fix: promote immutable verified release bundles

scripts/check-supply-chain-provider-fixtures.ts

@@ -1,103 +1,118 @@
-import { spawnSync } from "node:child_process";
-import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
-import path from "node:path";
+import { generateKeyPairSync, sign } from "node:crypto";
+import { mkdir, writeFile } from "node:fs/promises";
 
-type Document = Record<string, unknown>;
+import {
+  evaluatePromotionEvidence,
+  providerEvidenceSignaturePayload,
+} from "./lib/provider-evidence.ts";
 
-function isRecord(value: unknown): value is Document {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}
-
-async function readDocument(file: string): Promise<Document> {
-  const parsed: unknown = JSON.parse(await readFile(file, "utf8"));
-  if (!isRecord(parsed)) throw new Error(`${file} must be a JSON object`);
-  return parsed;
-}
-
-const fixtureDirectory = path.resolve(".tmp/supply-chain-provider-fixture");
-await rm(fixtureDirectory, { recursive: true, force: true });
-await mkdir(fixtureDirectory, { recursive: true });
-const inventory = await readDocument(
-  "artifacts/release/dependency-inventory.json",
-);
-const verification = await readDocument(
-  "artifacts/security/supply-chain-verification.json",
-);
-const vulnerabilityPath = path.join(
-  fixtureDirectory,
-  "vulnerability-report.json",
-);
-const attestationPath = path.join(fixtureDirectory, "attestation.json");
-await writeFile(
-  vulnerabilityPath,
-  `${JSON.stringify(
-    {
-      schemaVersion: 1,
-      provider: "fixture-scanner",
-      scannedLockfileSha256: inventory.lockfileSha256,
-      generatedAt: "2026-07-26T00:00:00.000Z",
-      findings: [],
-    },
-    null,
-    2,
-  )}\n`,
-);
-await writeFile(
-  attestationPath,
-  `${JSON.stringify(
-    {
-      schemaVersion: 1,
-      provider: "fixture-attestor",
-      signer: "fixture-workload-identity",
-      subject: {
-        name: "dist",
-        digest: { sha256: verification.distSha256 },
-      },
-    },
-    null,
-    2,
-  )}\n`,
-);
-const providerRun = spawnSync(
-  "node",
-  ["scripts/generate-supply-chain.ts"],
-  {
-    env: {
-      ...process.env,
-      VULNERABILITY_REPORT_PATH: vulnerabilityPath,
-      PROVENANCE_ATTESTATION_PATH: attestationPath,
-    },
-    encoding: "utf8",
+const candidateDistSha256 = "1".repeat(64);
+const lockfileSha256 = "2".repeat(64);
+const vulnerabilityKeys = generateKeyPairSync("ed25519");
+const provenanceKeys = generateKeyPairSync("ed25519");
+const trust = {
+  vulnerabilityTrust: {
+    keyId: "fixture-vulnerability-key",
+    publicKey: vulnerabilityKeys.publicKey,
   },
-);
-let promotionStatus = "MISSING";
-if (providerRun.status === 0) {
-  const providerVerification = await readDocument(
-    "artifacts/security/supply-chain-verification.json",
-  );
-  promotionStatus =
-    typeof providerVerification.promotionStatus === "string"
-      ? providerVerification.promotionStatus
-      : "MISSING";
+  provenanceTrust: {
+    keyId: "fixture-provenance-key",
+    publicKey: provenanceKeys.publicKey,
+  },
+};
+
+function signedEvidence(
+  value: Record<string, unknown>,
+  keyId: string,
+  privateKey: typeof vulnerabilityKeys.privateKey,
+) {
+  return {
+    ...value,
+    signature: {
+      algorithm: "Ed25519",
+      keyId,
+      value: sign(
+        null,
+        providerEvidenceSignaturePayload(value),
+        privateKey,
+      ).toString("base64"),
+    },
+  };
 }
-const restore = spawnSync(
-  "node",
-  ["scripts/generate-supply-chain.ts"],
-  { encoding: "utf8" },
-);
-await rm(fixtureDirectory, { recursive: true, force: true });
+
+function evidenceFor(distDigest: string) {
+  return {
+    vulnerabilityReport: signedEvidence(
+      {
+        schemaVersion: 1,
+        provider: "fixture-vulnerability-provider",
+        generatedAt: "2026-08-01T00:00:00.000Z",
+        scannedLockfileSha256: lockfileSha256,
+        scannedDistSha256: distDigest,
+        findings: [],
+      },
+      "fixture-vulnerability-key",
+      vulnerabilityKeys.privateKey,
+    ),
+    provenanceAttestation: signedEvidence(
+      {
+        schemaVersion: 1,
+        provider: "fixture-provenance-provider",
+        signer: "fixture-workload-identity",
+        generatedAt: "2026-08-01T00:00:00.000Z",
+        subject: { name: "dist", digest: { sha256: distDigest } },
+      },
+      "fixture-provenance-key",
+      provenanceKeys.privateKey,
+    ),
+  };
+}
+
+const base = {
+  candidate: { distSha256: candidateDistSha256, lockfileSha256 },
+  currentDistSha256: candidateDistSha256,
+  localStatus: "PASS",
+  ...trust,
+};
+const validEvidence = evidenceFor(candidateDistSha256);
+const fixtures = {
+  absent: evaluatePromotionEvidence({
+    ...base,
+    vulnerabilityReport: null,
+    provenanceAttestation: null,
+  }),
+  validImmutable: evaluatePromotionEvidence({ ...base, ...validEvidence }),
+  wrongDigest: evaluatePromotionEvidence({
+    ...base,
+    ...evidenceFor("3".repeat(64)),
+  }),
+  postAttestationMutation: evaluatePromotionEvidence({
+    ...base,
+    ...validEvidence,
+    currentDistSha256: "4".repeat(64),
+  }),
+};
 const passed =
-  providerRun.status === 0 &&
-  promotionStatus === "PASS" &&
-  restore.status === 0;
+  fixtures.validImmutable.status === "PASS" &&
+  fixtures.absent.status === "FAIL_UNVERIFIED" &&
+  fixtures.wrongDigest.status === "FAIL_UNVERIFIED" &&
+  fixtures.postAttestationMutation.status === "FAIL_UNVERIFIED";
+
+await mkdir("artifacts/security", { recursive: true });
 await writeFile(
   "artifacts/security/supply-chain-provider-fixtures.json",
   `${JSON.stringify(
     {
       schemaVersion: 1,
-      providerAccepted: providerRun.status === 0,
-      promotionStatus,
-      unverifiedDefaultRestored: restore.status === 0,
+      fixtures: Object.fromEntries(
+        Object.entries(fixtures).map(([name, result]) => [
+          name,
+          { status: result.status, failures: result.failures },
+        ]),
+      ),
+      passingFixtureCount: Object.values(fixtures).filter(
+        (result) => result.status === "PASS",
+      ).length,
       status: passed ? "PASS" : "FAIL",
     },
     null,
@@ -105,17 +120,9 @@ await writeFile(
   )}\n`,
 );
 if (!passed) {
-  const detail =
-    providerRun.stderr ||
-    restore.stderr ||
-    providerRun.stdout ||
-    restore.stdout ||
-    `providerStatus=${String(providerRun.status)}, promotionStatus=${promotionStatus}, restoreStatus=${String(restore.status)}`;
-  process.stderr.write(
-    `Supply-chain provider fixture failed: ${detail}\n`,
-  );
+  process.stderr.write("Supply-chain provider fixtures failed closed incorrectly\n");
   process.exit(1);
 }
 process.stdout.write(
-  "Supply-chain provider fixture: verified PASS and unconfigured default restored\n",
+  "Supply-chain provider fixtures: only the valid immutable fixture PASS\n",
 );