@xemahq/xema 0.58.0 → 0.59.1

package/edition/third-party-bundle-registry.mjs

@@ -3,9 +3,12 @@
 // verified by cosign (`third-party-source-evidence.mjs`) before it is committed.
 
 import { execFileSync } from 'node:child_process';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 
 import { certificateConstraintArgs, certificateIdentityArgs } from './cosign-certificate-constraints.mjs';
-import { COSIGN_ENV, decodeExactUtf8, sha256Digest, validatePinnedTrustedRoot } from './image-evidence.mjs';
+import { COSIGN_ENV, classicCosignTrustMaterial, decodeExactUtf8, sha256Digest, validatePinnedTrustedRoot } from './image-evidence.mjs';
 import { splitImageRef } from './registry-credentials.mjs';
 import { BUNDLE_MEDIA_TYPE } from './sigstore-bundle-media-type.mjs';
 import { SLSA_PROVENANCE_V1, decodeJsonStatement, digestOfOciRef } from './third-party-source-evidence.mjs';
@@ -137,7 +140,13 @@ export async function bundleDigestRef({ clientFor, ociRef }) {
 
 const tail = (error) => String(error?.stderr ?? error?.message ?? error).trim().split('\n').slice(-4).join(' | ').slice(0, 1024);
 
-/** The cosign run of a registry verification: the trusted binary, the operator's registry credential (HOME / DOCKER_CONFIG). */
+/**
+ * The cosign run of a registry verification: the trusted binary under a CLEAN environment (`COSIGN_ENV` and the
+ * operator's registry credential, HOME / DOCKER_CONFIG; no `SIGSTORE_*`, `COSIGN_*` or `TUF_*` of the operator is ever
+ * inherited). `run` takes `--offline --trusted-root <pinned>`; `runClassic` instead pins cosign's classic trust inputs
+ * to the keys derived from the same pinned root (`classicCosignTrustMaterial`), in a private directory removed after the
+ * run, with an empty private TUF_ROOT so no live TUF material is ever read.
+ */
 function registryCosign({ trustedCosign, policy, policyRoot, row, ociRef, env }) {
   const root = validatePinnedTrustedRoot(policyRoot, policy);
   const environment = {
@@ -145,18 +154,41 @@ function registryCosign({ trustedCosign, policy, policyRoot, row, ociRef, env })
     ...(env.HOME === undefined ? {} : { HOME: env.HOME }),
     ...(env.DOCKER_CONFIG === undefined ? {} : { DOCKER_CONFIG: env.DOCKER_CONFIG }),
   };
+  const exec = (command, args, runEnv) => {
+    try {
+      return execFileSync(assertPreparedExecutable(trustedCosign, 'cosign'), [command, ...args], {
+        env: runEnv,
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+        timeout: REGISTRY_COSIGN_TIMEOUT_MS,
+      });
+    } catch (error) {
+      throw new Error(`cosign ${command} refused ${ociRef} under row "${row.policyId}": ${tail(error)}`);
+    }
+  };
   return {
     trustArgs: ['--offline', '--trusted-root', root.path],
-    run(command, args) {
+    run: (command, args) => exec(command, args, environment),
+    runClassic(command, args) {
+      const material = classicCosignTrustMaterial(root.bytes);
+      const dir = mkdtempSync(join(tmpdir(), 'xema-cosign-trust-'));
       try {
-        return execFileSync(assertPreparedExecutable(trustedCosign, 'cosign'), [command, ...args], {
-          env: environment,
-          encoding: 'utf8',
-          stdio: ['ignore', 'pipe', 'pipe'],
-          timeout: REGISTRY_COSIGN_TIMEOUT_MS,
+        const file = (name, content) => {
+          const path = join(dir, name);
+          writeFileSync(path, content, { mode: 0o600, flag: 'wx' });
+          return path;
+        };
+        const tufRoot = join(dir, 'tuf');
+        mkdirSync(tufRoot, { mode: 0o700 });
+        return exec(command, ['--offline', ...args], {
+          ...environment,
+          SIGSTORE_ROOT_FILE: file('fulcio.pem', material.fulcioPem),
+          SIGSTORE_REKOR_PUBLIC_KEY: file('rekor.pub', material.rekorPem),
+          SIGSTORE_CT_LOG_PUBLIC_KEY_FILE: file('ctlog.pub', material.ctLogPem),
+          TUF_ROOT: tufRoot,
         });
-      } catch (error) {
-        throw new Error(`cosign ${command} refused ${ociRef} under row "${row.policyId}": ${tail(error)}`);
+      } finally {
+        rmSync(dir, { recursive: true, force: true });
       }
     },
   };
@@ -165,16 +197,21 @@ function registryCosign({ trustedCosign, policy, policyRoot, row, ociRef, env })
 /**
  * (a) against the registry: keyless `cosign verify` and `cosign verify-attestation --type slsaprovenance1` of the bundle
  * artifact under EXACTLY the signer row's identity and issuer, the row's workflow repository, ref and the stated
- * commit, the pinned trusted root and the trusted cosign binary. `--offline` verifies the tlog inclusion proof carried
- * with the signature; the tlog is never ignored. The registry credential is the operator's (HOME / DOCKER_CONFIG).
+ * commit, and the trusted cosign binary, both `--offline`: the tlog entry carried with the signature is verified, the
+ * tlog is never ignored. The registry credential is the operator's (HOME / DOCKER_CONFIG).
+ *
+ * Publishers write the CLASSIC cosign format (`sha256-<d>.sig` / `.att` tags; `cosign sign` / `cosign attest`), not
+ * referrer Sigstore bundles. `verify` takes the pinned trusted root as is (`--trusted-root`, classic or bundle form).
+ * cosign 2.6 `verify-attestation` takes `--trusted-root` only with `--new-bundle-format`, which finds no classic
+ * attestation, so it runs without either, against the Fulcio, Rekor v1 and CT keys derived from the SAME pinned root
+ * and passed in cosign's classic trust variables (`registryCosign().runClassic`). A publisher switching to referrer
+ * bundles is refused loudly (cosign then requires a trusted root), never verified against anything unpinned.
  */
 export function verifyBundleOnRegistry({ trustedCosign, policy, policyRoot, row, workflowSha, ociRef, env = process.env }) {
   const cosign = registryCosign({ trustedCosign, policy, policyRoot, row, ociRef, env });
-  const common = [...cosign.trustArgs, ...certificateConstraintArgs(row, workflowSha)];
-  cosign.run('verify', [...common, ociRef]);
-  // cosign refuses `verify-attestation --trusted-root` without `--new-bundle-format`; plain `verify` takes it as is.
-  const [offline, trustedRoot, rootPath, ...claims] = common;
-  cosign.run('verify-attestation', [offline, '--new-bundle-format', trustedRoot, rootPath, '--type', COSIGN_SLSA_PROVENANCE_ALIAS, ...claims, ociRef]);
+  const claims = certificateConstraintArgs(row, workflowSha);
+  cosign.run('verify', [...cosign.trustArgs, ...claims, ociRef]);
+  cosign.runClassic('verify-attestation', ['--type', COSIGN_SLSA_PROVENANCE_ALIAS, ...claims, ociRef]);
 }
 
 const WORKFLOW_SHA = /^[0-9a-f]{40}$/u;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.58.0",
+  "version": "0.59.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-cli.git",
@@ -100,7 +100,7 @@
     "typecheck": "tsc --noEmit"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:90788d0401718a3e8bfab84c8818ff21bde3b1218931ab71aedd032894bc346a",
-    "sha": "931d0b103540e14e34d6c726a5167640aa7a1c6e"
+    "sourceDigest": "sha256:f02866c7d95e9f1f32bbbf2879720aa6c6a4ff30ea4c7ac306047775483f31bd",
+    "sha": "36535b2452d6413f38a32eafc2544ba463c41f62"
   }
 }