persona-harness 0.8.11 → 0.8.14
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli/authority-artifact-binding.d.ts +11 -0
- package/dist/cli/authority-artifact-binding.js +59 -0
- package/dist/cli/authority-artifact-binding.js.map +1 -1
- package/dist/cli/authority-command-surface.d.ts +4 -1
- package/dist/cli/authority-command-surface.js +78 -14
- package/dist/cli/authority-command-surface.js.map +1 -1
- package/dist/cli/authority-command.d.ts +2 -1
- package/dist/cli/authority-command.js +11 -5
- package/dist/cli/authority-command.js.map +1 -1
- package/dist/cli/authority-fetch-worker.d.ts +3 -1
- package/dist/cli/authority-fetch-worker.js +20 -9
- package/dist/cli/authority-fetch-worker.js.map +1 -1
- package/docs/current/release/consumer-authority-beta.md +6 -4
- package/docs/current/release/consumer-authority-v0812-acceptance.json +1101 -0
- package/docs/current/release/consumer-authority-v0813-acceptance.json +1123 -0
- package/docs/current/release/consumer-authority-v0814-acceptance.json +1138 -0
- package/docs/current/release/v0.8.12-release-notes.md +31 -0
- package/docs/current/release/v0.8.13-release-notes.md +19 -0
- package/docs/current/release/v0.8.14-release-notes.md +24 -0
- package/package.json +7 -1
- package/packages/shared-skills/package.json +1 -1
- package/scripts/consumer-authority-observer-gh-stage.d.mts +1 -0
- package/scripts/consumer-authority-observer-gh-stage.mjs +5 -0
- package/scripts/consumer-authority-observer-gh-tool.d.mts +2 -1
- package/scripts/consumer-authority-observer-gh-tool.mjs +11 -2
- package/scripts/consumer-authority-observer-gh-workflow-selector.mjs +2 -0
- package/scripts/consumer-authority-v0812-acceptance-schema.d.mts +40 -0
- package/scripts/consumer-authority-v0812-acceptance-schema.mjs +119 -0
- package/scripts/consumer-authority-v0813-acceptance-schema.d.mts +51 -0
- package/scripts/consumer-authority-v0813-acceptance-schema.mjs +131 -0
- package/scripts/consumer-authority-v0814-acceptance-schema.d.mts +65 -0
- package/scripts/consumer-authority-v0814-acceptance-schema.mjs +146 -0
- package/scripts/fetch-consumer-authority-artifact.mjs +26 -2
- package/scripts/preflight-consumer-authority-external-artifact-transport.mjs +2 -2
- package/scripts/preflight-consumer-authority-external-attestation.mjs +2 -2
|
@@ -1,7 +1,18 @@
|
|
|
1
1
|
import type { AuthorityArtifact } from "./authority-artifact-store.js";
|
|
2
2
|
import type { AuthorityEnrollment } from "./authority-enrollment.js";
|
|
3
3
|
import type { ProjectFinishAttestationVerifierAssessment } from "./project-finish-attestation-verifier.js";
|
|
4
|
+
export type AuthorityArtifactTuple = {
|
|
5
|
+
readonly artifactId: number;
|
|
6
|
+
readonly artifactDigest: string;
|
|
7
|
+
readonly runId: string;
|
|
8
|
+
readonly sourceHead: string;
|
|
9
|
+
};
|
|
10
|
+
export declare function matchesAuthorityArtifactTuple(artifact: AuthorityArtifact, expected: AuthorityArtifactTuple): boolean;
|
|
11
|
+
export declare function classifyAuthorityArtifactTupleReason(artifact: AuthorityArtifact, expected: AuthorityArtifactTuple): AuthorityBindingReason;
|
|
4
12
|
export declare function matchesAuthorityArtifactBinding(artifact: AuthorityArtifact, enrollment: AuthorityEnrollment, assessment: ProjectFinishAttestationVerifierAssessment): boolean;
|
|
5
13
|
export declare const AUTHORITY_BINDING_REASONS: readonly ["artifact", "package-version", "source", "enrollment", "run", "signer", "freshness", "consumption", "verification", "unknown"];
|
|
6
14
|
export type AuthorityBindingReason = typeof AUTHORITY_BINDING_REASONS[number];
|
|
15
|
+
export declare const AUTHORITY_SOURCE_REASONS: readonly ["head", "inputs", "identity", "status", "index", "content", "working-tree", "workspace", "unknown"];
|
|
16
|
+
export type AuthoritySourceReason = typeof AUTHORITY_SOURCE_REASONS[number];
|
|
7
17
|
export declare function classifyAuthorityBindingReason(artifact: AuthorityArtifact, enrollment: AuthorityEnrollment, assessment: ProjectFinishAttestationVerifierAssessment): AuthorityBindingReason;
|
|
18
|
+
export declare function classifyAuthoritySourceReason(artifact: AuthorityArtifact, assessment: ProjectFinishAttestationVerifierAssessment): AuthoritySourceReason;
|
|
@@ -1,5 +1,20 @@
|
|
|
1
1
|
import { matchProjectFinishAttestationEnrollment } from "./project-finish-attestation-policy.js";
|
|
2
2
|
import { projectFinishAttestationReusableCertificateSan } from "./project-finish-attestation-workflow-identity.js";
|
|
3
|
+
export function matchesAuthorityArtifactTuple(artifact, expected) {
|
|
4
|
+
return artifact.artifactId === expected.artifactId
|
|
5
|
+
&& artifact.artifactDigest === expected.artifactDigest
|
|
6
|
+
&& artifact.runId === expected.runId
|
|
7
|
+
&& artifact.sourceHead === expected.sourceHead;
|
|
8
|
+
}
|
|
9
|
+
export function classifyAuthorityArtifactTupleReason(artifact, expected) {
|
|
10
|
+
if (artifact.artifactId !== expected.artifactId || artifact.artifactDigest !== expected.artifactDigest)
|
|
11
|
+
return "artifact";
|
|
12
|
+
if (artifact.runId !== expected.runId)
|
|
13
|
+
return "run";
|
|
14
|
+
if (artifact.sourceHead !== expected.sourceHead)
|
|
15
|
+
return "source";
|
|
16
|
+
return "unknown";
|
|
17
|
+
}
|
|
3
18
|
export function matchesAuthorityArtifactBinding(artifact, enrollment, assessment) {
|
|
4
19
|
const receipt = assessment.receipt;
|
|
5
20
|
return assessment.authorityEligible
|
|
@@ -23,6 +38,17 @@ export const AUTHORITY_BINDING_REASONS = [
|
|
|
23
38
|
"verification",
|
|
24
39
|
"unknown",
|
|
25
40
|
];
|
|
41
|
+
export const AUTHORITY_SOURCE_REASONS = [
|
|
42
|
+
"head",
|
|
43
|
+
"inputs",
|
|
44
|
+
"identity",
|
|
45
|
+
"status",
|
|
46
|
+
"index",
|
|
47
|
+
"content",
|
|
48
|
+
"working-tree",
|
|
49
|
+
"workspace",
|
|
50
|
+
"unknown",
|
|
51
|
+
];
|
|
26
52
|
export function classifyAuthorityBindingReason(artifact, enrollment, assessment) {
|
|
27
53
|
const stateReason = classifyAssessmentState(assessment.state);
|
|
28
54
|
if (stateReason !== undefined)
|
|
@@ -35,6 +61,16 @@ export function classifyAuthorityBindingReason(artifact, enrollment, assessment)
|
|
|
35
61
|
}
|
|
36
62
|
return classifyDiagnosticReason(assessment.diagnostics);
|
|
37
63
|
}
|
|
64
|
+
export function classifyAuthoritySourceReason(artifact, assessment) {
|
|
65
|
+
if (assessment.state === "source-drift") {
|
|
66
|
+
const diagnostic = assessment.diagnostics.find(({ code }) => code === "source-drift");
|
|
67
|
+
return classifySourceDiagnosticPath(diagnostic?.path);
|
|
68
|
+
}
|
|
69
|
+
const receipt = assessment.receipt;
|
|
70
|
+
return receipt !== undefined && artifact.sourceHead !== receipt.source.head
|
|
71
|
+
? "head"
|
|
72
|
+
: "unknown";
|
|
73
|
+
}
|
|
38
74
|
function classifyAssessmentState(state) {
|
|
39
75
|
switch (state) {
|
|
40
76
|
case "source-drift":
|
|
@@ -106,6 +142,29 @@ function classifyDiagnosticPath(path) {
|
|
|
106
142
|
return "artifact";
|
|
107
143
|
return undefined;
|
|
108
144
|
}
|
|
145
|
+
function classifySourceDiagnosticPath(path) {
|
|
146
|
+
switch (path) {
|
|
147
|
+
case "source.repositoryHead":
|
|
148
|
+
return "head";
|
|
149
|
+
case "source.inputs":
|
|
150
|
+
return "inputs";
|
|
151
|
+
case "source.identity":
|
|
152
|
+
case "source.git":
|
|
153
|
+
return "identity";
|
|
154
|
+
case "source.gitStatusDigest":
|
|
155
|
+
return "status";
|
|
156
|
+
case "source.trackedIndexDigest":
|
|
157
|
+
return "index";
|
|
158
|
+
case "source.contentDigest":
|
|
159
|
+
return "content";
|
|
160
|
+
case "source.workingTreeBytesDifferFromMatchingGitIndex":
|
|
161
|
+
return "working-tree";
|
|
162
|
+
case "workspace":
|
|
163
|
+
return "workspace";
|
|
164
|
+
default:
|
|
165
|
+
return "unknown";
|
|
166
|
+
}
|
|
167
|
+
}
|
|
109
168
|
function assertNever(value) {
|
|
110
169
|
throw new Error(`authority-binding-state:${String(value)}`);
|
|
111
170
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authority-artifact-binding.js","sourceRoot":"","sources":["../../src/cli/authority-artifact-binding.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAA;AAMhG,OAAO,EAAE,8CAA8C,EAAE,MAAM,mDAAmD,CAAA;
|
|
1
|
+
{"version":3,"file":"authority-artifact-binding.js","sourceRoot":"","sources":["../../src/cli/authority-artifact-binding.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAA;AAMhG,OAAO,EAAE,8CAA8C,EAAE,MAAM,mDAAmD,CAAA;AASlH,MAAM,UAAU,6BAA6B,CAC3C,QAA2B,EAC3B,QAAgC;IAEhC,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;WAC7C,QAAQ,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;WACnD,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;WACjC,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,CAAA;AAClD,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,QAA2B,EAC3B,QAAgC;IAEhC,IAAI,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;QAAE,OAAO,UAAU,CAAA;IACzH,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IACnD,IAAI,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;QAAE,OAAO,QAAQ,CAAA;IAChE,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,QAA2B,EAC3B,UAA+B,EAC/B,UAAsD;IAEtD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAA;IAClC,OAAO,UAAU,CAAC,iBAAiB;WAC9B,OAAO,KAAK,SAAS;WACrB,QAAQ,CAAC,YAAY,KAAK,OAAO,CAAC,UAAU,CAAC,EAAE;WAC/C,QAAQ,CAAC,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI;WAC3C,QAAQ,CAAC,KAAK,KAAK,OAAO,CAAC,SAAS,CAAC,KAAK;WAC1C,QAAQ,CAAC,KAAK,KAAK,OAAO,CAAC,QAAQ,CAAC,KAAK;WACzC,OAAO,CAAC,QAAQ,CAAC,cAAc,KAAK,8CAA8C,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;WACjH,uCAAuC,CAAC,OAAO,EAAE,UAAU,CAAC,KAAK,SAAS,CAAA;AACjF,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,UAAU;IACV,iBAAiB;IACjB,QAAQ;IACR,YAAY;IACZ,KAAK;IACL,QAAQ;IACR,WAAW;IACX,aAAa;IACb,cAAc;IACd,SAAS;CACD,CAAA;AAIV,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,MAAM;IACN,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,OAAO;IACP,SAAS;IACT,cAAc;IACd,WAAW;IACX,SAAS;CACD,CAAA;AAIV,MAAM,UAAU,8BAA8B,CAC5C,QAA2B,EAC3B,UAA+B,EAC/B,UAAsD;IAEtD,MAAM,WAAW,GAAG,uBAAuB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IAC7D,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,WAAW,CAAA;IAEjD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAA;IAClC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,aAAa,GAAG,4BAA4B,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;QACjF,IAAI,aAAa,KAAK,SAAS;YAAE,OAAO,aAAa,CAAA;IACvD,CAAC;IAED,OAAO,wBAAwB,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;AACzD,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,QAA2B,EAC3B,UAAsD;IAEtD,IAAI,UAAU,CAAC,KAAK,KAAK,cAAc,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,KAAK,cAAc,CAAC,CAAA;QACrF,OAAO,4BAA4B,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;IACvD,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAA;IAClC,OAAO,OAAO,KAAK,SAAS,IAAI,QAAQ,CAAC,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI;QACzE,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED,SAAS,uBAAuB,CAC9B,KAA0D;IAE1D,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,cAAc;YACjB,OAAO,QAAQ,CAAA;QACjB,KAAK,OAAO;YACV,OAAO,WAAW,CAAA;QACpB,KAAK,UAAU;YACb,OAAO,aAAa,CAAA;QACtB,KAAK,qBAAqB;YACxB,OAAO,QAAQ,CAAA;QACjB,KAAK,eAAe,CAAC;QACrB,KAAK,iBAAiB,CAAC;QACvB,KAAK,qBAAqB,CAAC;QAC3B,KAAK,qBAAqB,CAAC;QAC3B,KAAK,mBAAmB,CAAC;QACzB,KAAK,sBAAsB,CAAC;QAC5B,KAAK,wBAAwB,CAAC;QAC9B,KAAK,sBAAsB;YACzB,OAAO,cAAc,CAAA;QACvB,KAAK,kBAAkB,CAAC;QACxB,KAAK,cAAc,CAAC;QACpB,KAAK,SAAS;YACZ,OAAO,SAAS,CAAA;QAClB,KAAK,WAAW,CAAC;QACjB,KAAK,kBAAkB,CAAC;QACxB,KAAK,SAAS;YACZ,OAAO,UAAU,CAAA;QACnB;YACE,OAAO,WAAW,CAAC,KAAK,CAAC,CAAA;IAC7B,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CACnC,QAA2B,EAC3B,UAA+B,EAC/B,OAAwC;IAExC,IAAI,QAAQ,CAAC,YAAY,KAAK,OAAO,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,YAAY,CAAA;IACxE,IAAI,QAAQ,CAAC,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAA;IAChE,IAAI,QAAQ,CAAC,KAAK,KAAK,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,KAAK,OAAO,CAAC,QAAQ,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IACzG,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,KAAK,8CAA8C,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtH,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,MAAM,kBAAkB,GAAG,uCAAuC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IACvF,IAAI,kBAAkB,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACtD,OAAO,kBAAkB,CAAC,IAAI,KAAK,8BAA8B,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAA;AAC7F,CAAC;AAED,SAAS,wBAAwB,CAC/B,WAAkE;IAElE,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,sBAAsB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;QACtD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAA;IACzC,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC1C,IAAI,IAAI,KAAK,6BAA6B;QAAE,OAAO,iBAAiB,CAAA;IACpE,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC;QAAE,OAAO,aAAa,CAAA;IACzD,IAAI,IAAI,KAAK,8BAA8B,IAAI,IAAI,KAAK,4BAA4B;QAAE,OAAO,QAAQ,CAAA;IACrG,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO,YAAY,CAAA;IACvD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,QAAQ,CAAA;IAC9D,IAAI,IAAI,KAAK,6BAA6B;QAAE,OAAO,WAAW,CAAA;IAC9D,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,UAAU,CAAA;IACtH,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,4BAA4B,CAAC,IAAwB;IAC5D,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,uBAAuB;YAC1B,OAAO,MAAM,CAAA;QACf,KAAK,eAAe;YAClB,OAAO,QAAQ,CAAA;QACjB,KAAK,iBAAiB,CAAC;QACvB,KAAK,YAAY;YACf,OAAO,UAAU,CAAA;QACnB,KAAK,wBAAwB;YAC3B,OAAO,QAAQ,CAAA;QACjB,KAAK,2BAA2B;YAC9B,OAAO,OAAO,CAAA;QAChB,KAAK,sBAAsB;YACzB,OAAO,SAAS,CAAA;QAClB,KAAK,mDAAmD;YACtD,OAAO,cAAc,CAAA;QACvB,KAAK,WAAW;YACd,OAAO,WAAW,CAAA;QACpB;YACE,OAAO,SAAS,CAAA;IACpB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAY;IAC/B,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;AAC7D,CAAC"}
|
|
@@ -1,4 +1,6 @@
|
|
|
1
|
+
import type { AuthorityArtifactTuple } from "./authority-artifact-binding.js";
|
|
1
2
|
import type { AuthorityBindingReason } from "./authority-artifact-binding.js";
|
|
3
|
+
import type { AuthoritySourceReason } from "./authority-artifact-binding.js";
|
|
2
4
|
import type { CliRunResult } from "./bearshell.js";
|
|
3
5
|
import type { GithubAuthorityFetchDiagnostic } from "./authority-fetch-worker.js";
|
|
4
6
|
export type AuthorityStatus = {
|
|
@@ -10,6 +12,7 @@ export type AuthorityStatus = {
|
|
|
10
12
|
readonly state: "authentication-unavailable" | "enrollment-unavailable" | "missing" | "trusted";
|
|
11
13
|
};
|
|
12
14
|
export type AuthorityFetchArgs = {
|
|
15
|
+
readonly artifactTuple?: AuthorityArtifactTuple;
|
|
13
16
|
readonly json: boolean;
|
|
14
17
|
readonly repositorySlug?: string;
|
|
15
18
|
};
|
|
@@ -25,5 +28,5 @@ export declare function parseEnrollmentArgs(args: readonly string[]): {
|
|
|
25
28
|
export declare function textStatus(summary: AuthorityStatus, explain: boolean): CliRunResult;
|
|
26
29
|
export declare function jsonStatus(summary: AuthorityStatus): CliRunResult;
|
|
27
30
|
export declare function invalidAuthorityCommand(invocationName: string): CliRunResult;
|
|
28
|
-
export declare function blockedFetch(json: boolean, state: string, next?: AuthorityStatus["next"], diagnostic?: GithubAuthorityFetchDiagnostic, bindingReason?: AuthorityBindingReason): CliRunResult;
|
|
31
|
+
export declare function blockedFetch(json: boolean, state: string, next?: AuthorityStatus["next"], diagnostic?: GithubAuthorityFetchDiagnostic, bindingReason?: AuthorityBindingReason, sourceReason?: AuthoritySourceReason): CliRunResult;
|
|
29
32
|
export declare function githubAuthenticationRequired(): CliRunResult;
|
|
@@ -8,24 +8,86 @@ export function authorityUsage(invocationName = "ph") {
|
|
|
8
8
|
" explain [--json] Explain the bounded next authority step.",
|
|
9
9
|
" enroll github <owner/repository> --workflow <path>",
|
|
10
10
|
" Interactively enroll a public GitHub workflow pin.",
|
|
11
|
-
" fetch github [owner/repository]
|
|
12
|
-
"
|
|
11
|
+
" fetch github [owner/repository] --artifact-id <id> --run-id <id>",
|
|
12
|
+
" --source-head <sha> --artifact-digest <sha256> [--json]",
|
|
13
|
+
" Fetch one explicit original artifact without consuming it.",
|
|
13
14
|
].join("\n");
|
|
14
15
|
}
|
|
15
16
|
export function parseReadOnlyArgs(args) {
|
|
16
17
|
return args.length === 0 ? { json: false } : args.length === 1 && args[0] === "--json" ? { json: true } : undefined;
|
|
17
18
|
}
|
|
18
19
|
export function parseFetchArgs(args) {
|
|
19
|
-
if (args
|
|
20
|
-
return
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
20
|
+
if (args[0] !== "github")
|
|
21
|
+
return undefined;
|
|
22
|
+
let cursor = 1;
|
|
23
|
+
const repositorySlug = args[cursor]?.startsWith("--") === false ? args[cursor++] : undefined;
|
|
24
|
+
if (repositorySlug !== undefined && !isPublicRepositorySlug(repositorySlug))
|
|
25
|
+
return undefined;
|
|
26
|
+
let json = false;
|
|
27
|
+
let artifactId;
|
|
28
|
+
let artifactDigest;
|
|
29
|
+
let runId;
|
|
30
|
+
let sourceHead;
|
|
31
|
+
while (cursor < args.length) {
|
|
32
|
+
const flag = args[cursor++];
|
|
33
|
+
if (flag === "--json" && !json) {
|
|
34
|
+
json = true;
|
|
35
|
+
continue;
|
|
36
|
+
}
|
|
37
|
+
const value = args[cursor++];
|
|
38
|
+
if (value === undefined || value.startsWith("--"))
|
|
39
|
+
return undefined;
|
|
40
|
+
switch (flag) {
|
|
41
|
+
case "--artifact-id":
|
|
42
|
+
if (artifactId !== undefined)
|
|
43
|
+
return undefined;
|
|
44
|
+
artifactId = value;
|
|
45
|
+
break;
|
|
46
|
+
case "--artifact-digest":
|
|
47
|
+
if (artifactDigest !== undefined)
|
|
48
|
+
return undefined;
|
|
49
|
+
artifactDigest = value;
|
|
50
|
+
break;
|
|
51
|
+
case "--run-id":
|
|
52
|
+
if (runId !== undefined)
|
|
53
|
+
return undefined;
|
|
54
|
+
runId = value;
|
|
55
|
+
break;
|
|
56
|
+
case "--source-head":
|
|
57
|
+
if (sourceHead !== undefined)
|
|
58
|
+
return undefined;
|
|
59
|
+
sourceHead = value;
|
|
60
|
+
break;
|
|
61
|
+
default:
|
|
62
|
+
return undefined;
|
|
63
|
+
}
|
|
64
|
+
}
|
|
65
|
+
const tuple = parseArtifactTuple(artifactId, artifactDigest, runId, sourceHead);
|
|
66
|
+
return tuple === undefined
|
|
67
|
+
? { json, repositorySlug }
|
|
68
|
+
: { artifactTuple: tuple, json, repositorySlug };
|
|
69
|
+
}
|
|
70
|
+
function parseArtifactTuple(artifactId, artifactDigest, runId, sourceHead) {
|
|
71
|
+
if (artifactId === undefined && artifactDigest === undefined && runId === undefined && sourceHead === undefined)
|
|
72
|
+
return undefined;
|
|
73
|
+
if (artifactId === undefined
|
|
74
|
+
|| artifactDigest === undefined
|
|
75
|
+
|| runId === undefined
|
|
76
|
+
|| sourceHead === undefined
|
|
77
|
+
|| !/^[1-9][0-9]{0,18}$/u.test(artifactId)
|
|
78
|
+
|| !/^[1-9][0-9]{0,18}$/u.test(runId)
|
|
79
|
+
|| !/^[a-f0-9]{40}$/iu.test(sourceHead)
|
|
80
|
+
|| !/^sha256:[a-f0-9]{64}$/iu.test(artifactDigest))
|
|
25
81
|
return undefined;
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
82
|
+
const parsedArtifactId = Number(artifactId);
|
|
83
|
+
return Number.isSafeInteger(parsedArtifactId)
|
|
84
|
+
? {
|
|
85
|
+
artifactId: parsedArtifactId,
|
|
86
|
+
artifactDigest: artifactDigest.toLowerCase(),
|
|
87
|
+
runId,
|
|
88
|
+
sourceHead: sourceHead.toLowerCase(),
|
|
89
|
+
}
|
|
90
|
+
: undefined;
|
|
29
91
|
}
|
|
30
92
|
export function parseEnrollmentArgs(args) {
|
|
31
93
|
if (args.length !== 4 || args[0] !== "github" || args[2] !== "--workflow")
|
|
@@ -66,7 +128,8 @@ export function jsonStatus(summary) {
|
|
|
66
128
|
export function invalidAuthorityCommand(invocationName) {
|
|
67
129
|
return { status: 1, stdout: "", stderr: `${authorityUsage(invocationName)}\n` };
|
|
68
130
|
}
|
|
69
|
-
export function blockedFetch(json, state, next = "authority-fetch-github", diagnostic, bindingReason) {
|
|
131
|
+
export function blockedFetch(json, state, next = "authority-fetch-github", diagnostic, bindingReason, sourceReason) {
|
|
132
|
+
const normalizedSourceReason = bindingReason === "source" ? sourceReason : undefined;
|
|
70
133
|
return {
|
|
71
134
|
status: 1,
|
|
72
135
|
stdout: json
|
|
@@ -75,11 +138,12 @@ export function blockedFetch(json, state, next = "authority-fetch-github", diagn
|
|
|
75
138
|
consumptionState: "not-applicable",
|
|
76
139
|
...(diagnostic === undefined ? {} : { diagnostic }),
|
|
77
140
|
...(bindingReason === undefined ? {} : { bindingReason }),
|
|
141
|
+
...(normalizedSourceReason === undefined ? {} : { sourceReason: normalizedSourceReason }),
|
|
78
142
|
next,
|
|
79
|
-
schemaVersion: "consumer-authority-fetch.
|
|
143
|
+
schemaVersion: "consumer-authority-fetch.4",
|
|
80
144
|
state,
|
|
81
145
|
})}\n`
|
|
82
|
-
: `Consumer authority fetch: BLOCKED (${state})${diagnostic === undefined ? "" : `; diagnostic: ${diagnostic}`}${bindingReason === undefined ? "" : `; binding reason: ${bindingReason}`}. No evidence was retained or consumed.\n`,
|
|
146
|
+
: `Consumer authority fetch: BLOCKED (${state})${diagnostic === undefined ? "" : `; diagnostic: ${diagnostic}`}${bindingReason === undefined ? "" : `; binding reason: ${bindingReason}`}${normalizedSourceReason === undefined ? "" : `; source reason: ${normalizedSourceReason}`}. No evidence was retained or consumed.\n`,
|
|
83
147
|
stderr: "",
|
|
84
148
|
};
|
|
85
149
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authority-command-surface.js","sourceRoot":"","sources":["../../src/cli/authority-command-surface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAA;
|
|
1
|
+
{"version":3,"file":"authority-command-surface.js","sourceRoot":"","sources":["../../src/cli/authority-command-surface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAA;AAsB3E,MAAM,UAAU,cAAc,CAAC,cAAc,GAAG,IAAI;IAClD,OAAO;QACL,UAAU,cAAc,oDAAoD;QAC5E,EAAE;QACF,WAAW;QACX,+FAA+F;QAC/F,oFAAoF;QACpF,sDAAsD;QACtD,6FAA6F;QAC7F,oEAAoE;QACpE,6DAA6D;QAC7D,qGAAqG;KACtG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAuB;IACvD,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AACrH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAuB;IACpD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC1C,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC5F,IAAI,cAAc,KAAK,SAAS,IAAI,CAAC,sBAAsB,CAAC,cAAc,CAAC;QAAE,OAAO,SAAS,CAAA;IAC7F,IAAI,IAAI,GAAG,KAAK,CAAA;IAChB,IAAI,UAA8B,CAAA;IAClC,IAAI,cAAkC,CAAA;IACtC,IAAI,KAAyB,CAAA;IAC7B,IAAI,UAA8B,CAAA;IAClC,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;QAC3B,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAC/B,IAAI,GAAG,IAAI,CAAA;YACX,SAAQ;QACV,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;QAC5B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAA;QACnE,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,eAAe;gBAClB,IAAI,UAAU,KAAK,SAAS;oBAAE,OAAO,SAAS,CAAA;gBAC9C,UAAU,GAAG,KAAK,CAAA;gBAClB,MAAK;YACP,KAAK,mBAAmB;gBACtB,IAAI,cAAc,KAAK,SAAS;oBAAE,OAAO,SAAS,CAAA;gBAClD,cAAc,GAAG,KAAK,CAAA;gBACtB,MAAK;YACP,KAAK,UAAU;gBACb,IAAI,KAAK,KAAK,SAAS;oBAAE,OAAO,SAAS,CAAA;gBACzC,KAAK,GAAG,KAAK,CAAA;gBACb,MAAK;YACP,KAAK,eAAe;gBAClB,IAAI,UAAU,KAAK,SAAS;oBAAE,OAAO,SAAS,CAAA;gBAC9C,UAAU,GAAG,KAAK,CAAA;gBAClB,MAAK;YACP;gBACE,OAAO,SAAS,CAAA;QACpB,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;IAC/E,OAAO,KAAK,KAAK,SAAS;QACxB,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE;QAC1B,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAA;AACpD,CAAC;AAED,SAAS,kBAAkB,CACzB,UAA8B,EAC9B,cAAkC,EAClC,KAAyB,EACzB,UAA8B;IAE9B,IAAI,UAAU,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACjI,IACE,UAAU,KAAK,SAAS;WACrB,cAAc,KAAK,SAAS;WAC5B,KAAK,KAAK,SAAS;WACnB,UAAU,KAAK,SAAS;WACxB,CAAC,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC;WACvC,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;WAClC,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC;WACpC,CAAC,yBAAyB,CAAC,IAAI,CAAC,cAAc,CAAC;QAClD,OAAO,SAAS,CAAA;IAClB,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC,CAAA;IAC3C,OAAO,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC;QAC3C,CAAC,CAAC;YACE,UAAU,EAAE,gBAAgB;YAC5B,cAAc,EAAE,cAAc,CAAC,WAAW,EAAE;YAC5C,KAAK;YACL,UAAU,EAAE,UAAU,CAAC,WAAW,EAAE;SACrC;QACH,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IAIzD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY;QAAE,OAAO,SAAS,CAAA;IAC3F,MAAM,cAAc,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IAC5B,MAAM,UAAU,GAAG,+BAA+B,CAAC;QACjD,kBAAkB,EAAE,YAAY;QAChC,YAAY,EAAE,CAAC;QACf,cAAc,EAAE,cAAc,IAAI,EAAE;QACpC,mBAAmB,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;KACpC,CAAC,CAAA;IACF,OAAO,UAAU,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS;QAC7D,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,CAAC,kBAAkB,EAAE,CAAA;AACrE,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAwB,EAAE,OAAgB;IACnE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;IACjE,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,EAAE;YACN,eAAe,OAAO,CAAC,UAAU,EAAE;YACnC,0BAA0B,OAAO,CAAC,oBAAoB,EAAE;YACxD,uBAAuB,KAAK,EAAE;YAC9B,gBAAgB,OAAO,CAAC,gBAAgB,EAAE;YAC1C,SAAS,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;SAC3C,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI;QACnB,MAAM,EAAE,EAAE;KACX,CAAA;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAwB;IACjD,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,6BAA6B,EAAE,GAAG,OAAO,EAAE,CAAC,IAAI;QAC3F,MAAM,EAAE,EAAE;KACX,CAAA;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,cAAsB;IAC5D,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;AACjF,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,IAAa,EACb,KAAa,EACb,OAAgC,wBAAwB,EACxD,UAA2C,EAC3C,aAAsC,EACtC,YAAoC;IAEpC,MAAM,sBAAsB,GAAG,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAA;IACpF,OAAO;QACL,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,IAAI;YACV,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;gBAClB,iBAAiB,EAAE,KAAK;gBACxB,gBAAgB,EAAE,gBAAgB;gBAClC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;gBACnD,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;gBACzD,GAAG,CAAC,sBAAsB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,sBAAsB,EAAE,CAAC;gBACzF,IAAI;gBACJ,aAAa,EAAE,4BAA4B;gBAC3C,KAAK;aACN,CAAC,IAAI;YACN,CAAC,CAAC,sCAAsC,KAAK,IAAI,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,UAAU,EAAE,GAAG,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB,aAAa,EAAE,GAAG,sBAAsB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,sBAAsB,EAAE,2CAA2C;QAChU,MAAM,EAAE,EAAE;KACX,CAAA;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B;IAC1C,OAAO;QACL,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,uIAAuI;KAChJ,CAAA;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAA6B,EAAE,OAAgB;IAC/D,IAAI,IAAI,KAAK,qBAAqB;QAAE,OAAO,OAAO;YAChD,CAAC,CAAC,2GAA2G;YAC7G,CAAC,CAAC,qBAAqB,CAAA;IACzB,IAAI,IAAI,KAAK,yBAAyB;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,sEAAsE,CAAC,CAAC,CAAC,yBAAyB,CAAA;IAC3J,IAAI,IAAI,KAAK,wBAAwB;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,+DAA+D,CAAC,CAAC,CAAC,wBAAwB,CAAA;IAClJ,OAAO,OAAO,CAAC,CAAC,CAAC,kEAAkE,CAAC,CAAC,CAAC,iBAAiB,CAAA;AACzG,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,OAAO,OAAO,KAAK,KAAK,QAAQ;WAC3B,KAAK,CAAC,MAAM,GAAG,CAAC;WAChB,KAAK,CAAC,MAAM,IAAI,GAAG;WACnB,qCAAqC,CAAC,IAAI,CAAC,KAAK,CAAC;WACjD,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,CAAA;AACtE,CAAC"}
|
|
@@ -1,10 +1,11 @@
|
|
|
1
1
|
import { type AuthorityArtifact } from "./authority-artifact-store.js";
|
|
2
|
+
import { type AuthorityArtifactTuple } from "./authority-artifact-binding.js";
|
|
2
3
|
import { type AuthorityEnrollment, type AuthorityEnrollmentReadback, type AuthorityEnrollmentStoreOptions } from "./authority-enrollment.js";
|
|
3
4
|
import { type AuthorityStatus } from "./authority-command-surface.js";
|
|
4
5
|
import { type ProjectFinishAttestationVerifierAssessment } from "./project-finish-attestation-verifier.js";
|
|
5
6
|
import type { CliRunResult } from "./bearshell.js";
|
|
6
7
|
type AuthorityCommandOptions = AuthorityEnrollmentStoreOptions & {
|
|
7
|
-
readonly artifactFetch?: (projectDir: string, enrollment: AuthorityEnrollment) => AuthorityArtifact | undefined;
|
|
8
|
+
readonly artifactFetch?: (projectDir: string, enrollment: AuthorityEnrollment, expected: AuthorityArtifactTuple) => AuthorityArtifact | undefined;
|
|
8
9
|
readonly artifactInspector?: (projectDir: string, enrollment: AuthorityEnrollment, archive: Buffer, now: Date) => ProjectFinishAttestationVerifierAssessment;
|
|
9
10
|
readonly confirmEnrollment?: boolean;
|
|
10
11
|
readonly enrollmentReadback?: (repositorySlug: string, workflowPath: string) => AuthorityEnrollmentReadback | undefined;
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { writeAuthorityArtifact } from "./authority-artifact-store.js";
|
|
2
|
-
import { classifyAuthorityBindingReason, matchesAuthorityArtifactBinding, } from "./authority-artifact-binding.js";
|
|
2
|
+
import { classifyAuthorityBindingReason, classifyAuthoritySourceReason, classifyAuthorityArtifactTupleReason, matchesAuthorityArtifactTuple, matchesAuthorityArtifactBinding, } from "./authority-artifact-binding.js";
|
|
3
3
|
import { authorityEnrollmentFromReadback, readAuthorityEnrollments, writeAuthorityEnrollment, } from "./authority-enrollment.js";
|
|
4
4
|
import { readGithubAuthorityEnrollment } from "./authority-github-readback-worker.js";
|
|
5
5
|
import { fetchGithubAuthorityArtifact } from "./authority-fetch-worker.js";
|
|
@@ -61,6 +61,8 @@ function runFetch(args, options, invocationName) {
|
|
|
61
61
|
const parsed = parseFetchArgs(args);
|
|
62
62
|
if (parsed === undefined)
|
|
63
63
|
return invalidAuthorityCommand(invocationName);
|
|
64
|
+
if (parsed.artifactTuple === undefined)
|
|
65
|
+
return blockedFetch(parsed.json, "selection-required");
|
|
64
66
|
const entries = readAuthorityEnrollments(options);
|
|
65
67
|
if (entries.state !== "ready") {
|
|
66
68
|
const summary = readAuthorityStatus(options);
|
|
@@ -79,8 +81,8 @@ function runFetch(args, options, invocationName) {
|
|
|
79
81
|
return blockedFetch(parsed.json, "authentication-unavailable", "github-authenticate");
|
|
80
82
|
}
|
|
81
83
|
const fetched = options.artifactFetch === undefined
|
|
82
|
-
? fetchGithubAuthorityArtifact(projectDir, enrollment, options.githubToken, options.now ?? new Date())
|
|
83
|
-
: { artifact: options.artifactFetch(projectDir, enrollment), kind: "ready" };
|
|
84
|
+
? fetchGithubAuthorityArtifact(projectDir, enrollment, parsed.artifactTuple, options.githubToken, options.now ?? new Date())
|
|
85
|
+
: { artifact: options.artifactFetch(projectDir, enrollment, parsed.artifactTuple), kind: "ready" };
|
|
84
86
|
if (fetched.kind === "blocked") {
|
|
85
87
|
return blockedFetch(parsed.json, "missing", "authority-fetch-github", fetched.diagnostic);
|
|
86
88
|
}
|
|
@@ -88,9 +90,13 @@ function runFetch(args, options, invocationName) {
|
|
|
88
90
|
if (artifact === undefined || artifact.repositoryId !== enrollment.repositoryId) {
|
|
89
91
|
return blockedFetch(parsed.json, "missing");
|
|
90
92
|
}
|
|
93
|
+
if (!matchesAuthorityArtifactTuple(artifact, parsed.artifactTuple)) {
|
|
94
|
+
return blockedFetch(parsed.json, "binding-mismatch", "authority-fetch-github", undefined, classifyAuthorityArtifactTupleReason(artifact, parsed.artifactTuple));
|
|
95
|
+
}
|
|
91
96
|
const assessment = (options.artifactInspector ?? inspectProjectFinishAttestationArtifact)(projectDir, enrollment, artifact.archive, options.now ?? new Date());
|
|
92
97
|
if (!matchesAuthorityArtifactBinding(artifact, enrollment, assessment)) {
|
|
93
|
-
|
|
98
|
+
const bindingReason = classifyAuthorityBindingReason(artifact, enrollment, assessment);
|
|
99
|
+
return blockedFetch(parsed.json, "binding-mismatch", "authority-fetch-github", undefined, bindingReason, bindingReason === "source" ? classifyAuthoritySourceReason(artifact, assessment) : undefined);
|
|
94
100
|
}
|
|
95
101
|
if (!writeAuthorityArtifact(artifact, options)) {
|
|
96
102
|
return blockedFetch(parsed.json, "binding-mismatch");
|
|
@@ -108,7 +114,7 @@ function runFetch(args, options, invocationName) {
|
|
|
108
114
|
},
|
|
109
115
|
consumptionState: assessment.consumptionState,
|
|
110
116
|
next: "workflow-finish",
|
|
111
|
-
schemaVersion: "consumer-authority-fetch.
|
|
117
|
+
schemaVersion: "consumer-authority-fetch.4",
|
|
112
118
|
state: "trusted",
|
|
113
119
|
})}\n`
|
|
114
120
|
: "Fetched and verified matching original public evidence. Artifact identity was retained. No completion authority was consumed.\n",
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authority-command.js","sourceRoot":"","sources":["../../src/cli/authority-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAA0B,MAAM,+BAA+B,CAAA;AAC9F,OAAO,EACL,8BAA8B,EAC9B,+BAA+B,
|
|
1
|
+
{"version":3,"file":"authority-command.js","sourceRoot":"","sources":["../../src/cli/authority-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAA0B,MAAM,+BAA+B,CAAA;AAC9F,OAAO,EACL,8BAA8B,EAC9B,6BAA6B,EAC7B,oCAAoC,EACpC,6BAA6B,EAC7B,+BAA+B,GAEhC,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,+BAA+B,EAE/B,wBAAwB,EACxB,wBAAwB,GAIzB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAA;AACrF,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAA;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACpE,OAAO,EACL,cAAc,EACd,YAAY,EACZ,4BAA4B,EAC5B,uBAAuB,EACvB,UAAU,EACV,mBAAmB,EACnB,cAAc,EACd,iBAAiB,EACjB,UAAU,GAEX,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,qCAAqC,EAAE,MAAM,oCAAoC,CAAA;AAC1F,OAAO,EACL,uCAAuC,GAExC,MAAM,0CAA0C,CAAA;AAiBjD,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAC/D,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,GACxB,MAAM,2BAA2B,CAAA;AAGlC,MAAM,UAAU,mBAAmB,CACjC,IAAuB,EACvB,UAAmC,EAAE,EACrC,cAAc,GAAG,IAAI;IAErB,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IACvB,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5F,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IACjF,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC/C,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,uBAAuB,CAAC,cAAc,CAAC,CAAA;QACxE,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;QAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,KAAK,SAAS,CAAC,CAAA;IACvF,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,CAAA;IAC9D,CAAC;IACD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,CAAA;IACzD,CAAC;IACD,OAAO,uBAAuB,CAAC,cAAc,CAAC,CAAA;AAChD,CAAC;AAED,SAAS,aAAa,CACpB,IAAuB,EACvB,OAAgC,EAChC,cAAsB;IAEtB,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;IACxC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,uBAAuB,CAAC,cAAc,CAAC,CAAA;IACxE,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7F,OAAO,4BAA4B,EAAE,CAAA;IACvC,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC/B,OAAO;YACL,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,oEAAoE;SAC7E,CAAA;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,kBAAkB,IAAI,CAAC,CAAC,cAAc,EAAE,YAAY,EAAE,EAAE,CAChF,6BAA6B,CAC3B,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,EACnC,cAAc,EACd,YAAY,EACZ,OAAO,CAAC,WAAW,CACpB,CAAC,CAAC,CACH,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,YAAY,CACpB,CAAA;IACD,MAAM,UAAU,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,+BAA+B,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;IAC9G,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc,IAAI,UAAU,CAAC,kBAAkB,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC;QAC7I,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,kFAAkF,EAAE,CAAA;IAC9H,CAAC;IACD,IAAI,CAAC,wBAAwB,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC;QACnD,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,6DAA6D,EAAE,CAAA;IACzG,CAAC;IACD,OAAO;QACL,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,iFAAiF;QACzF,MAAM,EAAE,EAAE;KACX,CAAA;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAuB,EAAE,OAAgC,EAAE,cAAsB;IACjG,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IACnC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,uBAAuB,CAAC,cAAc,CAAC,CAAA;IACxE,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAA;IAC9F,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAA;IACjD,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;QAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACvE,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,KAAK,SAAS;QACpD,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QAC3D,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc,CAAC,CAAA;IACjF,IAAI,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAChG,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAA;IACxD,CAAC;IACD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IACzE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAA;IACtD,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACxF,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,4BAA4B,EAAE,qBAAqB,CAAC,CAAA;IACvF,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,KAAK,SAAS;QACjD,CAAC,CAAC,4BAA4B,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QAC5H,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAgB,EAAE,CAAA;IAC7G,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,wBAAwB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;IAC3F,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;IACjC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,YAAY,KAAK,UAAU,CAAC,YAAY,EAAE,CAAC;QAChF,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IAC7C,CAAC;IACD,IAAI,CAAC,6BAA6B,CAAC,QAAQ,EAAE,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QACnE,OAAO,YAAY,CACjB,MAAM,CAAC,IAAI,EACX,kBAAkB,EAClB,wBAAwB,EACxB,SAAS,EACT,oCAAoC,CAAC,QAAQ,EAAE,MAAM,CAAC,aAAa,CAAC,CACrE,CAAA;IACH,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,iBAAiB,IAAI,uCAAuC,CAAC,CACvF,UAAU,EACV,UAAU,EACV,QAAQ,CAAC,OAAO,EAChB,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAC1B,CAAA;IACD,IAAI,CAAC,+BAA+B,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;QACvE,MAAM,aAAa,GAAG,8BAA8B,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;QACtF,OAAO,YAAY,CACjB,MAAM,CAAC,IAAI,EACX,kBAAkB,EAClB,wBAAwB,EACxB,SAAS,EACT,aAAa,EACb,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,6BAA6B,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAC7F,CAAA;IACH,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;QAC/C,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA;IACtD,CAAC;IACD,OAAO;QACL,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,MAAM,CAAC,IAAI;YACjB,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;gBAClB,iBAAiB,EAAE,IAAI;gBACvB,QAAQ,EAAE;oBACR,MAAM,EAAE,QAAQ,CAAC,cAAc;oBAC/B,EAAE,EAAE,QAAQ,CAAC,UAAU;oBACvB,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,UAAU,EAAE,QAAQ,CAAC,UAAU;iBAChC;gBACD,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;gBAC7C,IAAI,EAAE,iBAAiB;gBACvB,aAAa,EAAE,4BAA4B;gBAC3C,KAAK,EAAE,SAAS;aACjB,CAAC,IAAI;YACN,CAAC,CAAC,iIAAiI;QACrI,MAAM,EAAE,EAAE;KACX,CAAA;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,UAAmC,EAAE;IACvE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAA;IACtD,MAAM,oBAAoB,GAAG,sBAAsB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAA;IACtG,MAAM,mBAAmB,GAAG,qCAAqC,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;IACnG,IAAI,mBAAmB,CAAC,eAAe,KAAK,OAAO,EAAE,CAAC;QACpD,OAAO;YACL,iBAAiB,EAAE,KAAK;YACxB,gBAAgB,EAAE,gBAAgB;YAClC,UAAU,EAAE,aAAa;YACzB,oBAAoB;YACpB,IAAI,EAAE,oBAAoB,KAAK,WAAW,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,qBAAqB;YAC9F,KAAK,EAAE,oBAAoB,KAAK,WAAW,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,4BAA4B;SACtG,CAAA;IACH,CAAC;IACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,UAAU,CAAA;IAClH,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO;YACL,iBAAiB,EAAE,IAAI;YACvB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY;YACrF,UAAU,EAAE,WAAW;YACvB,oBAAoB;YACpB,IAAI,EAAE,iBAAiB;YACvB,KAAK,EAAE,SAAS;SACjB,CAAA;IACH,CAAC;IACD,OAAO;QACL,iBAAiB,EAAE,KAAK;QACxB,gBAAgB,EAAE,gBAAgB;QAClC,UAAU,EAAE,WAAW;QACvB,oBAAoB;QACpB,IAAI,EAAE,oBAAoB,KAAK,WAAW,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,qBAAqB;QAC7F,KAAK,EAAE,oBAAoB,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,4BAA4B;KACvF,CAAA;AACH,CAAC"}
|
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import type { AuthorityArtifactTuple } from "./authority-artifact-binding.js";
|
|
1
2
|
import type { AuthorityArtifact } from "./authority-artifact-store.js";
|
|
2
3
|
import type { AuthorityEnrollment } from "./authority-enrollment.js";
|
|
3
4
|
export type GithubAuthorityFetchDiagnostic = "authority-fetch-evidence" | "authority-fetch-invalid" | "authority-fetch-network" | "authority-fetch-policy";
|
|
@@ -8,7 +9,8 @@ export type GithubAuthorityFetchResult = {
|
|
|
8
9
|
readonly artifact: AuthorityArtifact;
|
|
9
10
|
readonly kind: "ready";
|
|
10
11
|
};
|
|
11
|
-
export declare function
|
|
12
|
+
export declare function serializeAuthorityFetchChildInput(enrollment: Pick<AuthorityEnrollment, "callerWorkflowPath" | "repositoryId" | "repositorySlug">, sourceHead: string, expected: AuthorityArtifactTuple): string;
|
|
13
|
+
export declare function fetchGithubAuthorityArtifact(projectDir: string, enrollment: AuthorityEnrollment, expected: AuthorityArtifactTuple, githubToken: string | undefined, now?: Date): GithubAuthorityFetchResult;
|
|
12
14
|
export declare function parseFetchedArtifact(value: string): {
|
|
13
15
|
readonly archive: Buffer;
|
|
14
16
|
readonly artifactId: number;
|
|
@@ -1,13 +1,27 @@
|
|
|
1
1
|
import { spawnSync } from "node:child_process";
|
|
2
2
|
import { fileURLToPath } from "node:url";
|
|
3
3
|
import { createAuthorityFetchChildEnvironment as createBoundedAuthorityFetchChildEnvironment } from "../../scripts/authority-fetch-child-environment.mjs";
|
|
4
|
-
import { isAuthorityGithubToken
|
|
4
|
+
import { isAuthorityGithubToken } from "./authority-github-token.js";
|
|
5
5
|
import { captureGitIdentity, captureWorkspaceIdentity } from "./ci-reverification-identity.js";
|
|
6
6
|
const WORKER_PATH = fileURLToPath(new URL("../../scripts/fetch-consumer-authority-artifact.mjs", import.meta.url));
|
|
7
7
|
const MAX_ARCHIVE_BYTES = 8 * 1024 * 1024;
|
|
8
8
|
const MAX_OUTPUT_BYTES = 12 * 1024 * 1024;
|
|
9
9
|
const WORKER_TIMEOUT_MS = 30_000;
|
|
10
|
-
export function
|
|
10
|
+
export function serializeAuthorityFetchChildInput(enrollment, sourceHead, expected) {
|
|
11
|
+
return JSON.stringify({
|
|
12
|
+
callerWorkflowPath: enrollment.callerWorkflowPath,
|
|
13
|
+
expected: {
|
|
14
|
+
artifactDigest: expected.artifactDigest,
|
|
15
|
+
artifactId: expected.artifactId,
|
|
16
|
+
runId: expected.runId,
|
|
17
|
+
sourceHead: expected.sourceHead,
|
|
18
|
+
},
|
|
19
|
+
repositoryId: enrollment.repositoryId,
|
|
20
|
+
repositorySlug: enrollment.repositorySlug,
|
|
21
|
+
sourceHead,
|
|
22
|
+
});
|
|
23
|
+
}
|
|
24
|
+
export function fetchGithubAuthorityArtifact(projectDir, enrollment, expected, githubToken, now = new Date()) {
|
|
11
25
|
if (!isAuthorityGithubToken(githubToken))
|
|
12
26
|
return { kind: "blocked" };
|
|
13
27
|
const workspace = captureWorkspaceIdentity(projectDir);
|
|
@@ -16,6 +30,8 @@ export function fetchGithubAuthorityArtifact(projectDir, enrollment, githubToken
|
|
|
16
30
|
const git = captureGitIdentity(projectDir, workspace.value);
|
|
17
31
|
if (!git.available || git.head === undefined)
|
|
18
32
|
return { kind: "blocked" };
|
|
33
|
+
if (git.head.toLowerCase() !== expected.sourceHead)
|
|
34
|
+
return { kind: "blocked" };
|
|
19
35
|
const childEnvironment = createAuthorityFetchChildEnvironment(githubToken);
|
|
20
36
|
if (childEnvironment === undefined)
|
|
21
37
|
return { kind: "blocked" };
|
|
@@ -23,12 +39,7 @@ export function fetchGithubAuthorityArtifact(projectDir, enrollment, githubToken
|
|
|
23
39
|
cwd: workspace.value.realpath,
|
|
24
40
|
encoding: "utf8",
|
|
25
41
|
env: childEnvironment,
|
|
26
|
-
input:
|
|
27
|
-
callerWorkflowPath: enrollment.callerWorkflowPath,
|
|
28
|
-
repositoryId: enrollment.repositoryId,
|
|
29
|
-
repositorySlug: enrollment.repositorySlug,
|
|
30
|
-
sourceHead: git.head,
|
|
31
|
-
}),
|
|
42
|
+
input: serializeAuthorityFetchChildInput(enrollment, git.head, expected),
|
|
32
43
|
maxBuffer: MAX_OUTPUT_BYTES,
|
|
33
44
|
shell: false,
|
|
34
45
|
stdio: ["pipe", "pipe", "ignore"],
|
|
@@ -52,7 +63,7 @@ export function fetchGithubAuthorityArtifact(projectDir, enrollment, githubToken
|
|
|
52
63
|
fetchedAt: now.toISOString(),
|
|
53
64
|
repositoryId: enrollment.repositoryId,
|
|
54
65
|
runId: fetched.runId,
|
|
55
|
-
sourceHead:
|
|
66
|
+
sourceHead: expected.sourceHead,
|
|
56
67
|
},
|
|
57
68
|
kind: "ready",
|
|
58
69
|
};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authority-fetch-worker.js","sourceRoot":"","sources":["../../src/cli/authority-fetch-worker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,OAAO,EAAE,oCAAoC,IAAI,2CAA2C,EAAE,MAAM,qDAAqD,CAAA;
|
|
1
|
+
{"version":3,"file":"authority-fetch-worker.js","sourceRoot":"","sources":["../../src/cli/authority-fetch-worker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,OAAO,EAAE,oCAAoC,IAAI,2CAA2C,EAAE,MAAM,qDAAqD,CAAA;AAIzJ,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACpE,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAA;AAE9F,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,qDAAqD,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AAClH,MAAM,iBAAiB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AACzC,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AACzC,MAAM,iBAAiB,GAAG,MAAM,CAAA;AAYhC,MAAM,UAAU,iCAAiC,CAC/C,UAA+F,EAC/F,UAAkB,EAClB,QAAgC;IAEhC,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;QACjD,QAAQ,EAAE;YACR,cAAc,EAAE,QAAQ,CAAC,cAAc;YACvC,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,UAAU,EAAE,QAAQ,CAAC,UAAU;SAChC;QACD,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,UAAU;KACX,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,UAAkB,EAClB,UAA+B,EAC/B,QAAgC,EAChC,WAA+B,EAC/B,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IACpE,MAAM,SAAS,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAA;IACtD,IAAI,SAAS,CAAC,MAAM,KAAK,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAChE,MAAM,GAAG,GAAG,kBAAkB,CAAC,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC,CAAA;IAC3D,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IACxE,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAC9E,MAAM,gBAAgB,GAAG,oCAAoC,CAAC,WAAW,CAAC,CAAA;IAC1E,IAAI,gBAAgB,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAC9D,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE;QACxD,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,QAAQ;QAC7B,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,gBAAgB;QACrB,KAAK,EAAE,iCAAiC,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC;QACxE,SAAS,EAAE,gBAAgB;QAC3B,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;QACjC,OAAO,EAAE,iBAAiB;KAC3B,CAAC,CAAA;IACF,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;QACvG,CAAC,CAAC,mCAAmC,CAAC,MAAM,CAAC,MAAM,CAAC;QACpD,CAAC,CAAC,SAAS,CAAA;IACb,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IACpE,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IACtH,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACnD,OAAO,OAAO,KAAK,SAAS;QAC1B,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE;QACrB,CAAC,CAAC;YACE,QAAQ,EAAE;gBACR,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;gBAC5B,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,UAAU,EAAE,QAAQ,CAAC,UAAU;aAChC;YACD,IAAI,EAAE,OAAO;SACd,CAAA;AACP,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAMhD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACzC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;YAC9H,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAA;QAC/J,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QACrD,OAAO,OAAO,CAAC,UAAU,GAAG,CAAC;eACxB,OAAO,CAAC,UAAU,IAAI,iBAAiB;eACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,OAAO;YAChD,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE;YACxG,CAAC,CAAC,SAAS,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,WAAmB,EACnB,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAC3B,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IAE3D,OAAO,2CAA2C,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAA;AAC/F,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,KAAa;IAC/D,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACzC,OAAO,QAAQ,CAAC,MAAM,CAAC;eAClB,SAAS,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;eACjC,MAAM,CAAC,EAAE,KAAK,KAAK;eACnB,gCAAgC,CAAC,MAAM,CAAC,IAAI,CAAC;YAChD,CAAC,CAAC,MAAM,CAAC,IAAI;YACb,CAAC,CAAC,SAAS,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B,EAAE,IAAuB;IACxE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAA;IACxC,OAAO,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;AAC3F,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAC3E,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACvE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAA;AAC9E,CAAC;AAED,SAAS,gCAAgC,CAAC,KAAc;IACtD,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,0BAA0B,CAAC;QAChC,KAAK,yBAAyB,CAAC;QAC/B,KAAK,yBAAyB,CAAC;QAC/B,KAAK,wBAAwB;YAC3B,OAAO,IAAI,CAAA;QACb;YACE,OAAO,KAAK,CAAA;IAChB,CAAC;AACH,CAAC"}
|
|
@@ -349,12 +349,14 @@ blocked and never convert package provenance into Finish authority.
|
|
|
349
349
|
Multiple enrollments require an explicit enrolled `owner/repository` argument
|
|
350
350
|
to `fetch github`; ambiguous selection performs no network request.
|
|
351
351
|
|
|
352
|
-
The public fetch JSON uses `consumer-authority-fetch.
|
|
352
|
+
The public fetch JSON uses `consumer-authority-fetch.4`. A verifier block keeps
|
|
353
353
|
the public state `binding-mismatch` and may add only the fixed `bindingReason`
|
|
354
354
|
enum: `artifact`, `package-version`, `source`, `enrollment`, `run`, `signer`,
|
|
355
|
-
`freshness`, `consumption`, `verification`, or `unknown
|
|
356
|
-
|
|
357
|
-
|
|
355
|
+
`freshness`, `consumption`, `verification`, or `unknown`, plus a fixed
|
|
356
|
+
`sourceReason` enum only when `bindingReason` is `source`: `head`, `inputs`,
|
|
357
|
+
`identity`, `status`, `index`, `content`, `working-tree`, `workspace`, or
|
|
358
|
+
`unknown`. It never includes diagnostic paths, receipt values, tokens, URLs,
|
|
359
|
+
raw verifier output, or local paths; Finish and replay behavior are unchanged.
|
|
358
360
|
|
|
359
361
|
## Live Trust Diagnostics
|
|
360
362
|
|