xgauntlet 0.8.2 → 0.8.4

package/bin/xgauntlet.js

@@ -8,6 +8,7 @@ import { spawnSync, spawn, execFileSync } from 'node:child_process';
 import path from 'node:path';
 import fs from 'node:fs';
 import os from 'node:os';
+import crypto from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 
 const __filename = fileURLToPath(import.meta.url);
@@ -17,6 +18,149 @@ const pkg = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf8'));
 const VERSION = pkg.version;
 const REPO = 'rolfmadsen/xgauntlet';
 
+export const EXPECTED_REPOSITORY_ID = '1359184794';
+export const EXPECTED_REPO = 'rolfmadsen/xgauntlet';
+export const EXPECTED_WORKFLOW = '.github/workflows/release.yml';
+
+export function extractBundleClaims(bundle, statement) {
+  let repositoryId = null;
+  let repository = null;
+  let workflow = null;
+  let ref = null;
+
+  if (statement?.predicate) {
+    const pred = statement.predicate;
+    repositoryId =
+      pred.buildDefinition?.internalParameters?.github?.repository_id ||
+      pred.invocation?.environment?.github?.repository_id ||
+      null;
+
+    repository =
+      pred.buildDefinition?.externalParameters?.workflow?.repository ||
+      pred.invocation?.configSource?.uri ||
+      null;
+
+    workflow =
+      pred.buildDefinition?.externalParameters?.workflow?.path ||
+      pred.invocation?.configSource?.entryPoint ||
+      null;
+
+    ref =
+      pred.buildDefinition?.externalParameters?.workflow?.ref ||
+      pred.invocation?.configSource?.ref ||
+      null;
+  }
+
+  const certBytes =
+    bundle?.verificationMaterial?.certificate?.rawBytes ||
+    bundle?.verificationMaterial?.x509CertificateChain?.certificates?.[0]?.rawBytes;
+
+  if (certBytes) {
+    const certBuf = Buffer.isBuffer(certBytes) ? certBytes : Buffer.from(certBytes, 'base64');
+    const certStr = certBuf.toString('utf8');
+
+    if (!repositoryId && certStr.includes('1359184794')) {
+      repositoryId = '1359184794';
+    }
+    if (!repository && certStr.includes('rolfmadsen/xgauntlet')) {
+      repository = 'rolfmadsen/xgauntlet';
+    }
+    if (!workflow && certStr.includes('.github/workflows/release.yml')) {
+      workflow = '.github/workflows/release.yml';
+    }
+  }
+
+  return { repositoryId, repository, workflow, ref };
+}
+
+export async function verifyReleaseArchive({
+  archiveBuffer,
+  archiveName,
+  bundle,
+  expectedRepoId = EXPECTED_REPOSITORY_ID,
+  expectedRepo = EXPECTED_REPO,
+  expectedWorkflow = EXPECTED_WORKFLOW,
+  expectedRef,
+  sigstoreVerifier,
+  claimsExtractor,
+}) {
+  if (!bundle) {
+    throw new Error('INVALID_BUNDLE: Missing attestation bundle');
+  }
+
+  if (sigstoreVerifier) {
+    await sigstoreVerifier(bundle, archiveBuffer);
+  } else {
+    try {
+      const sigstore = await import('sigstore');
+      await sigstore.verify(bundle, archiveBuffer);
+    } catch (err) {
+      throw new Error(`SIGNATURE_VERIFICATION_FAILED: ${err.message}`);
+    }
+  }
+
+  if (!bundle.dsseEnvelope?.payload) {
+    throw new Error('INVALID_BUNDLE: Missing dsseEnvelope payload in attestation bundle');
+  }
+
+  const payloadStr = Buffer.from(bundle.dsseEnvelope.payload, 'base64').toString('utf8');
+  let statement;
+  try {
+    statement = JSON.parse(payloadStr);
+  } catch (err) {
+    throw new Error(`INVALID_PAYLOAD: Failed to parse in-toto statement JSON: ${err.message}`);
+  }
+
+  const actualDigest = crypto.createHash('sha256').update(archiveBuffer).digest('hex');
+
+  const subjects = statement.subject || [];
+  const matchingSubject = subjects.find((s) => {
+    const subjDigest = s.digest?.sha256;
+    if (!subjDigest) return false;
+    return subjDigest.toLowerCase() === actualDigest.toLowerCase();
+  });
+
+  if (!matchingSubject) {
+    throw new Error(
+      `DIGEST_MISMATCH: Archive digest (${actualDigest}) does not match any attested subject in bundle`
+    );
+  }
+
+  const claims = claimsExtractor
+    ? claimsExtractor(bundle, statement)
+    : extractBundleClaims(bundle, statement);
+
+  if (claims.repositoryId && String(claims.repositoryId) !== String(expectedRepoId)) {
+    throw new Error(
+      `REPOSITORY_ID_MISMATCH: Attested repository ID '${claims.repositoryId}' does not match expected ID '${expectedRepoId}'`
+    );
+  }
+
+  if (claims.repository && !claims.repository.toLowerCase().includes(expectedRepo.toLowerCase())) {
+    throw new Error(
+      `REPOSITORY_MISMATCH: Attested repository '${claims.repository}' does not match expected repository '${expectedRepo}'`
+    );
+  }
+
+  if (claims.workflow && !claims.workflow.includes(expectedWorkflow)) {
+    throw new Error(
+      `WORKFLOW_MISMATCH: Attested workflow '${claims.workflow}' does not match expected workflow '${expectedWorkflow}'`
+    );
+  }
+
+  if (expectedRef && claims.ref && claims.ref !== expectedRef) {
+    throw new Error(
+      `REF_MISMATCH: Attested ref '${claims.ref}' does not match expected ref '${expectedRef}'`
+    );
+  }
+
+  return {
+    verified: true,
+    digest: actualDigest,
+    claims,
+  };
+}
+
 export function getPlatformInfo(platform = os.platform(), arch = os.arch()) {
   const isWindows = platform === 'win32';
   const binName = isWindows ? 'xgauntlet.exe' : 'xgauntlet';
@@ -48,6 +192,9 @@ function getCacheDir() {
 }
 
 function findLocalBinary() {
+  if (process.env.XGAUNTLET_TEST_FORCE_NOT_FOUND === '1') {
+    return null;
+  }
   const { isWindows, binName } = getPlatformInfo();
 
   // 1. Check Cargo target directory in local workspace
@@ -89,7 +236,38 @@ function findLocalBinary() {
   return null;
 }
 
+export async function fetchAttestationBundle(repo = REPO, version = VERSION, customFetcher = null) {
+  const fetchFn = customFetcher || fetch;
+  const candidates = [
+    `https://github.com/${repo}/releases/download/v${version}/attestation.bundle`,
+    `https://github.com/${repo}/releases/download/v${version}/attestation.json`,
+  ];
+
+  let lastStatus = 404;
+  let lastStatusText = 'Not Found';
+
+  for (const url of candidates) {
+    try {
+      const res = await fetchFn(url, { redirect: 'follow' });
+      if (res && res.ok) {
+        return await res.json();
+      }
+      if (res) {
+        lastStatus = res.status;
+        lastStatusText = res.statusText || 'Not Found';
+      }
+    } catch (err) {
+      lastStatusText = err.message;
+    }
+  }
+
+  throw new Error(`HTTP ${lastStatus} fetching attestation bundle: ${lastStatusText}`);
+}
+
 async function downloadAndCacheBinary() {
+  if (process.env.XGAUNTLET_TEST_FORCE_NOT_FOUND === '1') {
+    throw new Error('Forced missing binary for test');
+  }
   const { platform, arch, isWindows, binName, archiveName } = getPlatformInfo();
 
   if (!archiveName) {
@@ -106,17 +284,39 @@ async function downloadAndCacheBinary() {
   const downloadUrl = `https://github.com/${REPO}/releases/download/v${VERSION}/${archiveName}`;
   process.stderr.write(`[xgauntlet] Fetching native engine v${VERSION} for ${platform}-${arch}...\n`);
 
-  fs.mkdirSync(cacheDir, { recursive: true });
-  const tempArchive = path.join(cacheDir, `temp-${Date.now()}-${archiveName}`);
+  let tempArchive = null;
+  let createdCacheDir = false;
 
   try {
-    const res = await fetch(downloadUrl, { redirect: 'follow' });
-    if (!res.ok) {
-      throw new Error(`HTTP ${res.status}: ${res.statusText}`);
+    const [resArchive, bundleJson] = await Promise.all([
+      fetch(downloadUrl, { redirect: 'follow' }),
+      fetchAttestationBundle(REPO, VERSION),
+    ]);
+
+    if (!resArchive.ok) {
+      throw new Error(`HTTP ${resArchive.status} fetching binary archive: ${resArchive.statusText}`);
     }
 
-    const buffer = Buffer.from(await res.arrayBuffer());
-    fs.writeFileSync(tempArchive, buffer);
+    const archiveBuffer = Buffer.from(await resArchive.arrayBuffer());
+
+    process.stderr.write(`[xgauntlet] Verifying cryptographic release attestation for ${archiveName}...\n`);
+    await verifyReleaseArchive({
+      archiveBuffer,
+      archiveName,
+      bundle: bundleJson,
+      expectedRepoId: EXPECTED_REPOSITORY_ID,
+      expectedRepo: EXPECTED_REPO,
+      expectedWorkflow: EXPECTED_WORKFLOW,
+      expectedRef: `refs/tags/v${VERSION}`,
+    });
+    process.stderr.write(`[xgauntlet] Attestation verified successfully (Repo ID: ${EXPECTED_REPOSITORY_ID}).\n`);
+
+    if (!fs.existsSync(cacheDir)) {
+      fs.mkdirSync(cacheDir, { recursive: true });
+      createdCacheDir = true;
+    }
+    tempArchive = path.join(cacheDir, `temp-${Date.now()}-${archiveName}`);
+    fs.writeFileSync(tempArchive, archiveBuffer);
 
     if (archiveName.endsWith('.tar.gz')) {
       execFileSync('tar', ['-xzf', tempArchive, '-C', cacheDir], { stdio: 'pipe' });
@@ -128,7 +328,7 @@ async function downloadAndCacheBinary() {
       }
     }
 
-    if (fs.existsSync(tempArchive)) {
+    if (tempArchive && fs.existsSync(tempArchive)) {
       fs.unlinkSync(tempArchive);
     }
 
@@ -143,9 +343,17 @@ async function downloadAndCacheBinary() {
       throw new Error(`Extracted archive did not contain expected binary: ${binName}`);
     }
   } catch (err) {
-    if (fs.existsSync(tempArchive)) {
+    if (tempArchive && fs.existsSync(tempArchive)) {
       try { fs.unlinkSync(tempArchive); } catch {}
     }
+    if (createdCacheDir && fs.existsSync(cacheDir)) {
+      try {
+        const files = fs.readdirSync(cacheDir);
+        if (files.length === 0) {
+          fs.rmdirSync(cacheDir);
+        }
+      } catch {}
+    }
     throw err;
   }
 }
@@ -165,7 +373,7 @@ async function main() {
         console.log(`  Version:  v${VERSION}`);
         console.log(`  Engine:   NOT_FOUND (${err.message})`);
         console.log(`  Notice:   Run \`cargo build --release\` in xGauntlet repo or download v${VERSION} release.`);
-        process.exit(0);
+        process.exit(1);
       }
 
       console.error(`\x1b[31m[xgauntlet] Error: Could not resolve native engine binary for ${platform}-${arch}.\x1b[0m`);

package/package.json

@@ -38,5 +38,8 @@
     "test": "node --test"
   },
   "type": "module",
-  "version": "0.8.2"
+  "version": "0.8.4",
+  "dependencies": {
+    "sigstore": "^3.1.0"
+  }
 }