@xemahq/xema 0.55.0 → 0.57.0

package/edition/develop-edition.mjs

@@ -130,7 +130,7 @@ import { runImageRecord } from './develop-image-record.mjs';
 import { runSelectRecords } from './develop-select-records.mjs';
 import { readSelectionPins } from './develop-selection-pins.mjs';
 import { runVerifyImageRecord } from './develop-verify-image-record.mjs';
-import { LOCAL_WORKFLOW, assertExistingArtifactMatches, developEditionTarget, workflowFromEnv, writeEditionArtifact } from './edition-artifact.mjs';
+import { LOCAL_WORKFLOW, assertExistingArtifactMatches, developEditionTarget, editionRepository, workflowFromEnv, writeEditionArtifact } from './edition-artifact.mjs';
 import { EditionChannel, EditionKind } from './edition-constants.mjs';
 import { WorkspaceRoot, configureEditionWorkspaceFromProcess, isEntryModule, kernelRepoDir } from './edition-workspace.mjs';
 import { descriptorEvidenceTrust } from './evidence-trust-policy.mjs';
@@ -138,6 +138,7 @@ import { createSatelliteVerifier, imageBuildRecordDigest, readImageBuildRecord }
 import { assertKernelCommitSupported, chooseKernelCommit } from './kernel-protocol-choice.mjs';
 import { loadKernelDistributionSchemas } from './lib.mjs';
 import { snapshotPinSource } from './pin-source.mjs';
+import { PREVIOUS_SEAL_SIGNER_FLAG, previousSealFromRegistry } from './previous-seal-registry.mjs';
 import { composeEdition } from './resolve-distribution.mjs';
 import { resolvePreviousSeal } from './resolve-images.mjs';
 import { readStrictJsonFile } from './strict-json.mjs';
@@ -206,7 +207,22 @@ async function run(argv, env) {
         env,
         engine: { repository: options['--engine-repository'], signer: options['--engine-signer'] },
         cosignBinary: options['--cosign'],
-        previousLock: await resolvePreviousSeal({ distributionId: id, previousLockPath: options[PREVIOUS_LOCK_FLAG], previousLockSha256: options[PREVIOUS_LOCK_SHA256_FLAG], firstSeal: Boolean(options[FIRST_SEAL_FLAG]) }),
+        previousLock: await resolvePreviousSeal({
+          distributionId: id,
+          previousLockPath: options[PREVIOUS_LOCK_FLAG],
+          previousLockSha256: options[PREVIOUS_LOCK_SHA256_FLAG],
+          firstSeal: Boolean(options[FIRST_SEAL_FLAG]),
+          ...(options[PREVIOUS_SEAL_SIGNER_FLAG] === undefined ? {} : {
+            registry: {
+              find: () => previousSealFromRegistry({
+                repository: editionRepository(id, options['--registry'], EditionChannel.Develop),
+                signerIdentity: options[PREVIOUS_SEAL_SIGNER_FLAG],
+                cosignBinary: options['--cosign'],
+                env,
+              }),
+            },
+          }),
+        }),
         ...(options[IMAGES_FROM_FLAG] === undefined ? {} : {
           imagesFrom: await readImageBuildRecord(options[IMAGES_FROM_FLAG]),
           verifySatellites: createSatelliteVerifier({ registry: options['--registry'], cosignBinary: options['--cosign'], env }),

package/edition/develop-git-bundles.mjs

@@ -0,0 +1,201 @@
+// develop-git-bundles — the OCI bundle of a git-sourced biome, in a VENDOR DEVELOP edition only (XEMA-2456).
+//
+// A release and a customer edition never carry an OCI bundle on a git-sourced row: the manifest's `bundleSource` names
+// an artifact the release lane builds, not one built from the pinned commit (resolve-distribution.mjs strips it, the
+// release refuses it). A develop edition freezes a git source at its develop head F, and the source's own develop lane
+// publishes the bundle the manifest names, signed keyless by its develop workflow. This module proves that bundle is
+// the one F describes, and only then does the resolve keep it on the row, by DIGEST, with its develop bundle signer:
+//
+//   1. the bundle: the manifest's own `bundleSource.ociRef` at F (`<repository>:<version>`; the kernel holds the tag to
+//      the manifest version) resolved to its digest at the registry. The lock records `<repository>@sha256:<hex>`, never
+//      the tag, so the edition names immutable bytes;
+//   2. the signer: the ONE `develop` row of the source's repository in the data root's trust policy
+//      (`bundleSignerRowFor`). cosign verifies the digest's signature under that row's identity, issuer, workflow
+//      repository and ref, and states the ONE commit P its certificate was issued at (`verifiedBundleSignerCommit`);
+//      `verifyBundleOnRegistry` then holds the signature AND the SLSA provenance to exactly the row and P. P is never
+//      read from bytes cosign has not verified;
+//   3. the content binding of P to F. A version that is already published is never re-attested by the publisher
+//      (`xema biome publish` "already current"), so P is the commit that last published the version, and F may be a
+//      later commit of the same version. Two checks, refused on either, each naming P, F and the mismatching pair:
+//        (a) the kernel's `computeBiomeSourceManifestHash` of the bundle's own `xema-biome.json` equals the
+//            `sourceManifestHash` of the biome at F (the hash the seal and verify hold to the git source at F);
+//        (b) the git tree id of the biome directory at P equals its tree id at F (the catalogue's `sourceTreeIds`
+//            notion), so the bundle was built from the same biome source F holds.
+//      THE GAP, develop only: build inputs outside the biome directory (shared packages, the lockfile, the publisher's
+//      toolchain) are not bound. A change there between P and F reaches no check here. A release never relies on this:
+//      it carries a third-party bundle only through an `oci` source with a third-party pin, whose evidence is bound to
+//      the pinned commit itself.
+//
+// Every failure is a `DevelopGitBundleError` naming the biome; all subjects are verified before one is refused.
+
+import { canonicalPublicHttpsRepositoryUrl, repositoryOwnerName } from './canonical-repository-url.mjs';
+import { RefusalError } from './collected-refusals.mjs';
+import { EditionChannel } from './edition-channel.mjs';
+import { editionWorkspaceConfig } from './edition-config.mjs';
+import { loadPinnedDeclaredTrustPolicy } from './evidence-trust-pin.mjs';
+import { sourceTreeIdAt } from './external-source-walk.mjs';
+import { prepareTrustedCosignBinary } from './image-evidence.mjs';
+import { BundleSignerRefusedError, DevelopGitBundleError } from './locked-bundle-signer.mjs';
+import { createRegistryClientResolver } from './oci-image-source-evidence.mjs';
+import { bundleDigestRef, fetchBundleManifest, verifiedBundleSignerCommit, verifyBundleOnRegistry } from './third-party-bundle-registry.mjs';
+import { bundleSignerRowFor } from './third-party-source-evidence.mjs';
+import { OCI_BUNDLE_SOURCE_KIND } from './third-party-subjects.mjs';
+
+/** The key a verified bundle is looked up by: the source name and the biome id of its index entry. */
+export const developGitBundleKey = (sourceName, biomeId) => `${sourceName}\u0000${biomeId}`;
+
+/**
+ * The rows a develop resolve must verify a bundle for: each git-sourced biome of `lock` (a row with a `source`) whose
+ * index entry declares a biome-level OCI `bundleSource`.
+ *
+ * @returns {{biomeId: string, source: {name: string, url: string, commit: string}, entry: object}[]}
+ */
+export function developGitBundleSubjects({ lock, index }) {
+  const entries = new Map(index.filter((entry) => entry.source !== undefined).map((entry) => [developGitBundleKey(entry.source, entry.id), entry]));
+  return lock.biomes.flatMap((biome) => {
+    if (biome.source === undefined) {return [];}
+    const entry = entries.get(developGitBundleKey(biome.source.name, biome.id));
+    return entry?.bundleSource?.kind === OCI_BUNDLE_SOURCE_KIND ? [{ biomeId: biome.id, source: biome.source, entry }] : [];
+  });
+}
+
+const subjectLabel = ({ biomeId, source }) => `biome "${biomeId}" (git source "${source.name}" at ${source.commit})`;
+
+/** The biome directory relative to its source repository: the index path is `<source name>/<directory>`. */
+function repositoryPathOf({ source, entry }) {
+  const prefix = `${source.name}/`;
+  if (!entry.path.startsWith(prefix)) {
+    throw new Error(`${subjectLabel({ biomeId: entry.id, source })}: index path ${JSON.stringify(entry.path)} is not under the source "${source.name}"`);
+  }
+  return entry.path.slice(prefix.length);
+}
+
+/** Verify every subject, then refuse them all at once: one refusal is rethrown unchanged, several are one error. */
+async function verifyEach(subjects, verifyOne) {
+  const verified = new Map();
+  const refused = [];
+  for (const subject of subjects) {
+    try {
+      verified.set(developGitBundleKey(subject.source.name, subject.biomeId), await verifyOne(subject));
+    } catch (error) {
+      // A refusal, or a plain Error of the registry, cosign or git: this subject is refused. A defect (TypeError, ...) is not.
+      const refusal = error instanceof RefusalError || error?.constructor === Error;
+      if (!refusal) {throw error;}
+      refused.push(error instanceof DevelopGitBundleError ? error : new DevelopGitBundleError(`${subjectLabel(subject)}: ${error.message}`));
+    }
+  }
+  if (refused.length === 1) {throw refused[0];}
+  if (refused.length > 1) {throw new BundleSignerRefusedError(refused);}
+  return verified;
+}
+
+/**
+ * One subject, verified (steps 1 to 3 of this file's header). `context` is `{policy, policyRoot, schemas, trustedCosign}`.
+ *
+ * @returns {Promise<{bundleSource: object}>} the bundle source the lock row carries: the declared one, by digest
+ */
+export async function verifyDevelopGitBundle({
+  subject,
+  checkout,
+  context,
+  clientFor,
+  signerCommit = verifiedBundleSignerCommit,
+  verifyOnRegistry = verifyBundleOnRegistry,
+  treeIdAt = sourceTreeIdAt,
+  env = process.env,
+}) {
+  const { biomeId, source, entry } = subject;
+  const label = subjectLabel(subject);
+  if (checkout === undefined) {
+    throw new Error(`${label}: the source walk holds no checkout of "${source.name}"`);
+  }
+  const repository = repositoryOwnerName(canonicalPublicHttpsRepositoryUrl(source.url, `${label} source url`), `${label} source url`);
+  const row = bundleSignerRowFor({ policy: context.policy, repository, channel: EditionChannel.Develop, schemas: context.schemas, label: `${label} develop bundle signer` });
+
+  // 1 + 2: the digest the manifest's tag serves; the commit P cosign verified the develop signature at; signature and
+  // provenance held to the row at P.
+  const ociRef = await bundleDigestRef({ clientFor, ociRef: entry.bundleSource.ociRef });
+  const cosign = { trustedCosign: context.trustedCosign, policy: context.policy, policyRoot: context.policyRoot, row, ociRef, env };
+  const attestedCommit = signerCommit(cosign);
+  verifyOnRegistry({ ...cosign, workflowSha: attestedCommit });
+
+  // 3: the content binding of P to F (see the header for the gap it leaves: build inputs outside the biome directory).
+  const binding = `the bundle ${ociRef} attested at ${attestedCommit} (P) against the source at ${source.commit} (F)`;
+  const { manifest } = await fetchBundleManifest({ clientFor, ociRef });
+  if (manifest?.xema?.id !== biomeId) {
+    throw new Error(`${label}: ${ociRef} declares xema.id ${JSON.stringify(manifest?.xema?.id)}, not "${biomeId}"`);
+  }
+  const bundleManifestHash = await context.schemas.computeBiomeSourceManifestHash(manifest);
+  if (bundleManifestHash !== entry.sourceManifestHash) {
+    throw new DevelopGitBundleError(
+      `${label}: ${binding}: the bundle's xema-biome.json hashes to sourceManifestHash ${bundleManifestHash}, but the manifest at F hashes to ${entry.sourceManifestHash}`,
+    );
+  }
+  const path = repositoryPathOf(subject);
+  const treeAtAttested = treeIdAt({ checkout, commit: attestedCommit, path, env });
+  const treeAtFrozen = treeIdAt({ checkout, commit: source.commit, path, env });
+  if (treeAtAttested !== treeAtFrozen) {
+    throw new DevelopGitBundleError(
+      `${label}: ${binding}: the biome directory ${path} is tree ${treeAtAttested} at P but tree ${treeAtFrozen} at F; publish a new version of the biome from F`,
+    );
+  }
+  return { bundleSource: { ...entry.bundleSource, ociRef } };
+}
+
+/**
+ * The verifier a vendor develop resolve hands `prepareDistributionWithIndex` (`inputs.developGitBundles`). Nothing is
+ * read (no trust policy, no cosign) unless a subject exists.
+ *
+ * @param {object} options
+ * @param {string|undefined} options.cosignBinary the cosign the trust policy pins by digest (`--cosign`)
+ * @param {string} options.dataRoot
+ */
+export function createDevelopGitBundleVerifier({ cosignBinary, dataRoot, env = process.env, clientFor, treeIdAt }) {
+  return Object.freeze({
+    async verify({ subjects, checkouts, schemas }) {
+      if (subjects.length === 0) {return new Map();}
+      if (cosignBinary === undefined) {
+        throw new DevelopGitBundleError(
+          `${subjects.map(subjectLabel).join(', ')} declare an OCI bundle; verifying it needs a cosign binary (--cosign), and none was given`,
+        );
+      }
+      const policy = loadPinnedDeclaredTrustPolicy({ dataRoot, declaration: editionWorkspaceConfig().evidenceTrustPolicy, schemas });
+      const trustedCosign = prepareTrustedCosignBinary({ cosignBinary, policy });
+      const context = { policy, policyRoot: dataRoot, schemas, trustedCosign };
+      const registry = clientFor ?? createRegistryClientResolver({ dataRoot });
+      try {
+        return await verifyEach(subjects, (subject) =>
+          verifyDevelopGitBundle({ subject, checkout: checkouts.get(subject.source.name), context, clientFor: registry, env, ...(treeIdAt === undefined ? {} : { treeIdAt }) }),
+        );
+      } finally {
+        trustedCosign.dispose();
+      }
+    },
+  });
+}
+
+/**
+ * The OFFLINE verifier of a candidate re-seal: the bundle the pinned develop edition already verified for the SAME
+ * source commit, carried forward unchanged, with the signer it was verified under (`pinnedBundleSigner`): the resolve
+ * refuses the row when the current trust policy selects any other signer (a rotated develop row). A subject at another commit, or one the pinned edition carried no bundle
+ * for, is refused: verifying a new bundle reads the registry, which an offline re-seal does not.
+ *
+ * @param {object} pinnedLock the pinned edition's parsed distribution lock
+ */
+export function carriedDevelopGitBundles(pinnedLock) {
+  return Object.freeze({
+    async verify({ subjects }) {
+      return verifyEach(subjects, async (subject) => {
+        const row = pinnedLock.biomes.find(
+          (biome) => biome.id === subject.biomeId && biome.source?.name === subject.source.name && biome.source.commit === subject.source.commit,
+        );
+        if (row?.bundleSource?.kind !== OCI_BUNDLE_SOURCE_KIND || row.bundleSigner === undefined) {
+          throw new DevelopGitBundleError(
+            `${subjectLabel(subject)}: the pinned edition carries no verified bundle at this commit, and an offline re-seal cannot verify one; resolve the develop edition instead`,
+          );
+        }
+        return { bundleSource: row.bundleSource, pinnedBundleSigner: row.bundleSigner };
+      });
+    },
+  });
+}

package/edition/external-source-walk.mjs

@@ -180,6 +180,24 @@ function resolveRemoteCommit(source, gitEnv, exec = execFileSync) {
   return commit;
 }
 
+/** Fetch `commit` by id, depth 1, into the checkout at `directory` unless it already holds it. */
+function fetchCommitUnlessHeld(directory, commit, gitEnv, exec) {
+  const have = (() => {
+    try {
+      return git(directory, ['cat-file', '-e', `${commit}^{commit}`], gitEnv, exec) === '';
+    } catch {
+      return false;
+    }
+  })();
+  if (!have) {
+    exec(
+      'git',
+      ['-C', directory, 'fetch', '--quiet', '--depth=1', 'origin', commit],
+      { env: gitEnv, stdio: ['ignore', 'pipe', 'pipe'] },
+    );
+  }
+}
+
 /**
  * Fetch a declared git source and return the directory + the EXACT commit its
  * manifests will be read at.
@@ -209,20 +227,7 @@ export function materializeGitSource({
       // reuses it: fetch from where the declaration says the source lives NOW.
       git(directory, ['remote', 'set-url', 'origin', source.url], gitEnv, exec);
     }
-    const have = (() => {
-      try {
-        return git(directory, ['cat-file', '-e', `${commit}^{commit}`], gitEnv, exec) === '';
-      } catch {
-        return false;
-      }
-    })();
-    if (!have) {
-      exec(
-        'git',
-        ['-C', directory, 'fetch', '--quiet', '--depth=1', 'origin', commit],
-        { env: gitEnv, stdio: ['ignore', 'pipe', 'pipe'] },
-      );
-    }
+    fetchCommitUnlessHeld(directory, commit, gitEnv, exec);
     git(directory, ['checkout', '--quiet', '--detach', commit], gitEnv, exec);
     return { directory, commit: pinExternalSourceCommit({ name: source.name, directory, commit }) };
   });
@@ -405,6 +410,7 @@ export async function walkDeclaredSources({
 } = {}) {
   const entries = [];
   const sourceRecords = new Map();
+  const checkouts = new Map();
   // Every source is held (kind, then credential and URL) before the first is materialised.
   const heldWorkspace = sources.length === 0 ? undefined : (workspace ?? editionWorkspaceConfig());
   for (const source of sources) {
@@ -446,6 +452,7 @@ export async function walkDeclaredSources({
       entries.push(stampEntry(assertSourceWalkedOrigin(await manifestToIndexEntry(manifest), source.name), source.name));
     }
     sourceRecords.set(source.name, lockedSourceRecord(source, commit));
+    checkouts.set(source.name, { source, directory });
   }
   // The last point at which an unstamped entry can be caught before it reaches
   // the shared index, where absent-is-the-identity makes it admissible
@@ -459,5 +466,20 @@ export async function walkDeclaredSources({
         'open-source edition. Refusing.',
     );
   }
-  return { entries, sourceRecords };
+  return { entries, sourceRecords, checkouts };
+}
+
+/**
+ * The git tree id of `path` (repository-relative, `.` for the root) of a declared git source at `commit`, read in the
+ * walk's checkout of that source (`checkouts` of `walkDeclaredSources`). A commit the checkout does not hold is fetched
+ * by id, depth 1, from the declared URL under the source's own credential hold: no history is needed.
+ */
+export function sourceTreeIdAt({ checkout, commit, path, env = process.env, workspace = editionWorkspaceConfig(), exec = execFileSync }) {
+  if (!EXACT_COMMIT.test(String(commit))) {
+    throw new Error(`source "${checkout.source.name}": tree of ${JSON.stringify(commit)} asked, which is not an exact 40-hex commit`);
+  }
+  return withSourceGitEnv(checkout.source, { workspace, env }, (gitEnv) => {
+    fetchCommitUnlessHeld(checkout.directory, commit, gitEnv, exec);
+    return git(checkout.directory, ['rev-parse', '--verify', path === '.' ? `${commit}^{tree}` : `${commit}:${path}`], gitEnv, exec);
+  });
 }

package/edition/locked-bundle-signer.mjs

@@ -3,7 +3,10 @@
 // Every `bundleSource: {kind: 'oci'}` row of a lock (a biome's, or one of its host modules') states WHO signs its bundle:
 // `bundleSigner: {policyId, signer}`, the kernel's `lockedBundleSignerOf` projection of ONE row of the data root's evidence
 // trust policy. The row is selected, never defaulted:
-//   - a git-sourced row (one with a lock `source`) carries no OCI bundle at all, and a lock stating one is refused;
+//   - a git-sourced row (one with a lock `source`) carries no OCI bundle, and a lock stating one is refused, EXCEPT in a
+//     selection made for a vendor develop edition (`GitSourcedBundle.DevelopVerified`, XEMA-2456): there a git-sourced
+//     biome row may carry the bundle the develop resolve verified (`develop-git-bundles.mjs`), signed by the ONE
+//     `develop` row of the source's repository;
 //   - a third-party row (no `source`, `isThirdPartyOciRow`) by its pin (`third-party-source-pins.json`), whose `bundle.signerPolicyId` names an
 //     `oidc-certificate` row held to the checks `thirdPartySignerRow` makes;
 //   - a first-party row by the data root's `firstPartyBundleSigner.policyId`, a `public-key` row whose key is bound to
@@ -15,13 +18,15 @@
 
 import { createRequire } from 'node:module';
 
+import { canonicalPublicHttpsRepositoryUrl, repositoryOwnerName } from './canonical-repository-url.mjs';
 import { KernelRefusalName, RefusalError, collectRefusals, isRefusal, joinRefusalMessages } from './collected-refusals.mjs';
+import { EditionChannel } from './edition-channel.mjs';
 import { editionWorkspaceConfig } from './edition-config.mjs';
 import { assertKernelEditionProtocol } from './edition-protocol.mjs';
 import { dataRoot, kernelDistPath, kernelPackageDir } from './edition-workspace.mjs';
 import { loadPinnedDeclaredTrustPolicy } from './evidence-trust-pin.mjs';
 import { loadTrustedThirdPartySourcePins } from './third-party-pins-trusted.mjs';
-import { thirdPartySignerRow } from './third-party-source-evidence.mjs';
+import { bundleSignerRowFor, thirdPartySignerRow } from './third-party-source-evidence.mjs';
 import { OCI_BUNDLE_SOURCE_KIND, isThirdPartyOciRow } from './third-party-subjects.mjs';
 
 const requireFromHere = createRequire(import.meta.url);
@@ -31,6 +36,13 @@ const PUBLIC_KEY_KIND = 'public-key';
 
 const KERNEL_EXPORTS = Object.freeze(['lockedBundleSignerOf', 'assertLockedBundleSignerMatches', 'LockedBundleSignerUnknownPolicyError', 'LockedBundleSignerAmbiguousPolicyError']);
 
+/**
+ * Whether a selection admits an OCI bundle on a git-sourced row. `Refused` is every release, customer and dist-check
+ * selection, unchanged; `DevelopVerified` only a vendor develop edition's resolve, seal and verify, whose git bundles
+ * the develop resolve verified against the source commit (`develop-git-bundles.mjs`).
+ */
+export const GitSourcedBundle = Object.freeze({ Refused: 'refused', DevelopVerified: 'develop-verified' });
+
 /** A named refusal of the bundle signer plane. */
 export class BundleSignerError extends RefusalError {
   constructor(message) {
@@ -56,6 +68,8 @@ export class BundleSignerMissingError extends BundleSignerError {}
 export class BundleSourceOnGitRowError extends BundleSignerError {}
 /** A resolve found an OCI host-module bundle on a git-sourced biome: such a bundle reaches an edition only through an `oci` source. */
 export class GitSourcedHostModuleBundleError extends BundleSignerError {}
+/** A develop resolve could not verify the OCI bundle a git-sourced biome declares (no develop row, cosign, or the content binding refused it). */
+export class DevelopGitBundleError extends BundleSignerError {}
 /** The loaded kernel does not export what the bundle signer plane needs. */
 export class BundleSignerKernelUnsupportedError extends BundleSignerError {}
 /** Several OCI rows were refused in one pass; `.errors` holds each row's own refusal. */
@@ -98,6 +112,13 @@ function assertNotGitSourced(subject) {
   }
 }
 
+/** Refuses a git-sourced subject unless the selection admits develop git bundles and the subject is a biome row. */
+function assertGitSourceAdmitted(subject, gitSourcedBundle) {
+  if (subject.source === undefined) {return;}
+  if (gitSourcedBundle === GitSourcedBundle.DevelopVerified && subject.componentKey === undefined) {return;}
+  assertNotGitSourced(subject);
+}
+
 const rowsOf = (policy, policyId) => policy.policies.filter((row) => row.policyId === policyId);
 
 /**
@@ -105,7 +126,7 @@ const rowsOf = (policy, policyId) => policy.policies.filter((row) => row.policyI
  *   firstPartyPolicyId: string|undefined, schemas: object, kernel?: object}} options
  * @returns {{policyIdFor: (subject: object) => string, signerFor: (subject: object) => object, assertSealed: (subject: object, stated: object|undefined) => void}}
  */
-export function createBundleSignerSelection({ policy, thirdPartyPins, firstPartyPolicyId, schemas, kernel }) {
+export function createBundleSignerSelection({ policy, thirdPartyPins, firstPartyPolicyId, schemas, kernel, gitSourcedBundle = GitSourcedBundle.Refused }) {
   let loaded = kernel;
   const kernelExports = () => (loaded ??= loadBundleSignerKernel());
 
@@ -155,6 +176,24 @@ export function createBundleSignerSelection({ policy, thirdPartyPins, firstParty
     return row;
   }
 
+  // A git-sourced biome's develop bundle: the ONE develop row of the source's repository (a host module never reaches here:
+  // the resolve refuses an OCI host module on a git-sourced biome in every channel).
+  function developGitRow(subject) {
+    const label = `${describeSubject(subject)} develop bundle signer`;
+    const repository = repositoryOwnerName(canonicalPublicHttpsRepositoryUrl(subject.source.url, `${label} source url`), `${label} source url`);
+    let row;
+    try {
+      row = bundleSignerRowFor({ policy, repository, channel: EditionChannel.Develop, schemas, label });
+    } catch (error) {
+      throw new BundleSignerPolicyAbsentError(error.message);
+    }
+    requireKind(subject, row, OIDC_CERTIFICATE_KIND);
+    return onlyRow(row.policyId);
+  }
+
+  /** Refuses a git-sourced subject this selection does not admit; any other subject passes. */
+  const assertAdmitted = (subject) => assertGitSourceAdmitted(subject, gitSourcedBundle);
+
   function requirePolicy(subject) {
     if (policy === null) {
       throw new BundleSignerPolicyAbsentError(
@@ -164,8 +203,9 @@ export function createBundleSignerSelection({ policy, thirdPartyPins, firstParty
   }
 
   function selectedRow(subject) {
-    assertNotGitSourced(subject);
+    assertAdmitted(subject);
     requirePolicy(subject);
+    if (subject.source !== undefined) {return developGitRow(subject);}
     return isThirdPartyOciRow(subject) ? thirdPartyRow(subject) : firstPartyRow(subject);
   }
 
@@ -178,6 +218,7 @@ export function createBundleSignerSelection({ policy, thirdPartyPins, firstParty
   };
 
   return {
+    assertAdmitted,
     policyIdFor: (subject) => selectedRow(subject).policyId,
     signerFor,
     assertSealed(subject, stated) {
@@ -200,7 +241,7 @@ export function createBundleSignerSelection({ policy, thirdPartyPins, firstParty
  * The data root's selection, LAZY: nothing is read until the first OCI subject asks, so a lock with no OCI row never
  * needs a policy, a pin or a kernel that speaks v33.
  */
-export function loadBundleSignerSelection({ dataRoot, schemas }) {
+export function loadBundleSignerSelection({ dataRoot, schemas, gitSourcedBundle = GitSourcedBundle.Refused }) {
   let selection;
   const resolved = () => {
     if (selection === undefined) {
@@ -211,11 +252,14 @@ export function loadBundleSignerSelection({ dataRoot, schemas }) {
         thirdPartyPins: loadTrustedThirdPartySourcePins(dataRoot),
         firstPartyPolicyId: config.firstPartyBundleSigner?.policyId,
         schemas,
+        gitSourcedBundle,
       });
     }
     return selection;
   };
   return Object.freeze({
+    // Refusing an unadmitted git-sourced row needs no data root, so it reads none.
+    assertAdmitted: (subject) => assertGitSourceAdmitted(subject, gitSourcedBundle),
     policyIdFor: (subject) => resolved().policyIdFor(subject),
     signerFor: (subject) => resolved().signerFor(subject),
     assertSealed: (subject, stated) => resolved().assertSealed(subject, stated),
@@ -242,12 +286,12 @@ export function lockBundleSubjects(lock) {
  * row is never checked and never resolves a data root: `selection` is used when given, else the data root's is loaded
  * on the first OCI subject.
  */
-export function assertLockBundleSigners({ lock, selection, schemas }) {
+export function assertLockBundleSigners({ lock, selection, schemas, gitSourcedBundle = GitSourcedBundle.Refused }) {
   const subjects = lockBundleSubjects(lock);
   if (subjects.length === 0) {return;}
-  const chosen = selection ?? loadBundleSignerSelection({ dataRoot: dataRoot(), schemas });
+  const chosen = selection ?? loadBundleSignerSelection({ dataRoot: dataRoot(), schemas, gitSourcedBundle });
   collectRefusals(subjects, ({ row, subject }) => {
-    assertNotGitSourced(subject);
+    chosen.assertAdmitted(subject);
     chosen.assertSealed(subject, row.bundleSigner);
   }, isRefusal, BundleSignerRefusedError);
 }

package/edition/previous-seal-registry.mjs

@@ -0,0 +1,149 @@
+// previous-seal-registry — the previous seal of a snapshot edition, read from the edition's own registry repository.
+//
+// A write of an images lock carries its composed artifacts' generations forward from the previous seal (resolve-images.mjs
+// resolvePreviousSeal). In CI that is the images.lock layer of the LATEST SIGNED edition already published to the
+// edition repository `<registry root>/<channel segment>/xema-edition-<id>`. `--previous-seal-signer <identity>` finds it:
+//
+// - every snapshot tag (64 hex) is read by tag, deduplicated by digest; each must be an edition artifact with an
+//   `org.opencontainers.image.created` annotation (oras writes it on push; it is inside the signed manifest);
+// - the newest by that annotation is the candidate. A candidate with no cosign signature tag (`sha256-<hex>.sig`) was never
+//   published (a failed sign) and is passed over, named; a candidate WITH a signature must verify against exactly the given
+//   certificate identity and the GitHub OIDC issuer, offline, through the pinned cosign. A failure there is a refusal,
+//   never a step back to an older edition (that would regress or fork the generation);
+// - its images.lock layer is fetched by digest (the bytes hash to the layer digest the signed manifest names).
+//
+// FIRST SEAL is never inferred here. A registry that answers 404 for the repository's tag list may be one that hides a
+// private repository from a credential that cannot read it, and a repository that exists but holds no signed edition may
+// have lost its editions to retention: neither proves that no edition was ever published. Both are refused, naming the
+// operator's explicit `--first-seal` (once, for a distribution that has never had an edition).
+//
+// Concurrency is the caller's: the per-edition concurrency group serializes the runs that push to one repository, so the
+// edition read here is the one the previous run of that group pushed and signed.
+
+import { RefusalError } from './collected-refusals.mjs';
+import { EDITION_ARTIFACT_TYPE, EditionLockFile } from './edition-constants.mjs';
+import { cosignEnvironment, withPinnedCosign } from './pinned-cosign.mjs';
+import { splitImageRef } from './registry-credentials.mjs';
+import { isNotPublishedYet } from './seal-image-digests.mjs';
+import { GITHUB_ACTIONS_OIDC_ISSUER } from './third-party-source-evidence.mjs';
+
+export const PREVIOUS_SEAL_SIGNER_FLAG = '--previous-seal-signer';
+
+const SNAPSHOT_TAG_PATTERN = /^[0-9a-f]{64}$/;
+const SIGNATURE_TAG_PATTERN = /^sha256-([0-9a-f]{64})\.sig$/;
+const CREATED_ANNOTATION = 'org.opencontainers.image.created';
+const TITLE_ANNOTATION = 'org.opencontainers.image.title';
+const RFC3339_UTC_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$/;
+const IDENTITY_PATTERN = /^https:\/\/github\.com\/[^/@\s]+\/[^/@\s]+\/\.github\/workflows\/[^/@\s]+@refs\/[^\s]+$/;
+const MAX_IMAGES_LOCK_BYTES = 64 * 1024 * 1024;
+const MANIFEST_READ_CONCURRENCY = 4;
+const STDERR_TAIL_BYTES = 800;
+
+const tail = (text) => String(text).trim().slice(-STDERR_TAIL_BYTES);
+
+/**
+ * The signer `--previous-seal-signer` names: the EXACT certificate identity of the workflow that signs this repository's
+ * editions (`https://github.com/<owner>/<name>/.github/workflows/<file>@refs/...`) and the GitHub OIDC issuer. Only the
+ * identity is held, not the workflow-repository extension: a reusable workflow called from another repository signs
+ * with its own identity but the CALLER's repository extension.
+ */
+export function previousSealSignerOf(identity) {
+  if (typeof identity !== 'string' || !IDENTITY_PATTERN.test(identity)) {
+    throw new RefusalError(
+      `${PREVIOUS_SEAL_SIGNER_FLAG} must be the exact certificate identity https://github.com/<owner>/<name>/.github/workflows/<file>@refs/<...>; got ${JSON.stringify(identity)}`,
+    );
+  }
+  return { certificateIdentity: identity, oidcIssuer: GITHUB_ACTIONS_OIDC_ISSUER };
+}
+
+async function mapBounded(items, limit, fn) {
+  const results = new Array(items.length);
+  let next = 0;
+  const worker = async () => {
+    while (next < items.length) {
+      const index = next;
+      next += 1;
+      results[index] = await fn(items[index]);
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+  return results;
+}
+
+/**
+ * Find the latest signed edition of `repository` (`<authority>/<path>`) and return its images.lock bytes.
+ * @returns {Promise<{edition: string, created: string, imagesLockSha256: string, bytes: Buffer}>}
+ */
+export async function findPreviousSealOnRegistry({ repository, signer, clientFor, runCosign, cosignEnvFor, trustedRootPath, log = (line) => console.error(line) }) {
+  const { authority, repository: path } = splitImageRef(repository);
+  const client = clientFor(authority);
+  let tags;
+  try {
+    tags = await client.listTags(path);
+  } catch (error) {
+    if (isNotPublishedYet(error)) {
+      throw new RefusalError(
+        `[previous-seal] the registry answered 404 for the tags of ${repository}: either no edition was ever published there or this credential cannot see it, ` +
+          'and a 404 does not tell which. If this distribution has never had an edition, resolve once with --first-seal; otherwise fix the credential.',
+      );
+    }
+    throw new Error(`[previous-seal] the registry did not answer for the tags of ${repository}; refusing to guess the previous seal: ${error.message}`);
+  }
+  const signed = new Set(tags.map((tag) => SIGNATURE_TAG_PATTERN.exec(tag)?.[1]).filter((hex) => hex !== undefined).map((hex) => `sha256:${hex}`));
+  const snapshotTags = tags.filter((tag) => SNAPSHOT_TAG_PATTERN.test(tag)).sort();
+  const read = await mapBounded(snapshotTags, MANIFEST_READ_CONCURRENCY, async (tag) => ({ tag, manifest: await client.getManifestByTag(path, tag) }));
+  const byDigest = new Map();
+  for (const { tag, manifest } of read) {
+    const ref = `${repository}:${tag}`;
+    if (manifest.isIndex || manifest.document?.artifactType !== EDITION_ARTIFACT_TYPE) {
+      throw new RefusalError(`[previous-seal] ${ref} is not an edition artifact (artifactType ${JSON.stringify(manifest.document?.artifactType)}); refusing to choose a previous seal past it`);
+    }
+    const created = manifest.document.annotations?.[CREATED_ANNOTATION];
+    if (typeof created !== 'string' || !RFC3339_UTC_PATTERN.test(created) || Number.isNaN(Date.parse(created))) {
+      throw new RefusalError(`[previous-seal] ${ref} (${manifest.digest}) has no ${CREATED_ANNOTATION} annotation in RFC 3339 UTC; the latest edition cannot be told`);
+    }
+    if (!byDigest.has(manifest.digest)) {byDigest.set(manifest.digest, { digest: manifest.digest, tag, created, time: Date.parse(created), document: manifest.document });}
+  }
+  const editions = [...byDigest.values()].sort((a, b) => b.time - a.time);
+  for (let i = 0; i < editions.length; i += 1) {
+    const edition = editions[i];
+    const ref = `${repository}@${edition.digest}`;
+    if (i + 1 < editions.length && editions[i + 1].time === edition.time) {
+      throw new RefusalError(`[previous-seal] ${ref} and ${repository}@${editions[i + 1].digest} were both created at ${edition.created}; the latest edition cannot be told`);
+    }
+    if (!signed.has(edition.digest)) {
+      log(`[previous-seal] ${ref} (${edition.created}) carries no signature: it was never published; passing over it`);
+      continue;
+    }
+    const result = await runCosign(
+      ['verify', '--offline', '--trusted-root', trustedRootPath, '--certificate-identity', signer.certificateIdentity, '--certificate-oidc-issuer', signer.oidcIssuer, ref],
+      cosignEnvironment(cosignEnvFor, authority),
+    );
+    if (result.code !== 0) {
+      throw new RefusalError(
+        `[previous-seal] the latest edition ${ref} (${edition.created}) carries a signature that does not verify for ${signer.certificateIdentity}; ` +
+          `refusing it and refusing to fall back to an older edition (cosign exit ${result.code}): ${tail(result.stderr)}`,
+      );
+    }
+    const layers = (edition.document.layers ?? []).filter((layer) => layer.annotations?.[TITLE_ANNOTATION] === EditionLockFile.Images);
+    if (layers.length !== 1) {
+      throw new RefusalError(`[previous-seal] ${ref} carries ${layers.length} layers titled ${EditionLockFile.Images}; an edition carries exactly one`);
+    }
+    const [layer] = layers;
+    const bytes = await client.getBlob(path, layer.digest, MAX_IMAGES_LOCK_BYTES);
+    log(`[previous-seal] previous seal: ${ref} (${edition.created}), ${EditionLockFile.Images} ${layer.digest}`);
+    return { edition: ref, created: edition.created, imagesLockSha256: layer.digest.slice('sha256:'.length), bytes };
+  }
+  throw new RefusalError(
+    `[previous-seal] ${repository} exists but holds no signed edition (${editions.length} unsigned); that no edition was ever published cannot be proven. ` +
+      'If none ever was, resolve once with --first-seal.',
+  );
+}
+
+/** `findPreviousSealOnRegistry` under the data root's pinned cosign and declared registry credentials. */
+export async function previousSealFromRegistry({ repository, signerIdentity, cosignBinary, env, pinned = {}, log }) {
+  const signer = previousSealSignerOf(signerIdentity);
+  return withPinnedCosign({ cosignBinary, env, ...pinned }, ({ runCosign, cosignEnvFor, clientFor, trustedRootPath }) =>
+    findPreviousSealOnRegistry({ repository, signer, clientFor, runCosign, cosignEnvFor, trustedRootPath, ...(log === undefined ? {} : { log }) }),
+  );
+}