@xemahq/xema 0.54.0 → 0.56.0

package/edition/third-party-source-evidence.mjs

@@ -66,31 +66,56 @@ export function parseProvenanceStatement(value) {
 const readEvidenceFile = (root, path, label, maxBytes) => readBoundedNoFollowFile(root, path, label, maxBytes);
 
 /**
- * The trust-policy row `policyId` names, held to everything a third-party signer row must be: one row, the release
- * channel signed from refs/heads/main, the GitHub Actions issuer, the exact identity of its own workflow, and the
- * pinned repository and workflow. Throws naming the row and the field.
+ * A keyless signer row of `channel`, held to everything such a row must be: the channel signed from that channel's ref, the
+ * GitHub Actions issuer and the exact identity of its own workflow. Throws naming the row and the field.
  */
-export function thirdPartySignerRow({ policy, policyId, source, schemas, label }) {
-  const rows = policy.policies.filter((row) => row.policyId === policyId);
-  if (rows.length !== 1) {
-    throw new Error(`${label}: the trust policy has ${rows.length} rows with policyId "${policyId}"; exactly one is required`);
-  }
-  const [row] = rows;
-  const ref = schemas.EVIDENCE_CHANNEL_REFS[THIRD_PARTY_EVIDENCE_CHANNEL];
-  if (row.channel !== THIRD_PARTY_EVIDENCE_CHANNEL || row.githubWorkflow?.ref !== ref) {
+export function assertChannelSignerRow({ row, channel, schemas, label }) {
+  const ref = schemas.EVIDENCE_CHANNEL_REFS[channel];
+  if (row.channel !== channel || row.githubWorkflow?.ref !== ref) {
     throw new Error(
-      `${label}: row "${policyId}" is not a ${THIRD_PARTY_EVIDENCE_CHANNEL} row signed from ${ref} ` +
+      `${label}: row "${row.policyId}" is not a ${channel} row signed from ${ref} ` +
         `(channel ${JSON.stringify(row.channel)}, ref ${JSON.stringify(row.githubWorkflow?.ref)})`,
     );
   }
   if (row.oidcIssuer !== GITHUB_ACTIONS_OIDC_ISSUER) {
-    throw new Error(`${label}: row "${policyId}" oidcIssuer ${JSON.stringify(row.oidcIssuer)} is not ${GITHUB_ACTIONS_OIDC_ISSUER}`);
+    throw new Error(`${label}: row "${row.policyId}" oidcIssuer ${JSON.stringify(row.oidcIssuer)} is not ${GITHUB_ACTIONS_OIDC_ISSUER}`);
   }
   const { repository, path } = row.githubWorkflow;
   const identity = `https://github.com/${repository}/${path}@${ref}`;
   if (row.certificateIdentity !== identity) {
-    throw new Error(`${label}: row "${policyId}" certificateIdentity ${JSON.stringify(row.certificateIdentity)} is not the exact workflow identity ${identity}`);
+    throw new Error(`${label}: row "${row.policyId}" certificateIdentity ${JSON.stringify(row.certificateIdentity)} is not the exact workflow identity ${identity}`);
   }
+  return row;
+}
+
+/**
+ * The ONE `channel` row that signs the SLSA provenance of `repository`'s biome bundles, held to `assertChannelSignerRow`.
+ * None, or several, is refused naming the repository and the channel.
+ */
+export function bundleSignerRowFor({ policy, repository, channel, schemas, label }) {
+  const rows = policy.policies.filter(
+    (row) => row.channel === channel && row.predicateTypes?.includes(SLSA_PROVENANCE_V1) && row.githubWorkflow?.repository === repository,
+  );
+  if (rows.length !== 1) {
+    throw new Error(
+      `${label}: the trust policy has ${rows.length} ${channel} rows authorizing ${SLSA_PROVENANCE_V1} for ${repository}; exactly one bundle-signer row is required`,
+    );
+  }
+  return assertChannelSignerRow({ row: rows[0], channel, schemas, label });
+}
+
+/**
+ * The trust-policy row `policyId` names, held to everything a third-party signer row must be: one row, the release
+ * channel signed from refs/heads/main, the GitHub Actions issuer, the exact identity of its own workflow, and the
+ * pinned repository and workflow. Throws naming the row and the field.
+ */
+export function thirdPartySignerRow({ policy, policyId, source, schemas, label }) {
+  const rows = policy.policies.filter((row) => row.policyId === policyId);
+  if (rows.length !== 1) {
+    throw new Error(`${label}: the trust policy has ${rows.length} rows with policyId "${policyId}"; exactly one is required`);
+  }
+  const row = assertChannelSignerRow({ row: rows[0], channel: THIRD_PARTY_EVIDENCE_CHANNEL, schemas, label });
+  const { repository, path } = row.githubWorkflow;
   if (repository !== source.repository) {
     throw new Error(`${label}: row "${policyId}" signs for ${repository}, but the source is pinned to ${source.repository}`);
   }

package/edition/third-party-source-writer.mjs

@@ -16,8 +16,8 @@ import { bundleImageNames, fetchBundleManifest, fetchBundleProvenance, verifyBun
 import {
   PROVENANCE_BUNDLE_FILE,
   PROVENANCE_STATEMENT_FILE,
-  SLSA_PROVENANCE_V1,
   THIRD_PARTY_EVIDENCE_CHANNEL,
+  bundleSignerRowFor,
   digestOfOciRef,
   provenanceDirectoryForDigest,
   thirdPartySignerRow,
@@ -28,22 +28,6 @@ import { assertThirdPartyUniqueness } from './third-party-source-uniqueness.mjs'
 
 const compare = (left, right) => (left < right ? -1 : left > right ? 1 : 0);
 
-/** The one release-channel row that signs the biome bundle's provenance for `repository`. */
-function bundleSignerRow(policy, repository) {
-  const rows = policy.policies.filter(
-    (row) =>
-      row.channel === THIRD_PARTY_EVIDENCE_CHANNEL &&
-      row.predicateTypes.includes(SLSA_PROVENANCE_V1) &&
-      row.githubWorkflow?.repository === repository,
-  );
-  if (rows.length !== 1) {
-    throw new Error(
-      `the trust policy has ${rows.length} ${THIRD_PARTY_EVIDENCE_CHANNEL} rows authorizing ${SLSA_PROVENANCE_V1} for ${repository}; exactly one bundle-signer row is required`,
-    );
-  }
-  return rows[0];
-}
-
 /** The one release-channel row whose imageRepositories lists `imageRef`. */
 function imageSignerRow(policy, schemas, imageRef) {
   const rows = policyCandidates(policy, schemas.IMAGE_PRODUCER_PREDICATE_TYPE, THIRD_PARTY_EVIDENCE_CHANNEL, imageRef);
@@ -116,7 +100,7 @@ async function collectImage({ image, request, context, clientFor, services }) {
 export async function planThirdPartySourceWrite({ request, context, clientFor, withProducerWorkflowPin, dataRoot, verifyOnRegistry = verifyBundleOnRegistry }) {
   const { policy, schemas } = context;
   const repositoryUrl = `https://github.com/${request.repository}`;
-  const row = bundleSignerRow(policy, request.repository);
+  const row = bundleSignerRowFor({ policy, repository: request.repository, channel: THIRD_PARTY_EVIDENCE_CHANNEL, schemas, label: `third-party source "${request.name}" bundle signer` });
   const workflowPath = row.githubWorkflow.path;
   // The row must be exact (release channel, refs/heads/main, the GitHub issuer, its own workflow identity) before cosign runs.
   thirdPartySignerRow({ policy, policyId: row.policyId, source: { repository: request.repository, producerWorkflow: { path: workflowPath } }, schemas, label: `third-party source "${request.name}" bundle signer` });

package/edition/trust-policy-arming.mjs

@@ -38,6 +38,13 @@
 // channel neither arm nor disarm the other: a policy that authorizes the three
 // stages on the release channel and pins both binaries is ARMED for a release
 // edition whatever it says about develop.
+//
+// ONLY A STAGE ROW ARMS A CHANNEL: a row counts toward a channel's arming when it
+// authorizes one of the stage predicates judged here. A bundle-signer row (SLSA
+// provenance of a third-party bundle, e.g. the develop row of a git-sourced
+// biome) authorizes bundle verification and arms no stage, so a channel whose
+// only rows are bundle signers is UNARMED, exactly like a channel with no row.
+// One stage row on the channel still makes it PARTIAL until every stage is met.
 
 export const TrustPolicyArmingState = Object.freeze({
   ARMED: 'armed',
@@ -81,8 +88,11 @@ export function assessTrustPolicyArming(policy, schemas, channel, { consumesCata
       stages.push(['edition-catalogue', schemas.EDITION_CATALOGUE_PREDICATE_TYPE]);
     }
   }
-  const onChannel = policy.policies.filter((candidate) => candidate.channel === channel);
-  const authorized = stages.filter(([, predicateType]) => onChannel.some((candidate) => candidate.predicateTypes.includes(predicateType)));
+  const stagePredicateTypes = stages.map(([, predicateType]) => predicateType);
+  const stageRows = policy.policies.filter(
+    (candidate) => candidate.channel === channel && candidate.predicateTypes.some((predicateType) => stagePredicateTypes.includes(predicateType)),
+  );
+  const authorized = stages.filter(([, predicateType]) => stageRows.some((candidate) => candidate.predicateTypes.includes(predicateType)));
 
   if (policy.policies.length === 0) {
     unmet.push(
@@ -120,12 +130,13 @@ export function assessTrustPolicyArming(policy, schemas, channel, { consumesCata
     policy.policies.length === 0 &&
     policy.trustedCosignBinaryDigests.length === 0 &&
     policy.trustedGitBinaryDigests.length === 0;
-  // The channel states nothing while another channel does: its signers and the
-  // binary pins are that channel's arming, not half of this one's.
-  const anotherChannelOnly = onChannel.length === 0 && policy.policies.length > 0;
+  // The channel has no stage row while the policy has rows (another channel's,
+  // or bundle signers): those rows and the binary pins are not half of this
+  // channel's arming.
+  const noStageRow = stageRows.length === 0 && policy.policies.length > 0;
   const state = armed
     ? TrustPolicyArmingState.ARMED
-    : bootstrap || anotherChannelOnly
+    : bootstrap || noStageRow
       ? TrustPolicyArmingState.UNARMED
       : TrustPolicyArmingState.PARTIAL;
 

package/edition/verify-image-platforms.mjs

@@ -434,6 +434,8 @@ export async function verifyDistributionPlatforms({
     return {
       subjectKind: subject.kind,
       subjectId: subject.id,
+      subjectImageRef: subject.imageRef,
+      subjectContentHash: subject.contentHash,
       coordinate,
       manifestDigest: published.indexDigest,
       multiArchIndex: published.isIndex,

package/edition/workspace-sections.mjs

@@ -118,6 +118,9 @@ export const FirstPartyImageOrigin = Object.freeze({
 
 const IMAGE_ORIGINS = Object.values(FirstPartyImageOrigin);
 
+/** An issue key, `<PROJECT>-<number>`: the ticket that removes a member's current-resolution exception. */
+const TICKET = /^[A-Z][A-Z0-9]*-[1-9][0-9]*$/;
+
 /**
  * `firstPartySources`: every first-party repository, keyed by its source
  * checkout handle, with its declared source id (the identity a runtime subject
@@ -126,6 +129,9 @@ const IMAGE_ORIGINS = Object.values(FirstPartyImageOrigin);
  * is checked canonical and under `sourceRepositoryUrlPrefix` with the whole
  * config (edition-config.mjs). `imageOrigin` (FirstPartyImageOrigin) is optional
  * here and has no default: `--images-from` refuses a source that does not declare it.
+ * `currentResolution` (a ticket, `<PROJECT>-<number>`) is optional and has no default: a member that declares it keeps
+ * the CURRENT develop resolution instead of a signed build record until that ticket removes it
+ * (develop-current-resolution.mjs); a member without it never does.
  */
 export function parseFirstPartySources(value) {
   const where = '"firstPartySources"';
@@ -136,17 +142,21 @@ export function parseFirstPartySources(value) {
     repoHandle(repo, `${where} key`);
     if (typeof entry === 'string') {throw new RetiredFirstPartySourceShapeError(repo, entry);}
     const at = `${where}["${repo}"]`;
-    exactObject(entry, at, ['sourceId', 'repositoryUrl'], ['imageOrigin']);
+    exactObject(entry, at, ['sourceId', 'repositoryUrl'], ['imageOrigin', 'currentResolution']);
     if (typeof entry.sourceId !== 'string' || !SOURCE_ID.test(entry.sourceId)) {
       fail(`${at}.sourceId`, `must be a lowercase kebab-case source id; got ${JSON.stringify(entry.sourceId)}`);
     }
     if (Object.hasOwn(entry, 'imageOrigin') && !IMAGE_ORIGINS.includes(entry.imageOrigin)) {
       fail(`${at}.imageOrigin`, `must be one of ${IMAGE_ORIGINS.join(', ')}; got ${JSON.stringify(entry.imageOrigin)}`);
     }
+    if (Object.hasOwn(entry, 'currentResolution') && (typeof entry.currentResolution !== 'string' || !TICKET.test(entry.currentResolution))) {
+      fail(`${at}.currentResolution`, `must be the ticket that removes the exception, <PROJECT>-<number>; got ${JSON.stringify(entry.currentResolution)}`);
+    }
     return [repo, Object.freeze({
       sourceId: entry.sourceId,
       repositoryUrl: text(entry.repositoryUrl, `${at}.repositoryUrl`),
       ...(Object.hasOwn(entry, 'imageOrigin') ? { imageOrigin: entry.imageOrigin } : {}),
+      ...(Object.hasOwn(entry, 'currentResolution') ? { currentResolution: entry.currentResolution } : {}),
     })];
   });
   uniqueBy(entries, `${where} sourceId`, ([, entry]) => entry.sourceId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.54.0",
+  "version": "0.56.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-cli.git",
@@ -61,7 +61,7 @@
     "@xemahq/distribution-source-hash": "^0.2.2",
     "@xemahq/dsl": "^0.28.0",
     "@xemahq/identity-client": "^0.36.0",
-    "@xemahq/contracts": "^0.117.0",
+    "@xemahq/contracts": "^0.119.0",
     "@xemahq/kernel-state-runtime": "^0.8.0",
     "@xemahq/license-verifier": "^0.2.0",
     "@xemahq/release-policy": "^17.6.0",
@@ -100,6 +100,6 @@
     "typecheck": "tsc --noEmit"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:7bcf18b69778e4e380b22bf9c301cf08ea6234a10c98ec06940abdde0f8920c1"
+    "sourceDigest": "sha256:80acaaf576705b4a71ecd5e67794fea62c6fc834652a2830bbd03a2d855d2409"
   }
 }