bootproof 0.3.0 → 0.4.0

package/dist/proof.js

@@ -3,11 +3,13 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { execFileSync } from "node:child_process";
-export const TOOL_ID = "bootproof@0.3.0";
+import { buildExecutionEnv } from "./exec.js";
+import { redactJsonValue } from "./redact.js";
+export const TOOL_ID = "bootproof@0.4.0";
 export function gitInfo(repo) {
     const git = (...args) => {
         try {
-            return execFileSync("git", ["-C", repo, ...args], { encoding: "utf8" }).trim();
+            return execFileSync("git", ["-C", repo, ...args], { encoding: "utf8", env: buildExecutionEnv() }).trim();
         }
         catch {
             return null;
@@ -26,6 +28,9 @@ export function gitInfo(repo) {
 function signerKeyPath() {
     return path.join(os.homedir(), ".bootproof", "signer.json");
 }
+export function knownSignersPath() {
+    return path.join(os.homedir(), ".bootproof", "known_signers.json");
+}
 function loadOrCreateSigner() {
     const p = signerKeyPath();
     if (fs.existsSync(p)) {
@@ -39,27 +44,204 @@ function loadOrCreateSigner() {
     fs.writeFileSync(p, JSON.stringify({ privateKeyPem, publicKeyPem }), { mode: 0o600 });
     return { privateKey: crypto.createPrivateKey(privateKeyPem), publicKeyPem };
 }
+/**
+ * Rotate the local ed25519 signing key. The old key's public key is archived
+ * (so existing attestations remain independently verifiable), a new keypair is
+ * generated, and the latest attestation in the given repo is optionally
+ * re-signed with the new key.
+ *
+ * Rotation does NOT invalidate existing attestations — they still carry the
+ * old public key inline and verify with it. Rotation only affects what key
+ * future attestations will be signed with.
+ */
+export function rotateSigner(opts = {}) {
+    const p = signerKeyPath();
+    const oldKey = fs.existsSync(p) ? JSON.parse(fs.readFileSync(p, "utf8")) : null;
+    const oldPublicKeyPem = oldKey?.publicKeyPem ?? null;
+    // Generate the new keypair.
+    const { privateKey, publicKey } = crypto.generateKeyPairSync("ed25519");
+    const newPrivateKeyPem = privateKey.export({ type: "pkcs8", format: "pem" }).toString();
+    const newPublicKeyPem = publicKey.export({ type: "spki", format: "pem" }).toString();
+    // Back up the old key before overwriting (unless explicitly skipped).
+    let backedUpTo = null;
+    if (opts.backup !== false && oldKey) {
+        const backupDir = path.join(os.homedir(), ".bootproof", "archived-keys");
+        fs.mkdirSync(backupDir, { recursive: true, mode: 0o700 });
+        const backupName = `signer-${new Date().toISOString().replace(/[:.]/g, "-")}.json`;
+        backedUpTo = path.join(backupDir, backupName);
+        fs.writeFileSync(backedUpTo, JSON.stringify(oldKey, null, 2), { mode: 0o600 });
+    }
+    // Write the new key.
+    fs.mkdirSync(path.dirname(p), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(p, JSON.stringify({ privateKeyPem: newPrivateKeyPem, publicKeyPem: newPublicKeyPem }), { mode: 0o600 });
+    // Optionally re-sign the latest attestation with the new key.
+    let reSigned = false;
+    if (opts.resignAttestation && opts.repo) {
+        const attPath = attestationPath(opts.repo);
+        if (fs.existsSync(attPath)) {
+            const att = JSON.parse(fs.readFileSync(attPath, "utf8"));
+            // Re-sign: the canonical body excludes signature and signer fields.
+            const body = canonicalBody(att);
+            const newPrivateKey = crypto.createPrivateKey(newPrivateKeyPem);
+            att.signature = crypto.sign(null, body, newPrivateKey).toString("base64");
+            att.signer = { publicKey: newPublicKeyPem, algorithm: "ed25519" };
+            fs.writeFileSync(attPath, JSON.stringify(att, null, 2) + "\n");
+            reSigned = true;
+        }
+    }
+    return {
+        schema: "bootproof/key-rotation/v1",
+        rotatedAt: new Date().toISOString(),
+        oldPublicKey: oldPublicKeyPem ?? "(no prior key existed)",
+        newPublicKey: newPublicKeyPem,
+        backedUpTo,
+        reSignedAttestation: reSigned,
+    };
+}
+function localSignerPublicKey() {
+    const p = signerKeyPath();
+    if (!fs.existsSync(p))
+        return null;
+    try {
+        const saved = JSON.parse(fs.readFileSync(p, "utf8"));
+        return typeof saved.publicKeyPem === "string" ? saved.publicKeyPem : null;
+    }
+    catch {
+        return null;
+    }
+}
+function emptyKnownSignerStore() {
+    return { schema: "bootproof/known-signers/v1", signers: {} };
+}
+function readKnownSignerStore() {
+    const p = knownSignersPath();
+    if (!fs.existsSync(p))
+        return emptyKnownSignerStore();
+    try {
+        const value = JSON.parse(fs.readFileSync(p, "utf8"));
+        if (value.schema !== "bootproof/known-signers/v1" || !value.signers || typeof value.signers !== "object") {
+            return emptyKnownSignerStore();
+        }
+        return { schema: value.schema, signers: value.signers };
+    }
+    catch {
+        return emptyKnownSignerStore();
+    }
+}
+export function signerFingerprint(publicKeyPem) {
+    const publicKey = crypto.createPublicKey(publicKeyPem);
+    const spki = publicKey.export({ type: "spki", format: "der" });
+    return `sha256:${crypto.createHash("sha256").update(spki).digest("hex")}`;
+}
+export function trustSigner(publicKeyPem, label) {
+    const fingerprint = signerFingerprint(publicKeyPem);
+    const store = readKnownSignerStore();
+    const existing = store.signers[fingerprint];
+    const record = existing ?? {
+        firstSeenAt: new Date().toISOString(),
+        ...(label ? { label } : {}),
+    };
+    if (label)
+        record.label = label;
+    store.signers[fingerprint] = record;
+    const p = knownSignersPath();
+    fs.mkdirSync(path.dirname(p), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(p, JSON.stringify(store, null, 2) + "\n", { mode: 0o600 });
+    return {
+        fingerprint,
+        firstSeenAt: record.firstSeenAt,
+        label: record.label ?? null,
+    };
+}
+function signerTrust(publicKeyPem) {
+    let fingerprint;
+    try {
+        fingerprint = signerFingerprint(publicKeyPem);
+    }
+    catch {
+        return { tier: "invalid", fingerprint: null, label: null };
+    }
+    const localPublicKey = localSignerPublicKey();
+    if (localPublicKey) {
+        try {
+            if (signerFingerprint(localPublicKey) === fingerprint) {
+                return { tier: "self", fingerprint, label: null };
+            }
+        }
+        catch {
+            // A malformed local signer cannot establish trust in a foreign artifact.
+        }
+    }
+    const known = readKnownSignerStore().signers[fingerprint];
+    if (known)
+        return { tier: "known", fingerprint, label: known.label ?? null };
+    return { tier: "unknown-foreign", fingerprint, label: null };
+}
+export function evaluateDetachedSignature(body, signature, publicKeyPem) {
+    if (!signature || !publicKeyPem || !verifyDetached(body, signature, publicKeyPem)) {
+        return { integrityValid: false, tier: "invalid", fingerprint: null, label: null };
+    }
+    return { integrityValid: true, ...signerTrust(publicKeyPem) };
+}
 function canonicalBody(att) {
     const { signature: _s, signer: _k, ...body } = att;
     return Buffer.from(JSON.stringify(body));
 }
 export function buildAttestation(input) {
+    const verificationMode = input.verificationMode ?? "bootproof-orchestrated";
+    const bootproofOrchestrated = verificationMode === "external-health"
+        ? false
+        : input.bootproofOrchestrated ?? true;
+    const redactionsApplied = new Set();
+    const redact = (value) => {
+        const redacted = redactJsonValue(value);
+        for (const rule of redacted.applied)
+            redactionsApplied.add(rule);
+        return redacted.value;
+    };
+    const repo = gitInfo(input.repo);
+    const persistedRepo = {
+        ...repo,
+        remote: redact(repo.remote),
+    };
+    const persistedPlan = redact(input.plan);
+    const persistedObserved = redact(input.observed);
+    const persistedHealthObservation = redact(input.healthObservation);
+    const persistedHealthEvidence = redact(input.healthEvidence ?? null);
+    const persistedObservedHealthCandidates = redact(input.observedHealthCandidates ?? []);
+    const persistedFailureEvidence = redact(input.failureEvidence);
+    const persistedExplanation = redact(input.explanation);
+    const persistedExternalHealthUrl = redact(input.externalHealthUrl ?? null);
+    const persistedObservedFinalUrl = redact(input.observedFinalUrl ?? null);
+    const persistedResponseSnippet = redact(input.responseSnippet ?? "");
     const att = {
         schema: "bootproof/attestation/v1",
         tool: TOOL_ID,
-        repo: gitInfo(input.repo),
+        verificationMode,
+        bootproofOrchestrated,
+        externalHealthUrl: persistedExternalHealthUrl,
+        observedStatus: input.observedStatus ?? null,
+        observedFinalUrl: persistedObservedFinalUrl,
+        observedAt: input.observedAt ?? null,
+        responseSnippet: persistedResponseSnippet,
+        classification: input.classification ?? null,
+        redactionsApplied: [...redactionsApplied].sort(),
+        repo: persistedRepo,
         environment: { os: `${os.platform()} ${os.release()}`, arch: os.arch(), node: process.version },
-        trust: { level: "local_developer_signed", signer: "local_ed25519", oidc: null },
-        plan: input.plan,
-        observed: input.observed,
+        trust: input.trust ?? { level: "local_developer_signed", signer: "local_ed25519", oidc: null },
+        plan: persistedPlan,
+        observed: persistedObserved,
         result: {
             booted: input.booted,
             healthVerified: input.healthVerified,
-            healthObservation: input.healthObservation,
-            observedHealthCandidates: input.observedHealthCandidates ?? [],
+            healthObservation: persistedHealthObservation,
+            healthEvidence: persistedHealthEvidence,
+            observedHealthCandidates: persistedObservedHealthCandidates,
+            observedPort: persistedPlan.observedPort ?? null,
+            healthCandidateSource: persistedPlan.healthCandidateSource ?? "inferred",
             failureClass: input.failureClass,
-            failureEvidence: input.failureEvidence,
-            explanation: input.explanation,
+            failureEvidence: persistedFailureEvidence,
+            explanation: persistedExplanation,
         },
         startedAt: input.startedAt,
         finishedAt: new Date().toISOString(),
@@ -71,6 +253,67 @@ export function buildAttestation(input) {
     att.signer = { publicKey: publicKeyPem, algorithm: "ed25519" };
     return att;
 }
+/**
+ * Detect GitHub Actions OIDC environment. Present only when the workflow has
+ * `permissions: id-token: write`. The presence of these env vars IS the consent —
+ * the workflow author explicitly granted the OIDC scope.
+ */
+export function detectOidcEnv(env = process.env) {
+    const url = env.ACTIONS_ID_TOKEN_REQUEST_URL?.trim();
+    const token = env.ACTIONS_ID_TOKEN_REQUEST_TOKEN?.trim();
+    if (!url || !token)
+        return null;
+    return { requestUrl: url, requestToken: token };
+}
+/**
+ * Fetch the OIDC JWT from GitHub Actions and decode its claims (without verification —
+ * verification is the receiver's job, not the signer's). Returns a compact record of
+ * claims suitable for embedding in the attestation trust block.
+ */
+export async function fetchOidcClaims(requestUrl, requestToken, fetchImpl = fetch) {
+    const url = new URL(requestUrl);
+    url.searchParams.set("audience", "bootproof.dev");
+    const response = await fetchImpl(url.toString(), {
+        headers: { authorization: `bearer ${requestToken}` },
+    });
+    if (!response.ok) {
+        throw new Error(`OIDC token request failed with HTTP ${response.status}`);
+    }
+    const body = await response.json();
+    if (!body.value || typeof body.value !== "string") {
+        throw new Error("OIDC token response did not contain a 'value' field");
+    }
+    // Decode the JWT payload (middle segment). No verification — the receiver verifies.
+    const parts = body.value.split(".");
+    if (parts.length !== 3)
+        throw new Error("OIDC token is not a valid JWT");
+    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+    // Extract the claims that matter for provenance. Stringify everything for the schema.
+    const claims = {};
+    for (const key of ["iss", "sub", "aud", "ref", "repository", "repository_owner", "run_id", "run_attempt", "event_name", "workflow", "job_workflow_ref"]) {
+        if (payload[key] !== undefined && payload[key] !== null) {
+            claims[key] = String(payload[key]);
+        }
+    }
+    return claims;
+}
+/**
+ * Resolve the trust block for an attestation. When `--ci-oidc` is requested and
+ * the GitHub Actions OIDC environment is present, fetch the OIDC token and return
+ * a ci_oidc_signed trust block. Otherwise return local_developer_signed.
+ */
+export async function resolveTrust(opts = {}) {
+    if (!opts.ciOidc) {
+        return { level: "local_developer_signed", signer: "local_ed25519", oidc: null };
+    }
+    const oidcEnv = detectOidcEnv(opts.env);
+    if (!oidcEnv) {
+        throw new Error("--ci-oidc was requested but ACTIONS_ID_TOKEN_REQUEST_URL/ACTIONS_ID_TOKEN_REQUEST_TOKEN are not set. "
+            + "Ensure the workflow has `permissions: id-token: write`.");
+    }
+    const claims = await fetchOidcClaims(oidcEnv.requestUrl, oidcEnv.requestToken, opts.fetchImpl);
+    return { level: "ci_oidc_signed", signer: "local_ed25519", oidc: claims };
+}
 export function signDetached(body) {
     const { privateKey, publicKeyPem } = loadOrCreateSigner();
     return { signature: crypto.sign(null, body, privateKey).toString("base64"), publicKeyPem };
@@ -86,11 +329,21 @@ export function verifyDetached(body, signature, publicKeyPem) {
 export function verifySignature(att) {
     if (!att.signature || !att.signer)
         return false;
+    return verifyDetached(canonicalBody(att), att.signature, att.signer.publicKey);
+}
+export function evaluateAttestationSignature(att) {
+    return evaluateDetachedSignature(canonicalBody(att), att.signature, att.signer?.publicKey);
+}
+export function currentGitHead(repo) {
     try {
-        return crypto.verify(null, canonicalBody(att), crypto.createPublicKey(att.signer.publicKey), Buffer.from(att.signature, "base64"));
+        return execFileSync("git", ["-C", repo, "rev-parse", "HEAD"], {
+            encoding: "utf8",
+            env: buildExecutionEnv(),
+            stdio: ["ignore", "pipe", "ignore"],
+        }).trim();
     }
     catch {
-        return false;
+        return null;
     }
 }
 export function attestationPath(repo) {

package/dist/receipt.d.ts

@@ -0,0 +1,52 @@
+import type { Attestation } from "./types.js";
+interface ReceiptRecord {
+    schema: string;
+    id: string;
+    capturedAt: string;
+    capturedBy: string;
+    trust: {
+        level: string;
+        signer: string;
+        oidc: string | null;
+        upgradePath: string[];
+    };
+    repo: {
+        url: string;
+        commit: string;
+        branch: string;
+        label: string;
+    };
+    inference: {
+        language: string;
+        packageManager: string;
+        startCommand: string;
+    } | null;
+    plan: Array<{
+        step: string;
+        command: string;
+        exitCode: number;
+        durationMs: number;
+    }>;
+    log: Array<{
+        t: number;
+        level: string;
+        line: string;
+    }>;
+    observed: {
+        kind: string;
+        url?: string;
+        status?: number;
+        latencyMs?: number;
+        body?: string;
+        signal?: string | null;
+        code?: number;
+        windowMs?: number;
+        exitCode?: number;
+    };
+    booted: boolean;
+    healthVerified: boolean;
+    failureClass: string | null;
+}
+declare function attestationToRecord(att: Attestation): ReceiptRecord;
+export declare function emitLivingReceipt(att: Attestation, outPath: string): string;
+export { attestationToRecord };