refactor: generate CI workflow from gate contracts

scripts/lib/promotion-verifier.ts

@@ -1,9 +1,9 @@
-import { createPublicKey } from "node:crypto";
-import { readFile } from "node:fs/promises";
+import { createHash, createPublicKey } from "node:crypto";
 import path from "node:path";
 
 import {
   evaluatePromotionEvidence,
+  type ProviderVerificationArtifactType,
   type ProviderTrust,
 } from "./provider-evidence.ts";
 import {
@@ -12,20 +12,58 @@ import {
   verifyReleaseCandidate,
 } from "./release-candidate.ts";
 import { verifyArchivedLocalEvidence } from "./local-release-evidence.ts";
+import { readBoundedRegularFile } from "./ci-artifact-validator.ts";
 
 type LocalEvidenceVerifier = typeof verifyArchivedLocalEvidence;
 
 export type VerifyPromotionInputsOptions = Readonly<{
+  artifactType: ProviderVerificationArtifactType;
   environment?: NodeJS.ProcessEnv;
   repositoryRoot?: string;
+  providerEvidenceRoot?: string;
+  trustRoot?: string;
   verifyLocalEvidence?: LocalEvidenceVerifier;
 }>;
 
 export async function verifyPromotionInputs(
-  options: VerifyPromotionInputsOptions = {},
+  options: VerifyPromotionInputsOptions,
 ) {
   const environment = options.environment ?? process.env;
   const repositoryRoot = path.resolve(options.repositoryRoot ?? process.cwd());
+  const trustRoot = path.resolve(options.trustRoot ?? repositoryRoot);
+  const providerEvidenceRoot = path.resolve(
+    options.providerEvidenceRoot ?? repositoryRoot,
+  );
+  const inputFailures: string[] = [];
+  const archive = await captureOptionalInput(
+    providerEvidenceRoot,
+    environment.CANDIDATE_ARCHIVE_PATH,
+    268_435_456,
+    "candidate archive",
+    inputFailures,
+  );
+  if (!environment.CANDIDATE_ARCHIVE_SHA256) {
+    inputFailures.push("candidate archive expected SHA-256 is missing");
+  } else if (
+    archive.sha256 &&
+    archive.sha256 !== environment.CANDIDATE_ARCHIVE_SHA256
+  ) {
+    inputFailures.push("candidate archive SHA-256 does not match immutable output");
+  }
+  const vulnerabilityCapture = await captureOptionalInput(
+    providerEvidenceRoot,
+    environment.VULNERABILITY_REPORT_PATH,
+    16_777_216,
+    "vulnerability report",
+    inputFailures,
+  );
+  const provenanceCapture = await captureOptionalInput(
+    providerEvidenceRoot,
+    environment.PROVENANCE_ATTESTATION_PATH,
+    16_777_216,
+    "provenance attestation",
+    inputFailures,
+  );
   const manifestDocument = await requiredJson(
     repositoryRoot,
     RELEASE_CANDIDATE_MANIFEST_PATH,
@@ -38,38 +76,34 @@ export async function verifyPromotionInputs(
   const localEvidence = await (
     options.verifyLocalEvidence ?? verifyArchivedLocalEvidence
   )({ repositoryRoot, candidate: manifest });
-  const vulnerabilityReport = await optionalJson(
-    repositoryRoot,
-    environment.VULNERABILITY_REPORT_PATH,
-  );
-  const provenanceAttestation = await optionalJson(
-    repositoryRoot,
-    environment.PROVENANCE_ATTESTATION_PATH,
-  );
+  const vulnerabilityReport = parseCapturedJson(vulnerabilityCapture.bytes);
+  const provenanceAttestation = parseCapturedJson(provenanceCapture.bytes);
   const result = evaluatePromotionEvidence({
     candidate: manifest,
     currentDistSha256: candidate.currentDistSha256 ?? "",
     localStatus: localEvidence.status,
     vulnerabilityReport,
     provenanceAttestation,
-    vulnerabilityTrust: await readTrust(
-      repositoryRoot,
+    vulnerabilityTrust: await readProviderTrust(
+      trustRoot,
       environment.VULNERABILITY_PUBLIC_KEY_PATH,
       environment.VULNERABILITY_KEY_ID,
     ),
-    provenanceTrust: await readTrust(
-      repositoryRoot,
+    provenanceTrust: await readProviderTrust(
+      trustRoot,
       environment.PROVENANCE_PUBLIC_KEY_PATH,
       environment.PROVENANCE_KEY_ID,
     ),
   });
   const failures = [
+    ...inputFailures,
     ...candidate.failures,
     ...localEvidence.failures,
     ...result.failures,
   ];
   return Object.freeze({
-    schemaVersion: 1 as const,
+    schemaVersion: 2 as const,
+    artifactType: options.artifactType,
     status:
       failures.length === 0 && result.status === "PASS"
         ? ("PASS" as const)
@@ -78,11 +112,14 @@ export async function verifyPromotionInputs(
     provenanceAttestationStatus: result.provenanceAttestationStatus,
     lockfileSha256: manifest.lockfileSha256,
     distSha256: manifest.distSha256,
+    candidateArchiveSha256: archive.sha256,
+    vulnerabilityReportSha256: vulnerabilityCapture.sha256,
+    provenanceAttestationSha256: provenanceCapture.sha256,
     failures: Object.freeze(failures),
   });
 }
 
-async function readTrust(
+export async function readProviderTrust(
   repositoryRoot: string,
   publicKeyPath: string | undefined,
   keyId: string | undefined,
@@ -92,7 +129,9 @@ async function readTrust(
     return Object.freeze({
       keyId,
       publicKey: createPublicKey(
-        await readFile(path.resolve(repositoryRoot, publicKeyPath), "utf8"),
+        new TextDecoder("utf-8", { fatal: true }).decode(
+          await boundedConfiguredFile(repositoryRoot, publicKeyPath, 1_048_576),
+        ),
       ),
     });
   } catch {
@@ -100,15 +139,35 @@ async function readTrust(
   }
 }
 
-async function optionalJson(
-  repositoryRoot: string,
-  file: string | undefined,
-): Promise<unknown> {
-  if (!file) return null;
+async function captureOptionalInput(
+  root: string,
+  configuredPath: string | undefined,
+  maxBytes: number,
+  label: string,
+  failures: string[],
+): Promise<Readonly<{ bytes: Buffer | null; sha256: string | null }>> {
+  if (!configuredPath) {
+    failures.push(`${label} path is missing`);
+    return Object.freeze({ bytes: null, sha256: null });
+  }
   try {
-    return JSON.parse(
-      await readFile(path.resolve(repositoryRoot, file), "utf8"),
-    ) as unknown;
+    const bytes = await boundedConfiguredFile(root, configuredPath, maxBytes);
+    return Object.freeze({
+      bytes,
+      sha256: createHash("sha256").update(bytes).digest("hex"),
+    });
+  } catch (error) {
+    failures.push(
+      `${label} capture failed: ${error instanceof Error ? error.message : String(error)}`,
+    );
+    return Object.freeze({ bytes: null, sha256: null });
+  }
+}
+
+function parseCapturedJson(bytes: Buffer | null): unknown {
+  if (!bytes) return null;
+  try {
+    return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes)) as unknown;
   } catch {
     return null;
   }
@@ -119,10 +178,28 @@ async function requiredJson(
   file: string,
 ): Promise<Record<string, unknown>> {
   const value: unknown = JSON.parse(
-    await readFile(path.join(repositoryRoot, file), "utf8"),
+    new TextDecoder("utf-8", { fatal: true }).decode(
+      await boundedConfiguredFile(repositoryRoot, file, 8_388_608),
+    ),
   );
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     throw new TypeError(`${file} must be a JSON object`);
   }
   return value as Record<string, unknown>;
 }
+
+async function boundedConfiguredFile(
+  configuredRoot: string,
+  configuredPath: string,
+  maxBytes: number,
+): Promise<Buffer> {
+  const root = path.resolve(configuredRoot);
+  const absolute = path.resolve(root, configuredPath);
+  const relative = path.relative(root, absolute);
+  const outside = relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative);
+  return readBoundedRegularFile({
+    root: outside ? path.dirname(absolute) : root,
+    relativePath: outside ? path.basename(absolute) : relative.replaceAll(path.sep, "/"),
+    maxBytes,
+  });
+}