@xemahq/xema 0.54.0 → 0.56.0

package/edition/locked-bundle-signer.mjs

@@ -3,7 +3,10 @@
 // Every `bundleSource: {kind: 'oci'}` row of a lock (a biome's, or one of its host modules') states WHO signs its bundle:
 // `bundleSigner: {policyId, signer}`, the kernel's `lockedBundleSignerOf` projection of ONE row of the data root's evidence
 // trust policy. The row is selected, never defaulted:
-//   - a git-sourced row (one with a lock `source`) carries no OCI bundle at all, and a lock stating one is refused;
+//   - a git-sourced row (one with a lock `source`) carries no OCI bundle, and a lock stating one is refused, EXCEPT in a
+//     selection made for a vendor develop edition (`GitSourcedBundle.DevelopVerified`, XEMA-2456): there a git-sourced
+//     biome row may carry the bundle the develop resolve verified (`develop-git-bundles.mjs`), signed by the ONE
+//     `develop` row of the source's repository;
 //   - a third-party row (no `source`, `isThirdPartyOciRow`) by its pin (`third-party-source-pins.json`), whose `bundle.signerPolicyId` names an
 //     `oidc-certificate` row held to the checks `thirdPartySignerRow` makes;
 //   - a first-party row by the data root's `firstPartyBundleSigner.policyId`, a `public-key` row whose key is bound to
@@ -15,13 +18,15 @@
 
 import { createRequire } from 'node:module';
 
+import { canonicalPublicHttpsRepositoryUrl, repositoryOwnerName } from './canonical-repository-url.mjs';
 import { KernelRefusalName, RefusalError, collectRefusals, isRefusal, joinRefusalMessages } from './collected-refusals.mjs';
+import { EditionChannel } from './edition-channel.mjs';
 import { editionWorkspaceConfig } from './edition-config.mjs';
 import { assertKernelEditionProtocol } from './edition-protocol.mjs';
 import { dataRoot, kernelDistPath, kernelPackageDir } from './edition-workspace.mjs';
 import { loadPinnedDeclaredTrustPolicy } from './evidence-trust-pin.mjs';
 import { loadTrustedThirdPartySourcePins } from './third-party-pins-trusted.mjs';
-import { thirdPartySignerRow } from './third-party-source-evidence.mjs';
+import { bundleSignerRowFor, thirdPartySignerRow } from './third-party-source-evidence.mjs';
 import { OCI_BUNDLE_SOURCE_KIND, isThirdPartyOciRow } from './third-party-subjects.mjs';
 
 const requireFromHere = createRequire(import.meta.url);
@@ -31,6 +36,13 @@ const PUBLIC_KEY_KIND = 'public-key';
 
 const KERNEL_EXPORTS = Object.freeze(['lockedBundleSignerOf', 'assertLockedBundleSignerMatches', 'LockedBundleSignerUnknownPolicyError', 'LockedBundleSignerAmbiguousPolicyError']);
 
+/**
+ * Whether a selection admits an OCI bundle on a git-sourced row. `Refused` is every release, customer and dist-check
+ * selection, unchanged; `DevelopVerified` only a vendor develop edition's resolve, seal and verify, whose git bundles
+ * the develop resolve verified against the source commit (`develop-git-bundles.mjs`).
+ */
+export const GitSourcedBundle = Object.freeze({ Refused: 'refused', DevelopVerified: 'develop-verified' });
+
 /** A named refusal of the bundle signer plane. */
 export class BundleSignerError extends RefusalError {
   constructor(message) {
@@ -56,6 +68,8 @@ export class BundleSignerMissingError extends BundleSignerError {}
 export class BundleSourceOnGitRowError extends BundleSignerError {}
 /** A resolve found an OCI host-module bundle on a git-sourced biome: such a bundle reaches an edition only through an `oci` source. */
 export class GitSourcedHostModuleBundleError extends BundleSignerError {}
+/** A develop resolve could not verify the OCI bundle a git-sourced biome declares (no develop row, cosign, or the content binding refused it). */
+export class DevelopGitBundleError extends BundleSignerError {}
 /** The loaded kernel does not export what the bundle signer plane needs. */
 export class BundleSignerKernelUnsupportedError extends BundleSignerError {}
 /** Several OCI rows were refused in one pass; `.errors` holds each row's own refusal. */
@@ -98,6 +112,13 @@ function assertNotGitSourced(subject) {
   }
 }
 
+/** Refuses a git-sourced subject unless the selection admits develop git bundles and the subject is a biome row. */
+function assertGitSourceAdmitted(subject, gitSourcedBundle) {
+  if (subject.source === undefined) {return;}
+  if (gitSourcedBundle === GitSourcedBundle.DevelopVerified && subject.componentKey === undefined) {return;}
+  assertNotGitSourced(subject);
+}
+
 const rowsOf = (policy, policyId) => policy.policies.filter((row) => row.policyId === policyId);
 
 /**
@@ -105,7 +126,7 @@ const rowsOf = (policy, policyId) => policy.policies.filter((row) => row.policyI
  *   firstPartyPolicyId: string|undefined, schemas: object, kernel?: object}} options
  * @returns {{policyIdFor: (subject: object) => string, signerFor: (subject: object) => object, assertSealed: (subject: object, stated: object|undefined) => void}}
  */
-export function createBundleSignerSelection({ policy, thirdPartyPins, firstPartyPolicyId, schemas, kernel }) {
+export function createBundleSignerSelection({ policy, thirdPartyPins, firstPartyPolicyId, schemas, kernel, gitSourcedBundle = GitSourcedBundle.Refused }) {
   let loaded = kernel;
   const kernelExports = () => (loaded ??= loadBundleSignerKernel());
 
@@ -155,6 +176,24 @@ export function createBundleSignerSelection({ policy, thirdPartyPins, firstParty
     return row;
   }
 
+  // A git-sourced biome's develop bundle: the ONE develop row of the source's repository (a host module never reaches here:
+  // the resolve refuses an OCI host module on a git-sourced biome in every channel).
+  function developGitRow(subject) {
+    const label = `${describeSubject(subject)} develop bundle signer`;
+    const repository = repositoryOwnerName(canonicalPublicHttpsRepositoryUrl(subject.source.url, `${label} source url`), `${label} source url`);
+    let row;
+    try {
+      row = bundleSignerRowFor({ policy, repository, channel: EditionChannel.Develop, schemas, label });
+    } catch (error) {
+      throw new BundleSignerPolicyAbsentError(error.message);
+    }
+    requireKind(subject, row, OIDC_CERTIFICATE_KIND);
+    return onlyRow(row.policyId);
+  }
+
+  /** Refuses a git-sourced subject this selection does not admit; any other subject passes. */
+  const assertAdmitted = (subject) => assertGitSourceAdmitted(subject, gitSourcedBundle);
+
   function requirePolicy(subject) {
     if (policy === null) {
       throw new BundleSignerPolicyAbsentError(
@@ -164,8 +203,9 @@ export function createBundleSignerSelection({ policy, thirdPartyPins, firstParty
   }
 
   function selectedRow(subject) {
-    assertNotGitSourced(subject);
+    assertAdmitted(subject);
     requirePolicy(subject);
+    if (subject.source !== undefined) {return developGitRow(subject);}
     return isThirdPartyOciRow(subject) ? thirdPartyRow(subject) : firstPartyRow(subject);
   }
 
@@ -178,6 +218,7 @@ export function createBundleSignerSelection({ policy, thirdPartyPins, firstParty
   };
 
   return {
+    assertAdmitted,
     policyIdFor: (subject) => selectedRow(subject).policyId,
     signerFor,
     assertSealed(subject, stated) {
@@ -200,7 +241,7 @@ export function createBundleSignerSelection({ policy, thirdPartyPins, firstParty
  * The data root's selection, LAZY: nothing is read until the first OCI subject asks, so a lock with no OCI row never
  * needs a policy, a pin or a kernel that speaks v33.
  */
-export function loadBundleSignerSelection({ dataRoot, schemas }) {
+export function loadBundleSignerSelection({ dataRoot, schemas, gitSourcedBundle = GitSourcedBundle.Refused }) {
   let selection;
   const resolved = () => {
     if (selection === undefined) {
@@ -211,11 +252,14 @@ export function loadBundleSignerSelection({ dataRoot, schemas }) {
         thirdPartyPins: loadTrustedThirdPartySourcePins(dataRoot),
         firstPartyPolicyId: config.firstPartyBundleSigner?.policyId,
         schemas,
+        gitSourcedBundle,
       });
     }
     return selection;
   };
   return Object.freeze({
+    // Refusing an unadmitted git-sourced row needs no data root, so it reads none.
+    assertAdmitted: (subject) => assertGitSourceAdmitted(subject, gitSourcedBundle),
     policyIdFor: (subject) => resolved().policyIdFor(subject),
     signerFor: (subject) => resolved().signerFor(subject),
     assertSealed: (subject, stated) => resolved().assertSealed(subject, stated),
@@ -242,12 +286,12 @@ export function lockBundleSubjects(lock) {
  * row is never checked and never resolves a data root: `selection` is used when given, else the data root's is loaded
  * on the first OCI subject.
  */
-export function assertLockBundleSigners({ lock, selection, schemas }) {
+export function assertLockBundleSigners({ lock, selection, schemas, gitSourcedBundle = GitSourcedBundle.Refused }) {
   const subjects = lockBundleSubjects(lock);
   if (subjects.length === 0) {return;}
-  const chosen = selection ?? loadBundleSignerSelection({ dataRoot: dataRoot(), schemas });
+  const chosen = selection ?? loadBundleSignerSelection({ dataRoot: dataRoot(), schemas, gitSourcedBundle });
   collectRefusals(subjects, ({ row, subject }) => {
-    assertNotGitSourced(subject);
+    chosen.assertAdmitted(subject);
     chosen.assertSealed(subject, row.bundleSigner);
   }, isRefusal, BundleSignerRefusedError);
 }

package/edition/resolve-customer-edition.mjs

@@ -150,7 +150,7 @@ export function projectVendorImages(catalogue, lock, enums) {
       ...(biome.runtimeComponents ?? []).map((id) => [enums.RuntimeImageSubjectKind.RuntimeComponent, id]),
     ];
     for (const [kind, id] of wanted) {
-      if (subjectServingBiome(subjects, biome.id, kind, id, enums) === undefined) {
+      if (subjectServingBiome(catalogue.images.schemaVersion, subjects, biome.id, kind, id, enums) === undefined) {
         throw new CatalogueCeilingError(`the catalogue carries no image row for ${kind}:${id} of selected biome "${biome.id}"`);
       }
     }

package/edition/resolve-distribution.mjs

@@ -62,6 +62,7 @@
 
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
 
 import { adapterHostRow, assertAdapterBundlesMatchHost, fetchRegistryManifest } from './adapter-bundled-versions.mjs';
 import {
@@ -75,6 +76,7 @@ import {
   writeAuthorizationLock,
 } from './authorization-base.mjs';
 import { RefusalError, captureRefusal, isRefusal, throwCollectedRefusals } from './collected-refusals.mjs';
+import { developGitBundleKey, developGitBundleSubjects } from './develop-git-bundles.mjs';
 import { resolveDispatchedRuntimeComponents } from './dispatched-runtime-components.mjs';
 import { fleetChartSetLockPath, writeEditionChartSet } from './edition-chart-set.mjs';
 import { workspaceSection } from './edition-config.mjs';
@@ -96,7 +98,14 @@ import {
   validateImmutableDistributionLock,
   validateServiceDependencyOwnerParity,
 } from './lib.mjs';
-import { BundleSignerPolicyAbsentError, BundleSignerRefusedError, GitSourcedHostModuleBundleError, loadBundleSignerSelection } from './locked-bundle-signer.mjs';
+import {
+  BundleSignerPolicyAbsentError,
+  BundleSignerRefusedError,
+  DevelopGitBundleError,
+  GitSourcedBundle,
+  GitSourcedHostModuleBundleError,
+  loadBundleSignerSelection,
+} from './locked-bundle-signer.mjs';
 import { admitDistributionLock } from './operation-grant-admission.mjs';
 import { PUBLISHED_PIN_SOURCE, pinnedSource } from './pin-source.mjs';
 import { verifiedPlatformServiceIndex } from './platform-service-ownership.mjs';
@@ -1792,7 +1801,14 @@ export function resolveUnadmittedDistributionFromInputs(
   // trust policy selects for it. See `locked-bundle-signer.mjs`.
   const bundleSignerRefusals = [];
   const bundleSignerOf = (e, bundleSource, componentKey) => {
-    const subject = { biomeId: e.id, ...(componentKey === undefined ? {} : { componentKey }), origin: e.origin, repo: e.repo, bundleSource };
+    const subject = {
+      biomeId: e.id,
+      ...(componentKey === undefined ? {} : { componentKey }),
+      origin: e.origin,
+      repo: e.repo,
+      ...(isGitSourced(e) ? { source: requireSourceRecord(e, sourceRecords) } : {}),
+      bundleSource,
+    };
     if (composed?.bundleSigners === undefined) {
       throw new BundleSignerPolicyAbsentError(
         `${componentKey === undefined ? `biome "${e.id}"` : `host module "${componentKey}" of biome "${e.id}"`} is an OCI bundle, but this resolve was given no bundle signer selection`,
@@ -1801,12 +1817,45 @@ export function resolveUnadmittedDistributionFromInputs(
     // Every row is selected before any is refused, so one run names them all; the lock is not built from a refused row.
     return captureRefusal(bundleSignerRefusals, () => composed.bundleSigners.signerFor(subject), isRefusal);
   };
-  // A row drawn from a GIT source carries no OCI bundle (biome-level; an OCI host-module bundle is refused below), hence no bundleSigner: it is built
-  // from the pinned source, and the manifest's `bundleSource` names a release artifact not built from this commit.
-  // Omitted here, at the copy point. (An entry of a declared `oci` source has a stamp but no record: not git.)
+  // A row drawn from a GIT source is built from the pinned source, and the manifest's biome-level `bundleSource` names an
+  // artifact its release lane publishes, not one proven to be built from this commit. So, at the copy point:
+  //   - with `composed.developGitBundles` (a VENDOR DEVELOP resolve, XEMA-2456) the row carries the bundle the develop
+  //     resolve verified for it (`develop-git-bundles.mjs`: the develop signer at the attested commit, content-bound to
+  //     the frozen one), by digest, and its develop bundle signer. A git-sourced OCI row the resolve did not verify is
+  //     refused, never stripped;
+  //   - otherwise (release, customer, dist-check) it carries neither, as before; the release refuses the declaration.
+  // An OCI host-module bundle on a git-sourced biome is refused below in every channel. (An entry of a declared `oci`
+  // source has a stamp but no record: not git.)
   const isGitSourced = (e) => e.source !== undefined && sourceRecords.has(e.source);
-  const bundleSourceOf = (e) => (e.bundleSource === undefined || isGitSourced(e) ? {} : { bundleSource: e.bundleSource });
-  const bundleSignerFor = (e) => (e.bundleSource?.kind === 'oci' && !isGitSourced(e) ? { bundleSigner: bundleSignerOf(e, e.bundleSource) } : {});
+  const developGitBundleOf = (e) => {
+    if (composed?.developGitBundles === undefined || !isGitSourced(e) || e.bundleSource?.kind !== 'oci') {return undefined;}
+    const verified = composed.developGitBundles.get(developGitBundleKey(e.source, e.id));
+    if (verified === undefined) {
+      throw new DevelopGitBundleError(`biome "${e.id}" (git source "${e.source}") declares an OCI bundle (${e.bundleSource.ociRef}) that this develop resolve did not verify`);
+    }
+    return verified;
+  };
+  const bundleSourceOf = (e) => {
+    if (e.bundleSource === undefined) {return {};}
+    if (!isGitSourced(e)) {return { bundleSource: e.bundleSource };}
+    const verified = developGitBundleOf(e);
+    return verified === undefined ? {} : { bundleSource: verified.bundleSource };
+  };
+  const bundleSignerFor = (e) => {
+    if (e.bundleSource?.kind !== 'oci') {return {};}
+    if (!isGitSourced(e)) {return { bundleSigner: bundleSignerOf(e, e.bundleSource) };}
+    const verified = developGitBundleOf(e);
+    if (verified === undefined) {return {};}
+    const bundleSigner = bundleSignerOf(e, verified.bundleSource);
+    // A bundle carried from a pinned lock (an offline re-seal) was verified under the pinned signer; a develop row rotated
+    // since then would put into the lock a signer the bundle was never verified under, so any difference is refused.
+    if (verified.pinnedBundleSigner !== undefined && !isDeepStrictEqual(verified.pinnedBundleSigner, bundleSigner)) {
+      throw new DevelopGitBundleError(
+        `biome "${e.id}" (git source "${e.source}"): the pinned edition verified ${verified.bundleSource.ociRef} under bundle signer ${JSON.stringify(verified.pinnedBundleSigner)}, but the current trust policy selects ${JSON.stringify(bundleSigner)}; resolve the develop edition to verify the bundle under the current row`,
+      );
+    }
+    return { bundleSigner };
+  };
   const hostModuleOf = (e, hostModule) => {
     if (isGitSourced(e)) {
       // The lock schema requires a host module's bundleSource, so an OCI one cannot be omitted: it is refused, in every
@@ -2405,7 +2454,7 @@ export async function prepareDistributionWithIndex(id, { materialize, inputs, re
     validateImmutableBiomeIndex(inputs?.biomeIndex ?? pinned.biomeIndex),
     platformServiceIndex,
   );
-  const { entries, sourceRecords } = await walkDeclaredSources({
+  const { entries, sourceRecords, checkouts } = await walkDeclaredSources({
     sources: composed.declaredSources,
     ...(materialize === undefined ? {} : { materialize }),
   });
@@ -2416,19 +2465,33 @@ export async function prepareDistributionWithIndex(id, { materialize, inputs, re
     inputs !== undefined && Object.hasOwn(inputs, 'storePublisherTrust')
       ? inputs.storePublisherTrust
       : readStorePublisherTrust();
-  const lock = resolveUnadmittedDistributionFromInputs(
-    id,
-    index,
-    schemas,
-    {
-      ...composed,
-      sourceRecords,
-      storePublisherTrust,
-      bundleSigners: inputs?.bundleSigners ?? loadBundleSignerSelection({ dataRoot: dataRoot(), schemas }),
-    },
-    new Date().toISOString(),
-    platformServiceIndex,
-  );
+  // A VENDOR DEVELOP resolve hands `inputs.developGitBundles` (develop-git-bundles.mjs); nothing else does, so a release,
+  // customer or dist-check resolve keeps a git-sourced row bundle-less, exactly as before.
+  const developGitBundles = inputs?.developGitBundles;
+  const bundleSigners =
+    inputs?.bundleSigners ??
+    loadBundleSignerSelection({
+      dataRoot: dataRoot(),
+      schemas,
+      gitSourcedBundle: developGitBundles === undefined ? GitSourcedBundle.Refused : GitSourcedBundle.DevelopVerified,
+    });
+  const resolvedAt = new Date().toISOString();
+  const resolveWith = (verified) =>
+    resolveUnadmittedDistributionFromInputs(
+      id,
+      index,
+      schemas,
+      { ...composed, sourceRecords, storePublisherTrust, bundleSigners, ...(verified === undefined ? {} : { developGitBundles: verified }) },
+      resolvedAt,
+      platformServiceIndex,
+    );
+  // Selection never reads a bundle, so the first pass selects exactly the biomes the second ships: only THEIR bundles are
+  // verified (a source's unselected biome is never fetched), and the second pass refuses any git-sourced OCI row the
+  // verifier did not answer for.
+  const selectedOnly = resolveWith(undefined);
+  if (developGitBundles === undefined) {return { lock: selectedOnly, index, schemas };}
+  const subjects = developGitBundleSubjects({ lock: selectedOnly, index });
+  const lock = subjects.length === 0 ? selectedOnly : resolveWith(await developGitBundles.verify({ subjects, checkouts, schemas }));
   return { lock, index, schemas };
 }
 

package/edition/resolve-edition.mjs

@@ -106,9 +106,10 @@ export function parseResolveEditionArgs(args) {
   return { id, check };
 }
 
+/** The in-repo lane: the previous images lock is the committed file at the target path, read before it is overwritten; none there is the first seal. */
 export async function writeResolvedLockSet(id) {
   await writeResolvedDistribution(id);
-  await writeResolvedImages(id, { trustedWriteV3: true });
+  await writeResolvedImages(id, { trustedWriteV3: true, previousFromTarget: true });
 }
 
 export async function checkResolvedLockSet(id) {