSchemaError,
+  UnknownBuildRecordProducerError,
+  declaredDataRootRepositoryUrl,
+  recordSigner,
+} from './develop-record-verify.mjs';
 
-/** Read one record by its tag: manifest by digest, its single layer, parsed against the kernel's schema. */
-async function readRecord({ kernel, client, repository, repo, tag }) {
-  const served = await fromRegistry(repo, `${repository}:${tag}`, () => client.getManifestByTag(repository, tag));
-  const manifest = await fromRegistry(repo, `${repository}@${served.digest}`, () => client.getManifestByDigest(repository, served.digest));
-  const layers = manifest.document.layers;
-  if (!Array.isArray(layers) || layers.length !== 1) {
-    throw new RecordRefused(repo, `record ${tag} has ${Array.isArray(layers) ? layers.length : 'no'} layers, not exactly one`);
-  }
-  const [layer] = layers;
-  if (layer.mediaType !== kernel.BUILD_RECORD_MEDIA_TYPE) {
-    throw new RecordRefused(repo, `record ${tag} layer media type is ${JSON.stringify(layer.mediaType)}, not ${kernel.BUILD_RECORD_MEDIA_TYPE}`);
-  }
-  const bytes = await fromRegistry(repo, `${repository}@${layer.digest}`, () => client.getBlob(repository, layer.digest));
-  let document;
-  try {
-    document = JSON.parse(bytes.toString('utf8'));
-  } catch (error) {
-    throw new RecordRefused(repo, `record ${tag} is not JSON: ${error.message}`);
-  }
-  const parsed = kernel.BuildRecordSchema.safeParse(document);
-  if (!parsed.success) {throw new RecordRefused(repo, `record ${tag} does not parse as a build record: ${parsed.error.message}`);}
-  return { record: parsed.data, digest: served.digest };
-}
-
-/** The tag's record, verified by digest against the constrained signer, then held to its own repo, branch and tag. */
-async function loadVerifiedRecord({ kernel, client, runCosign, cosignEnv, trustedRootPath, repository, member, branch, dataRootRepositoryUrl, tag }) {
-  const repo = member.repo;
-  const { record, digest } = await readRecord({ kernel, client, repository, repo, tag });
-  const signer = recordSigner({ branch, dataRootRepositoryUrl, memberRepositoryUrl: member.repositoryUrl });
-  const { repository: callerRepository, snapshot } = producerClaims({ record, repo, memberRepository: signer.memberRepository });
-  signer.githubWorkflow.repository = callerRepository;
-  const ref = `${repository}@${digest}`;
-  const args = ['verify', '--offline', '--trusted-root', trustedRootPath, ...certificateConstraintArgs(signer, record.commit), ref];
-  let result;
-  try {
-    result = await runCosign(args, cosignEnv);
-  } catch (error) {
-    // no numeric exit code: cosign did not run (spawn failure) or did not answer (timeout, kill signal)
-    throw new Error(`select-records: ${repo}: cosign could not run for ${ref}: ${error.message}`);
-  }
-  if (result.code !== 0) {
-    if (COSIGN_TRANSPORT_FAILURE.test(result.stderr)) {
-      throw new Error(`select-records: ${repo}: cosign could not reach the registry for ${ref} (exit ${result.code}): ${result.stderr.trim()}`);
-    }
-    throw new RecordRefused(repo, `cosign refused record ${tag} (${digest}) as signed by ${signer.certificateIdentity} (exit ${result.code}): ${result.stderr.trim()}`);
-  }
-  if (record.branch !== branch) {throw new RecordRefused(repo, `record ${tag} is for branch ${record.branch}, not ${branch}`);}
-  if (kernel.buildRecordTag(record) !== tag) {throw new RecordRefused(repo, `record tagged ${tag} says it is ${kernel.buildRecordTag(record)}`);}
-  return { record, snapshot };
-}
+const ISO_UTC = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$/;
 
 /**
  * @param {object} request
@@ -221,26 +74,12 @@ export async function selectRecords({ branch, registry, at, members, dataRootRep
   }
   const selected = [];
   for (const member of members) {
-    const repository = `${registry}/${BUILD_RECORDS_SEGMENT}/${member.repo.split('/').at(-1)}`;
-    const { authority } = splitImageRef(repository);
-    const client = clientFor(authority);
-    let tags;
-    try {
-      tags = await client.listTags(repository);
-    } catch (error) {
-      if (isNotPublishedYet(error)) {throw new RecordRefused(member.repo, `${repository} does not exist: no build record was ever published`);}
-      throw new Error(`select-records: ${member.repo}: the registry did not answer for ${repository} tags: ${error.message}`);
-    }
-    const runs = tags
-      .map((tag) => ({ tag, run: kernel.parseBuildRecordTag(tag, branch) }))
-      .filter(({ run }) => run !== undefined)
-      .sort((a, b) => kernel.compareBuildRecordRuns(b.run, a.run));
-    if (runs.length === 0) {throw new RecordRefused(member.repo, `${repository} has no build record for branch ${branch}`);}
+    const { repository, authority, client, runs } = await listBuildRecordRuns({ kernel, clientFor, registry, member, branch });
     // EVERY candidate is read and verified; any that fails refuses the run. None is skipped.
     const verified = [];
     for (const { tag, run } of runs) {
       const loaded = await loadVerifiedRecord({
-        kernel, client, runCosign, cosignEnv: { ...COSIGN_ENV, ...cosignEnvFor(authority) }, trustedRootPath,
+        kernel, client, runCosign, cosignEnv: cosignEnvironment(cosignEnvFor, authority), trustedRootPath,
         repository, member, branch, dataRootRepositoryUrl, tag,
       });
       verified.push({ tag, run, ...loaded });
@@ -302,55 +141,18 @@ export function readPublishedPins(path) {
 export async function runSelectRecords({
   options,
   env = process.env,
-  loadPolicy = loadDeclaredPinnedPolicy,
-  prepareCosign = prepareTrustedCosignBinary,
-  loadKernel = loadKernelDistributionSchemas,
-  trustedRootBytes = (root, pinnedPolicy) => validatePinnedTrustedRoot(root, pinnedPolicy).bytes,
-  cosignPathOf = (handle) => assertPreparedExecutable(handle, 'cosign'),
   members = developGraphMembers(),
-  runCosign: injectedRunCosign,
-  clientsOverride,
   runGit,
   write = writeOnce,
+  ...verifierInjections
 }) {
-  const dataRootRepositoryUrl = declaredDataRootRepositoryUrl();
-  const { policy, dataRoot: policyRoot } = await loadPolicy();
-  const kernel = requireBuildRecordKernel(await loadKernel());
-  const trustedCosign = prepareCosign({ cosignBinary: options['--cosign'], policy });
-  const cosignPath = cosignPathOf(trustedCosign);
-  const runCosign = injectedRunCosign ?? ((args, cosignEnv) => defaultRunCosign(cosignPath, args, cosignEnv));
-  const scratch = mkdtempSync(join(tmpdir(), 'xema-select-records-'));
-  try {
-    const trustedRootPath = join(scratch, 'trusted-root.json');
-    writeFileSync(trustedRootPath, trustedRootBytes(policyRoot, policy), { flag: 'wx', mode: 0o600 });
-    const declarations = clientsOverride === undefined ? loadRegistryCredentialDeclarations(dataRoot()) : null;
-    const clients = new Map();
-    const clientFor = (authority) => {
-      if (clientsOverride !== undefined) {return clientsOverride(authority);}
-      if (!clients.has(authority)) {
-        clients.set(authority, registryClientsFor([{ imageRef: `${authority}/x` }], { declarations, env }).get(authority));
-      }
-      return clients.get(authority);
-    };
-    // cosign gets the SAME declared credential oras uses, in its environment, never argv.
-    const cosignEnvFor = (authority) => {
-      if (clientsOverride !== undefined) {return {};}
-      const credential = resolveRegistryCredential({ authority, declarations, env });
-      if (credential.access === 'anonymous') {return {};}
-      const { username, password } = basicAuthParts(credential);
-      return { COSIGN_REGISTRY_USERNAME: username, COSIGN_REGISTRY_PASSWORD: password };
-    };
+  return withRecordVerifier({ cosignBinary: options['--cosign'], env, ...verifierInjections }, async (verifier) => {
     const selection = await selectRecords({
       branch: options['--branch'],
       registry: options['--registry'],
       at: options['--at'],
       members,
-      dataRootRepositoryUrl,
-      kernel,
-      clientFor,
-      runCosign,
-      cosignEnvFor,
-      trustedRootPath,
+      ...verifier,
       publishedPins: options['--published-pins'] === undefined ? undefined : readPublishedPins(options['--published-pins']),
       workspace: editionWorkspaceConfig(),
       env,
@@ -358,8 +160,5 @@ export async function runSelectRecords({
     });
     write(options['--out'], selection);
     return selection;
-  } finally {
-    rmSync(scratch, { recursive: true, force: true });
-    trustedCosign.dispose();
-  }
+  });
 }

package/edition/develop-verify-image-record.mjs

@@ -0,0 +1,90 @@
+// develop-verify-image-record — the body of `xema edition develop verify-image-record`.
+//
+// Does an authenticated build record bind this image digest to this producer? The producer's records of the
+// develop branch are read newest run first and each is verified by the shared core (`develop-record-verify.mjs`:
+// cosign keyless identity of the data root's record workflow, caller repository = the producer, ref, workflow
+// sha = the record's commit, and the record's producer repository = the producer). Only a record produced by the
+// producer's own CI workflow (`.github/workflows/ci.yaml`) can name the images it serves: a verified record of
+// another workflow is skipped, and the answer is the newest ci.yaml record that lists the exact `name@digest`.
+//
+// Deterministic: `listBuildRecordRuns` (develop-record-verify.mjs:205) sorts the tags by the kernel's
+// `compareBuildRecordRuns` (build-record.ts:218-228: run number, then attempt), highest first, and the first
+// match wins; a record that fails verification refuses the call before any older one is read.
+//
+// The returned `commit` is the commit of the newest verified ci.yaml record (by run number, then attempt) that lists
+// the digest. That can be an older commit when a later run targeted it (a manual ci.yaml run on an older commit gets a
+// higher run number), and for an image the producer REUSED by content hash it is NOT the commit that built the image.
+// This is safe because the digest is what binds the bytes: every ci.yaml record lists every image served at its commit,
+// built or reused, so the record names the running digest without a rebuild.
+//
+// Every refusal is a `RecordRefused` naming the producer: no ci.yaml record lists the image, the record names
+// another producer, or cosign refuses the identity. A registry or cosign that could not answer is a plain Error.
+// On success it prints `{image, digest, producer, commit}`.
+
+import {
+  cosignEnvironment,
+  listBuildRecordRuns,
+  loadVerifiedRecord,
+  withRecordVerifier,
+} from './develop-record-verify.mjs';
+import { serializeJson } from './lib.mjs';
+import { RecordRefused } from './record-refused.mjs';
+
+/** The only branch with a declared record signer. */
+export const VERIFY_IMAGE_RECORD_BRANCH = 'develop';
+/** The only workflow whose records name a producer's served images. */
+export const PRODUCER_IMAGE_WORKFLOW = '.github/workflows/ci.yaml';
+
+const IMAGE_REFERENCE = /^([^@\s]+)@(sha256:[0-9a-f]{64})$/;
+const PRODUCER_REPOSITORY = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
+
+/** `name@sha256:<64 hex>` split into its name and digest; anything else is refused. */
+export function parseImageReference(image) {
+  const match = IMAGE_REFERENCE.exec(image);
+  if (match === null) {throw new Error(`--image must be <name>@sha256:<64 hex digest>; got ${JSON.stringify(image)}`);}
+  return { name: match[1], digest: match[2] };
+}
+
+/** The producer member the records are read for: its repository `owner/name` and the URL the signer constrains. */
+function producerMember(producer) {
+  if (!PRODUCER_REPOSITORY.test(producer)) {throw new Error(`--producer must be <owner>/<repo>; got ${JSON.stringify(producer)}`);}
+  return { repo: producer, repositoryUrl: `https://github.com/${producer}.git` };
+}
+
+/**
+ * @param {object} request
+ * @param {string} request.image `<name>@sha256:<digest>`
+ * @param {string} request.producer `<owner>/<repo>`
+ * @param {string} request.registry the registry root that holds `build-records/<repo>`
+ * @returns {Promise<{image: string, digest: string, producer: string, commit: string}>}
+ */
+export async function verifyImageRecord({ image, producer, registry, dataRootRepositoryUrl, kernel, clientFor, runCosign, cosignEnvFor, trustedRootPath }) {
+  const { name, digest } = parseImageReference(image);
+  const member = producerMember(producer);
+  const branch = VERIFY_IMAGE_RECORD_BRANCH;
+  const { repository, authority, client, runs } = await listBuildRecordRuns({ kernel, clientFor, registry, member, branch });
+  for (const { tag } of runs) {
+    const { record } = await loadVerifiedRecord({
+      kernel, client, runCosign, cosignEnv: cosignEnvironment(cosignEnvFor, authority), trustedRootPath,
+      repository, member, branch, dataRootRepositoryUrl, tag,
+    });
+    if (record.producer.workflow !== PRODUCER_IMAGE_WORKFLOW) {continue;}
+    if (!record.images.some((listed) => listed.name === name && listed.digest === digest)) {continue;}
+    return { image: name, digest, producer, commit: record.commit };
+  }
+  throw new RecordRefused(producer, `no verified ${PRODUCER_IMAGE_WORKFLOW} build record of ${repository} for branch ${branch} lists ${name}@${digest}`);
+}
+
+/** The `verify-image-record` verb. */
+export async function runVerifyImageRecord({ options, env = process.env, write = (text) => process.stdout.write(text), ...verifierInjections }) {
+  return withRecordVerifier({ cosignBinary: options['--cosign'], env, ...verifierInjections }, async (verifier) => {
+    const verified = await verifyImageRecord({
+      image: options['--image'],
+      producer: options['--producer'],
+      registry: options['--registry'],
+      ...verifier,
+    });
+    write(serializeJson(verified));
+    return verified;
+  });
+}

package/edition/dist-check.mjs

@@ -48,7 +48,7 @@ import { editionWorkspaceConfig } from './edition-config.mjs';
 import { editionPinnedInputs } from './edition-pinned-inputs.mjs';
 import { assertKernelEditionProtocol } from './edition-protocol.mjs';
 import { describeEditionHolds } from './edition-source-pins.mjs';
-import { WorkspaceRoot, biomeIndexPath, configureEditionWorkspaceFromProcess, editionsRoot, isEntryModule, kernelPackageDir, platformServiceIndexPath, runtimeImageSourceIndexPath, workspaceArgv } from './edition-workspace.mjs';
+import { WorkspaceRoot, biomeIndexPath, configureEditionWorkspaceFromProcess, dataRoot, editionsRoot, isEntryModule, kernelPackageDir, platformServiceIndexPath, runtimeImageSourceIndexPath, workspaceArgv } from './edition-workspace.mjs';
 import { checkEvidenceTrustPolicy } from './evidence-trust-policy.mjs';
 import {
   compareIndexEntries,
@@ -64,7 +64,7 @@ import {
   validateServiceDependencyOwnerParity,
 } from './lib.mjs';
 import { commandFor } from './remedy-command.mjs';
-import { resolveDistributionWithIndex } from './resolve-distribution.mjs';
+import { assertReleaseGitSourcesDeclareNoBundle, resolveDistributionWithIndex } from './resolve-distribution.mjs';
 import {
   resolveDistributionDeclaredSources,
   resolveDistributionRequiredPlatforms,
@@ -72,12 +72,15 @@ import {
   resolveImages,
   resolveComposedProcessStructure,
   resolveImageStructure,
+  structureSubjects,
   sourceTreeLocator,
   supplementalSourcesFor,
 } from './resolve-images.mjs';
 import { withoutSealedDigests } from './seal-image-digests.mjs';
 import { createPinnedSourceAuthority } from './source-authority.mjs';
 import { readStorePublisherTrust } from './store-publisher-trust.mjs';
+import { CHECK_THIRD_PARTY_FLAG, COSIGN_BIN_ENV, COSIGN_FLAG } from './third-party-source-flags.mjs';
+import { loadThirdPartySourcePins } from './third-party-source-pins.mjs';
 
 if (isEntryModule(import.meta.url)) {
   configureEditionWorkspaceFromProcess([WorkspaceRoot.Data, WorkspaceRoot.Editions, WorkspaceRoot.Sources, WorkspaceRoot.Kernel, WorkspaceRoot.Deploy, WorkspaceRoot.Cache]);
@@ -157,6 +160,7 @@ export async function checkDistributionLock(id) {
   const lockPath = join(editionsRoot(), id, 'distribution.lock.json');
   try {
     const { lock: fresh, index } = await resolveDistributionWithIndex(id);
+    assertReleaseGitSourcesDeclareNoBundle(fresh, index);
     const verdict = await compareCommittedLock(lockPath, fresh);
     if (verdict === LockCheck.MISSING) {
       console.error(
@@ -302,7 +306,11 @@ export async function checkImagesLock(id, checkSourceEvidence) {
         schemas,
         requiredPlatforms,
         resolveDistributionDeclaredSources(schemas, id),
-        { biomeIndex: pinned.biomeIndex, supplementalSources: supplementalSourcesFor(runtimeSourceIndex) },
+        {
+          biomeIndex: pinned.biomeIndex,
+          supplementalSources: supplementalSourcesFor(runtimeSourceIndex),
+          thirdPartyPins: loadThirdPartySourcePins(dataRoot()),
+        },
       ),
       schemas,
       requiredPlatforms,
@@ -311,6 +319,7 @@ export async function checkImagesLock(id, checkSourceEvidence) {
       distributionId: id,
       contractAuthority: runtimeSourceIndex.contractAuthority,
       ...structure,
+      subjects: structureSubjects(structure),
     };
     if (!existsSync(imageLockPath)) {
       console.error(
@@ -385,6 +394,18 @@ export async function checkCommittedRuntimeImageSourceIndex(checkSources) {
       ],
       { stdio: 'inherit' },
     );
+    // Every pinned third-party source, from its committed evidence (a data root with none passes trivially).
+    const cosign = process.env[COSIGN_BIN_ENV];
+    execFileSync(
+      process.execPath,
+      [
+        join(HERE, 'build-runtime-image-source-index.mjs'),
+        CHECK_THIRD_PARTY_FLAG,
+        ...(cosign === undefined || cosign === '' ? [] : [COSIGN_FLAG, cosign]),
+        ...workspaceArgv(),
+      ],
+      { stdio: 'inherit' },
+    );
     return true;
   } catch (error) {
     console.error(

package/edition/distribution-evidence-set.mjs

@@ -67,6 +67,8 @@ import {
 } from './oci-image-source-evidence.mjs';
 import { BUNDLE_MEDIA_TYPE, canonicalSignedBundleBytes, cosignVerifyAttestationArgs, validateProducedBundle } from './produce-image-source-evidence.mjs';
 import { splitImageRef } from './registry-credentials.mjs';
+import { imageSubjectKey, thirdPartyImagePins } from './third-party-image-pins.mjs';
+import { thirdPartyProducerRecord } from './third-party-producer-evidence.mjs';
 
 /**
  * The ONE Sigstore bundle media type this plane stores — re-exported, never
@@ -467,6 +469,8 @@ export async function resolveProducerEvidence({
   expectedContractAuthority,
   registryClientFactory,
   channel,
+  // The reader of the edition's validated locks; a seam so the assembly is testable without a whole edition tree.
+  loadLocks = loadValidatedLocks,
 }) {
   assertCanonicalDistributionId(distributionId);
   assertAbsolutePath(dataRoot, 'data root');
@@ -474,8 +478,8 @@ export async function resolveProducerEvidence({
   if (!expectedContractAuthority) {
     throw new Error('the expected kernel contract authority is required');
   }
-  const { distributionLock, imageLock, repositoryPins, runtimeSourceIndex } =
-    await loadValidatedLocks(distributionId, dataRoot, schemas, { editionsRoot, channel });
+  const { distributionLock, imageLock, repositoryPins, runtimeSourceIndex, thirdPartySources } =
+    await loadLocks(distributionId, dataRoot, schemas, { editionsRoot, channel });
   assertKernelContractAuthorityEqual(
     runtimeSourceIndex.contractAuthority,
     expectedContractAuthority,
@@ -486,8 +490,32 @@ export async function resolveProducerEvidence({
     factory: registryClientFactory,
   });
 
+  const thirdPartyImages = thirdPartyImagePins({
+    pins: { byRepository: (repository) => thirdPartySources.get(repository) },
+    subjects: imageLock.subjects,
+  });
   const producers = [];
   for (const subject of imageLock.subjects) {
+    const pinImage = thirdPartyImages.get(imageSubjectKey(subject));
+    if (pinImage !== undefined) {
+      // A third-party subject's contentHash is publisher-attested, not a tag: its evidence is the committed evidence its pin
+      // binds, read from the data root with no registry call.
+      producers.push(
+        thirdPartyProducerRecord({
+          subject,
+          pinImage,
+          dataRoot,
+          schemas,
+          expectedSource: expectedProducerSource({
+            subject,
+            repositoryPin: repositoryPins.get(subject.repo),
+            sourceHashAlgorithm: imageLock.sourceHashAlgorithm,
+          }),
+          stem: subjectStem(subject),
+        }),
+      );
+      continue;
+    }
     const expectedSource = expectedProducerSource({
       subject,
       repositoryPin: repositoryPins.get(subject.repo),