@xemahq/xema 0.59.0 → 0.60.1

package/edition/source-closure.mjs

@@ -1,115 +0,0 @@
-#!/usr/bin/env node
-// `xema edition source-closure`: the source tree hash of one directory of a
-// source repository at an exact commit, with its workspace-package closure.
-//
-// usage: xema edition source-closure --repo <repo> --path <dir> --commit <40 hex> --sources-root <dir> --kernel <dir>
-//
-// These are the facts a content coordinate is derived from. A consumer frames
-// them into its own coordinate; it never reads a git tree, a workspace graph
-// or a lockfile itself. `--path` is relative to the repository (`.` for its
-// root). The hashes are the ones the image content hash is built from, so a
-// coordinate derived from them moves exactly when the built bytes can move.
-
-import { join } from 'node:path';
-
-import { parseEvidenceCliFlags } from './distribution-evidence-set.mjs';
-import {
-  WorkspaceRoot,
-  configureEditionWorkspaceFromArgv,
-  isEntryModule,
-  sourcesRoot,
-} from './edition-workspace.mjs';
-import { COMMIT_PATTERN } from './evidence-grammars.mjs';
-import {
-  compareStrings,
-  gitCommitTreeIndex,
-  hashGitSourceTree,
-  serializeJson,
-  workspaceClosure,
-  workspacePackagesAtCommit,
-} from './lib.mjs';
-
-/** The tree hash algorithm of every hash this verb prints. */
-export const SOURCE_CLOSURE_TREE_ALGORITHM = 'xema-source-tree-sha256-v2';
-const LOCKFILE_PATH = 'pnpm-lock.yaml';
-
-function assertContainedDirectory(directory) {
-  if (
-    typeof directory !== 'string' ||
-    directory.length === 0 ||
-    directory.startsWith('/') ||
-    (directory !== '.' && directory.split('/').some((part) => part === '' || part === '.' || part === '..'))
-  ) {
-    throw new Error(`--path "${String(directory)}" is not a directory inside the repository`);
-  }
-  return directory;
-}
-
-/**
- * The closure of `directory` in `repoDir` at `commit`. `lockfileBlobId` is the
- * repository lockfile's blob when the directory is buildable (it has a
- * `package.json`), and `null` when it is not; a buildable directory in a
- * repository with no lockfile is refused, because its build would resolve
- * dependencies unpinned.
- */
-export function readSourceClosure({ repoDir, repo, directory, commit }) {
-  if (!COMMIT_PATTERN.test(commit ?? '')) {
-    throw new Error(`--commit must be an exact 40-hex commit (got ${JSON.stringify(commit ?? null)})`);
-  }
-  assertContainedDirectory(directory);
-  const tree = gitCommitTreeIndex(repoDir, commit);
-  const graph = workspacePackagesAtCommit(repoDir, commit, tree);
-  const buildable = tree.isFile(directory === '.' ? 'package.json' : `${directory}/package.json`);
-  const lockfileBlobId = buildable ? tree.blobId(LOCKFILE_PATH) : undefined;
-  if (buildable && lockfileBlobId === undefined) {
-    throw new Error(
-      `${repo}:${directory} has a package.json but ${repo} has no ${LOCKFILE_PATH} at ${commit.slice(0, 12)}`,
-    );
-  }
-  return {
-    schemaVersion: 1,
-    repo,
-    directory,
-    commit,
-    treeAlgorithm: SOURCE_CLOSURE_TREE_ALGORITHM,
-    treeHash: hashGitSourceTree(repoDir, directory, commit, SOURCE_CLOSURE_TREE_ALGORITHM),
-    buildable,
-    lockfileBlobId: lockfileBlobId ?? null,
-    closure: [...workspaceClosure(directory, graph, commit)].sort(compareStrings).map((member) => ({
-      directory: member,
-      treeHash: hashGitSourceTree(repoDir, member, commit, SOURCE_CLOSURE_TREE_ALGORITHM),
-    })),
-  };
-}
-
-function main() {
-  const rest = configureEditionWorkspaceFromArgv(process.argv.slice(2), [
-    WorkspaceRoot.Sources,
-    // The hash implementation is held to the kernel it was built for.
-    WorkspaceRoot.Kernel,
-  ]);
-  const flags = parseEvidenceCliFlags(rest, { single: ['repo', 'path', 'commit'] });
-  const repo = flags.require('repo');
-  if (repo.startsWith('/') || repo.split('/').some((part) => part === '' || part === '.' || part === '..')) {
-    throw new Error(`--repo "${repo}" is not a repository under the sources root`);
-  }
-  process.stdout.write(
-    serializeJson(
-      readSourceClosure({
-        repoDir: join(sourcesRoot(), repo),
-        repo,
-        directory: flags.require('path'),
-        commit: flags.require('commit'),
-      }),
-    ),
-  );
-}
-
-if (isEntryModule(import.meta.url)) {
-  try {
-    main();
-  } catch (error) {
-    console.error(`[source-closure] ${error.message}`);
-    process.exitCode = 1;
-  }
-}

package/edition/store-publisher-trust.mjs

@@ -1,40 +0,0 @@
-// The Store publishers a vendor edition's data root trusts: read from
-// `store-publisher-identities.json` and written to the lock as
-// `storePublisherTrust`. The kernel lock schema is the ONE validator (non-empty,
-// sorted by anchorKey, unique, https issuer, no refs/pull/); it runs at the
-// resolver's `parseUnsealedDistributionLock` step, so nothing here re-checks it.
-
-import { existsSync } from 'node:fs';
-
-import { storePublisherIdentitiesPath } from './edition-workspace.mjs';
-import { readStrictJsonFile } from './strict-json.mjs';
-
-/** The data root's trusted Store publishers, or `undefined` when it holds no such file. */
-export function readStorePublisherTrust() {
-  const path = storePublisherIdentitiesPath();
-  if (!existsSync(path)) {return undefined;}
-  const document = readStrictJsonFile(path);
-  if (document === null || typeof document !== 'object' || Array.isArray(document)) {
-    throw new Error(`${path}: must be a JSON object`);
-  }
-  const unknown = Object.keys(document).filter((key) => key !== 'schemaVersion' && key !== 'publishers');
-  if (unknown.length > 0) {
-    throw new Error(`${path}: unknown top-level key ${unknown.map((key) => JSON.stringify(key)).join(', ')}`);
-  }
-  if (document.schemaVersion === 1) {
-    throw new Error(
-      `${path}: schemaVersion 1 states no signer; move the file to schemaVersion 2 (\`oidcIssuer\` and \`identity\` per anchor)`,
-    );
-  }
-  if (document.schemaVersion !== 2) {
-    throw new Error(`${path}: schemaVersion must be 2, got ${JSON.stringify(document.schemaVersion)}`);
-  }
-  const { publishers } = document;
-  if (!Array.isArray(publishers) || publishers.some((row) => row === null || typeof row !== 'object' || Array.isArray(row))) {
-    throw new Error(`${path}: publishers must be an array of objects`);
-  }
-  // Only `sourceRepositories` (vendor-ops' key) is dropped; every other key reaches the kernel's
-  // strict schema unchanged, so a stray or misspelt key is refused there, never dropped here.
-  return publishers.map(({ sourceRepositories: _vendorOps, ...row }) => row);
-}
-

package/edition/strict-json.mjs

@@ -1,121 +0,0 @@
-/**
- * The ONE strict JSON reader for authored inputs of the distribution plane.
- *
- * `JSON.parse` resolves a duplicated object key by silently keeping the LAST
- * occurrence. For an authored manifest that is a declaration being deleted
- * with no signal: `xema-biome.json` once carried two `resources` keys inside
- * one component, every reader dropped the first, the sealed lock never
- * admitted the Redis namespace it declared, and the service crashlooped in a
- * deployment on `redis-namespace-not-declared`. Nothing between the author and
- * the cluster could say so, because every reader agreed on the wrong answer.
- *
- * So a duplicate key is REFUSED here, naming the file, the JSON pointer of the
- * object and the key. There is deliberately no lenient mode and no "last wins"
- * option: two values for one key is an authoring error with no correct reading.
- *
- * Node builtins only, so it runs from a bare checkout. The sibling
- * implementation for the biome authoring toolchain is `strict-json.ts` in
- * `@xemahq/biome-sdk` (xema-biome-sdk, `packages/sdks/biome-sdk/src/builder/lib/`);
- * the two repositories share no package this could live in without a publish,
- * so each holds one copy. Change both together.
- */
-import { readFileSync } from 'node:fs';
-
-/** A JSON object declared the same key more than once. */
-export class DuplicateJsonKeyError extends Error {
-  /**
-   * @param {string} source  file path (or other handle) of the document
-   * @param {string} pointer RFC 6901 pointer of the OBJECT holding the key ("" = root)
-   * @param {string} key     the duplicated key, after escape decoding
-   */
-  constructor(source, pointer, key) {
-    super(
-      `${source}: duplicate key ${JSON.stringify(key)} in the object at JSON pointer ` +
-        `${JSON.stringify(pointer)}${pointer === '' ? ' (the document root)' : ''}. ` +
-        `JSON.parse would silently keep the last occurrence and drop the other; ` +
-        `merge the two declarations into one key.`,
-    );
-    this.name = 'DuplicateJsonKeyError';
-    this.code = 'DUPLICATE_JSON_KEY';
-    this.source = source;
-    this.pointer = pointer;
-    this.key = key;
-  }
-}
-
-function pointerSegment(segment) {
-  return String(segment).replaceAll('~', '~0').replaceAll('/', '~1');
-}
-
-/**
- * Scan a document `JSON.parse` has ALREADY accepted for duplicated keys.
- *
- * Because the grammar is known to be valid, the scan only has to tell a string
- * from structure: a `{`, `[`, `,` or `"` inside a string is never structural,
- * and a string is left only at an unescaped `"`. Keys are compared after
- * escape decoding (`"a"` and `"a"` are the same key to every reader).
- */
-function assertNoDuplicateKeys(text, source) {
-  /** @type {Array<{object: boolean, pointer: string, keys: Set<string>, expectKey: boolean, key: string, index: number}>} */
-  const stack = [];
-  const childPointer = () => {
-    const top = stack.at(-1);
-    if (!top) {return '';}
-    return `${top.pointer}/${pointerSegment(top.object ? top.key : top.index)}`;
-  };
-  for (let i = 0; i < text.length; i += 1) {
-    const char = text[i];
-    if (char === '"') {
-      const start = i;
-      i += 1;
-      while (text[i] !== '"') {i += text[i] === '\\' ? 2 : 1;}
-      const top = stack.at(-1);
-      if (top?.object && top.expectKey) {
-        const key = JSON.parse(text.slice(start, i + 1));
-        if (top.keys.has(key)) {
-          throw new DuplicateJsonKeyError(source, top.pointer, key);
-        }
-        top.keys.add(key);
-        top.key = key;
-        top.expectKey = false;
-      }
-    } else if (char === '{' || char === '[') {
-      stack.push({
-        object: char === '{',
-        pointer: childPointer(),
-        keys: new Set(),
-        expectKey: char === '{',
-        key: '',
-        index: 0,
-      });
-    } else if (char === '}' || char === ']') {
-      stack.pop();
-    } else if (char === ',') {
-      const top = stack.at(-1);
-      if (top.object) {top.expectKey = true;}
-      else {top.index += 1;}
-    }
-  }
-}
-
-/**
- * Parse JSON text, refusing a duplicated object key anywhere in the document.
- * `source` names the document in every error.
- */
-export function parseStrictJson(text, source) {
-  let value;
-  try {
-    value = JSON.parse(text);
-  } catch (error) {
-    throw new Error(`${source}: invalid JSON: ${error.message}`, {
-      cause: error,
-    });
-  }
-  assertNoDuplicateKeys(text, source);
-  return value;
-}
-
-/** Read and strictly parse a JSON file from the working tree. */
-export function readStrictJsonFile(path) {
-  return parseStrictJson(readFileSync(path, 'utf8'), path);
-}

package/edition/string-order.mjs

@@ -1,5 +0,0 @@
-/** Stable, locale-independent string comparator (code-point order). */
-export function compareStrings(a, b) {
-  if (a === b) {return 0;}
-  return a < b ? -1 : 1;
-}

package/edition/third-party-admission.mjs

@@ -1,91 +0,0 @@
-// Admission of third-party image subjects (XEMA-1611 design section 4), beside `externalSourceRepositoryPins` and
-// `verifyDistributionImageEvidenceSet` of `image-evidence.mjs`. Pure over data: the pins come from the data root's
-// `third-party-source-pins.json` (held to the evidence trust pin by the entry), the statement and bundle from a
-// descriptor `verifySigstoreEvidenceDescriptor` has just verified.
-
-import { assertCertificateExtensions } from './third-party-certificate-extensions.mjs';
-
-/** The declared source kind that names a third-party pin. */
-const OCI_SOURCE_KIND = 'oci';
-const FIRST_PARTY_LAYOUT_PREFIX = /^(?:repos|submodules)\//u;
-
-const repositoryPathOf = (repositoryUrl) => new URL(repositoryUrl).pathname.replace(/^\//u, '').replace(/\.git$/u, '');
-
-/**
- * The repository pins of the edition's declared OCI sources, derived from their third-party source pins:
- * `repo` (the pinned `owner/name`), `repositoryUrl` and `sourceCommit`. Every declared OCI source must be pinned (a
- * missing or empty pin file refuses, with the loader's reason), and the pin must not collide with an index pin or a git
- * source, nor sit under the first-party layout (`repos/`, `submodules/`). A declared source that ships no image yields no
- * pin; every subject of a source must agree on the pinned commit.
- *
- * @returns {Map<string, {repo: string, repositoryUrl: string, sourceCommit: string}>}
- */
-export function thirdPartySourceRepositoryPins({ distribution, imageLock, repositoryPins, thirdPartyPins }) {
-  const sources = distribution.sources ?? [];
-  const derived = new Map();
-  for (const source of sources) {
-    if (source.kind !== OCI_SOURCE_KIND) {continue;}
-    const pin = thirdPartyPins.byName(source.name);
-    if (pin === undefined) {
-      throw new Error(
-        `edition source "${source.name}" is kind "${OCI_SOURCE_KIND}", but ${thirdPartyPins.reason ?? `the data root's third-party source pins hold no pin named "${source.name}"`}`,
-      );
-    }
-    if (FIRST_PARTY_LAYOUT_PREFIX.test(pin.repository)) {
-      throw new Error(`third-party source "${pin.name}" pins repository "${pin.repository}", which is under the first-party layout (repos/ or submodules/)`);
-    }
-    if (repositoryPins.has(pin.repository)) {
-      throw new Error(`third-party source "${pin.name}" repository "${pin.repository}" shadows a repository pin the runtime image source index already commits`);
-    }
-    const shadowed = sources.find((candidate) => candidate.kind === 'git' && (candidate.name === pin.repository || candidate.name === pin.name));
-    if (shadowed !== undefined) {
-      throw new Error(`third-party source "${pin.name}" (${pin.repository}) collides with the git source "${shadowed.name}" of the same edition`);
-    }
-    const subjects = imageLock.subjects.filter((subject) => subject.repo === pin.repository);
-    if (subjects.length === 0) {continue;}
-    const wrong = subjects.filter((subject) => subject.sourceCommit !== pin.sourceCommit);
-    if (wrong.length > 0) {
-      throw new Error(
-        `third-party source "${pin.name}" is pinned at ${pin.sourceCommit}, but images.lock.json builds ${wrong.map((subject) => `${subject.kind}:${subject.id}`).join(', ')} at ${[...new Set(wrong.map((subject) => subject.sourceCommit))].join(', ')}`,
-      );
-    }
-    derived.set(pin.repository, { repo: pin.repository, repositoryUrl: pin.repositoryUrl, sourceCommit: pin.sourceCommit });
-  }
-  return derived;
-}
-
-/** The pins behind `thirdPartySourceRepositoryPins`, by repository. */
-export const thirdPartySourcesByRepository = (derived, thirdPartyPins) =>
-  new Map([...derived.keys()].map((repo) => [repo, thirdPartyPins.byRepository(repo)]));
-
-/**
- * What a third-party subject must satisfy beyond a first-party one, after its evidence has verified:
- *  * [d9-1] the signing row's workflow repository, the subject's `repo` and the path of the predicate's
- *    `source.repositoryUrl` are one repository;
- *  * the subject is the pinned image (reference, content hash, sealed digest when sealed);
- *  * (d) the leaf certificate states the pinned repository id, owner id and a GitHub-hosted runner.
- */
-export function assertThirdPartySubjectAdmission({ subject, source, statement, identityPolicy, bundle }) {
-  const label = `third-party subject "${subject.kind}:${subject.id}" (source "${source.name}")`;
-  const claimedRepository = repositoryPathOf(statement.predicate.source.repositoryUrl);
-  const signerRepository = identityPolicy.githubWorkflow.repository;
-  if (signerRepository !== subject.repo || claimedRepository !== subject.repo) {
-    throw new Error(
-      `${label}: the signing row's workflow repository (${signerRepository}), the subject repo (${subject.repo}) and the predicate source.repositoryUrl repository (${claimedRepository}) must be one repository`,
-    );
-  }
-  const image = source.images.find((candidate) => candidate.subjectKind === subject.kind && candidate.subjectId === subject.id);
-  if (image === undefined) {
-    throw new Error(`${label}: the pin pins no image for it`);
-  }
-  if (subject.imageRef !== image.imageRef) {
-    throw new Error(`${label}: images.lock.json names ${subject.imageRef}, but the pin pins ${image.imageRef}`);
-  }
-  if (subject.contentHash !== image.sourceTreeHash) {
-    throw new Error(`${label}: images.lock.json has contentHash ${subject.contentHash}, but the pin records sourceTreeHash ${image.sourceTreeHash}`);
-  }
-  if (subject.imageDigest !== undefined && subject.imageDigest !== image.manifestDigest) {
-    throw new Error(`${label}: images.lock.json seals ${subject.imageDigest}, but the pin records manifestDigest ${image.manifestDigest}`);
-  }
-  assertCertificateExtensions({ bundle, source, label });
-}

package/edition/third-party-bundle-registry.mjs

@@ -1,242 +0,0 @@
-// The registry side of the third-party writer (XEMA-1611 design section 3 (a)): the biome bundle, by digest, and the
-// sigstore bundle of its SLSA provenance, read as an OCI referrer. Nothing here is trusted: every byte it returns is
-// verified by cosign (`third-party-source-evidence.mjs`) before it is committed.
-
-import { execFileSync } from 'node:child_process';
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import { certificateConstraintArgs, certificateIdentityArgs } from './cosign-certificate-constraints.mjs';
-import { COSIGN_ENV, classicCosignTrustMaterial, decodeExactUtf8, sha256Digest, validatePinnedTrustedRoot } from './image-evidence.mjs';
-import { splitImageRef } from './registry-credentials.mjs';
-import { BUNDLE_MEDIA_TYPE } from './sigstore-bundle-media-type.mjs';
-import { SLSA_PROVENANCE_V1, decodeJsonStatement, digestOfOciRef } from './third-party-source-evidence.mjs';
-import { assertPreparedExecutable } from './trusted-executable.mjs';
-
-const BIOME_MANIFEST_FILE = 'xema-biome.json';
-const BIOME_GENERATED_INDEX_FILE = 'xema-biome.index.json';
-const OCI_TITLE_ANNOTATION = 'org.opencontainers.image.title';
-const MAX_BIOME_MANIFEST_BYTES = 4 * 1024 * 1024;
-const MAX_BUNDLE_BYTES = 16 * 1024 * 1024;
-const REGISTRY_COSIGN_TIMEOUT_MS = 120_000;
-/** What `cosign verify-attestation --type` calls the SLSA v1 provenance predicate. */
-const COSIGN_SLSA_PROVENANCE_ALIAS = 'slsaprovenance1';
-
-const repositoryOf = (ociRef) => splitImageRef(ociRef.slice(0, ociRef.indexOf('@')));
-
-/**
- * The biome bundle manifest JSON (`xema-biome.json`) of an OCI artifact, fetched by digest.
- *
- * @returns {Promise<{manifest: object, bytes: Buffer}>}
- */
-export async function fetchBundleManifest({ clientFor, ociRef }) {
-  const bytes = await fetchTitledLayer({ clientFor, ociRef, title: BIOME_MANIFEST_FILE });
-  return { manifest: decodeJsonStatement(bytes, `${ociRef} ${BIOME_MANIFEST_FILE}`), bytes };
-}
-
-/**
- * The committed generated index (`xema-biome.index.json`) of an OCI biome bundle, fetched by digest: the authority for
- * the biomes the bundle requires, read from the same bundle bytes as its manifest, so it cannot describe another revision.
- */
-export async function fetchBundleGeneratedIndex({ clientFor, ociRef }) {
-  const bytes = await fetchTitledLayer({ clientFor, ociRef, title: BIOME_GENERATED_INDEX_FILE });
-  return decodeJsonStatement(bytes, `${ociRef} ${BIOME_GENERATED_INDEX_FILE}`);
-}
-
-/** The one layer of the bundle manifest at `ociRef` (by digest) annotated with `title`. */
-async function fetchTitledLayer({ clientFor, ociRef, title }) {
-  const { authority, repository } = repositoryOf(ociRef);
-  const client = clientFor(authority);
-  const { document } = await client.getManifestByDigest(repository, digestOfOciRef(ociRef));
-  const layers = (document.layers ?? []).filter((layer) => layer.annotations?.[OCI_TITLE_ANNOTATION] === title);
-  if (layers.length !== 1) {
-    throw new Error(`${ociRef} has ${layers.length} layers titled ${title}; a biome bundle has exactly one`);
-  }
-  const bytes = await client.getBlob(repository, layers[0].digest, MAX_BIOME_MANIFEST_BYTES);
-  if (sha256Digest(bytes) !== layers[0].digest) {
-    throw new Error(`${ociRef} layer titled ${title} does not match its descriptor`);
-  }
-  return bytes;
-}
-
-/**
- * The image names a biome manifest ships: its service and worker components with an `oci-image` artifact, named the way
- * the index builder names them (a service by `protocol.serviceName`, a worker by its component `key`).
- */
-export function bundleImageNames(manifest) {
-  const components = Array.isArray(manifest?.xema?.components) ? manifest.xema.components : [];
-  return new Set(
-    components
-      .filter((component) => (component?.kind === 'service' || component?.kind === 'worker') && component.artifact?.kind === 'oci-image')
-      .map((component) => (component.kind === 'service' ? component.protocol?.serviceName : component.key)),
-  );
-}
-
-function provenanceOf(bundleBytes, bundleDigest) {
-  const bundle = JSON.parse(decodeExactUtf8(bundleBytes, 'sigstore bundle'));
-  if (bundle?.dsseEnvelope === undefined) {
-    return null; // a message-signature bundle (the artifact signature): not an attestation
-  }
-  const payload = Buffer.from(bundle.dsseEnvelope.payload, 'base64');
-  const statement = decodeJsonStatement(payload, 'DSSE payload');
-  if (statement.predicateType !== SLSA_PROVENANCE_V1) {
-    return null;
-  }
-  if (`sha256:${statement.subject?.[0]?.digest?.sha256}` !== bundleDigest) {
-    throw new Error(`a SLSA provenance referrer attests ${statement.subject?.[0]?.digest?.sha256}, not ${bundleDigest}`);
-  }
-  return { statementBytes: payload, bundleBytes };
-}
-
-/**
- * The SLSA provenance attestation of the bundle: the one sigstore-bundle referrer of `ociRef` whose DSSE statement is a
- * `https://slsa.dev/provenance/v1` attestation over exactly this digest. None, or more than one, is refused.
- *
- * @returns {Promise<{statementBytes: Buffer, bundleBytes: Buffer}>}
- */
-export async function fetchBundleProvenance({ clientFor, ociRef }) {
-  const { authority, repository } = repositoryOf(ociRef);
-  const client = clientFor(authority);
-  const subjectDigest = digestOfOciRef(ociRef);
-  const referrers = await client.listReferrers(repository, subjectDigest, BUNDLE_MEDIA_TYPE);
-  const found = [];
-  for (const referrer of referrers) {
-    const { document } = await client.getManifestByDigest(repository, referrer.digest);
-    for (const layer of document.layers ?? []) {
-      if (layer.mediaType !== BUNDLE_MEDIA_TYPE) {continue;}
-      const bytes = await client.getBlob(repository, layer.digest, MAX_BUNDLE_BYTES);
-      if (sha256Digest(bytes) !== layer.digest) {
-        throw new Error(`${ociRef} referrer ${referrer.digest} layer does not match its descriptor`);
-      }
-      const provenance = provenanceOf(bytes, subjectDigest);
-      if (provenance !== null) {found.push(provenance);}
-    }
-  }
-  if (found.length === 0) {
-    throw new Error(`${ociRef} has no SLSA provenance attestation (${SLSA_PROVENANCE_V1}) among its ${referrers.length} sigstore-bundle referrers; the bundle must be published with provenance`);
-  }
-  if (found.length > 1) {
-    throw new Error(`${ociRef} has ${found.length} SLSA provenance attestations; exactly one is required, so the evidence is unambiguous`);
-  }
-  return found[0];
-}
-
-/**
- * The `<repository>@sha256:<hex>` a bundle reference names: a digest reference as it is, a tag reference resolved at
- * the registry (the manifest the tag serves, its bytes verified against the digest the registry described).
- */
-export async function bundleDigestRef({ clientFor, ociRef }) {
-  if (ociRef.includes('@')) {return ociRef;}
-  const colon = ociRef.lastIndexOf(':');
-  if (colon <= ociRef.lastIndexOf('/')) {
-    throw new Error(`bundle reference ${JSON.stringify(ociRef)} names neither a tag nor a digest`);
-  }
-  const name = ociRef.slice(0, colon);
-  const { authority, repository } = splitImageRef(name);
-  const { digest } = await clientFor(authority).getManifestByTag(repository, ociRef.slice(colon + 1));
-  return `${name}@${digest}`;
-}
-
-const tail = (error) => String(error?.stderr ?? error?.message ?? error).trim().split('\n').slice(-4).join(' | ').slice(0, 1024);
-
-/**
- * The cosign run of a registry verification: the trusted binary under a CLEAN environment (`COSIGN_ENV` and the
- * operator's registry credential, HOME / DOCKER_CONFIG; no `SIGSTORE_*`, `COSIGN_*` or `TUF_*` of the operator is ever
- * inherited). `run` takes `--offline --trusted-root <pinned>`; `runClassic` instead pins cosign's classic trust inputs
- * to the keys derived from the same pinned root (`classicCosignTrustMaterial`), in a private directory removed after the
- * run, with an empty private TUF_ROOT so no live TUF material is ever read.
- */
-function registryCosign({ trustedCosign, policy, policyRoot, row, ociRef, env }) {
-  const root = validatePinnedTrustedRoot(policyRoot, policy);
-  const environment = {
-    ...COSIGN_ENV,
-    ...(env.HOME === undefined ? {} : { HOME: env.HOME }),
-    ...(env.DOCKER_CONFIG === undefined ? {} : { DOCKER_CONFIG: env.DOCKER_CONFIG }),
-  };
-  const exec = (command, args, runEnv) => {
-    try {
-      return execFileSync(assertPreparedExecutable(trustedCosign, 'cosign'), [command, ...args], {
-        env: runEnv,
-        encoding: 'utf8',
-        stdio: ['ignore', 'pipe', 'pipe'],
-        timeout: REGISTRY_COSIGN_TIMEOUT_MS,
-      });
-    } catch (error) {
-      throw new Error(`cosign ${command} refused ${ociRef} under row "${row.policyId}": ${tail(error)}`);
-    }
-  };
-  return {
-    trustArgs: ['--offline', '--trusted-root', root.path],
-    run: (command, args) => exec(command, args, environment),
-    runClassic(command, args) {
-      const material = classicCosignTrustMaterial(root.bytes);
-      const dir = mkdtempSync(join(tmpdir(), 'xema-cosign-trust-'));
-      try {
-        const file = (name, content) => {
-          const path = join(dir, name);
-          writeFileSync(path, content, { mode: 0o600, flag: 'wx' });
-          return path;
-        };
-        const tufRoot = join(dir, 'tuf');
-        mkdirSync(tufRoot, { mode: 0o700 });
-        return exec(command, ['--offline', ...args], {
-          ...environment,
-          SIGSTORE_ROOT_FILE: file('fulcio.pem', material.fulcioPem),
-          SIGSTORE_REKOR_PUBLIC_KEY: file('rekor.pub', material.rekorPem),
-          SIGSTORE_CT_LOG_PUBLIC_KEY_FILE: file('ctlog.pub', material.ctLogPem),
-          TUF_ROOT: tufRoot,
-        });
-      } finally {
-        rmSync(dir, { recursive: true, force: true });
-      }
-    },
-  };
-}
-
-/**
- * (a) against the registry: keyless `cosign verify` and `cosign verify-attestation --type slsaprovenance1` of the bundle
- * artifact under EXACTLY the signer row's identity and issuer, the row's workflow repository, ref and the stated
- * commit, and the trusted cosign binary, both `--offline`: the tlog entry carried with the signature is verified, the
- * tlog is never ignored. The registry credential is the operator's (HOME / DOCKER_CONFIG).
- *
- * Publishers write the CLASSIC cosign format (`sha256-<d>.sig` / `.att` tags; `cosign sign` / `cosign attest`), not
- * referrer Sigstore bundles. `verify` takes the pinned trusted root as is (`--trusted-root`, classic or bundle form).
- * cosign 2.6 `verify-attestation` takes `--trusted-root` only with `--new-bundle-format`, which finds no classic
- * attestation, so it runs without either, against the Fulcio, Rekor v1 and CT keys derived from the SAME pinned root
- * and passed in cosign's classic trust variables (`registryCosign().runClassic`). A publisher switching to referrer
- * bundles is refused loudly (cosign then requires a trusted root), never verified against anything unpinned.
- */
-export function verifyBundleOnRegistry({ trustedCosign, policy, policyRoot, row, workflowSha, ociRef, env = process.env }) {
-  const cosign = registryCosign({ trustedCosign, policy, policyRoot, row, ociRef, env });
-  const claims = certificateConstraintArgs(row, workflowSha);
-  cosign.run('verify', [...cosign.trustArgs, ...claims, ociRef]);
-  cosign.runClassic('verify-attestation', ['--type', COSIGN_SLSA_PROVENANCE_ALIAS, ...claims, ociRef]);
-}
-
-const WORKFLOW_SHA = /^[0-9a-f]{40}$/u;
-
-/**
- * The commit the row's workflow signed the bundle artifact at, as cosign states it: `cosign verify` under the row's
- * identity, issuer, workflow repository and ref (no commit: it is what is asked), and the `githubWorkflowSha` claim of
- * every signature cosign verified. Exactly one commit is required; none, or two, is refused. The caller then holds the
- * signature AND the provenance to that commit with `verifyBundleOnRegistry`.
- */
-export function verifiedBundleSignerCommit({ trustedCosign, policy, policyRoot, row, ociRef, env = process.env }) {
-  const cosign = registryCosign({ trustedCosign, policy, policyRoot, row, ociRef, env });
-  const output = cosign.run('verify', [...cosign.trustArgs, ...certificateIdentityArgs(row), '--output', 'json', ociRef]);
-  let verified;
-  try {
-    verified = JSON.parse(output);
-  } catch {
-    throw new Error(`cosign verify of ${ociRef} under row "${row.policyId}" printed no JSON list of verified signatures`);
-  }
-  const commits = [...new Set((Array.isArray(verified) ? verified : []).map((signature) => signature?.optional?.githubWorkflowSha))];
-  if (commits.length !== 1 || !WORKFLOW_SHA.test(String(commits[0]))) {
-    throw new Error(
-      `${ociRef} carries signatures by row "${row.policyId}" (${row.certificateIdentity}) stating ${commits.length} workflow commits ` +
-        `(${commits.map(String).join(', ')}); exactly one 40-hex commit is required`,
-    );
-  }
-  return commits[0];
-}

package/edition/third-party-certificate-extensions.mjs

@@ -1,21 +0,0 @@
-// (d) of the third-party checks: the Fulcio extensions of a bundle's leaf certificate, held to a source pin. Its own module
-// (it imports no evidence module) because admission in `image-evidence.mjs` and the pin verifier both use it.
-
-import { FulcioExtensionOid, GITHUB_HOSTED_RUNNER_ENVIRONMENT, readFulcioExtensionsFromBundle } from './fulcio-certificate-extensions.mjs';
-
-/** The leaf certificate of a parsed Sigstore `bundle` states the pinned repository id, owner id and a GitHub-hosted runner. */
-export function assertCertificateExtensions({ bundle, source, label }) {
-  const read = readFulcioExtensionsFromBundle(bundle);
-  const expectations = [
-    [FulcioExtensionOid.SourceRepositoryIdentifier, 'Source Repository Identifier', read.sourceRepositoryIdentifier, source.repositoryId, 'repositoryId'],
-    [FulcioExtensionOid.SourceRepositoryOwnerIdentifier, 'Source Repository Owner Identifier', read.sourceRepositoryOwnerIdentifier, source.repositoryOwnerId, 'repositoryOwnerId'],
-    [FulcioExtensionOid.RunnerEnvironment, 'Runner Environment', read.runnerEnvironment, GITHUB_HOSTED_RUNNER_ENVIRONMENT, GITHUB_HOSTED_RUNNER_ENVIRONMENT],
-  ];
-  for (const [oid, name, actual, expected, pinned] of expectations) {
-    if (actual !== expected) {
-      throw new Error(
-        `${label} certificate ${name} (${oid}) is ${JSON.stringify(actual)}, but the pin requires ${JSON.stringify(expected)} (${pinned})`,
-      );
-    }
-  }
-}