@xemahq/xema 0.56.0 → 0.57.0

package/dist/edition/verify-image-evidence.bundle.provenance.json

@@ -2599,355 +2599,355 @@
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/adapter-host-versions.mjs",
       "sha256": "sha256:1b7ebd3592f4da1225fba74aaba912e7d85fbceeb1626f7dcdac83491cbb4d69"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/authorization-base.mjs",
       "sha256": "sha256:815c9be9f71731dcc805d85da2d733350ddb6fbdf32b6f1cf34f228ce6381c7c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/build-ledger.mjs",
       "sha256": "sha256:05202cbdd606aee086c8e9c62d28be68c429653a8b1d73a289ed0fe4ff14da85"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/canonical-evidence-json.mjs",
       "sha256": "sha256:3b32f6786c9fb1c0deadf2f687077356a503b0db766392d2e0254aa1ab78feec"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/canonical-repository-url.mjs",
       "sha256": "sha256:f36e4f7cbe7849789422ec2f0ebce2d62f7dc3684afecc3ac51a32560e72d8a1"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/collected-refusals.mjs",
       "sha256": "sha256:ae21c069dbff0afa9aca18b7b909d5de405df2277f6431bc3fda20528115bcd1"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/connector-source-authority.mjs",
       "sha256": "sha256:ea94475f4324737673accd7de1303c44db1cbc4dac61a865a06cd83abe310164"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/cosign-certificate-constraints.mjs",
       "sha256": "sha256:bb9ba7038f1de9211c9cbcf99f02255f3623ce72d86c71fdcfa146a4e0edbd9a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/develop-graph.mjs",
       "sha256": "sha256:decebd437c9f4c8bdd6bee3baabfdc340fd7b9d175aca7e702cb330e912708d5"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/dispatched-runtime-components.mjs",
       "sha256": "sha256:9712823d183a60108cd002b2d36a9e5c0867b9d576dd02825264a18f7b8ece69"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/distribution-paths.mjs",
       "sha256": "sha256:d78a5c8405bc6c25d36fcec61b0030e1fdacac7d528e698adb96f906f4b70279"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/edition-artifact.mjs",
       "sha256": "sha256:3b588c9c50f64f3e7a45b954fe7b5fc67e11fc8ce3e7b323727af4541d29ae7f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/edition-channel.mjs",
       "sha256": "sha256:3c0c1564dc50be133cad500452d953353aa5beb703142c05a17bbce8175ba9f3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/edition-chart-set.mjs",
       "sha256": "sha256:f9f16b58279c8c2619a39c5cc92bdbc334543d1a324304cd5d3b120d66dc8f3a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/edition-config.mjs",
       "sha256": "sha256:58af55e9a2b36ca23485246d44a295260afa240bcdc0649c697563b36085ddaa"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/edition-constants.mjs",
       "sha256": "sha256:217fa5b1fa25cb50ee4e1b46ea5e086061ff1f44e00198e1dc28f52376f236a0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/edition-contract-parse.mjs",
       "sha256": "sha256:e2c6e66378f878499f44b62d060ae50197f40757b2044d9ce05290e367dfe21d"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/edition-contract.json",
       "sha256": "sha256:566a17301ad15b94a06fef12b26bbe39e292ed2bf30a2659a9bf07ce5ce487e0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/edition-kind.mjs",
       "sha256": "sha256:b4f3358ffa81bbafb8c37d158b9e01032a7358c38b9d6e5aca409091f989e47a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/edition-protocol.mjs",
       "sha256": "sha256:f02ea6427e2fd7ceea2c3cb49f3fa6d85b982870e487082a7466f8037cd2bed9"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/edition-publisher.mjs",
       "sha256": "sha256:8803b41067d81acbc35a8974426f606b5b8168b7a9c2581c16586a86f36db50f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/edition-source-pins.mjs",
       "sha256": "sha256:b141474fff33b06734fb62cd2552752b991c8267bb1c9bccb22a81dd80e91c6c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/edition-workspace.mjs",
       "sha256": "sha256:892b360f9f80d2308b0b12f9b99658ae06173878d9b71cf5d6fc8bd717b3c86e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/evidence-checkout.mjs",
       "sha256": "sha256:31fb669769b31de4c6f2b2501bb96959548172ef166e7568edbbfed7f5079a11"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/evidence-grammars.mjs",
       "sha256": "sha256:4bea69437af5a36c139b5b41d0ecf2d1ddcf3f871e10c78e3d351f608eedca3b"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/evidence-trust-pin.mjs",
       "sha256": "sha256:eb46e4d6a79dfac5536b7a439ab9df7dd4b03af369bdcfa9fcdd522aa1aab8dd"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/first-party-source-ids.mjs",
       "sha256": "sha256:20cb1ad7cfb8c6e6686a6be5a51289da4bba76c20b58d9c1b5b6b3813a38dc1c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/fulcio-certificate-extensions.mjs",
       "sha256": "sha256:6f1f5a8ea110a489f7aff4bfb8e0b2d058919fe3e8ba4a1e5e8396fca24861b7"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/git-json.mjs",
       "sha256": "sha256:d0d25cda0c19007becabc9a2827c3dcf759b295cd0b41596eb4480c9549a1f21"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/git-source-auth.mjs",
       "sha256": "sha256:c1b32aa6f7d59798db58238d632cafeadbd4f07376396a31acdeb5f0ac56dcac"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/image-delivery-entitlement-descriptor.mjs",
       "sha256": "sha256:4726b66116f01bf2523fafe2b7a356591eca8fb5ca6bd8b154dd4821873e921b"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/image-evidence-replay-state.mjs",
       "sha256": "sha256:eba0cf1d38af0ab2f00c5099fa8bc2edc543136ce92f895544d4d284b3d6af0f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/image-evidence.mjs",
       "sha256": "sha256:c6a202f3fc8efe97f00c7e69532c656646bdc5c93365d68676046c3aabd33233"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/image-subject-identity.mjs",
       "sha256": "sha256:6a64e44f9865f68484540e3264a1d87040ae021dfa6ee4b79239e66805754ac1"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/kernel-capability-domain.mjs",
       "sha256": "sha256:3ecf887dd8d399e91a8285f6f115f6e418fb59bbf3f004539fe65ec667219356"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/kernel-contract-authority.mjs",
       "sha256": "sha256:9de2645dca22274cad9fa68d0364bf57e4de704e9d49a8bbadde0e322ae317df"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/kernel-contract-source-path-set.mjs",
       "sha256": "sha256:bc4756f217d80fd8f802932f47da71ab14e782873fa9fa977002a94e058d8a9e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/kernel-package.mjs",
       "sha256": "sha256:e97a9491991d8332a4feed14ac48fe393e44d12c63bdfec89fac8b5b4ea2a574"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/lib.mjs",
       "sha256": "sha256:a0695c1e1649da205f4e5d0e8d411079d6af4eb00c7d753bb2e9bf9a5ed1232e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/no-follow-file.mjs",
       "sha256": "sha256:c17bdf5e441f3c079aa06d4b48bbed05cad087855b9ad2a5e6dc43d5ee2b17c3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/operation-requirements.mjs",
       "sha256": "sha256:d3b6807953f162ab4204dcd1a0f752e0f9b447726fc17a12534d28abe8e570b0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/pin-source.mjs",
       "sha256": "sha256:32fa918729a83587b4d3bca6e5fe381f5a525397ebc49d52729ec1f8cf216c37"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/sigstore-bundle-media-type.mjs",
       "sha256": "sha256:e0aa5a3992f0385ddbbe69eb0307d642ac428ef516c8394816ac4fd52e0ac39c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/source-authority.mjs",
       "sha256": "sha256:9c351f60e8ea838f445f89c3709c60b7f13b021b78d6e40eaef91350a793f0ff"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/strict-json.mjs",
       "sha256": "sha256:f95778396df7f38b086f55d2ec4f3b6644a8aeff2b32282a62829145fb544562"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/string-order.mjs",
       "sha256": "sha256:b3210cd273e4b2e01fb8b1a91e28734cd211d4010c080d0ce95f5e5ff631cffb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/third-party-admission.mjs",
       "sha256": "sha256:7e32f631a8948e2b93a5cfa163390d52d2a8d9ade87a637c7fe1fc6351fe5974"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/third-party-certificate-extensions.mjs",
       "sha256": "sha256:3293267b09452199f605001d8c14070d1c822b77390caee4088e17b059b7b05d"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/third-party-source-pins.mjs",
       "sha256": "sha256:6f12feb9061bd4ea3e5aeab3f369c081ab58da335c0d281e21b250251e1c0dd9"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/trust-policy-arming.mjs",
       "sha256": "sha256:f6ed96ee1d0b7698b1eea5066ba10abef1babeede8403a7c481bba53636cb1a5"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/trust-policy-image-ownership.mjs",
       "sha256": "sha256:be0c787c6a75124f0143fc0ce3b127a94e3bb7f6aa64e282c91dd84e566e550e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/trusted-executable.mjs",
       "sha256": "sha256:37d46cdbc999ddd55d4ea8aeed4850ddd1efde89ed7b532f5a2ddec87105d796"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/verifier-binding.mjs",
       "sha256": "sha256:80732658617f5255258c538eeb2383331ec8553b44b58d552b567845a7b916aa"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/verifier-files.mjs",
       "sha256": "sha256:cdd14a20a63f0f194a8abb55680a5a7e3ced1f09f8b210a90d349e655f6de0c0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/verifier-provenance.mjs",
       "sha256": "sha256:3e2fb8e07cf1f66b8ad6c7ac2555fe3af64ec7abeb07cecbaf1939a18c2b3663"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/verify-catalogue-evidence.mjs",
       "sha256": "sha256:156d0ee39210658ec489609629c5b9cddd3ce5b3938d8980dcf8282ae4be60bb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/verify-image-evidence.mjs",
       "sha256": "sha256:958360f7889985c48abb048852c5bbba349cd7353ce4b532c4511b4902380fac"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "edition/workspace-sections.mjs",
       "sha256": "sha256:1d2aff08bcd9e94b644c85c5b55c90c05b6b02bab662731fe3fcd53fcdf86e93"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.56.0",
+      "version": "0.57.0",
       "path": "scripts/build-evidence-verifier.mjs",
       "sha256": "sha256:5a688d20c47dc88aff37aa0c6cc02daf2c370a5bc610fef8446ce7be222d4c0b"
     },

package/edition/README.md

@@ -180,7 +180,13 @@ The edition library builds, validates and verifies evidence statements; it never
 
 ## Previous seal
 
-A write of `images.lock.json` (`resolve-images`, `xema edition develop resolve`) takes exactly one of `--previous-lock <lock> --previous-lock-sha256 <hex>` or `--first-seal`; the CLI refuses unless the lock's bytes hash to the digest, which the caller takes from the images.lock layer of the signed, published edition (the latest, under the per-edition concurrency group). The in-repo resolve and pin/unpin take the committed `images.lock.json` at the target path as the previous lock (first seal when absent). The the composed artifacts' generations carry forward from it.
+A write of `images.lock.json` (`resolve-images`, `xema edition develop resolve`) takes exactly one previous seal, whose composed artifacts' generations carry forward:
+
+- `--previous-seal-signer <certificate identity>` (develop resolve, vendor form): the CLI lists the edition's own repository (`<registry root>/develop-editions/xema-edition-<id>`), reads every snapshot tag, and takes the newest edition by its `org.opencontainers.image.created` annotation (inside the signed manifest). An edition with no signature was never published and is passed over; the newest signed one must verify, offline through the pinned cosign, for exactly that identity and the GitHub OIDC issuer, or the resolve is refused (it never steps back to an older edition). Its images.lock layer is fetched by digest. The run must be under the per-edition concurrency group, so the edition read is the one the previous run pushed.
+- `--previous-lock <lock> --previous-lock-sha256 <hex>`: the same layer, taken by the caller; the CLI refuses unless the bytes hash to the digest.
+- `--first-seal`: generation 1, only for a distribution that has never had an edition. The CLI never infers it: a 404 for the repository (a registry may hide a repository from a credential) and a repository with no signed edition (retention) are refused, naming `--first-seal`.
+
+The in-repo resolve and pin/unpin take the committed `images.lock.json` at the target path as the previous lock (first seal when absent).
 
 ## Kernel protocol and pins
 

package/edition/customer-edition-verbs.mjs

@@ -34,6 +34,7 @@ import { canonicalJson, sha256Digest } from './image-evidence.mjs';
 import { adoptCatalogueKernel } from './kernel-package.mjs';
 import { loadKernelDistributionSchemas, serializeJson } from './lib.mjs';
 import { isSourcePinKey, sortedSnapshotPins, sourcePinKey } from './pin-source.mjs';
+import { PREVIOUS_SEAL_SIGNER_FLAG } from './previous-seal-registry.mjs';
 import { assertSealedImageLock } from './release-edition-artifact.mjs';
 import { assertSourceImagesCoverDefinition, parseSourceImages, resolveCustomerEdition } from './resolve-customer-edition.mjs';
 import { externalSourceTrees, imageRefForSubject, sourceTreeLocator } from './resolve-images.mjs';
@@ -191,12 +192,13 @@ const COMMANDS = Object.freeze({
   resolve: {
     positional: true,
     // --images-from: the everyday job's image build record (images-from-record.mjs) instead of the registry probe; vendor only.
-    // --previous-lock with --previous-lock-sha256 (the digest of the latest signed, published edition's images.lock layer, passed by the workflow under
-    // the per-edition concurrency group) or --first-seal: the previous seal whose composed artifacts carry their generation forward; vendor only.
-    values: ['--pins', '--out', '--registry', ENGINE_REPOSITORY_FLAG, ENGINE_SIGNER_FLAG, COSIGN_FLAG, IMAGES_FROM_FLAG, PREVIOUS_LOCK_FLAG, PREVIOUS_LOCK_SHA256_FLAG],
+    // The previous seal whose composed artifacts carry their generation forward, exactly one of: --previous-seal-signer <identity> (the CLI reads
+    // the latest edition that identity signed in this edition's repository; the workflow runs under the per-edition concurrency group),
+    // --previous-lock with --previous-lock-sha256 (that edition's images.lock layer, taken by the caller) or --first-seal; vendor only.
+    values: ['--pins', '--out', '--registry', ENGINE_REPOSITORY_FLAG, ENGINE_SIGNER_FLAG, COSIGN_FLAG, IMAGES_FROM_FLAG, PREVIOUS_LOCK_FLAG, PREVIOUS_LOCK_SHA256_FLAG, PREVIOUS_SEAL_SIGNER_FLAG],
     switches: ['--local', FIRST_SEAL_FLAG],
     required: ['--pins', '--out', '--registry', ENGINE_REPOSITORY_FLAG, ENGINE_SIGNER_FLAG, COSIGN_FLAG],
-    customer: { values: [DEFINITION_FLAG, ...CREDENTIAL_FLAGS, SOURCE_IMAGE_FLAG, COSIGN_FLAG, ENGINE_IMAGE_FLAG], required: ['--pins', '--out', '--registry', '--engine-image'], refused: [IMAGES_FROM_FLAG, PREVIOUS_LOCK_FLAG, PREVIOUS_LOCK_SHA256_FLAG, FIRST_SEAL_FLAG], cosign: true },
+    customer: { values: [DEFINITION_FLAG, ...CREDENTIAL_FLAGS, SOURCE_IMAGE_FLAG, COSIGN_FLAG, ENGINE_IMAGE_FLAG], required: ['--pins', '--out', '--registry', '--engine-image'], refused: [IMAGES_FROM_FLAG, PREVIOUS_LOCK_FLAG, PREVIOUS_LOCK_SHA256_FLAG, FIRST_SEAL_FLAG, PREVIOUS_SEAL_SIGNER_FLAG], cosign: true },
     // A vendor resolve finds its engine itself; the old flag is refused by name, never read as a customer flag.
     removedFromVendor: { [ENGINE_IMAGE_FLAG]: `use ${ENGINE_REPOSITORY_FLAG} and ${ENGINE_SIGNER_FLAG}` },
   },

package/edition/develop-edition.mjs

@@ -130,7 +130,7 @@ import { runImageRecord } from './develop-image-record.mjs';
 import { runSelectRecords } from './develop-select-records.mjs';
 import { readSelectionPins } from './develop-selection-pins.mjs';
 import { runVerifyImageRecord } from './develop-verify-image-record.mjs';
-import { LOCAL_WORKFLOW, assertExistingArtifactMatches, developEditionTarget, workflowFromEnv, writeEditionArtifact } from './edition-artifact.mjs';
+import { LOCAL_WORKFLOW, assertExistingArtifactMatches, developEditionTarget, editionRepository, workflowFromEnv, writeEditionArtifact } from './edition-artifact.mjs';
 import { EditionChannel, EditionKind } from './edition-constants.mjs';
 import { WorkspaceRoot, configureEditionWorkspaceFromProcess, isEntryModule, kernelRepoDir } from './edition-workspace.mjs';
 import { descriptorEvidenceTrust } from './evidence-trust-policy.mjs';
@@ -138,6 +138,7 @@ import { createSatelliteVerifier, imageBuildRecordDigest, readImageBuildRecord }
 import { assertKernelCommitSupported, chooseKernelCommit } from './kernel-protocol-choice.mjs';
 import { loadKernelDistributionSchemas } from './lib.mjs';
 import { snapshotPinSource } from './pin-source.mjs';
+import { PREVIOUS_SEAL_SIGNER_FLAG, previousSealFromRegistry } from './previous-seal-registry.mjs';
 import { composeEdition } from './resolve-distribution.mjs';
 import { resolvePreviousSeal } from './resolve-images.mjs';
 import { readStrictJsonFile } from './strict-json.mjs';
@@ -206,7 +207,22 @@ async function run(argv, env) {
         env,
         engine: { repository: options['--engine-repository'], signer: options['--engine-signer'] },
         cosignBinary: options['--cosign'],
-        previousLock: await resolvePreviousSeal({ distributionId: id, previousLockPath: options[PREVIOUS_LOCK_FLAG], previousLockSha256: options[PREVIOUS_LOCK_SHA256_FLAG], firstSeal: Boolean(options[FIRST_SEAL_FLAG]) }),
+        previousLock: await resolvePreviousSeal({
+          distributionId: id,
+          previousLockPath: options[PREVIOUS_LOCK_FLAG],
+          previousLockSha256: options[PREVIOUS_LOCK_SHA256_FLAG],
+          firstSeal: Boolean(options[FIRST_SEAL_FLAG]),
+          ...(options[PREVIOUS_SEAL_SIGNER_FLAG] === undefined ? {} : {
+            registry: {
+              find: () => previousSealFromRegistry({
+                repository: editionRepository(id, options['--registry'], EditionChannel.Develop),
+                signerIdentity: options[PREVIOUS_SEAL_SIGNER_FLAG],
+                cosignBinary: options['--cosign'],
+                env,
+              }),
+            },
+          }),
+        }),
         ...(options[IMAGES_FROM_FLAG] === undefined ? {} : {
           imagesFrom: await readImageBuildRecord(options[IMAGES_FROM_FLAG]),
           verifySatellites: createSatelliteVerifier({ registry: options['--registry'], cosignBinary: options['--cosign'], env }),

package/edition/previous-seal-registry.mjs

@@ -0,0 +1,149 @@
+// previous-seal-registry — the previous seal of a snapshot edition, read from the edition's own registry repository.
+//
+// A write of an images lock carries its composed artifacts' generations forward from the previous seal (resolve-images.mjs
+// resolvePreviousSeal). In CI that is the images.lock layer of the LATEST SIGNED edition already published to the
+// edition repository `<registry root>/<channel segment>/xema-edition-<id>`. `--previous-seal-signer <identity>` finds it:
+//
+// - every snapshot tag (64 hex) is read by tag, deduplicated by digest; each must be an edition artifact with an
+//   `org.opencontainers.image.created` annotation (oras writes it on push; it is inside the signed manifest);
+// - the newest by that annotation is the candidate. A candidate with no cosign signature tag (`sha256-<hex>.sig`) was never
+//   published (a failed sign) and is passed over, named; a candidate WITH a signature must verify against exactly the given
+//   certificate identity and the GitHub OIDC issuer, offline, through the pinned cosign. A failure there is a refusal,
+//   never a step back to an older edition (that would regress or fork the generation);
+// - its images.lock layer is fetched by digest (the bytes hash to the layer digest the signed manifest names).
+//
+// FIRST SEAL is never inferred here. A registry that answers 404 for the repository's tag list may be one that hides a
+// private repository from a credential that cannot read it, and a repository that exists but holds no signed edition may
+// have lost its editions to retention: neither proves that no edition was ever published. Both are refused, naming the
+// operator's explicit `--first-seal` (once, for a distribution that has never had an edition).
+//
+// Concurrency is the caller's: the per-edition concurrency group serializes the runs that push to one repository, so the
+// edition read here is the one the previous run of that group pushed and signed.
+
+import { RefusalError } from './collected-refusals.mjs';
+import { EDITION_ARTIFACT_TYPE, EditionLockFile } from './edition-constants.mjs';
+import { cosignEnvironment, withPinnedCosign } from './pinned-cosign.mjs';
+import { splitImageRef } from './registry-credentials.mjs';
+import { isNotPublishedYet } from './seal-image-digests.mjs';
+import { GITHUB_ACTIONS_OIDC_ISSUER } from './third-party-source-evidence.mjs';
+
+export const PREVIOUS_SEAL_SIGNER_FLAG = '--previous-seal-signer';
+
+const SNAPSHOT_TAG_PATTERN = /^[0-9a-f]{64}$/;
+const SIGNATURE_TAG_PATTERN = /^sha256-([0-9a-f]{64})\.sig$/;
+const CREATED_ANNOTATION = 'org.opencontainers.image.created';
+const TITLE_ANNOTATION = 'org.opencontainers.image.title';
+const RFC3339_UTC_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$/;
+const IDENTITY_PATTERN = /^https:\/\/github\.com\/[^/@\s]+\/[^/@\s]+\/\.github\/workflows\/[^/@\s]+@refs\/[^\s]+$/;
+const MAX_IMAGES_LOCK_BYTES = 64 * 1024 * 1024;
+const MANIFEST_READ_CONCURRENCY = 4;
+const STDERR_TAIL_BYTES = 800;
+
+const tail = (text) => String(text).trim().slice(-STDERR_TAIL_BYTES);
+
+/**
+ * The signer `--previous-seal-signer` names: the EXACT certificate identity of the workflow that signs this repository's
+ * editions (`https://github.com/<owner>/<name>/.github/workflows/<file>@refs/...`) and the GitHub OIDC issuer. Only the
+ * identity is held, not the workflow-repository extension: a reusable workflow called from another repository signs
+ * with its own identity but the CALLER's repository extension.
+ */
+export function previousSealSignerOf(identity) {
+  if (typeof identity !== 'string' || !IDENTITY_PATTERN.test(identity)) {
+    throw new RefusalError(
+      `${PREVIOUS_SEAL_SIGNER_FLAG} must be the exact certificate identity https://github.com/<owner>/<name>/.github/workflows/<file>@refs/<...>; got ${JSON.stringify(identity)}`,
+    );
+  }
+  return { certificateIdentity: identity, oidcIssuer: GITHUB_ACTIONS_OIDC_ISSUER };
+}
+
+async function mapBounded(items, limit, fn) {
+  const results = new Array(items.length);
+  let next = 0;
+  const worker = async () => {
+    while (next < items.length) {
+      const index = next;
+      next += 1;
+      results[index] = await fn(items[index]);
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+  return results;
+}
+
+/**
+ * Find the latest signed edition of `repository` (`<authority>/<path>`) and return its images.lock bytes.
+ * @returns {Promise<{edition: string, created: string, imagesLockSha256: string, bytes: Buffer}>}
+ */
+export async function findPreviousSealOnRegistry({ repository, signer, clientFor, runCosign, cosignEnvFor, trustedRootPath, log = (line) => console.error(line) }) {
+  const { authority, repository: path } = splitImageRef(repository);
+  const client = clientFor(authority);
+  let tags;
+  try {
+    tags = await client.listTags(path);
+  } catch (error) {
+    if (isNotPublishedYet(error)) {
+      throw new RefusalError(
+        `[previous-seal] the registry answered 404 for the tags of ${repository}: either no edition was ever published there or this credential cannot see it, ` +
+          'and a 404 does not tell which. If this distribution has never had an edition, resolve once with --first-seal; otherwise fix the credential.',
+      );
+    }
+    throw new Error(`[previous-seal] the registry did not answer for the tags of ${repository}; refusing to guess the previous seal: ${error.message}`);
+  }
+  const signed = new Set(tags.map((tag) => SIGNATURE_TAG_PATTERN.exec(tag)?.[1]).filter((hex) => hex !== undefined).map((hex) => `sha256:${hex}`));
+  const snapshotTags = tags.filter((tag) => SNAPSHOT_TAG_PATTERN.test(tag)).sort();
+  const read = await mapBounded(snapshotTags, MANIFEST_READ_CONCURRENCY, async (tag) => ({ tag, manifest: await client.getManifestByTag(path, tag) }));
+  const byDigest = new Map();
+  for (const { tag, manifest } of read) {
+    const ref = `${repository}:${tag}`;
+    if (manifest.isIndex || manifest.document?.artifactType !== EDITION_ARTIFACT_TYPE) {
+      throw new RefusalError(`[previous-seal] ${ref} is not an edition artifact (artifactType ${JSON.stringify(manifest.document?.artifactType)}); refusing to choose a previous seal past it`);
+    }
+    const created = manifest.document.annotations?.[CREATED_ANNOTATION];
+    if (typeof created !== 'string' || !RFC3339_UTC_PATTERN.test(created) || Number.isNaN(Date.parse(created))) {
+      throw new RefusalError(`[previous-seal] ${ref} (${manifest.digest}) has no ${CREATED_ANNOTATION} annotation in RFC 3339 UTC; the latest edition cannot be told`);
+    }
+    if (!byDigest.has(manifest.digest)) {byDigest.set(manifest.digest, { digest: manifest.digest, tag, created, time: Date.parse(created), document: manifest.document });}
+  }
+  const editions = [...byDigest.values()].sort((a, b) => b.time - a.time);
+  for (let i = 0; i < editions.length; i += 1) {
+    const edition = editions[i];
+    const ref = `${repository}@${edition.digest}`;
+    if (i + 1 < editions.length && editions[i + 1].time === edition.time) {
+      throw new RefusalError(`[previous-seal] ${ref} and ${repository}@${editions[i + 1].digest} were both created at ${edition.created}; the latest edition cannot be told`);
+    }
+    if (!signed.has(edition.digest)) {
+      log(`[previous-seal] ${ref} (${edition.created}) carries no signature: it was never published; passing over it`);
+      continue;
+    }
+    const result = await runCosign(
+      ['verify', '--offline', '--trusted-root', trustedRootPath, '--certificate-identity', signer.certificateIdentity, '--certificate-oidc-issuer', signer.oidcIssuer, ref],
+      cosignEnvironment(cosignEnvFor, authority),
+    );
+    if (result.code !== 0) {
+      throw new RefusalError(
+        `[previous-seal] the latest edition ${ref} (${edition.created}) carries a signature that does not verify for ${signer.certificateIdentity}; ` +
+          `refusing it and refusing to fall back to an older edition (cosign exit ${result.code}): ${tail(result.stderr)}`,
+      );
+    }
+    const layers = (edition.document.layers ?? []).filter((layer) => layer.annotations?.[TITLE_ANNOTATION] === EditionLockFile.Images);
+    if (layers.length !== 1) {
+      throw new RefusalError(`[previous-seal] ${ref} carries ${layers.length} layers titled ${EditionLockFile.Images}; an edition carries exactly one`);
+    }
+    const [layer] = layers;
+    const bytes = await client.getBlob(path, layer.digest, MAX_IMAGES_LOCK_BYTES);
+    log(`[previous-seal] previous seal: ${ref} (${edition.created}), ${EditionLockFile.Images} ${layer.digest}`);
+    return { edition: ref, created: edition.created, imagesLockSha256: layer.digest.slice('sha256:'.length), bytes };
+  }
+  throw new RefusalError(
+    `[previous-seal] ${repository} exists but holds no signed edition (${editions.length} unsigned); that no edition was ever published cannot be proven. ` +
+      'If none ever was, resolve once with --first-seal.',
+  );
+}
+
+/** `findPreviousSealOnRegistry` under the data root's pinned cosign and declared registry credentials. */
+export async function previousSealFromRegistry({ repository, signerIdentity, cosignBinary, env, pinned = {}, log }) {
+  const signer = previousSealSignerOf(signerIdentity);
+  return withPinnedCosign({ cosignBinary, env, ...pinned }, ({ runCosign, cosignEnvFor, clientFor, trustedRootPath }) =>
+    findPreviousSealOnRegistry({ repository, signer, clientFor, runCosign, cosignEnvFor, trustedRootPath, ...(log === undefined ? {} : { log }) }),
+  );
+}

package/edition/resolve-images.mjs

@@ -73,7 +73,7 @@ import {
 } from './lib.mjs';
 import { assertReleaseContent } from './release-channel-guard.mjs';
 import { composeEdition } from './resolve-distribution.mjs';
-import { readStrictJsonFile } from './strict-json.mjs';
+import { parseStrictJson, readStrictJsonFile } from './strict-json.mjs';
 import { loadThirdPartySourcePins } from './third-party-source-pins.mjs';
 import {
   assertOciBundleSourceOrigin,
@@ -2089,22 +2089,35 @@ export async function resolveImageRows(id, { inputs, lock, onSubjectHashed, reco
 }
 
 export const PREVIOUS_SEAL_USAGE =
-  'exactly one of `--previous-lock <images.lock.json> --previous-lock-sha256 <hex>` (the caller takes the digest from the images.lock ' +
-  'layer of the latest signed, published edition of this distribution, under the per-edition concurrency group) or `--first-seal`';
+  'exactly one of `--previous-seal-signer <certificate identity>` (the CLI reads the images.lock layer of the latest edition ' +
+  'signed by that identity in this edition\'s registry repository; run under the per-edition concurrency group), ' +
+  '`--previous-lock <images.lock.json> --previous-lock-sha256 <hex>` (the same layer, taken by the caller) or `--first-seal` ' +
+  '(only for a distribution that has never had an edition)';
 
 /**
- * The previous seal an images-lock write carries composed artifacts forward from, as an EXPLICIT input: the previous lock
- * with the sha256 of its bytes (taken by the caller from the signed, published edition's images.lock layer), or
- * `--first-seal` (null: generation 1). Neither, both kinds, or half of the pair is refused; the bytes must hash to the given
- * digest, and the lock is parsed with the kernel's `parseImageLock` and must be this edition's own (`distributionId`).
+ * The previous seal an images-lock write carries composed artifacts forward from, as an EXPLICIT input of exactly one kind:
+ * - `registry` (`--previous-seal-signer`): `{ find }`, where `find()` returns the latest signed edition's images.lock bytes
+ *   and their sha256 (previous-seal-registry.mjs);
+ * - the previous lock with the sha256 of its bytes (taken by the caller from the signed, published edition's images.lock
+ *   layer);
+ * - `--first-seal` (null: generation 1).
+ * None, more than one kind, or half of the pair is refused; the bytes must hash to the given digest, and the lock is parsed
+ * with the kernel's `parseImageLock` and must be this edition's own (`distributionId`).
  */
-export async function resolvePreviousSeal({ distributionId, previousLockPath, previousLockSha256, firstSeal = false }) {
+export async function resolvePreviousSeal({ distributionId, previousLockPath, previousLockSha256, firstSeal = false, registry = undefined }) {
   const given = [previousLockPath, previousLockSha256].filter((value) => value !== undefined);
-  if (firstSeal) {
-    if (given.length > 0) {
-      throw new Error(`--first-seal and a previous lock (--previous-lock/--previous-lock-sha256) are both given; give ${PREVIOUS_SEAL_USAGE}`);
+  const kinds = [registry !== undefined, given.length > 0, firstSeal].filter(Boolean).length;
+  if (kinds > 1) {
+    throw new Error(`more than one previous seal is given (--previous-seal-signer, --previous-lock/--previous-lock-sha256, --first-seal); give ${PREVIOUS_SEAL_USAGE}`);
+  }
+  if (firstSeal) {return null;}
+  if (registry !== undefined) {
+    const { bytes, imagesLockSha256, edition } = await registry.find();
+    const actual = createHash('sha256').update(bytes).digest('hex');
+    if (actual !== imagesLockSha256) {
+      throw new Error(`the images lock of ${edition} has sha256 ${actual}, not its layer digest ${imagesLockSha256}`);
     }
-    return null;
+    return parsePreviousLock(distributionId, parseStrictJson(bytes.toString('utf8'), `${edition} images.lock.json`), `the images lock of ${edition}`);
   }
   if (given.length !== 2) {
     throw new Error(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.56.0",
+  "version": "0.57.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-cli.git",
@@ -100,6 +100,7 @@
     "typecheck": "tsc --noEmit"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:80acaaf576705b4a71ecd5e67794fea62c6fc834652a2830bbd03a2d855d2409"
+    "sourceDigest": "sha256:23c811648b74b4daf999382a1d0f6aa4cad8bfaad8b3f150e51326d709a4982b",
+    "sha": "b7d08af5d37faac60b04770fd2b0701811b96459"
   }
 }