@xemahq/xema 0.59.1 → 0.60.1

package/edition/produce-image-source-evidence.mjs

@@ -1,788 +0,0 @@
-#!/usr/bin/env node
-// The image-source producer statement layer: build the canonical statement
-// bytes a producing workflow signs, and accept the signed bundles back.
-//
-// `xema edition evidence statement producer stage|accept`. This module never
-// signs: it holds no key and requests no OIDC token. `stage` writes the exact
-// bytes to sign and prints the signing plan; the caller runs
-// `cosign attest-blob`; `accept` re-derives the statements from the same
-// input, refuses staged bytes that differ, validates each bundle, verifies it
-// with cosign against the declared signer, and seals the evidence directory.
-//
-// The kernel contract authority every statement binds is the one the data
-// root's evidence-trust pin records (`evidence-trust-pin.mjs`): the data root's
-// `runtime-image-source-index.json` states it, and it is used only once it is
-// the pinned one. The verifier holds producer statements to the same pin.
-
-import { execFileSync } from 'node:child_process';
-import { createHash } from 'node:crypto';
-import {
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  writeFileSync,
-} from 'node:fs';
-import { isAbsolute, join, resolve } from 'node:path';
-import { pathToFileURL } from 'node:url';
-
-import { certificateConstraintArgs } from './cosign-certificate-constraints.mjs';
-import { editionWorkspaceConfig } from './edition-config.mjs';
-import {
-  dataRoot,
-  isEntryModule,
-  kernelDistPath,
-  kernelRepoDir,
-} from './edition-workspace.mjs';
-import { COMMIT_PATTERN, GITHUB_REF_PATTERN, GITHUB_REPOSITORY_PATTERN, SHA256_DIGEST_PATTERN } from './evidence-grammars.mjs';
-import { EvidenceInputMode, configureEvidenceInputMode } from './evidence-input-mode.mjs';
-import {
-  KERNEL_CONTRACT_AUTHORITY_NOT_PINNED_ONE,
-  KernelContractAuthorityPinError,
-  RUNTIME_IMAGE_SOURCE_INDEX_FILE,
-  loadPinnedDeclaredTrustPolicy,
-  readEvidenceTrustPin,
-  readPinnedKernelContractAuthority,
-} from './evidence-trust-pin.mjs';
-import {
-  canonicalJsonBytes,
-  decodeExactUtf8,
-  parseCanonicalJsonBytes,
-  sha256Digest,
-} from './image-evidence.mjs';
-import { assertKernelContractAuthorityEqual } from './kernel-contract-authority.mjs';
-import { oidcCertificateSignerKind } from './kernel-signer-kind.mjs';
-import { serializeJson } from './lib.mjs';
-import { assertStagedExactly, reserveSealing, sealAccepted } from './sealed-evidence-accept.mjs';
-import { BUNDLE_MEDIA_TYPE } from './sigstore-bundle-media-type.mjs';
-
-export { BUNDLE_MEDIA_TYPE };
-const STAGED_STATEMENTS_DIRECTORY = 'statements';
-const STAGED_BUNDLES_DIRECTORY = 'bundles';
-
-/**
- * Git, run under a fully sandboxed environment: no user/system config, no
- * replace-objects rewriting, no credential prompt, no locale-dependent output.
- *
- * Exported because the producer-input assembler runs git against the SAME
- * checkouts under the SAME guarantees — a second copy of this environment is a
- * second security posture, and the two would drift silently (the assembler's
- * copy WAS byte-for-byte identical, which is exactly how nobody noticed).
- */
-export function sandboxedGit(repositoryRoot, args) {
-  return execFileSync('/usr/bin/git', ['-C', repositoryRoot, ...args], {
-    encoding: 'utf8',
-    env: {
-      GIT_CONFIG_GLOBAL: '/dev/null',
-      GIT_CONFIG_NOSYSTEM: '1',
-      GIT_NO_REPLACE_OBJECTS: '1',
-      GIT_OPTIONAL_LOCKS: '0',
-      GIT_TERMINAL_PROMPT: '0',
-      LANG: 'C',
-      LC_ALL: 'C',
-      PATH: '/usr/bin:/bin',
-    },
-    stdio: ['ignore', 'pipe', 'pipe'],
-  }).trim();
-}
-
-/** The data root's runtime image source index, unparsed: where the authority is read before any schema is loaded. */
-function readRawContractAuthority(root) {
-  if (!isAbsolute(root)) {
-    throw new Error('the data root must be an absolute path');
-  }
-  const authority = JSON.parse(
-    readFileSync(join(root, RUNTIME_IMAGE_SOURCE_INDEX_FILE), 'utf8'),
-  )?.contractAuthority;
-  if (
-    typeof authority?.repositoryUrl !== 'string' ||
-    !COMMIT_PATTERN.test(authority?.sourceCommit ?? '')
-  ) {
-    throw new Error(
-      `${RUNTIME_IMAGE_SOURCE_INDEX_FILE} at ${root} carries no kernel contract authority`,
-    );
-  }
-  return authority;
-}
-
-/**
- * The kernel contract authority evidence of a data root is held to: the one its
- * evidence-trust pin records. The runtime image source index states it; a
- * stated authority that is not the pinned one, or a data root with no pin, is
- * refused (`KernelContractAuthorityPinError`). `declaration` is the data root's
- * `evidenceTrustPolicy`; it defaults to the configured workspace's.
- */
-export function readPinnedContractAuthority({
-  dataRoot: root,
-  schemas,
-  declaration = editionWorkspaceConfig().evidenceTrustPolicy,
-}) {
-  return readPinnedKernelContractAuthority({ dataRoot: root, declaration, schemas });
-}
-
-/**
- * The kernel schemas, loaded from a kernel checkout that is clean, has the
- * authority's repository as its origin and is at exactly the PINNED authority
- * commit. The pin is read before any kernel code is imported, so a checkout at
- * a commit the data root did not pin is never loaded. Returns the schemas and
- * the pinned authority they were held to.
- */
-export async function loadProducerKernelSchemas({
-  dataRoot: root,
-  kernelRepositoryDirectory = kernelRepoDir(),
-  kernelDistributionModule = kernelDistPath('distribution', 'index.js'),
-  declaration = editionWorkspaceConfig().evidenceTrustPolicy,
-}) {
-  if (declaration.policy === null) {
-    // The coded refusal of a data root with no pin.
-    readPinnedKernelContractAuthority({ dataRoot: root, declaration, schemas: {} });
-  }
-  const expected = readRawContractAuthority(root);
-  const pinned = readEvidenceTrustPin({ dataRoot: root, declaration }).kernelContractAuthority;
-  if (pinned === null) {
-    throw new KernelContractAuthorityPinError(
-      KERNEL_CONTRACT_AUTHORITY_NOT_PINNED_ONE,
-      `${RUNTIME_IMAGE_SOURCE_INDEX_FILE} at ${root} states kernel contract authority commit ${expected.sourceCommit} ` +
-        'but the evidence-trust pin records none; re-pin with `xema edition repin-evidence-trust`',
-    );
-  }
-  if (expected.sourceCommit !== pinned.sourceCommit) {
-    throw new Error(
-      `${RUNTIME_IMAGE_SOURCE_INDEX_FILE} at ${root} states kernel contract authority commit ` +
-        `${expected.sourceCommit} but the evidence-trust pin records ${pinned.sourceCommit}`,
-    );
-  }
-  if (!isAbsolute(kernelRepositoryDirectory)) {
-    throw new Error('the kernel contracts checkout must be an absolute path');
-  }
-  if (
-    sandboxedGit(kernelRepositoryDirectory, ['remote', 'get-url', 'origin']) !==
-      expected.repositoryUrl ||
-    sandboxedGit(kernelRepositoryDirectory, ['rev-parse', '--verify', 'HEAD^{commit}']) !==
-      expected.sourceCommit ||
-    sandboxedGit(kernelRepositoryDirectory, [
-      'status',
-      '--porcelain=v1',
-      '--untracked-files=all',
-    ]) !== ''
-  ) {
-    throw new Error(
-      'kernel contracts checkout must be clean, canonical, and at the evidence authority commit',
-    );
-  }
-  let schemas;
-  try {
-    schemas = await import(pathToFileURL(kernelDistributionModule));
-  } catch (error) {
-    throw new Error(
-      `cannot load built kernel evidence schemas at ${expected.sourceCommit}: ${error.message}`,
-    );
-  }
-  return {
-    schemas,
-    contractAuthority: readPinnedContractAuthority({ dataRoot: root, schemas, declaration }),
-  };
-}
-
-function exactKeys(value, keys, label) {
-  if (
-    typeof value !== 'object' ||
-    value === null ||
-    Array.isArray(value) ||
-    JSON.stringify(Object.keys(value).sort()) !==
-      JSON.stringify([...keys].sort())
-  ) {
-    throw new Error(`${label} does not have the exact required fields`);
-  }
-  return value;
-}
-
-function subjectKey(subject) {
-  return `${subject.kind}:${subject.id}`;
-}
-
-function evidenceNonce(input, subject) {
-  return createHash('sha256')
-    .update('xema.image-source-evidence.nonce.v2\0')
-    .update(input.runId)
-    .update('\0')
-    .update(String(input.runAttempt))
-    .update('\0')
-    .update(subjectKey(subject))
-    .update('\0')
-    .update(subject.manifestDigest)
-    .digest('base64url');
-}
-
-function artifactStem(subject) {
-  return createHash('sha256').update(subjectKey(subject)).digest('hex');
-}
-
-function assertSigner(signer) {
-  exactKeys(
-    signer,
-    ['kind', 'certificateIdentity', 'oidcIssuer', 'githubWorkflow'],
-    'image-source producer signer',
-  );
-  exactKeys(
-    signer.githubWorkflow,
-    ['repository', 'ref', 'path'],
-    'image-source producer GitHub workflow',
-  );
-  const { repository, ref, path } = signer.githubWorkflow;
-  if (
-    !GITHUB_REPOSITORY_PATTERN.test(repository) ||
-    !GITHUB_REF_PATTERN.test(ref) ||
-    typeof path !== 'string' ||
-    !path.startsWith('.github/workflows/') ||
-    path.split('/').some((segment) => !segment || segment === '..')
-  ) {
-    throw new Error('image-source producer GitHub workflow is not canonical');
-  }
-  const expectedIdentity = `https://github.com/${repository}/${path}@${ref}`;
-  if (signer.kind !== oidcCertificateSignerKind()) {
-    throw new Error(
-      `image-source producer signer kind must be "${oidcCertificateSignerKind()}"`,
-    );
-  }
-  if (
-    signer.certificateIdentity !== expectedIdentity ||
-    signer.oidcIssuer !== 'https://token.actions.githubusercontent.com'
-  ) {
-    throw new Error(
-      'image-source producer signer identity or OIDC issuer is not exact',
-    );
-  }
-  return signer;
-}
-
-export function assertGitHubProducerContext(input, context) {
-  exactKeys(
-    context,
-    ['repository', 'ref', 'sha', 'workflowRef'],
-    'GitHub producer context',
-  );
-  const signer = assertSigner(input.signer);
-  const expectedWorkflowRef =
-    `${signer.githubWorkflow.repository}/${signer.githubWorkflow.path}` +
-    `@${signer.githubWorkflow.ref}`;
-  if (
-    context.repository !== signer.githubWorkflow.repository ||
-    context.ref !== signer.githubWorkflow.ref ||
-    context.sha !== input.producerWorkflowSha ||
-    context.workflowRef !== expectedWorkflowRef
-  ) {
-    throw new Error(
-      'GitHub producer context does not exactly match the input signer and workflow SHA',
-    );
-  }
-  return context;
-}
-
-/**
- * The producer input, exact. `expectedContractAuthority` is the data root's
- * pinned authority ({@link readPinnedContractAuthority}); an input that binds any
- * other authority is refused here, before a statement is built from it.
- */
-export function assertProducerInput(input, expectedContractAuthority) {
-  if (!expectedContractAuthority) {
-    throw new Error('the expected kernel contract authority is required');
-  }
-  exactKeys(
-    input,
-    [
-      'schemaVersion',
-      'contractAuthority',
-      'sourceHashAlgorithm',
-      'producerWorkflowSha',
-      'signer',
-      'builder',
-      'runId',
-      'runAttempt',
-      'issuedAt',
-      'expiresAt',
-      'expectedSubjects',
-      'subjects',
-    ],
-    'image-source producer input',
-  );
-  if (input.schemaVersion !== 1) {
-    throw new Error('image-source producer input requires schemaVersion 1');
-  }
-  assertKernelContractAuthorityEqual(
-    input.contractAuthority,
-    expectedContractAuthority,
-    'image-source producer input',
-  );
-  if (!COMMIT_PATTERN.test(input.producerWorkflowSha)) {
-    throw new Error('producerWorkflowSha must be an exact 40-hex commit');
-  }
-  assertSigner(input.signer);
-  exactKeys(
-    input.builder,
-    ['builderId', 'buildType', 'buildDefinitionDigest', 'parametersDigest'],
-    'image-source producer builder',
-  );
-  if (
-    !SHA256_DIGEST_PATTERN.test(input.builder.buildDefinitionDigest) ||
-    !SHA256_DIGEST_PATTERN.test(input.builder.parametersDigest)
-  ) {
-    throw new Error(
-      'producer build definition and parameters require sha256 digests',
-    );
-  }
-  if (
-    !Array.isArray(input.expectedSubjects) ||
-    input.expectedSubjects.length === 0
-  ) {
-    throw new Error('image-source producer expected subject set is empty');
-  }
-  if (!Array.isArray(input.subjects) || input.subjects.length === 0) {
-    throw new Error('image-source producer subject set is empty');
-  }
-  for (const subject of input.subjects) {
-    exactKeys(
-      subject,
-      [
-        'kind',
-        'id',
-        'repositoryUrl',
-        'repo',
-        'path',
-        'sourceCommit',
-        'sourceManifestHash',
-        'sourceTreeHash',
-        'imageRepository',
-        'manifestDigest',
-        'manifestMediaType',
-        'platforms',
-        'sbomDigest',
-        'provenanceDigest',
-      ],
-      `image-source producer subject ${String(subject?.kind)}:${String(subject?.id)}`,
-    );
-  }
-  const expected = [...input.expectedSubjects];
-  const actual = input.subjects.map(subjectKey);
-  const sortedExpected = [...new Set(expected)].sort();
-  const sortedActual = [...new Set(actual)].sort();
-  if (
-    JSON.stringify(expected) !== JSON.stringify(sortedExpected) ||
-    JSON.stringify(actual) !== JSON.stringify(sortedActual) ||
-    JSON.stringify(expected) !== JSON.stringify(actual)
-  ) {
-    throw new Error(
-      `image-source producer requires the exact complete subject set; expected=${expected.join(',')} actual=${actual.join(',')}`,
-    );
-  }
-}
-
-export function buildImageSourceStatements(input, schemas, expectedContractAuthority) {
-  assertProducerInput(input, expectedContractAuthority);
-  return input.subjects.map((subject) => {
-    const statement = {
-      _type: 'https://in-toto.io/Statement/v1',
-      subject: [
-        {
-          name: subject.imageRepository,
-          digest: { sha256: subject.manifestDigest.slice('sha256:'.length) },
-        },
-      ],
-      predicateType: schemas.IMAGE_PRODUCER_PREDICATE_TYPE,
-      predicate: {
-        schemaVersion: 2,
-        contractAuthority: input.contractAuthority,
-        source: {
-          kind: subject.kind,
-          id: subject.id,
-          repositoryUrl: subject.repositoryUrl,
-          repo: subject.repo,
-          path: subject.path,
-          sourceCommit: subject.sourceCommit,
-          sourceManifestHash: subject.sourceManifestHash,
-          sourceHashAlgorithm: input.sourceHashAlgorithm,
-          sourceTreeHash: subject.sourceTreeHash,
-        },
-        build: {
-          ...input.builder,
-          platforms: subject.platforms,
-        },
-        artifact: {
-          imageRepository: subject.imageRepository,
-          manifestDigest: subject.manifestDigest,
-          manifestMediaType: subject.manifestMediaType,
-          sbom: {
-            predicateType: 'https://spdx.dev/Document',
-            digest: subject.sbomDigest,
-          },
-          provenance: {
-            predicateType: 'https://slsa.dev/provenance/v1',
-            digest: subject.provenanceDigest,
-          },
-        },
-        producerRun: {
-          producerWorkflowSha: input.producerWorkflowSha,
-          runId: input.runId,
-          runAttempt: input.runAttempt,
-          nonce: evidenceNonce(input, subject),
-          issuedAt: input.issuedAt,
-          expiresAt: input.expiresAt,
-        },
-      },
-    };
-    return schemas.parseImageProducerStatement(statement);
-  });
-}
-
-export function validateProducedBundle(statementBytes, bundleBytes) {
-  const bundle = parseCanonicalJsonBytes(
-    bundleBytes,
-    'produced Sigstore bundle',
-  );
-  if (
-    bundle.mediaType !== BUNDLE_MEDIA_TYPE ||
-    bundle.messageSignature !== undefined ||
-    typeof bundle.dsseEnvelope !== 'object' ||
-    bundle.dsseEnvelope === null ||
-    bundle.dsseEnvelope.payloadType !== 'application/vnd.in-toto+json' ||
-    !Array.isArray(bundle.dsseEnvelope.signatures) ||
-    bundle.dsseEnvelope.signatures.length !== 1 ||
-    typeof bundle.dsseEnvelope.payload !== 'string'
-  ) {
-    throw new Error('produced bundle is not one exact DSSE in-toto signature');
-  }
-  const payload = Buffer.from(bundle.dsseEnvelope.payload, 'base64');
-  if (
-    payload.toString('base64') !== bundle.dsseEnvelope.payload ||
-    !payload.equals(statementBytes)
-  ) {
-    throw new Error(
-      'produced bundle payload does not exactly match its statement',
-    );
-  }
-  return bundle;
-}
-
-/** The cosign that verifies is the version the data root's trust policy pins; the library names none. */
-function exactCosignVersion(output, policyCosignVersion) {
-  if (typeof policyCosignVersion !== 'string' || !/^v\d+\.\d+\.\d+$/.test(policyCosignVersion)) {
-    throw new Error("the trust policy's cosignVersion is required to accept signed evidence");
-  }
-  const match = /\bGitVersion:\s*(v\d+\.\d+\.\d+)\b/.exec(output);
-  if (!match || match[1] !== policyCosignVersion) {
-    throw new Error(`cosign version does not match pinned ${policyCosignVersion}`);
-  }
-  return match[1];
-}
-
-/**
- * A cosign runner that can read the version and VERIFY, and nothing else: the
- * edition library never signs, so any other subcommand is refused here. It
- * passes no OIDC request variables to the child.
- */
-export function createCosignVerifier(cosignBinary) {
-  if (typeof cosignBinary !== 'string' || !isAbsolute(cosignBinary)) {
-    throw new Error('cosign binary must be an absolute path');
-  }
-  return {
-    readCosignVersion: () =>
-      execFileSync(cosignBinary, ['version'], {
-        encoding: 'utf8',
-        env: { LANG: 'C', LC_ALL: 'C', PATH: '/usr/bin:/bin', TZ: 'UTC' },
-        stdio: ['ignore', 'pipe', 'pipe'],
-        timeout: 10_000,
-      }),
-    runCosign: (args) => {
-      if (args[0] !== 'verify-blob-attestation') {
-        throw new Error(
-          `the edition library only verifies with cosign; it does not run "cosign ${String(args[0])}"`,
-        );
-      }
-      return execFileSync(cosignBinary, args, {
-        env: {
-          HOME: process.env.HOME,
-          LANG: 'C',
-          LC_ALL: 'C',
-          PATH: '/usr/bin:/bin',
-          TZ: 'UTC',
-        },
-        stdio: ['ignore', 'ignore', 'pipe'],
-        timeout: 180_000,
-      });
-    },
-  };
-}
-
-/** The verification every accepted bundle must pass: the declared signer, at the exact workflow commit. */
-export function cosignVerifyAttestationArgs({ bundlePath, signer, certificateWorkflowSha, predicateType }) {
-  return [
-    'verify-blob-attestation',
-    '--check-claims=false',
-    '--new-bundle-format',
-    '--bundle',
-    bundlePath,
-    ...certificateConstraintArgs(signer, certificateWorkflowSha),
-    '--type',
-    predicateType,
-  ];
-}
-
-/** The canonical bytes of a cosign-produced bundle, held to its statement. Reads; writes nothing. */
-export function canonicalSignedBundleBytes({ statementBytes, bundlePath }) {
-  let producedBundle;
-  try {
-    producedBundle = JSON.parse(
-      decodeExactUtf8(readFileSync(bundlePath), 'cosign-produced bundle'),
-    );
-  } catch (error) {
-    throw new Error(
-      `cosign-produced bundle is not exact UTF-8 JSON: ${error.message}`,
-    );
-  }
-  const bundleBytes = canonicalJsonBytes(producedBundle);
-  validateProducedBundle(statementBytes, bundleBytes);
-  return bundleBytes;
-}
-
-function stagedPaths(statement) {
-  const stem = artifactStem(statement.predicate.source);
-  return {
-    statementPath: `${STAGED_STATEMENTS_DIRECTORY}/${stem}.json`,
-    bundlePath: `${STAGED_BUNDLES_DIRECTORY}/${stem}.sigstore.json`,
-  };
-}
-
-/**
- * Write the canonical statement bytes to sign into a NEW staging directory and
- * return the signing plan: what to sign, where each bundle must be written,
- * and the identity each bundle will be verified against.
- */
-export function stageImageSourceEvidence({
-  input,
-  stagingDirectory,
-  schemas,
-  expectedContractAuthority,
-}) {
-  if (!isAbsolute(stagingDirectory)) {
-    throw new Error('the staging directory must be an absolute path');
-  }
-  if (existsSync(stagingDirectory)) {
-    throw new Error(`evidence staging directory already exists: ${stagingDirectory}`);
-  }
-  const statements = buildImageSourceStatements(input, schemas, expectedContractAuthority);
-  mkdirSync(join(stagingDirectory, STAGED_STATEMENTS_DIRECTORY), { recursive: true, mode: 0o700 });
-  mkdirSync(join(stagingDirectory, STAGED_BUNDLES_DIRECTORY), { mode: 0o700 });
-  const planned = [];
-  for (const statement of statements) {
-    const paths = stagedPaths(statement);
-    writeFileSync(join(stagingDirectory, paths.statementPath), canonicalJsonBytes(statement), {
-      flag: 'wx',
-      mode: 0o600,
-    });
-    planned.push({
-      subjectKind: statement.predicate.source.kind,
-      subjectId: statement.predicate.source.id,
-      ...paths,
-    });
-  }
-  return {
-    schemaVersion: 1,
-    kind: 'producer',
-    root: stagingDirectory,
-    predicateType: schemas.IMAGE_PRODUCER_PREDICATE_TYPE,
-    signer: input.signer,
-    certificateWorkflowSha: input.producerWorkflowSha,
-    statements: planned,
-  };
-}
-
-/**
- * Accept the signed bundles of a staged directory and seal `outputDirectory`.
- *
- * The output is BUILT, never renamed from the staging: each statement is
- * re-derived from `input` (a staged statement that is not byte-identical is
- * refused, so nothing but what this library built can have been signed), each
- * bundle is canonicalized and verified, and only those derived files are
- * written. The staging must hold exactly what stage recorded.
- *
- * The staging does not outlive accept. A refused accept removes it together
- * with the partial output, so no signed-but-unaccepted bundle is left for a
- * later step to pick up; a successful accept removes it too. Only the argument
- * refusals above the first read leave it in place.
- *
- * `inputMode` (EvidenceInputMode) decides the cosign version check. In vendor
- * mode `cosignVersion` is the trust policy's pinned version and the cosign that
- * verifies must be it. In public-input mode there is no vendor trust policy and
- * no version is held (`cosignVersion` must be null): the vendor's admission
- * re-verifies every bundle with its own pinned cosign, and that is the
- * authority. The signature verification itself runs in both modes.
- */
-export function acceptImageSourceEvidence({
-  input,
-  stagingDirectory,
-  outputDirectory,
-  schemas,
-  expectedContractAuthority,
-  inputMode,
-  cosignVersion,
-  readCosignVersion,
-  runCosign,
-}) {
-  if (!isAbsolute(stagingDirectory) || !isAbsolute(outputDirectory)) {
-    throw new Error('the staging and output directories must be absolute paths');
-  }
-  if (!Object.values(EvidenceInputMode).includes(inputMode)) {
-    throw new Error(`accept needs an input mode, one of ${Object.values(EvidenceInputMode).join(', ')} (got ${String(inputMode)})`);
-  }
-  if (inputMode === EvidenceInputMode.PublicInput && cosignVersion !== null) {
-    throw new Error('public-input accept holds no cosign version: the vendor admission re-verifies with its pinned cosign');
-  }
-  if (typeof readCosignVersion !== 'function' || typeof runCosign !== 'function') {
-    throw new Error('cosign seams are required');
-  }
-  const sealing = reserveSealing(outputDirectory, 'evidence');
-  return sealAccepted({
-    stagingDirectory,
-    sealing,
-    outputDirectory,
-    build: () => {
-      if (inputMode === EvidenceInputMode.Vendor) {
-        exactCosignVersion(readCosignVersion(), cosignVersion);
-      }
-      const statements = buildImageSourceStatements(input, schemas, expectedContractAuthority);
-      assertStagedExactly(
-        stagingDirectory,
-        statements.flatMap((statement) => {
-          const { statementPath, bundlePath } = stagedPaths(statement);
-          return [statementPath, bundlePath];
-        }),
-      );
-      mkdirSync(join(sealing, STAGED_STATEMENTS_DIRECTORY), { recursive: true, mode: 0o755 });
-      mkdirSync(join(sealing, STAGED_BUNDLES_DIRECTORY), { mode: 0o755 });
-      const producerEvidence = [];
-      for (const statement of statements) {
-        const { statementPath, bundlePath } = stagedPaths(statement);
-        const statementBytes = canonicalJsonBytes(statement);
-        if (!readFileSync(join(stagingDirectory, statementPath)).equals(statementBytes)) {
-          throw new Error(
-            `staged statement ${statementPath} is not the statement this producer input builds`,
-          );
-        }
-        const bundleBytes = canonicalSignedBundleBytes({
-          statementBytes,
-          bundlePath: join(stagingDirectory, bundlePath),
-        });
-        writeFileSync(join(sealing, statementPath), statementBytes, { flag: 'wx', mode: 0o644 });
-        writeFileSync(join(sealing, bundlePath), bundleBytes, { flag: 'wx', mode: 0o644 });
-        // Verified where it is sealed: the bytes cosign accepts are the bytes kept.
-        runCosign(
-          cosignVerifyAttestationArgs({
-            bundlePath: join(sealing, bundlePath),
-            signer: input.signer,
-            certificateWorkflowSha: input.producerWorkflowSha,
-            predicateType: schemas.IMAGE_PRODUCER_PREDICATE_TYPE,
-          }),
-        );
-        producerEvidence.push({
-          subjectKind: statement.predicate.source.kind,
-          subjectId: statement.predicate.source.id,
-          evidence: {
-            statementPath,
-            statementDigest: sha256Digest(statementBytes),
-            bundlePath,
-            bundleDigest: sha256Digest(bundleBytes),
-            bundleMediaType: BUNDLE_MEDIA_TYPE,
-          },
-        });
-      }
-      writeFileSync(
-        join(sealing, 'producer-evidence.json'),
-        serializeJson({ schemaVersion: 1, producerEvidence }),
-        { flag: 'wx', mode: 0o644 },
-      );
-      return producerEvidence;
-    },
-  });
-}
-
-const USAGE =
-  'usage: xema edition evidence statement producer <stage|accept> --input <json> --staging <absolute-directory> ' +
-  '--github-repository <owner/repo> --github-ref <ref> --github-sha <commit> ' +
-  '--github-workflow-ref <owner/repo/path@ref> [accept: --output <absolute-directory> --cosign <absolute-binary>] ' +
-  '(--data-root <dir> --kernel <dir> | --contract-authority <file>)';
-
-function parseFlags(args, known) {
-  const flags = new Map();
-  for (let index = 0; index < args.length; index += 2) {
-    const flag = args[index];
-    const value = args[index + 1];
-    if (typeof flag !== 'string' || !flag.startsWith('--') || !known.includes(flag.slice(2))) {
-      throw new Error(USAGE);
-    }
-    if (value === undefined || value.startsWith('--') || flags.has(flag.slice(2))) {
-      throw new Error(USAGE);
-    }
-    flags.set(flag.slice(2), value);
-  }
-  for (const name of known) {
-    if (!flags.has(name)) {throw new Error(USAGE);}
-  }
-  return flags;
-}
-
-async function main() {
-  const [phase, ...argv] = process.argv.slice(2);
-  if (phase !== 'stage' && phase !== 'accept') {
-    throw new Error(USAGE);
-  }
-  const mode = await configureEvidenceInputMode(argv, { verb: `statement producer ${phase}` });
-  const context = ['github-repository', 'github-ref', 'github-sha', 'github-workflow-ref'];
-  const flags = parseFlags(
-    mode.rest,
-    phase === 'stage' ? ['input', 'staging', ...context] : ['input', 'staging', 'output', 'cosign', ...context],
-  );
-  const input = JSON.parse(readFileSync(resolve(flags.get('input')), 'utf8'));
-  const { schemas, contractAuthority } =
-    mode.mode === EvidenceInputMode.PublicInput ? mode : await loadProducerKernelSchemas({ dataRoot: dataRoot() });
-  assertProducerInput(input, contractAuthority);
-  assertGitHubProducerContext(input, {
-    repository: flags.get('github-repository'),
-    ref: flags.get('github-ref'),
-    sha: flags.get('github-sha'),
-    workflowRef: flags.get('github-workflow-ref'),
-  });
-  if (phase === 'stage') {
-    const plan = stageImageSourceEvidence({
-      input,
-      stagingDirectory: flags.get('staging'),
-      schemas,
-      expectedContractAuthority: contractAuthority,
-    });
-    process.stdout.write(serializeJson(plan));
-    return;
-  }
-  const evidence = acceptImageSourceEvidence({
-    input,
-    stagingDirectory: flags.get('staging'),
-    outputDirectory: flags.get('output'),
-    schemas,
-    expectedContractAuthority: contractAuthority,
-    inputMode: mode.mode,
-    cosignVersion:
-      mode.mode === EvidenceInputMode.PublicInput
-        ? null
-        : loadPinnedDeclaredTrustPolicy({
-            dataRoot: dataRoot(),
-            declaration: editionWorkspaceConfig().evidenceTrustPolicy,
-            schemas,
-          }).cosignVersion,
-    ...createCosignVerifier(flags.get('cosign')),
-  });
-  process.stdout.write(serializeJson({ schemaVersion: 1, kind: 'producer', outputDirectory: flags.get('output'), producerEvidence: evidence }));
-}
-
-if (isEntryModule(import.meta.url)) {
-  main().catch((error) => {
-    console.error(`[image-source-evidence] ${error.message}`);
-    process.exitCode = 1;
-  });
-}