wyvrnpm 2.12.3 → 2.13.12

package/src/signing/index.js

@@ -0,0 +1,201 @@
+'use strict';
+
+const fs = require('fs');
+
+const ed25519 = require('./ed25519');
+const {
+  buildAttestation,
+  parseAttestation,
+  canonicalAttestationBytes,
+  assertBoundIdentity,
+  assertBoundHashes,
+} = require('./attestation');
+const { findKey, validateKeysJson } = require('./trust');
+
+/**
+ * High-level signing surface. Publish + upload-built call `signAttestation`;
+ * download calls `verifyAttestation`. Everything else (canonical bytes,
+ * trust-anchor lookup, identity assertions) is composed from the
+ * lower-level modules so each piece stays unit-testable.
+ *
+ * The `kind` field on a signing or verification result is always
+ * `"ed25519"` in v1. It exists so the dispatcher can grow to multiple
+ * backends without changing call sites.
+ */
+
+const SIG_ENVELOPE_ALG = 'ed25519';
+
+// ─── Sign ────────────────────────────────────────────────────────────────
+
+/**
+ * Resolve a private key from a signing context. Precedence (matches the
+ * publish flow):
+ *   1. `ctx.privateKeyPem`   — already-loaded PEM string (CLI / config).
+ *   2. `ctx.privateKeyEnv`   — env-var name to read.
+ *   3. `ctx.privateKeyFile`  — file path to read.
+ *
+ * Throws fast if none are set so a misconfigured publish never silently
+ * produces an unsigned artefact.
+ */
+function resolvePrivateKey(ctx) {
+  if (ctx.privateKeyPem) return ctx.privateKeyPem;
+
+  if (ctx.privateKeyEnv) {
+    const v = process.env[ctx.privateKeyEnv];
+    if (!v || v.length === 0) {
+      throw new Error(`signing: env var "${ctx.privateKeyEnv}" is empty or unset`);
+    }
+    return v;
+  }
+
+  if (ctx.privateKeyFile) {
+    if (!fs.existsSync(ctx.privateKeyFile)) {
+      throw new Error(`signing: private key file not found: ${ctx.privateKeyFile}`);
+    }
+    return fs.readFileSync(ctx.privateKeyFile, 'utf8');
+  }
+
+  throw new Error(
+    'signing: no private key configured — pass --signing-key-env / --signing-key-file ' +
+    'or configure defaultSigning.privateKey',
+  );
+}
+
+/**
+ * Sign a freshly-built attestation. Returns the canonical bytes (write to
+ * `wyvrn.att.json`) and a signature envelope (write to `wyvrn.sig`).
+ *
+ * The envelope is JSON to keep the signature inspectable and decouple
+ * future algorithm changes from the file format.
+ */
+function signAttestation(attestation, ctx) {
+  const att = buildAttestation(attestation);   // re-validate before signing
+  const attBytes = canonicalAttestationBytes(att);
+  const privateKeyPem = resolvePrivateKey(ctx);
+
+  // Sanity: the supplied keyId must match the key we're actually signing
+  // with. The publisher derives `publisherKeyId` from their config; if they
+  // swap the private key file without updating the config, fail loudly.
+  if (!ctx.keyId || typeof ctx.keyId !== 'string') {
+    throw new Error('signing: ctx.keyId required');
+  }
+  if (att.publisherKeyId !== ctx.keyId) {
+    throw new Error(
+      `signing: attestation.publisherKeyId="${att.publisherKeyId}" does not match ctx.keyId="${ctx.keyId}"`,
+    );
+  }
+
+  const sig = ed25519.sign(privateKeyPem, attBytes);
+  return {
+    kind:         SIG_ENVELOPE_ALG,
+    attBytes,
+    sigEnvelope:  { alg: SIG_ENVELOPE_ALG, keyId: ctx.keyId, sig: sig.toString('base64') },
+  };
+}
+
+/**
+ * Serialize the signature envelope for writing to `wyvrn.sig`.
+ */
+function serializeSigEnvelope(env) {
+  if (!env || env.alg !== SIG_ENVELOPE_ALG || typeof env.keyId !== 'string' || typeof env.sig !== 'string') {
+    throw new Error('signing: malformed signature envelope');
+  }
+  return JSON.stringify(env, null, 2) + '\n';
+}
+
+// ─── Verify ──────────────────────────────────────────────────────────────
+
+/**
+ * Parse a `wyvrn.sig` envelope and validate its shape. Rejects unknown
+ * `alg` values fail-closed so a future algorithm change must come with a
+ * verifier upgrade — never silently accept an alg the verifier can't check.
+ */
+function parseSigEnvelope(raw) {
+  let obj;
+  try {
+    obj = typeof raw === 'string' ? JSON.parse(raw) : raw;
+  } catch (err) {
+    throw new Error(`signature envelope: malformed JSON — ${err.message}`);
+  }
+  if (obj === null || typeof obj !== 'object' || Array.isArray(obj)) {
+    throw new Error('signature envelope: must be a JSON object');
+  }
+  if (obj.alg !== SIG_ENVELOPE_ALG) {
+    throw new Error(`signature envelope: unsupported alg "${obj.alg}" (this client supports "${SIG_ENVELOPE_ALG}")`);
+  }
+  if (typeof obj.keyId !== 'string' || obj.keyId.length === 0) {
+    throw new Error('signature envelope: missing keyId');
+  }
+  if (typeof obj.sig !== 'string' || obj.sig.length === 0) {
+    throw new Error('signature envelope: missing sig');
+  }
+  return obj;
+}
+
+/**
+ * Verify a downloaded attestation against the trust anchor. Throws on any
+ * failure (mismatch, unknown key, retired key, bad signature) — caller
+ * (download.js) treats every throw as a verification failure under the
+ * registry's `mode`.
+ *
+ * On success returns `{ kind, keyId, identityHint }` so download.js can
+ * stamp `.wyvrn-meta.json` with the signer.
+ *
+ * `expected` carries the consumer's view of what they downloaded:
+ *   { name, version, profileHash, contentSha256, manifestSha256 }
+ *
+ * The function asserts the attestation is bound to those values — defends
+ * against URL-swap attacks where a legitimately-signed attestation for one
+ * package gets dropped into another package's URL path.
+ */
+function verifyAttestation({ attBytes, sigEnvelope, trustAnchors, expected }) {
+  if (!Buffer.isBuffer(attBytes)) {
+    throw new Error('verifyAttestation: attBytes must be a Buffer');
+  }
+  validateKeysJson(trustAnchors);
+
+  const env = parseSigEnvelope(sigEnvelope);
+  const att = parseAttestation(attBytes.toString('utf8'));
+
+  const lookup = findKey(trustAnchors, env.keyId, att.publishedAt);
+  if (!lookup) {
+    throw new Error(`unknown publisher keyId "${env.keyId}" — not in trust anchor`);
+  }
+  if (lookup.expired) {
+    throw new Error(
+      `key "${env.keyId}" was retired before publishedAt (${att.publishedAt}); attestation rejected`,
+    );
+  }
+
+  // Cryptographic verify against the canonical bytes the publisher signed.
+  // We canonicalize the *parsed* attestation rather than verifying the raw
+  // bytes directly so a bytewise-different-but-semantically-equivalent
+  // serialisation (extra whitespace, key reorder) doesn't accidentally
+  // pass — there's only one canonical form, and it must match.
+  const canonicalBytes = canonicalAttestationBytes(att);
+  const ok = ed25519.verify(lookup.found.publicKey, canonicalBytes, env.sig);
+  if (!ok) {
+    throw new Error(`signature failed verification (keyId="${env.keyId}")`);
+  }
+
+  // Identity + hash bindings — a valid signature over a different package
+  // is still a verification failure for *this* package.
+  assertBoundIdentity(att, expected);
+  assertBoundHashes(att, expected);
+
+  return {
+    kind:         SIG_ENVELOPE_ALG,
+    keyId:        env.keyId,
+    identityHint: lookup.found.identityHint ?? null,
+    attestation:  att,
+  };
+}
+
+module.exports = {
+  SIG_ENVELOPE_ALG,
+  resolvePrivateKey,
+  signAttestation,
+  serializeSigEnvelope,
+  parseSigEnvelope,
+  verifyAttestation,
+};

package/src/signing/resolve-context.js

@@ -0,0 +1,73 @@
+'use strict';
+
+/**
+ * Resolve a publisher signing context per the precedence locked in the S1
+ * plan §3.3:
+ *
+ *   1. `--no-sign`                                              → skip
+ *   2. CLI `--signing-key-env` / `--signing-key-file` overrides → use those
+ *      for the private key, but inherit `keyId` from per-source `signing` /
+ *      `defaultSigning` so a swap of the key file can't accidentally
+ *      publish under the wrong publisher identity.
+ *   3. Per-source `signing` block on the resolved source entry.
+ *   4. `defaultSigning` from config.
+ *   5. Nothing configured                                       → null.
+ *
+ * Used identically by:
+ *   - `wyvrnpm publish`                       (publish-side signing)
+ *   - `wyvrnpm install --upload-built`        (consumer-upload signing)
+ *
+ * Throws on misconfiguration (e.g. CLI override without a configured
+ * keyId, or a `signing` block missing `keyId` / `privateKey.{env|file}`).
+ *
+ * @param {object} argv         the yargs argv (looks at noSign / signingKeyEnv / signingKeyFile)
+ * @param {object} config       the wyvrnpm config (defaultSigning lives here)
+ * @param {object|null} sourceEntry  the publish-source entry that signing is for
+ * @returns {{
+ *   skip?:           boolean,
+ *   reason?:         string,
+ *   keyId?:          string,
+ *   alg?:            'ed25519',
+ *   privateKeyEnv?:  string,
+ *   privateKeyFile?: string,
+ * } | null}
+ */
+function resolveSigningContext(argv, config, sourceEntry) {
+  if (argv?.noSign) return { skip: true, reason: '--no-sign passed on the CLI' };
+
+  const cliKeyEnv  = argv?.signingKeyEnv  ?? null;
+  const cliKeyFile = argv?.signingKeyFile ?? null;
+
+  const sourceSigning  = sourceEntry?.signing ?? null;
+  const defaultSigning = config?.defaultSigning ?? null;
+  const signing        = sourceSigning ?? defaultSigning;
+
+  if (!signing && !cliKeyEnv && !cliKeyFile) return null;
+
+  const keyId = signing?.keyId ?? null;
+  if (!keyId) {
+    throw new Error(
+      'signing: keyId is not configured. Set defaultSigning.keyId in config.json ' +
+      'or per-source signing.keyId on the source entry.',
+    );
+  }
+
+  const out = { keyId, alg: 'ed25519' };
+  if (cliKeyEnv) {
+    out.privateKeyEnv = cliKeyEnv;
+  } else if (cliKeyFile) {
+    out.privateKeyFile = cliKeyFile;
+  } else if (signing.privateKey?.env) {
+    out.privateKeyEnv = signing.privateKey.env;
+  } else if (signing.privateKey?.file) {
+    out.privateKeyFile = signing.privateKey.file;
+  } else {
+    throw new Error(
+      `signing: keyId "${keyId}" has no private-key source configured. ` +
+      'Set signing.privateKey.{env|file} in config or pass --signing-key-env / --signing-key-file.',
+    );
+  }
+  return out;
+}
+
+module.exports = { resolveSigningContext };

package/src/signing/trust.js

@@ -0,0 +1,215 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+
+const { getConfigDir } = require('../config');
+
+/**
+ * Local trust-anchor cache + TOFU diff. Mirrors PLAN-SIGNING.md §3.7 phase 1
+ * with one tightening: any non-additive change to `keys.json` (removed entry
+ * or modified `publicKey` / `alg` on an existing entry) fails closed and
+ * forces a deliberate `wyvrnpm trust refresh`. Pure additions are
+ * fast-pathed because adding a new publisher is the common rotation event
+ * and shouldn't break installs.
+ *
+ * Network IO is intentionally NOT here — callers pass in fetched bytes.
+ * Keeps the module unit-testable and avoids coupling to provider plumbing.
+ */
+
+const TRUST_DIR_NAME    = 'trust';
+const KEYS_FILE         = 'keys.json';
+const MODE_FILE         = 'mode.json';
+const TIMESTAMP_FILE    = 'fetched-at.txt';
+const DEFAULT_TTL_MS    = 60 * 60 * 1000;          // 1 hour
+const VALID_MODES       = new Set(['off', 'warn', 'require']);
+const KEYS_SCHEMA_VER   = 1;
+
+// ─── Path helpers ────────────────────────────────────────────────────────
+
+/**
+ * Per-source cache directory under the wyvrnpm config root. Source URL is
+ * SHA256-hashed (16-hex prefix) so any URL — `s3://bucket/path`, `https://`,
+ * UNC, file path — produces a filesystem-safe directory name.
+ */
+function getTrustCacheDir(source) {
+  const hash = crypto.createHash('sha256').update(source, 'utf8').digest('hex').slice(0, 16);
+  return path.join(getConfigDir(), TRUST_DIR_NAME, hash);
+}
+
+// ─── Validation ──────────────────────────────────────────────────────────
+
+function validateKeysJson(obj) {
+  if (obj === null || typeof obj !== 'object' || Array.isArray(obj)) {
+    throw new Error('keys.json: must be a JSON object');
+  }
+  if (obj.version !== KEYS_SCHEMA_VER) {
+    throw new Error(`keys.json: unsupported version ${obj.version} (this client supports ${KEYS_SCHEMA_VER})`);
+  }
+  if (!Array.isArray(obj.keys)) {
+    throw new Error('keys.json: "keys" must be an array');
+  }
+  const seenIds = new Set();
+  for (const [i, k] of obj.keys.entries()) {
+    if (k === null || typeof k !== 'object') {
+      throw new Error(`keys.json: keys[${i}] must be an object`);
+    }
+    if (typeof k.id !== 'string' || k.id.length === 0) {
+      throw new Error(`keys.json: keys[${i}].id missing`);
+    }
+    if (seenIds.has(k.id)) {
+      throw new Error(`keys.json: duplicate keyId "${k.id}"`);
+    }
+    seenIds.add(k.id);
+    if (k.alg !== 'ed25519') {
+      throw new Error(`keys.json: keys[${i}].alg must be "ed25519" (got "${k.alg}")`);
+    }
+    if (typeof k.publicKey !== 'string' || k.publicKey.length === 0) {
+      throw new Error(`keys.json: keys[${i}].publicKey missing`);
+    }
+    if (k.retiredAt !== null && k.retiredAt !== undefined && typeof k.retiredAt !== 'string') {
+      throw new Error(`keys.json: keys[${i}].retiredAt must be a string or null`);
+    }
+  }
+  return obj;
+}
+
+function validateModeJson(obj) {
+  if (obj === null || typeof obj !== 'object' || Array.isArray(obj)) {
+    throw new Error('mode.json: must be a JSON object');
+  }
+  if (!VALID_MODES.has(obj.mode)) {
+    throw new Error(`mode.json: mode must be one of ${[...VALID_MODES].join(', ')} (got "${obj.mode}")`);
+  }
+  return obj;
+}
+
+// ─── Cache reads ─────────────────────────────────────────────────────────
+
+function readCachedKeys(source) {
+  const file = path.join(getTrustCacheDir(source), KEYS_FILE);
+  if (!fs.existsSync(file)) return null;
+  return validateKeysJson(JSON.parse(fs.readFileSync(file, 'utf8')));
+}
+
+function readCachedMode(source) {
+  const file = path.join(getTrustCacheDir(source), MODE_FILE);
+  if (!fs.existsSync(file)) return null;
+  return validateModeJson(JSON.parse(fs.readFileSync(file, 'utf8')));
+}
+
+function getCacheAgeMs(source) {
+  const stamp = path.join(getTrustCacheDir(source), TIMESTAMP_FILE);
+  if (!fs.existsSync(stamp)) return Infinity;
+  const ms = parseInt(fs.readFileSync(stamp, 'utf8').trim(), 10);
+  if (!Number.isFinite(ms)) return Infinity;
+  return Date.now() - ms;
+}
+
+function isCacheFresh(source, ttlMs = DEFAULT_TTL_MS) {
+  return getCacheAgeMs(source) < ttlMs;
+}
+
+// ─── Cache writes ────────────────────────────────────────────────────────
+
+function writeCache(source, { keys, mode }) {
+  const dir = getTrustCacheDir(source);
+  fs.mkdirSync(dir, { recursive: true });
+  if (keys !== undefined) {
+    validateKeysJson(keys);
+    fs.writeFileSync(path.join(dir, KEYS_FILE), JSON.stringify(keys, null, 2) + '\n', 'utf8');
+  }
+  if (mode !== undefined) {
+    validateModeJson(mode);
+    fs.writeFileSync(path.join(dir, MODE_FILE), JSON.stringify(mode, null, 2) + '\n', 'utf8');
+  }
+  fs.writeFileSync(path.join(dir, TIMESTAMP_FILE), String(Date.now()), 'utf8');
+}
+
+function clearCache(source) {
+  const dir = getTrustCacheDir(source);
+  if (fs.existsSync(dir)) fs.rmSync(dir, { recursive: true, force: true });
+}
+
+// ─── TOFU diff ───────────────────────────────────────────────────────────
+
+/**
+ * Diff a fetched `keys.json` against the cached one. Classification:
+ *   - `unchanged`: cache and fetched are byte-identical.
+ *   - `additive`:  every cached entry is present unchanged in the fetched
+ *                  set; one or more new entries appear.
+ *   - `breaking`:  a cached entry is missing from the fetched set, OR a
+ *                  cached entry's `alg` / `publicKey` / `addedAt` changed.
+ *                  `retiredAt` and `identityHint` are allowed to change
+ *                  (rotation lifecycle).
+ *
+ * Returns `{ kind, addedIds, removedIds, modifiedIds }`. The caller decides
+ * how to act on `breaking` (typically: log + abort + prompt for manual
+ * `trust refresh`).
+ */
+function diffKeys(cached, fetched) {
+  if (cached === null) {
+    return { kind: 'first-fetch', addedIds: fetched.keys.map((k) => k.id), removedIds: [], modifiedIds: [] };
+  }
+  validateKeysJson(cached);
+  validateKeysJson(fetched);
+
+  const cachedById  = new Map(cached.keys.map((k) => [k.id, k]));
+  const fetchedById = new Map(fetched.keys.map((k) => [k.id, k]));
+
+  const addedIds    = [...fetchedById.keys()].filter((id) => !cachedById.has(id));
+  const removedIds  = [...cachedById.keys()].filter((id) => !fetchedById.has(id));
+  const modifiedIds = [];
+
+  for (const [id, c] of cachedById) {
+    const f = fetchedById.get(id);
+    if (!f) continue;
+    if (c.alg !== f.alg || c.publicKey !== f.publicKey || (c.addedAt ?? null) !== (f.addedAt ?? null)) {
+      modifiedIds.push(id);
+    }
+  }
+
+  if (removedIds.length === 0 && modifiedIds.length === 0 && addedIds.length === 0) {
+    return { kind: 'unchanged', addedIds: [], removedIds: [], modifiedIds: [] };
+  }
+  if (removedIds.length === 0 && modifiedIds.length === 0) {
+    return { kind: 'additive', addedIds, removedIds: [], modifiedIds: [] };
+  }
+  return { kind: 'breaking', addedIds, removedIds, modifiedIds };
+}
+
+/**
+ * Resolve which key in a `keys.json` should verify a signature for a given
+ * `keyId` and `publishedAt` timestamp. Honours retirement: a retired key
+ * still verifies signatures whose `publishedAt` predates `retiredAt`, but
+ * never accepts new ones.
+ */
+function findKey(keys, keyId, publishedAt) {
+  validateKeysJson(keys);
+  const k = keys.keys.find((entry) => entry.id === keyId);
+  if (!k) return null;
+  if (k.retiredAt && new Date(publishedAt) > new Date(k.retiredAt)) {
+    return { found: k, expired: true };
+  }
+  return { found: k, expired: false };
+}
+
+module.exports = {
+  TRUST_DIR_NAME,
+  KEYS_FILE,
+  MODE_FILE,
+  DEFAULT_TTL_MS,
+  KEYS_SCHEMA_VER,
+  getTrustCacheDir,
+  validateKeysJson,
+  validateModeJson,
+  readCachedKeys,
+  readCachedMode,
+  getCacheAgeMs,
+  isCacheFresh,
+  writeCache,
+  clearCache,
+  diffKeys,
+  findKey,
+};

package/src/upload-built.js

@@ -8,6 +8,12 @@ const { getProvider }        = require('./providers');
 const { defaultCompatBlock } = require('./compat');
 const { getBuildPaths }      = require('./build/cache');
 const { resolveSourceAuth }  = require('./auth');
+const { buildV2Meta }        = require('./v2-meta');
+const { sha256OfCanonical }  = require('./signing/canonical');
+const {
+  signAttestation,
+  serializeSigEnvelope,
+}                            = require('./signing');
 const log                    = require('./logger');
 
 const WYVRNPM_VERSION = require('../package.json').version;
@@ -79,6 +85,14 @@ function recordUploadSidecar({ name, version, profileHash, source, contentSha256
  * @param {object} [args.uploadAuth]       { awsProfile?, token? }
  * @param {Record<string, any>|null} [args.options]  Effective options for this build (fed through to buildSettings.options).
  * @param {string} [args.toolchainHash]    Optional SHA of the generated wyvrn_toolchain.cmake.
+ * @param {object|null} [args.signingContext]  Pre-resolved signing context
+ *   from the consumer's config (`{ keyId, alg, privateKeyEnv|privateKeyFile }`).
+ *   When non-null, the upload is signed identically to a `wyvrnpm publish`.
+ *   When null (or omitted), the upload is unsigned — registry's `mode.json`
+ *   governs whether a downstream consumer warns or aborts. The S1 plan
+ *   keeps `--upload-built` skip-never-break-install semantics: a sign
+ *   failure logs and proceeds without uploading, never aborts the parent
+ *   install.
  * @returns {Promise<{ uploaded: boolean, reason: string }>}
  */
 async function uploadSourceBuiltArtefact(args) {
@@ -89,6 +103,7 @@ async function uploadSourceBuiltArtefact(args) {
     uploadSource, uploadAuth = {},
     options = null,
     toolchainHash,
+    signingContext = null,
   } = args;
 
   if (!uploadSource) {
@@ -124,30 +139,84 @@ async function uploadSourceBuiltArtefact(args) {
 
   // ── Prepare manifest: cloned wyvrn.json + compat block + uploadedBy ──────
   const rawManifest = JSON.parse(fs.readFileSync(clonedManifestPath, 'utf8'));
-  const manifestForUpload = {
+  const baseManifest = {
     ...rawManifest,
     compatibility: rawManifest.compatibility ?? defaultCompatBlock(),
-    uploadedBy: {
-      kind:           'source-build',
-      profileHash,
-      builtFromGit:   gitRepo ?? null,
-      builtFromSha:   gitSha  ?? null,
-      ...(toolchainHash ? { toolchainHash } : {}),
-      uploadedAt:     new Date().toISOString(),
-      wyvrnpmVersion: WYVRNPM_VERSION,
-    },
   };
+  const uploadedBy = {
+    kind:           'source-build',
+    profileHash,
+    builtFromGit:   gitRepo ?? null,
+    builtFromSha:   gitSha  ?? null,
+    ...(toolchainHash ? { toolchainHash } : {}),
+    uploadedAt:     new Date().toISOString(),
+    wyvrnpmVersion: WYVRNPM_VERSION,
+  };
+
+  // Build v2Meta locally so the publisher's signature covers the exact
+  // bytes the provider will upload. Providers no longer mutate.
+  const publishedAt = new Date().toISOString();
+  const v2Meta = buildV2Meta(baseManifest, {
+    profileHash,
+    buildSettings: options ? { ...profile, options } : profile,
+    contentSha256,
+    gitSha:  gitSha  ?? null,
+    gitRepo: gitRepo ?? null,
+    publishedAt,
+    uploadedBy,
+  });
 
   const tmpManifestPath = path.join(
     os.tmpdir(),
     `wyvrnpm-upload-${name}-${version}-${profileHash}-${Date.now()}.json`,
   );
-  fs.writeFileSync(tmpManifestPath, JSON.stringify(manifestForUpload, null, 2), 'utf8');
+  fs.writeFileSync(tmpManifestPath, JSON.stringify(v2Meta, null, 2), 'utf8');
+
+  // ── Sign (S1) ────────────────────────────────────────────────────────────
+  // The consumer signs their own attestation over the consumer's
+  // contentSha256 + manifestSha256, with `uploadedBy` populated. Author
+  // publishes share the same machinery — only the `uploadedBy` block
+  // differs.
+  let attPath = null;
+  let sigPath = null;
+  let signerKeyId = null;
+  if (signingContext) {
+    try {
+      const manifestSha256 = sha256OfCanonical(v2Meta);
+      const att = {
+        name, version, profileHash,
+        contentSha256, manifestSha256,
+        publishedAt,
+        publisherKeyId: signingContext.keyId,
+        uploadedBy,
+      };
+      const result = signAttestation(att, signingContext);
+      attPath = path.join(os.tmpdir(), `wyvrnpm-upload-att-${name}-${version}-${profileHash}-${Date.now()}.json`);
+      sigPath = path.join(os.tmpdir(), `wyvrnpm-upload-sig-${name}-${version}-${profileHash}-${Date.now()}.json`);
+      fs.writeFileSync(attPath, result.attBytes);
+      fs.writeFileSync(sigPath, serializeSigEnvelope(result.sigEnvelope));
+      signerKeyId = signingContext.keyId;
+    } catch (err) {
+      // Skip-never-break-install: a sign failure on the upload tail
+      // doesn't abort the install. The artefact extracted fine; only the
+      // upload is forfeited.
+      try { fs.unlinkSync(tmpManifestPath); } catch { /* ignore */ }
+      return { uploaded: false, reason: `sign failed: ${err.message}` };
+    }
+  }
 
   try {
-    log.info(`upload-built: ${name}@${version} [${profileHash}] → ${uploadSource}`);
+    log.info(
+      `upload-built: ${name}@${version} [${profileHash}] → ${uploadSource}` +
+      (signerKeyId ? ` (signed by ${signerKeyId})` : ''),
+    );
     await provider.v2Publish(
-      { manifest: tmpManifestPath, zip: artefactPath },
+      {
+        manifest: tmpManifestPath,
+        zip: artefactPath,
+        ...(attPath ? { attPath } : {}),
+        ...(sigPath ? { sigPath } : {}),
+      },
       {
         source:        uploadSource,
         name, version, profileHash,
@@ -158,7 +227,10 @@ async function uploadSourceBuiltArtefact(args) {
         // Consumer uploads must not reshape the "latest" pointer — see
         // PLAN-UPLOAD-BUILT §3.3.
         updateLatest: false,
-        uploadedBy:   manifestForUpload.uploadedBy,
+        // Note: uploadedBy already baked into the manifest via buildV2Meta.
+        // Pass it again on options for back-compat with any legacy
+        // provider that still reads it; current providers ignore it.
+        uploadedBy,
         awsProfile,
         token,
       },
@@ -172,6 +244,8 @@ async function uploadSourceBuiltArtefact(args) {
     return { uploaded: false, reason: `upload failed: ${err.message}` };
   } finally {
     try { fs.unlinkSync(tmpManifestPath); } catch { /* ignore */ }
+    if (attPath) { try { fs.unlinkSync(attPath); } catch { /* ignore */ } }
+    if (sigPath) { try { fs.unlinkSync(sigPath); } catch { /* ignore */ } }
   }
 }