@xemahq/xema 0.48.0 → 0.49.1

package/edition/image-evidence.mjs

@@ -1,5 +1,4 @@
 import { execFileSync } from 'node:child_process';
-import { createHash } from 'node:crypto';
 import {
   mkdtempSync,
   readFileSync,
@@ -15,8 +14,8 @@ import {
   resolve,
   sep,
 } from 'node:path';
-import { TextDecoder } from 'node:util';
 
+import { canonicalJson, canonicalJsonBytes, decodeExactUtf8, parseCanonicalJsonBytes, sha256Digest } from './canonical-evidence-json.mjs';
 import { certificateConstraintArgs } from './cosign-certificate-constraints.mjs';
 import { assertCanonicalDistributionId } from './distribution-paths.mjs';
 import { effectiveRepositoryPins, manifestSourcePins } from './edition-source-pins.mjs';
@@ -27,22 +26,25 @@ import {
   validateImmutableImageLock,
 } from './lib.mjs';
 import { readBoundedNoFollowFile } from './no-follow-file.mjs';
+import {
+  assertThirdPartySubjectAdmission,
+  thirdPartySourceRepositoryPins,
+  thirdPartySourcesByRepository,
+} from './third-party-admission.mjs';
+import { loadThirdPartySourcePins } from './third-party-source-pins.mjs';
 import {
   assertPreparedExecutable,
   exactExecutableOutput,
   prepareDigestPinnedExecutable,
 } from './trusted-executable.mjs';
 
-const STRICT_UTF8 = new TextDecoder('utf-8', {
-  fatal: true,
-  ignoreBOM: true,
-});
 const MAX_CANONICAL_JSON_BYTES = 2 * 1024 * 1024;
 const MAX_STATEMENT_BYTES = 2 * 1024 * 1024;
 const MAX_SIGSTORE_BUNDLE_BYTES = 16 * 1024 * 1024;
 const MAX_TRUSTED_ROOT_BYTES = 8 * 1024 * 1024;
 /** The kernel's `SignerKind.OidcCertificate`: the one signer kind this verifier runs (cosign keyless). */
 const OIDC_CERTIFICATE_SIGNER = 'oidc-certificate';
+export { canonicalJson, canonicalJsonBytes, decodeExactUtf8, parseCanonicalJsonBytes, sha256Digest };
 export const COSIGN_ENV = Object.freeze({
   LANG: 'C',
   LC_ALL: 'C',
@@ -50,76 +52,6 @@ export const COSIGN_ENV = Object.freeze({
   TZ: 'UTC',
 });
 
-export function canonicalJson(value) {
-  if (
-    value === null ||
-    typeof value === 'boolean' ||
-    typeof value === 'string'
-  ) {
-    return JSON.stringify(value);
-  }
-  if (typeof value === 'number') {
-    if (!Number.isSafeInteger(value)) {
-      throw new Error('canonical evidence JSON permits only safe integers');
-    }
-    return JSON.stringify(value);
-  }
-  if (Array.isArray(value)) {
-    return `[${value.map(canonicalJson).join(',')}]`;
-  }
-  if (typeof value === 'object') {
-    const entries = Object.entries(value).sort(([left], [right]) =>
-      compareStrings(left, right),
-    );
-    return `{${entries
-      .map(([key, entry]) => `${JSON.stringify(key)}:${canonicalJson(entry)}`)
-      .join(',')}}`;
-  }
-  throw new Error(`unsupported canonical evidence JSON value ${typeof value}`);
-}
-
-export function canonicalJsonBytes(value) {
-  return Buffer.from(`${canonicalJson(value)}\n`, 'utf8');
-}
-
-export function sha256Digest(bytes) {
-  return `sha256:${createHash('sha256').update(bytes).digest('hex')}`;
-}
-
-/**
- * Exact UTF-8 decode. Exported because the producers need byte-for-byte the
- * same strictness the verifier applies — a producer that accepts bytes the
- * verifier will reject signs evidence that can never verify.
- */
-export function decodeExactUtf8(bytes, label) {
-  let text;
-  try {
-    text = STRICT_UTF8.decode(bytes);
-  } catch {
-    throw new Error(`${label} contains invalid UTF-8`);
-  }
-  if (!Buffer.from(text, 'utf8').equals(bytes)) {
-    throw new Error(`${label} is not exact UTF-8`);
-  }
-  return text;
-}
-
-export function parseCanonicalJsonBytes(bytes, label) {
-  const text = decodeExactUtf8(bytes, label);
-  let value;
-  try {
-    value = JSON.parse(text);
-  } catch (error) {
-    throw new Error(`${label} is not valid JSON: ${error.message}`);
-  }
-  const canonical = canonicalJsonBytes(value);
-  if (!bytes.equals(canonical)) {
-    throw new Error(
-      `${label} is not canonical JSON (duplicate keys, non-canonical ordering, or whitespace are refused)`,
-    );
-  }
-  return value;
-}
 
 export function resolveContainedFile(root, candidate, label) {
   if (
@@ -415,7 +347,7 @@ export function validateProducerStatementBinding({
   if (typeof subject.imageDigest !== 'string') {
     throw new Error(
       `${label}: images.lock.json seals no imageDigest for ${subject.kind}:${subject.id}, so the ` +
-        'attested manifest is bound to nothing. Run `xema edition seal` first.',
+        'attested manifest is bound to nothing. Run `xema edition resolve-digests` first.',
     );
   }
   if (subject.imageDigest !== predicate.artifact.manifestDigest) {
@@ -690,6 +622,9 @@ export function verifySigstoreEvidenceDescriptor({
   policyRoot = evidenceRoot,
   trustedCosign,
   holdProducerWorkflow,
+  // The statement bytes are the DSSE payload a third party's tool signed (cosign's provenance), which is
+  // exact JSON but not this CLI's canonical form; only that caller replaces the canonical decoder.
+  decodeStatement = parseCanonicalJsonBytes,
 }) {
   assertEvidenceChannel(channel);
   const statementFile = readExactDescriptorFile(
@@ -738,7 +673,7 @@ export function verifySigstoreEvidenceDescriptor({
     );
   }
   const statement = parseStatement(
-    parseCanonicalJsonBytes(statementFile.bytes, 'evidence statement'),
+    decodeStatement(statementFile.bytes, 'evidence statement'),
   );
   if (statement.predicateType !== predicateType) {
     throw new Error('evidence statement predicateType is not authorized');
@@ -850,6 +785,7 @@ export function verifySigstoreEvidenceDescriptor({
   return {
     statement,
     statementPath: statementFile.path,
+    bundle,
     identityPolicy: verifiedIdentityPolicy,
   };
 }
@@ -896,6 +832,7 @@ async function verifyDistributionImageEvidenceSetWithCosign({
     imageLock,
     repositoryPins,
     runtimeSourceIndex,
+    thirdPartySources,
   } = await loadValidatedLocks(distributionId, dataRoot, schemas, {
     editionsRoot,
     channel,
@@ -935,7 +872,7 @@ async function verifyDistributionImageEvidenceSetWithCosign({
         `runtime subject "${subject.kind}:${subject.id}" has no committed repository pin`,
       );
     }
-    const { statement, identityPolicy } = verifySigstoreEvidenceDescriptor({
+    const { statement, identityPolicy, bundle } = verifySigstoreEvidenceDescriptor({
       evidenceRoot,
       descriptor,
       policy,
@@ -947,6 +884,12 @@ async function verifyDistributionImageEvidenceSetWithCosign({
       trustedCosign,
       holdProducerWorkflow: (producer) => schemas.producerWorkflowPinRefusal(runtimeSourceIndex, producer),
     });
+    const thirdPartySource = thirdPartySources.get(subject.repo);
+    if (thirdPartySource !== undefined) {
+      assertThirdPartySubjectAdmission({ subject, source: thirdPartySource, statement, identityPolicy, bundle });
+    }
+    // XEMA-1611 d9-1 first-party form pending d9: no repository-agreement assertion is made for a first-party subject
+    // (a monorepo path is not the signing row's repository, and the xema-deploy rows sign other repositories' images).
     validateProducerStatementBinding({
       statement,
       subject,
@@ -1347,10 +1290,22 @@ export async function loadValidatedImageLocks(
   })) {
     repositoryPins.set(repo, pin);
   }
+  // Third-party OCI sources: pinned by the data root's third-party source pins (held to the evidence trust pin by the entry).
+  const thirdPartyPins = loadThirdPartySourcePins(dataRoot);
+  const thirdPartyRepositoryPins = thirdPartySourceRepositoryPins({
+    distribution,
+    imageLock,
+    repositoryPins,
+    thirdPartyPins,
+  });
+  for (const [repo, pin] of thirdPartyRepositoryPins) {
+    repositoryPins.set(repo, pin);
+  }
   return {
     schemas,
     imageLock,
     runtimeSourceIndex,
     repositoryPins,
+    thirdPartySources: thirdPartySourcesByRepository(thirdPartyRepositoryPins, thirdPartyPins),
   };
 }

package/edition/locked-bundle-signer.mjs

@@ -0,0 +1,241 @@
+// The ONE place the edition CLI selects and checks the signer of an OCI bundle row (XEMA-1631).
+//
+// Every `bundleSource: {kind: 'oci'}` row of a lock (a biome's, or one of its host modules') states WHO signs its bundle:
+// `bundleSigner: {policyId, signer}`, the kernel's `lockedBundleSignerOf` projection of ONE row of the data root's evidence
+// trust policy. The row is selected, never defaulted:
+//   - a git-sourced row (one with a lock `source`) carries no OCI bundle at all, and a lock stating one is refused;
+//   - a third-party row (no `source`, `isThirdPartyOciRow`) by its pin (`third-party-source-pins.json`), whose `bundle.signerPolicyId` names an
+//     `oidc-certificate` row held to the checks `thirdPartySignerRow` makes;
+//   - a first-party row by the data root's `firstPartyBundleSigner.policyId`, a `public-key` row whose key is bound to
+//     no other row.
+// A resolve fills the signer; a seal and a verify re-derive the selection and refuse a lock that states anything else.
+//
+// The kernel exports are loaded lazily, from the built kernel's `distribution` module as `kernel-signer-kind.mjs` does,
+// never through lib.mjs (whose imports must stay loadable by v28-v31 kernels): a lock with no OCI row never touches them.
+
+import { createRequire } from 'node:module';
+
+import { editionWorkspaceConfig } from './edition-config.mjs';
+import { assertKernelEditionProtocol } from './edition-protocol.mjs';
+import { dataRoot, kernelDistPath, kernelPackageDir } from './edition-workspace.mjs';
+import { loadPinnedDeclaredTrustPolicy } from './evidence-trust-pin.mjs';
+import { loadTrustedThirdPartySourcePins } from './third-party-pins-trusted.mjs';
+import { thirdPartySignerRow } from './third-party-source-evidence.mjs';
+import { OCI_BUNDLE_SOURCE_KIND, isThirdPartyOciRow } from './third-party-subjects.mjs';
+
+const requireFromHere = createRequire(import.meta.url);
+
+const OIDC_CERTIFICATE_KIND = 'oidc-certificate';
+const PUBLIC_KEY_KIND = 'public-key';
+
+const KERNEL_EXPORTS = Object.freeze(['lockedBundleSignerOf', 'assertLockedBundleSignerMatches', 'LockedBundleSignerUnknownPolicyError', 'LockedBundleSignerAmbiguousPolicyError']);
+
+/** A named refusal of the bundle signer plane. */
+class BundleSignerError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = new.target.name;
+  }
+}
+
+/** No trust policy row can be selected for the subject: no pin, no `firstPartyBundleSigner`, or no policy at all. */
+export class BundleSignerPolicyAbsentError extends BundleSignerError {}
+/** The selected row is not of the kind its origin requires. */
+export class BundleSignerKindMismatchError extends BundleSignerError {}
+/** A first-party bundle key is also carried by another policy row. */
+export class BundleSignerKeyBoundElsewhereError extends BundleSignerError {}
+/** The lock names a policy that exists but is not the one selection picks for the subject. */
+export class BundleSignerPolicyNotSelectedError extends BundleSignerError {}
+/** An OCI row of a lock states no `bundleSigner`. */
+export class BundleSignerMissingError extends BundleSignerError {}
+/** A lock row drawn from a git `source` states an OCI `bundleSource`: a git-sourced biome is built from that source, never pulled as a bundle. */
+export class BundleSourceOnGitRowError extends BundleSignerError {}
+/** A resolve found an OCI host-module bundle on a git-sourced biome: such a bundle reaches an edition only through an `oci` source. */
+export class GitSourcedHostModuleBundleError extends BundleSignerError {}
+/** The loaded kernel does not export what the bundle signer plane needs. */
+export class BundleSignerKernelUnsupportedError extends BundleSignerError {}
+
+/** What the kernel must export, validated once: `module` is the loaded kernel `distribution` module. */
+export function bundleSignerKernelFrom(module, location) {
+  const missing = KERNEL_EXPORTS.filter((name) => module?.[name] === undefined);
+  if (missing.length > 0) {
+    throw new BundleSignerKernelUnsupportedError(
+      `an OCI bundle row needs a kernel speaking edition protocol v33 or later; the kernel distribution module at ${location} lacks ${missing.join(', ')}`,
+    );
+  }
+  return Object.freeze(Object.fromEntries(KERNEL_EXPORTS.map((name) => [name, module[name]])));
+}
+
+/** The kernel's bundle signer exports, from the built kernel; refuses a kernel that speaks an older protocol. */
+export function loadBundleSignerKernel() {
+  assertKernelEditionProtocol(kernelPackageDir());
+  const location = kernelDistPath('distribution', 'index.js');
+  return bundleSignerKernelFrom(requireFromHere(location), location);
+}
+
+const describeSubject = ({ biomeId, componentKey }) =>
+  componentKey === undefined ? `biome "${biomeId}"` : `host module "${componentKey}" of biome "${biomeId}"`;
+
+/** A git-sourced row carries no OCI bundle (resolve omits it), so no signer is selected for one; a lock stating one is refused. */
+function assertNotGitSourced(subject) {
+  if (subject.source !== undefined) {
+    throw new BundleSourceOnGitRowError(
+      `${describeSubject(subject)} is drawn from git source "${subject.source?.name ?? subject.source}" and states an OCI bundleSource; a git-sourced biome carries none ` +
+        '(a third-party biome is an OCI bundle only as an `oci` source with a third-party pin)',
+    );
+  }
+}
+
+const rowsOf = (policy, policyId) => policy.policies.filter((row) => row.policyId === policyId);
+
+/**
+ * @param {{policy: {policies: readonly object[]}|null, thirdPartyPins: {byRepository: (repository: string) => object|undefined}|undefined,
+ *   firstPartyPolicyId: string|undefined, schemas: object, kernel?: object}} options
+ * @returns {{policyIdFor: (subject: object) => string, signerFor: (subject: object) => object, assertSealed: (subject: object, stated: object|undefined) => void}}
+ */
+export function createBundleSignerSelection({ policy, thirdPartyPins, firstPartyPolicyId, schemas, kernel }) {
+  let loaded = kernel;
+  const kernelExports = () => (loaded ??= loadBundleSignerKernel());
+
+  function onlyRow(policyId) {
+    const { LockedBundleSignerUnknownPolicyError, LockedBundleSignerAmbiguousPolicyError } = kernelExports();
+    const rows = rowsOf(policy, policyId);
+    if (rows.length === 0) {throw new LockedBundleSignerUnknownPolicyError(policyId);}
+    if (rows.length > 1) {throw new LockedBundleSignerAmbiguousPolicyError(policyId, rows.length);}
+    return rows[0];
+  }
+
+  function requireKind(subject, row, kind) {
+    if (row.kind !== kind) {
+      throw new BundleSignerKindMismatchError(
+        `${describeSubject(subject)}: trust policy row "${row.policyId}" is of kind ${JSON.stringify(row.kind)}, but a ${isThirdPartyOciRow(subject) ? 'third-party' : 'first-party'} bundle is signed by a "${kind}" row`,
+      );
+    }
+  }
+
+  function thirdPartyRow(subject) {
+    const pin = thirdPartyPins?.byRepository(subject.repo);
+    if (pin === undefined) {
+      throw new BundleSignerPolicyAbsentError(
+        `${describeSubject(subject)} is a third-party OCI bundle, but no third-party source pin names repository "${subject.repo}" to select its bundle signer`,
+      );
+    }
+    const policyId = pin.bundle.signerPolicyId;
+    const row = onlyRow(policyId);
+    requireKind(subject, row, OIDC_CERTIFICATE_KIND);
+    return thirdPartySignerRow({ policy, policyId, source: pin, schemas, label: `${describeSubject(subject)} bundle signer` });
+  }
+
+  function firstPartyRow(subject) {
+    if (firstPartyPolicyId === undefined) {
+      throw new BundleSignerPolicyAbsentError(
+        `${describeSubject(subject)} is a first-party OCI bundle, but the data root declares no "firstPartyBundleSigner" to select its bundle signer`,
+      );
+    }
+    const row = onlyRow(firstPartyPolicyId);
+    requireKind(subject, row, PUBLIC_KEY_KIND);
+    const bound = policy.policies.find((other) => other !== row && other.publicKey?.sha256 === row.publicKey.sha256);
+    if (bound !== undefined) {
+      throw new BundleSignerKeyBoundElsewhereError(
+        `${describeSubject(subject)}: the bundle key of row "${row.policyId}" is also carried by row "${bound.policyId}"; the bundle key must be bound to exactly one row, the bundle-signing one`,
+      );
+    }
+    return row;
+  }
+
+  function requirePolicy(subject) {
+    if (policy === null) {
+      throw new BundleSignerPolicyAbsentError(
+        `${describeSubject(subject)} is an OCI bundle, but the data root declares no evidenceTrustPolicy, so there is no row to select its bundle signer from`,
+      );
+    }
+  }
+
+  function selectedRow(subject) {
+    assertNotGitSourced(subject);
+    requirePolicy(subject);
+    return isThirdPartyOciRow(subject) ? thirdPartyRow(subject) : firstPartyRow(subject);
+  }
+
+  const signerFor = (subject) => {
+    const row = selectedRow(subject);
+    const { lockedBundleSignerOf, assertLockedBundleSignerMatches } = kernelExports();
+    const bundleSigner = lockedBundleSignerOf(row);
+    assertLockedBundleSignerMatches(bundleSigner, policy);
+    return bundleSigner;
+  };
+
+  return {
+    policyIdFor: (subject) => selectedRow(subject).policyId,
+    signerFor,
+    assertSealed(subject, stated) {
+      if (stated === undefined) {
+        throw new BundleSignerMissingError(`${describeSubject(subject)} is an OCI bundle row and states no bundleSigner`);
+      }
+      requirePolicy(subject);
+      const row = kernelExports().assertLockedBundleSignerMatches(stated, policy);
+      const expected = selectedRow(subject).policyId;
+      if (row.policyId !== expected) {
+        throw new BundleSignerPolicyNotSelectedError(
+          `${describeSubject(subject)} states bundle signer policy "${row.policyId}", but its bundle signer is selected from policy "${expected}"`,
+        );
+      }
+    },
+  };
+}
+
+/**
+ * The data root's selection, LAZY: nothing is read until the first OCI subject asks, so a lock with no OCI row never
+ * needs a policy, a pin or a kernel that speaks v33.
+ */
+export function loadBundleSignerSelection({ dataRoot, schemas }) {
+  let selection;
+  const resolved = () => {
+    if (selection === undefined) {
+      const config = editionWorkspaceConfig();
+      const declaration = config.evidenceTrustPolicy;
+      selection = createBundleSignerSelection({
+        policy: declaration.policy === null ? null : loadPinnedDeclaredTrustPolicy({ dataRoot, declaration, schemas }),
+        thirdPartyPins: loadTrustedThirdPartySourcePins(dataRoot),
+        firstPartyPolicyId: config.firstPartyBundleSigner?.policyId,
+        schemas,
+      });
+    }
+    return selection;
+  };
+  return Object.freeze({
+    policyIdFor: (subject) => resolved().policyIdFor(subject),
+    signerFor: (subject) => resolved().signerFor(subject),
+    assertSealed: (subject, stated) => resolved().assertSealed(subject, stated),
+  });
+}
+
+const isOci = (row) => row.bundleSource?.kind === OCI_BUNDLE_SOURCE_KIND;
+
+/** Every OCI subject of a lock: each biome and each host module whose `bundleSource` is OCI, with the biome's origin and repo. */
+export function lockBundleSubjects(lock) {
+  return lock.biomes.flatMap((biome) => [
+    ...(isOci(biome) ? [{ row: biome, subject: { biomeId: biome.id, origin: biome.origin, repo: biome.repo, source: biome.source, bundleSource: biome.bundleSource } }] : []),
+    ...(biome.hostModules ?? [])
+      .filter(isOci)
+      .map((hostModule) => ({
+        row: hostModule,
+        subject: { biomeId: biome.id, componentKey: hostModule.componentKey, origin: biome.origin, repo: biome.repo, source: biome.source, bundleSource: hostModule.bundleSource },
+      })),
+  ]);
+}
+
+/**
+ * Refuse a lock whose OCI rows do not state exactly the bundle signer the selection picks for them. A lock with no OCI
+ * row is never checked and never resolves a data root: `selection` is used when given, else the data root's is loaded
+ * on the first OCI subject.
+ */
+export function assertLockBundleSigners({ lock, selection, schemas }) {
+  const subjects = lockBundleSubjects(lock);
+  if (subjects.length === 0) {return;}
+  const chosen = selection ?? loadBundleSignerSelection({ dataRoot: dataRoot(), schemas });
+  for (const { row, subject } of subjects) {
+    assertNotGitSourced(subject);
+    chosen.assertSealed(subject, row.bundleSigner);
+  }
+}

package/edition/oci-evidence-verbs.mjs

@@ -232,10 +232,16 @@ export async function planOciEvidenceBackfill({
   const missingGit = new Map();
   for (const distributionId of distributionIds) {
     assertCanonicalDistributionId(distributionId);
-    const { imageLock, repositoryPins } = await loadValidatedImageLocks(distributionId, data, schemas, {
+    const { imageLock, repositoryPins, thirdPartySources } = await loadValidatedImageLocks(distributionId, data, schemas, {
       editionsRoot: editions,
     });
     for (const subject of imageLock.subjects) {
+      if (thirdPartySources.has(subject.repo)) {
+        // Evidence is attached to the registry image of a producer this fleet owns. A third-party image belongs to its
+        // publisher (its contentHash is not a tag here): its evidence is the data root's committed evidence, bound by its pin.
+        process.stderr.write(`[oci-evidence] ${distributionId} ${subject.kind}:${subject.id} is a third-party subject (${subject.repo}): no OCI evidence is attached to a publisher's image\n`);
+        continue;
+      }
       const source = expectedProducerSource({
         subject,
         repositoryPin: repositoryPins.get(subject.repo),

package/edition/pinned-cosign.mjs

@@ -0,0 +1,70 @@
+// pinned-cosign — the one way this CLI runs `cosign verify`: the caller's absolute cosign, held to the
+// cosign digest the data root's pinned evidence trust policy names; the policy's pinned Sigstore trusted
+// root written to a private scratch file for `--offline --trusted-root`; and cosign's registry credential
+// taken from the SAME declaration oras uses, in its environment, never argv. Every injection exists for
+// tests; the defaults are the real readers. Shared by the build-record verifier (develop-record-verify.mjs)
+// and the edition seal (edition-seal.mjs), so there is one copy of this trust path.
+
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { basicAuthParts, defaultRunCosign } from './develop-coverage-readers.mjs';
+import { dataRoot } from './edition-workspace.mjs';
+import { loadDeclaredPinnedPolicy } from './evidence-trust-policy.mjs';
+import { COSIGN_ENV, prepareTrustedCosignBinary, validatePinnedTrustedRoot } from './image-evidence.mjs';
+import { loadRegistryCredentialDeclarations, resolveRegistryCredential } from './registry-credentials.mjs';
+import { assertPreparedExecutable } from './trusted-executable.mjs';
+import { registryClientsFor } from './verify-image-platforms.mjs';
+
+/**
+ * Run `use({ policy, runCosign, cosignEnvFor, clientFor, trustedRootPath, ...prepared })` with a pinned cosign.
+ * `afterPolicy()` runs after the policy is loaded and before cosign is prepared; what it returns is spread into
+ * the argument of `use`. The scratch trusted root and the prepared cosign are disposed whatever `use` does.
+ */
+export async function withPinnedCosign({
+  cosignBinary,
+  env,
+  loadPolicy = loadDeclaredPinnedPolicy,
+  prepareCosign = prepareTrustedCosignBinary,
+  trustedRootBytes = (root, pinnedPolicy) => validatePinnedTrustedRoot(root, pinnedPolicy).bytes,
+  cosignPathOf = (handle) => assertPreparedExecutable(handle, 'cosign'),
+  runCosign: injectedRunCosign,
+  clientsOverride,
+  afterPolicy = async () => ({}),
+}, use) {
+  const { policy, dataRoot: policyRoot } = await loadPolicy();
+  const prepared = await afterPolicy();
+  const trustedCosign = prepareCosign({ cosignBinary, policy });
+  const cosignPath = cosignPathOf(trustedCosign);
+  const runCosign = injectedRunCosign ?? ((args, cosignEnv) => defaultRunCosign(cosignPath, args, cosignEnv));
+  const scratch = mkdtempSync(join(tmpdir(), 'xema-pinned-cosign-'));
+  try {
+    const trustedRootPath = join(scratch, 'trusted-root.json');
+    writeFileSync(trustedRootPath, trustedRootBytes(policyRoot, policy), { flag: 'wx', mode: 0o600 });
+    const declarations = clientsOverride === undefined ? loadRegistryCredentialDeclarations(dataRoot()) : null;
+    const clients = new Map();
+    const clientFor = (authority) => {
+      if (clientsOverride !== undefined) {return clientsOverride(authority);}
+      if (!clients.has(authority)) {
+        clients.set(authority, registryClientsFor([{ imageRef: `${authority}/x` }], { declarations, env }).get(authority));
+      }
+      return clients.get(authority);
+    };
+    // cosign gets the SAME declared credential oras uses, in its environment, never argv.
+    const cosignEnvFor = (authority) => {
+      if (clientsOverride !== undefined) {return {};}
+      const credential = resolveRegistryCredential({ authority, declarations, env });
+      if (credential.access === 'anonymous') {return {};}
+      const { username, password } = basicAuthParts(credential);
+      return { COSIGN_REGISTRY_USERNAME: username, COSIGN_REGISTRY_PASSWORD: password };
+    };
+    return await use({ ...prepared, policy, runCosign, cosignEnvFor, clientFor, trustedRootPath });
+  } finally {
+    rmSync(scratch, { recursive: true, force: true });
+    trustedCosign.dispose();
+  }
+}
+
+/** The environment cosign runs with for one authority: the pinned base plus its declared credential. */
+export const cosignEnvironment = (cosignEnvFor, authority) => ({ ...COSIGN_ENV, ...cosignEnvFor(authority) });

package/edition/plan-image-evidence-refresh.mjs

@@ -144,7 +144,7 @@ export async function planImageEvidenceRefresh({
 
   const subjects = [];
   for (const distributionId of [...distributionIds].sort(compareStrings)) {
-    const { imageLock, repositoryPins, runtimeSourceIndex } = await loadValidatedImageLocks(
+    const { imageLock, repositoryPins, runtimeSourceIndex, thirdPartySources } = await loadValidatedImageLocks(
       distributionId,
       dataRootDirectory,
       schemas,
@@ -156,6 +156,8 @@ export async function planImageEvidenceRefresh({
       'runtime-image-source-index.json',
     );
     for (const subject of imageLock.subjects) {
+      // A third-party subject's contentHash is publisher-attested (no tag, no registry referrer here); its evidence is the committed bundle.
+      if (thirdPartySources.has(subject.repo)) {continue;}
       const repositoryPin = repositoryPins.get(subject.repo);
       const expectedSource = expectedProducerSource({
         subject,

package/edition/producer-evidence-bundle.mjs

@@ -1,6 +1,7 @@
 import { readFileSync, statSync } from 'node:fs';
 import { isAbsolute, join } from 'node:path';
 
+
 import {
   canonicalJson,
   decodeExactUtf8,
@@ -10,8 +11,9 @@ import {
   BUNDLE_MEDIA_TYPE,
   validateProducedBundle,
 } from './produce-image-source-evidence.mjs';
+import { PRODUCER_EVIDENCE_INDEX_FILE } from './producer-evidence-index-file.mjs';
 
-export const PRODUCER_EVIDENCE_INDEX_FILE = 'producer-evidence.json';
+export { PRODUCER_EVIDENCE_INDEX_FILE };
 export const PRODUCER_EVIDENCE_INDEX_MEDIA_TYPE =
   'application/vnd.xema.image-source-evidence.index.v1+json';
 export const PRODUCER_STATEMENT_MEDIA_TYPE = 'application/vnd.in-toto+json';

package/edition/producer-evidence-index-file.mjs

@@ -0,0 +1,4 @@
+// The file name of a producer evidence directory's index. Its own module because the evidence verifier bundle needs it and must
+// not import a producer entry (every module of a bundle shares one `import.meta.url`, so a producer's entry guard would run
+// inside the verifier).
+export const PRODUCER_EVIDENCE_INDEX_FILE = 'producer-evidence.json';

package/edition/release-edition-artifact.mjs

@@ -20,7 +20,7 @@ import { writeCatalogue } from './catalogue.mjs';
 import { assertCanonicalDistributionId } from './distribution-paths.mjs';
 import { LOCAL_WORKFLOW, assertEngineImage, editionTarget, workflowFromEnv, writeEditionArtifact } from './edition-artifact.mjs';
 import { assertRosteredChartSetLock } from './edition-chart-set.mjs';
-import { EditionChannel, EditionLockFile } from './edition-constants.mjs';
+import { EditionChannel, EditionKind, EditionLockFile } from './edition-constants.mjs';
 import { editionPinnedInputs } from './edition-pinned-inputs.mjs';
 import { WorkspaceRoot, configureEditionWorkspaceFromProcess, editionsRoot, isEntryModule } from './edition-workspace.mjs';
 import { descriptorEvidenceTrust } from './evidence-trust-policy.mjs';
@@ -82,7 +82,7 @@ export function assertSealedImageLock(lock, label) {
   if (unsealed.length > 0) {
     throw new Error(
       `${label} is not sealed: ${unsealed.length} of ${subjects.length} subjects carry no imageDigest ` +
-        `(first: ${unsealed[0].kind}:${unsealed[0].id}). Run \`xema edition seal\` first.`,
+        `(first: ${unsealed[0].kind}:${unsealed[0].id}). Run \`xema edition resolve-digests\` first.`,
     );
   }
 }
@@ -128,7 +128,7 @@ async function run(argv, env) {
   const locks = await readCommittedEdition(id);
   // Refuses (EvidenceTrustRequiredError) unless the policy is ARMED on the
   // release channel: a release artifact is never written not-armed.
-  const evidenceTrustPolicy = await descriptorEvidenceTrust({ channel: EditionChannel.Release });
+  const evidenceTrustPolicy = await descriptorEvidenceTrust({ kind: EditionKind.Resolved, channel: EditionChannel.Release });
   const outDir = resolve(options['--out']);
   writeEditionArtifact({
     outDir,

package/edition/repin-evidence-trust.mjs

@@ -4,7 +4,8 @@
 // verifier bundle and provenance, the kernel contract authority the data
 // root's runtime image source index states (a customer data root has no such
 // index: the pin then records none and pins only what exists), and the oras
-// binaries that may read a registry. The result is a data-root change to review; nothing here is
+// binaries that may read a registry, and (only when the data root holds `third-party-source-pins.json`) that
+// file's sha256. The result is a data-root change to review; nothing here is
 // generated into the library.
 //
 //   [--trusted-oras-digest sha256:<64 hex>]…   the oras binaries to trust. Without
@@ -32,6 +33,7 @@ import {
   writeEvidenceTrustPin,
 } from './evidence-trust-pin.mjs';
 import { loadKernelDistributionSchemas } from './lib.mjs';
+import { loadThirdPartySourcePins, thirdPartySourcePinsDigest } from './third-party-source-pins.mjs';
 
 /**
  * Write the pin for the configured data root and return it.
@@ -59,6 +61,8 @@ export async function repinEvidenceTrust({
     }
     orasDigests = readEvidenceTrustPin({ dataRoot: root, declaration }).trustedOrasBinaryDigests;
   }
+  // A present file is a reviewed record: a schema-invalid one is refused here, never pinned.
+  loadThirdPartySourcePins(root);
   return writeEvidenceTrustPin({
     dataRoot: root,
     declaration,
@@ -66,6 +70,7 @@ export async function repinEvidenceTrust({
     verifier,
     kernelContractAuthority: hasRuntimeImageSourceIndex(root) ? readStatedKernelContractAuthority({ dataRoot: root, schemas }) : null,
     trustedOrasBinaryDigests: orasDigests,
+    thirdPartySourcePinsDigest: thirdPartySourcePinsDigest(root),
   });
 }