@xemahq/xema 0.57.1 → 0.59.0

package/edition/resolve-images.mjs

@@ -2126,12 +2126,21 @@ export async function resolvePreviousSeal({ distributionId, previousLockPath, pr
         : `--previous-lock and --previous-lock-sha256 go together (one was given); give ${PREVIOUS_SEAL_USAGE}`,
     );
   }
-  const bytes = readFileSync(previousLockPath);
+  const bytes = readPreviousLockBytes(previousLockPath, previousLockSha256);
+  return parsePreviousLock(distributionId, parseStrictJson(bytes.toString('utf8'), previousLockPath), '--previous-lock');
+}
+
+/**
+ * The bytes of a previous lock file, held to the sha256 (hex) they were given with: the one check of the pair
+ * (`flags` names the pair in the refusal). The parse, with the kernel and against the edition's id, is the caller's.
+ */
+export function readPreviousLockBytes(path, sha256, flags = { lock: '--previous-lock', sha256: '--previous-lock-sha256' }) {
+  const bytes = readFileSync(path);
   const actual = createHash('sha256').update(bytes).digest('hex');
-  if (actual !== previousLockSha256) {
-    throw new Error(`--previous-lock ${previousLockPath} has sha256 ${actual}, not the given --previous-lock-sha256 ${previousLockSha256}`);
+  if (actual !== sha256) {
+    throw new Error(`${flags.lock} ${path} has sha256 ${actual}, not the given ${flags.sha256} ${sha256}`);
   }
-  return parsePreviousLock(distributionId, readStrictJsonFile(previousLockPath), '--previous-lock');
+  return bytes;
 }
 
 /** The in-repo lane's previous lock: the committed file at `outPath`, parsed before it is overwritten; null (first seal) when there is none. */

package/edition/third-party-bundle-registry.mjs

@@ -3,9 +3,12 @@
 // verified by cosign (`third-party-source-evidence.mjs`) before it is committed.
 
 import { execFileSync } from 'node:child_process';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 
 import { certificateConstraintArgs, certificateIdentityArgs } from './cosign-certificate-constraints.mjs';
-import { COSIGN_ENV, decodeExactUtf8, sha256Digest, validatePinnedTrustedRoot } from './image-evidence.mjs';
+import { COSIGN_ENV, classicCosignTrustMaterial, decodeExactUtf8, sha256Digest, validatePinnedTrustedRoot } from './image-evidence.mjs';
 import { splitImageRef } from './registry-credentials.mjs';
 import { BUNDLE_MEDIA_TYPE } from './sigstore-bundle-media-type.mjs';
 import { SLSA_PROVENANCE_V1, decodeJsonStatement, digestOfOciRef } from './third-party-source-evidence.mjs';
@@ -137,7 +140,13 @@ export async function bundleDigestRef({ clientFor, ociRef }) {
 
 const tail = (error) => String(error?.stderr ?? error?.message ?? error).trim().split('\n').slice(-4).join(' | ').slice(0, 1024);
 
-/** The cosign run of a registry verification: the trusted binary, the operator's registry credential (HOME / DOCKER_CONFIG). */
+/**
+ * The cosign run of a registry verification: the trusted binary under a CLEAN environment (`COSIGN_ENV` and the
+ * operator's registry credential, HOME / DOCKER_CONFIG; no `SIGSTORE_*`, `COSIGN_*` or `TUF_*` of the operator is ever
+ * inherited). `run` takes `--offline --trusted-root <pinned>`; `runClassic` instead pins cosign's classic trust inputs
+ * to the keys derived from the same pinned root (`classicCosignTrustMaterial`), in a private directory removed after the
+ * run, with an empty private TUF_ROOT so no live TUF material is ever read.
+ */
 function registryCosign({ trustedCosign, policy, policyRoot, row, ociRef, env }) {
   const root = validatePinnedTrustedRoot(policyRoot, policy);
   const environment = {
@@ -145,18 +154,41 @@ function registryCosign({ trustedCosign, policy, policyRoot, row, ociRef, env })
     ...(env.HOME === undefined ? {} : { HOME: env.HOME }),
     ...(env.DOCKER_CONFIG === undefined ? {} : { DOCKER_CONFIG: env.DOCKER_CONFIG }),
   };
+  const exec = (command, args, runEnv) => {
+    try {
+      return execFileSync(assertPreparedExecutable(trustedCosign, 'cosign'), [command, ...args], {
+        env: runEnv,
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+        timeout: REGISTRY_COSIGN_TIMEOUT_MS,
+      });
+    } catch (error) {
+      throw new Error(`cosign ${command} refused ${ociRef} under row "${row.policyId}": ${tail(error)}`);
+    }
+  };
   return {
     trustArgs: ['--offline', '--trusted-root', root.path],
-    run(command, args) {
+    run: (command, args) => exec(command, args, environment),
+    runClassic(command, args) {
+      const material = classicCosignTrustMaterial(root.bytes);
+      const dir = mkdtempSync(join(tmpdir(), 'xema-cosign-trust-'));
       try {
-        return execFileSync(assertPreparedExecutable(trustedCosign, 'cosign'), [command, ...args], {
-          env: environment,
-          encoding: 'utf8',
-          stdio: ['ignore', 'pipe', 'pipe'],
-          timeout: REGISTRY_COSIGN_TIMEOUT_MS,
+        const file = (name, content) => {
+          const path = join(dir, name);
+          writeFileSync(path, content, { mode: 0o600, flag: 'wx' });
+          return path;
+        };
+        const tufRoot = join(dir, 'tuf');
+        mkdirSync(tufRoot, { mode: 0o700 });
+        return exec(command, ['--offline', ...args], {
+          ...environment,
+          SIGSTORE_ROOT_FILE: file('fulcio.pem', material.fulcioPem),
+          SIGSTORE_REKOR_PUBLIC_KEY: file('rekor.pub', material.rekorPem),
+          SIGSTORE_CT_LOG_PUBLIC_KEY_FILE: file('ctlog.pub', material.ctLogPem),
+          TUF_ROOT: tufRoot,
         });
-      } catch (error) {
-        throw new Error(`cosign ${command} refused ${ociRef} under row "${row.policyId}": ${tail(error)}`);
+      } finally {
+        rmSync(dir, { recursive: true, force: true });
       }
     },
   };
@@ -165,14 +197,21 @@ function registryCosign({ trustedCosign, policy, policyRoot, row, ociRef, env })
 /**
  * (a) against the registry: keyless `cosign verify` and `cosign verify-attestation --type slsaprovenance1` of the bundle
  * artifact under EXACTLY the signer row's identity and issuer, the row's workflow repository, ref and the stated
- * commit, the pinned trusted root and the trusted cosign binary. `--offline` verifies the tlog inclusion proof carried
- * with the signature; the tlog is never ignored. The registry credential is the operator's (HOME / DOCKER_CONFIG).
+ * commit, and the trusted cosign binary, both `--offline`: the tlog entry carried with the signature is verified, the
+ * tlog is never ignored. The registry credential is the operator's (HOME / DOCKER_CONFIG).
+ *
+ * Publishers write the CLASSIC cosign format (`sha256-<d>.sig` / `.att` tags; `cosign sign` / `cosign attest`), not
+ * referrer Sigstore bundles. `verify` takes the pinned trusted root as is (`--trusted-root`, classic or bundle form).
+ * cosign 2.6 `verify-attestation` takes `--trusted-root` only with `--new-bundle-format`, which finds no classic
+ * attestation, so it runs without either, against the Fulcio, Rekor v1 and CT keys derived from the SAME pinned root
+ * and passed in cosign's classic trust variables (`registryCosign().runClassic`). A publisher switching to referrer
+ * bundles is refused loudly (cosign then requires a trusted root), never verified against anything unpinned.
  */
 export function verifyBundleOnRegistry({ trustedCosign, policy, policyRoot, row, workflowSha, ociRef, env = process.env }) {
   const cosign = registryCosign({ trustedCosign, policy, policyRoot, row, ociRef, env });
-  const common = [...cosign.trustArgs, ...certificateConstraintArgs(row, workflowSha)];
-  cosign.run('verify', [...common, ociRef]);
-  cosign.run('verify-attestation', ['--type', COSIGN_SLSA_PROVENANCE_ALIAS, ...common, ociRef]);
+  const claims = certificateConstraintArgs(row, workflowSha);
+  cosign.run('verify', [...cosign.trustArgs, ...claims, ociRef]);
+  cosign.runClassic('verify-attestation', ['--type', COSIGN_SLSA_PROVENANCE_ALIAS, ...claims, ociRef]);
 }
 
 const WORKFLOW_SHA = /^[0-9a-f]{40}$/u;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.57.1",
+  "version": "0.59.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-cli.git",
@@ -100,7 +100,7 @@
     "typecheck": "tsc --noEmit"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:d587d9025bbf46bc076d6d88075347bd45fa0ca644c804a32a463157091f5bfa",
-    "sha": "286425dc5a0bf4ee9b7a3b3c0b53271f3ec661ed"
+    "sourceDigest": "sha256:bdd50b327d2da70bdc17c4cdcfce8ed38500fbd68aea8f23029c53d45ddbcb86",
+    "sha": "9e648fd62243cb0fc9df74680ce6c2a110a901ad"
   }
 }