border-customs 0.8.0 → 0.8.2

package/dist/assets/residue-src/npm.ts

@@ -35,11 +35,13 @@ import {
   NPM_PRIVATE_RULE,
   NPM_TARGET_LABEL,
   NPM_UNEXPECTED_RULE,
-  packOnce,
+  packOnce, sandboxPackOnce,
   publintFinding,
   sanitizeOut,
   tail,
 } from "./npmPack.ts";
+import { realDockerExec } from "../roundtrip/docker.ts";
+import type { DockerExec } from "../roundtrip/docker.ts";
 
 export { NPM_LIFECYCLE_RULE, NPM_PUBLINT_RULE, NPM_PRIVATE_RULE, NPM_TARGET_LABEL, NPM_UNEXPECTED_RULE };
 
@@ -64,11 +66,15 @@ export type NpmStageOptions = {
   readonly timeoutMs?: number;
   readonly npmTimeoutMs?: number;
   readonly publintTimeoutMs?: number;
+  /** W4 sandbox seam (only consulted when targets.npm.sandboxImage is set). */
+  readonly sandboxExec?: DockerExec;
 };
 
 export type NpmStageResult = {
   readonly findings: readonly Finding[];
   readonly artifact: NpmArtifactRecord | null;
+  /** Observed in-image toolchain versions (sandbox runs only) — record binding. */
+  readonly toolchain?: string;
 };
 
 function nativeFinding(
@@ -169,13 +175,33 @@ export async function runNpmArtifactStage(o: NpmStageOptions): Promise<NpmStageR
   const stateDir = join(repoDir, BORDER_STATE_DIR);
   const distDir = join(stateDir, "dist");
   mkdirSync(distDir, { recursive: true });
-  const { filename, sha256, bytes, tarballAbs } = packOnce({
-    repoDir,
-    distDir,
-    ...(o.env !== undefined ? { env: o.env } : {}),
-    ...(o.npmBinPath !== undefined ? { npmBinPath: o.npmBinPath } : {}),
-    ...(o.npmTimeoutMs !== undefined ? { npmTimeoutMs: o.npmTimeoutMs } : {}),
-  });
+  // W4: sandboxImage configured ⇒ the pack runs in the pinned container and
+  // the host npm is never touched; otherwise the host path (npm-version guard
+  // inside packOnce) builds exactly the same bytes recipe.
+  const sandboxImage = o.cfg.targets.npm.sandboxImage;
+  let filename: string;
+  let sha256: string;
+  let bytes: number;
+  let tarballAbs: string;
+  let stageToolchain: string | undefined;
+  if (sandboxImage !== undefined) {
+    const run = sandboxPackOnce({
+      repoDir,
+      distDir,
+      spec: { image: sandboxImage, docker: o.sandboxExec ?? realDockerExec() },
+    });
+    ({ filename, sha256, bytes, tarballAbs } = run.outcome);
+    stageToolchain = run.toolchain;
+  } else {
+    const packed = packOnce({
+      repoDir,
+      distDir,
+      ...(o.env !== undefined ? { env: o.env } : {}),
+      ...(o.npmBinPath !== undefined ? { npmBinPath: o.npmBinPath } : {}),
+      ...(o.npmTimeoutMs !== undefined ? { npmTimeoutMs: o.npmTimeoutMs } : {}),
+    });
+    ({ filename, sha256, bytes, tarballAbs } = packed);
+  }
 
   const findings: Finding[] = [];
   const extractDir = join(stateDir, "tmp", sha256.slice(0, 8));
@@ -304,5 +330,6 @@ export async function runNpmArtifactStage(o: NpmStageOptions): Promise<NpmStageR
   return {
     findings,
     artifact: { file: `${BORDER_STATE_DIR}/dist/${filename}`, sha256, bytes },
+    ...(stageToolchain !== undefined ? { toolchain: stageToolchain } : {}),
   };
 }

package/dist/assets/residue-src/pypi.ts

@@ -52,6 +52,8 @@ import {
   spawnEngine,
   type EngineOptions,
 } from "../engines/support.ts";
+import { sandboxRun } from "./sandbox.ts";
+import { realDockerExec, type DockerExec } from "../roundtrip/docker.ts";
 import { redact, type TextSanitizer } from "../redact.ts";
 
 /** Prerequisite failure — the CLI maps it to border exit 2 (library never process.exits). */
@@ -70,8 +72,12 @@ export type PypiInput = EngineOptions & {
   /** degraded-engine inheritance (todo 10 policy): the check pipeline skips the leg whose engine failed its probe. */
   readonly skipGitleaks?: boolean;
   readonly skipSecretlint?: boolean;
+  /** W4: digest-pinned image (from targets.pypi.sandboxImage); set ⇒ the
+   *  repo-chosen PEP 517 backend executes ONLY inside the container. */
+  readonly sandboxImage?: string;
+  readonly sandboxExec?: DockerExec;
 };
-export type PypiScanResult = { readonly artifacts: readonly PypiArtifact[]; readonly findings: readonly Finding[] };
+export type PypiScanResult = { readonly artifacts: readonly PypiArtifact[]; readonly findings: readonly Finding[]; readonly toolchain?: string };
 
 const ANSI_RE = /\u001B\[[0-9;]*m/g;
 /** Names setuptools emits into the sdist that no source declaration lists (whitelisted metadata). */
@@ -102,8 +108,8 @@ function requireModule(o: EngineOptions, module: "build" | "twine"): void {
 }
 
 /** build-once (G38): wipe stale dist, run `python3 -m build`, content-address every produced artifact. */
-export function buildPypiArtifacts(o: PypiInput): { readonly artifacts: readonly PypiArtifact[]; readonly distDir: string } {
-  requireModule(o, "build");
+export function buildPypiArtifacts(o: PypiInput): { readonly artifacts: readonly PypiArtifact[]; readonly distDir: string; readonly toolchain?: string } {
+  if (o.sandboxImage === undefined) requireModule(o, "build");
   const repoDir = resolve(o.repoDir);
   if (!existsSync(join(repoDir, "pyproject.toml"))) {
     throw new PypiPrerequisiteError(`no pyproject.toml in the repo root — the PyPI pipeline builds from pyproject's own [build-system]`);
@@ -121,9 +127,21 @@ export function buildPypiArtifacts(o: PypiInput): { readonly artifacts: readonly
   for (const name of readdirSync(distDir)) {
     if (name.endsWith(".tar.gz") || name.endsWith(".whl")) rmSync(join(distDir, name), { force: true });
   }
-  const out = spawnEngine(binaryCandidates("python3", o), ["-m", "build", "--no-isolation", "--outdir", distDir, repoDir], o);
-  if (out.status !== 0) {
-    throw new EngineRunError(`\`python3 -m build\` exited ${String(out.status)} — no artifacts to gate (border exit 2). stderr: ${tail(out.stderr)}`, out.status);
+  let sandboxToolchain: string | undefined;
+  if (o.sandboxImage !== undefined) {
+    const run = sandboxRun({
+      spec: { image: o.sandboxImage, docker: o.sandboxExec ?? realDockerExec() },
+      repoDir,
+      outDir: distDir,
+      laneProbes: ["python3"],
+      laneScript: "python3 -m build --no-isolation --outdir /audit/out .",
+    });
+    sandboxToolchain = run.toolchain;
+  } else {
+    const out = spawnEngine(binaryCandidates("python3", o), ["-m", "build", "--no-isolation", "--outdir", distDir, repoDir], o);
+    if (out.status !== 0) {
+      throw new EngineRunError(`\`python3 -m build\` exited ${String(out.status)} — no artifacts to gate (border exit 2). stderr: ${tail(out.stderr)}`, out.status);
+    }
   }
   const names = readdirSync(distDir).filter((n) => n.endsWith(".tar.gz") || n.endsWith(".whl")).sort();
   if (names.length === 0) {
@@ -133,7 +151,7 @@ export function buildPypiArtifacts(o: PypiInput): { readonly artifacts: readonly
     const path = join(distDir, name);
     return { path, kind: name.endsWith(".whl") ? "wheel" : "sdist", sha256: createHash("sha256").update(readFileSync(path)).digest("hex") };
   });
-  return { artifacts, distDir };
+  return { artifacts, distDir, ...(sandboxToolchain !== undefined ? { toolchain: sandboxToolchain } : {}) };
 }
 
 function walkFilesRel(root: string): string[] {
@@ -277,12 +295,14 @@ function twineCheck(o: PypiInput, artifacts: readonly PypiArtifact[], target: st
 
 /** Full todo-12 pipeline: prereqs → build → extract-scan (both artifacts, deduped) → manifest-diff → twine. */
 export async function scanPyPiArtifacts(o: PypiInput): Promise<PypiScanResult> {
-  requireModule(o, "build");
-  requireModule(o, "twine");
+  if (o.sandboxImage === undefined) {
+    requireModule(o, "build");
+    requireModule(o, "twine");
+  }
   const repoDir = resolve(o.repoDir);
   const stateDir = resolve(o.stateDir ?? join(repoDir, ".border"));
   const target = o.target ?? "artifact";
-  const { artifacts } = buildPypiArtifacts(o);
+  const { artifacts, toolchain: pypiToolchain } = buildPypiArtifacts(o);
   const tmpParent = join(stateDir, "tmp");
   mkdirSync(tmpParent, { recursive: true });
 
@@ -349,5 +369,5 @@ export async function scanPyPiArtifacts(o: PypiInput): Promise<PypiScanResult> {
       // non-empty ⇒ a concurrent run owns sandboxes here; leave for the .border/tmp GC
     }
   }
-  return { artifacts, findings: [...merged.entries()].sort(([a], [b]) => (a < b ? -1 : 1)).map(([, f]) => f) };
+  return { artifacts, findings: [...merged.entries()].sort(([a], [b]) => (a < b ? -1 : 1)).map(([, f]) => f), ...(pypiToolchain !== undefined ? { toolchain: pypiToolchain } : {}) };
 }

package/dist/assets/residue-src/rubygems.ts

@@ -36,6 +36,8 @@ import { gemCoherenceFindings } from "../rules/releaseCoherence.ts";
 import { scanTree } from "../engines/gitleaks.ts";
 import { scanPaths, type SecretlintMode } from "../engines/secretlint.ts";
 import { EngineMissingError, EngineRunError, type EngineOptions } from "../engines/support.ts";
+import { sandboxRun, shQuote } from "./sandbox.ts";
+import { realDockerExec, type DockerExec } from "../roundtrip/docker.ts";
 import type { TextSanitizer } from "../redact.ts";
 import { ConfigError } from "../channels/errors.ts";
 import { selectGemspec } from "../channels/gemspec.ts";
@@ -63,6 +65,8 @@ export type GemStageOptions = {
   readonly secretlintMode?: SecretlintMode;
   /** Exact gem binary seam (tests / pinned toolchains); default "gem" on PATH. */
   readonly gemBinPath?: string;
+  /** W4 sandbox seam (only consulted when targets.rubygems.sandboxImage is set). */
+  readonly sandboxExec?: DockerExec;
   /** shared engine/extract timeout. */
   readonly timeoutMs?: number;
   readonly gemTimeoutMs?: number;
@@ -71,6 +75,8 @@ export type GemStageOptions = {
 export type GemStageResult = {
   readonly findings: readonly Finding[];
   readonly artifact: GemArtifactRecord | null;
+  /** Observed in-image toolchain versions (sandbox runs only) — record binding. */
+  readonly toolchain?: string;
 };
 
 function scopeFindingPath(f: Finding, extractDir: string): Finding {
@@ -157,15 +163,18 @@ export async function runRubygemsArtifactStage(o: GemStageOptions): Promise<GemS
   }
   const gemName = `${identity.name}-${identity.version}.gem`;
 
-  const versionCheck = spawnSync(bin, ["--version"], {
-    encoding: "utf8",
-    stdio: "ignore",
-    ...(o.env === undefined ? {} : { env: { ...o.env } }),
-  });
-  if (versionCheck.error !== undefined || versionCheck.status !== 0) {
-    throw new EngineMissingError(
-      `gem (RubyGems) is not available (\`${bin} --version\` failed) — install it (apt-get install ruby-full on Debian/Ubuntu, or via rbenv/rvm) or pass gemBinPath before running border check (border exit 2)`,
-    );
+  const sandboxImage = o.cfg.targets.rubygems.sandboxImage;
+  if (sandboxImage === undefined) {
+    const versionCheck = spawnSync(bin, ["--version"], {
+      encoding: "utf8",
+      stdio: "ignore",
+      ...(o.env === undefined ? {} : { env: { ...o.env } }),
+    });
+    if (versionCheck.error !== undefined || versionCheck.status !== 0) {
+      throw new EngineMissingError(
+        `gem (RubyGems) is not available (\`\${bin} --version\` failed) — install it (apt-get install ruby-full on Debian/Ubuntu, or via rbenv/rvm) or pass gemBinPath before running border check (border exit 2)`,
+      );
+    }
   }
 
   ensureStateDir(repoDir);
@@ -174,17 +183,30 @@ export async function runRubygemsArtifactStage(o: GemStageOptions): Promise<GemS
   mkdirSync(distDir, { recursive: true });
 
   const dist = join(distDir, gemName);
-  const result = spawnSync(bin, ["build", (candidates[0] as { path: string }).path, "-o", dist], {
-    cwd: repoDir,
-    encoding: "utf8",
-    timeout: o.gemTimeoutMs ?? 120_000,
-    ...(o.env === undefined ? {} : { env: { ...o.env } }),
-  });
-  if (result.error !== undefined || result.status !== 0) {
-    throw new EngineRunError(
-      `gem build failed (exit ${String(result.status)}) — nothing to gate: ${(result.stderr ?? "").trim().slice(0, 400)}`,
-      result.status,
-    );
+  let stageToolchain: string | undefined;
+  if (sandboxImage !== undefined) {
+    const relGemspec = relative(repoDir, (candidates[0] as { path: string }).path);
+    const run = sandboxRun({
+      spec: { image: sandboxImage, docker: o.sandboxExec ?? realDockerExec() },
+      repoDir,
+      outDir: distDir,
+      laneProbes: ["gem", "ruby"],
+      laneScript: `gem build ${shQuote(relGemspec)} -o ${shQuote("/audit/out/" + gemName)}`,
+    });
+    stageToolchain = run.toolchain;
+  } else {
+    const result = spawnSync(bin, ["build", (candidates[0] as { path: string }).path, "-o", dist], {
+      cwd: repoDir,
+      encoding: "utf8",
+      timeout: o.gemTimeoutMs ?? 120_000,
+      ...(o.env === undefined ? {} : { env: { ...o.env } }),
+    });
+    if (result.error !== undefined || result.status !== 0) {
+      throw new EngineRunError(
+        `gem build failed (exit ${String(result.status)}) — nothing to gate: ${(result.stderr ?? "").trim().slice(0, 400)}`,
+        result.status,
+      );
+    }
   }
   if (!existsSync(dist)) {
     throw new EngineRunError(`gem build produced no ${gemName} in ${relative(repoDir, distDir)} — failing closed (was the gemspec's literal name/version re-read?)`, null);
@@ -286,5 +308,6 @@ export async function runRubygemsArtifactStage(o: GemStageOptions): Promise<GemS
   return {
     findings,
     artifact: { file: `${BORDER_STATE_DIR}/dist/${gemName}`, sha256, bytes: bytes.length },
+    ...(stageToolchain !== undefined ? { toolchain: stageToolchain } : {}),
   };
 }