fix: promote immutable verified release bundles

scripts/generate-supply-chain.ts

@@ -1,13 +1,10 @@
 import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { gzipSync } from "node:zlib";
 import {
   mkdir,
   readFile,
-  stat,
   writeFile,
 } from "node:fs/promises";
-import path from "node:path";
 
 import {
   bundlePerformanceArtifactSchema,
@@ -27,7 +24,6 @@ import {
   supplyChainDigest,
   validateDependencyReview,
   validateLicensePolicy,
-  validateVulnerabilityReport,
   verifySupplyChainCoherence,
   type DependencyInventoryDiff,
 } from "./lib/supply-chain.ts";
@@ -37,6 +33,7 @@ import {
   buildRepositoryFileInventory,
   parseRepositoryFileInventoryPolicy,
 } from "./lib/repository-file-inventory.ts";
+import { collectDistOutputs, distSha256 } from "./lib/release-candidate.ts";
 
 type Document = Record<string, unknown>;
 
@@ -151,31 +148,8 @@ const repositoryInventory = await buildRepositoryFileInventory({
   generatedRoots: inventoryPolicy.generatedRoots,
   optionalRoots: inventoryPolicy.optionalRoots,
 });
-const outputFiles = repositoryInventory.generatedFiles.filter(
-  (file) => file === "dist" || file.startsWith("dist/"),
-);
-if (outputFiles.length === 0) {
-  throw new Error("dist is missing; run the production build first");
-}
-const outputs = await Promise.all(
-  outputFiles.map(async (outputFile) => {
-    const content = await readFile(outputFile);
-    const metadata = await stat(outputFile);
-    return {
-      path: outputFile.replaceAll("\\", "/"),
-      bytes: metadata.size,
-      gzipBytes: gzipSync(content).byteLength,
-      sha256: createHash("sha256").update(content).digest("hex"),
-    };
-  }),
-);
-const distDigest = supplyChainDigest(
-  outputs.map(({ path: outputPath, bytes, sha256 }) => ({
-    path: outputPath,
-    bytes,
-    sha256,
-  })),
-);
+const outputs = await collectDistOutputs();
+const distDigest = distSha256(outputs);
 const inventory = await buildDependencyInventory();
 const licensePolicy = JSON.parse(
   await readFile("config/security/dependency-policy.json", "utf8"),
@@ -229,44 +203,15 @@ if (baseline && baselineApproval) {
   baselineFailures.push("dependency baseline and approval are required");
 }
 
-const vulnerabilityPolicy = JSON.parse(
-  await readFile("config/security/vulnerability-policy.json", "utf8"),
-);
-const vulnerabilityExceptions = JSON.parse(
-  await readFile("config/security/vulnerability-exceptions.json", "utf8"),
-);
-const vulnerabilityInput = process.env.VULNERABILITY_REPORT_PATH
-  ? await optionalJson(process.env.VULNERABILITY_REPORT_PATH)
-  : null;
-const vulnerabilityResult = vulnerabilityInput
-  ? validateVulnerabilityReport(
-      vulnerabilityInput,
-      vulnerabilityPolicy,
-      vulnerabilityExceptions,
-      inventory.lockfileSha256,
-    )
-  : {
-      passed: false,
-      failures: ["external vulnerability provider report is missing"],
-      blocking: [],
-    };
 const vulnerabilityReport = {
   schemaVersion: 1,
-  provider: vulnerabilityInput?.provider ?? "UNCONFIGURED",
-  scannedLockfileSha256:
-    vulnerabilityInput?.scannedLockfileSha256 ?? inventory.lockfileSha256,
-  status: vulnerabilityInput
-    ? vulnerabilityResult.passed
-      ? "PASS"
-      : "FAIL"
-    : "FAIL_UNVERIFIED",
-  findings: vulnerabilityInput?.findings ?? [],
-  exceptionsApplied:
-    vulnerabilityInput && vulnerabilityResult.passed
-      ? vulnerabilityExceptions.exceptions
-      : [],
-  failures: vulnerabilityResult.failures,
-  blocking: vulnerabilityResult.blocking,
+  provider: "UNCONFIGURED",
+  scannedLockfileSha256: inventory.lockfileSha256,
+  status: "FAIL_UNVERIFIED",
+  findings: [],
+  exceptionsApplied: [],
+  failures: ["external vulnerability provider report is missing"],
+  blocking: [],
 };
 
 const sourceFiles = [...repositoryInventory.trackedFiles];
@@ -364,40 +309,17 @@ const coherence = verifySupplyChainCoherence(
   distDigest,
 );
 
-const attestationInput = process.env.PROVENANCE_ATTESTATION_PATH
-  ? await optionalJson(process.env.PROVENANCE_ATTESTATION_PATH)
-  : null;
-const attestation = isRecord(attestationInput?.subject)
-  ? attestationInput.subject
-  : {};
-const attestationSubject = isRecord(attestation.digest)
-  ? attestation.digest
-  : {};
-const attestationPassed =
-  attestationSubject.sha256 === distDigest &&
-  typeof attestationInput?.provider === "string" &&
-  Boolean(attestationInput.provider) &&
-  typeof attestationInput?.signer === "string" &&
-  Boolean(attestationInput.signer);
 const localFailures = [
   ...licenseResult.failures,
   ...baselineFailures,
   ...reviewResult.failures,
   ...coherence.failures,
 ];
-if (vulnerabilityInput && !vulnerabilityResult.passed) {
-  localFailures.push(
-    ...vulnerabilityResult.failures,
-    ...vulnerabilityResult.blocking,
-  );
-}
 const localPassed = localFailures.length === 0;
-const promotionPassed =
-  localPassed && vulnerabilityResult.passed && attestationPassed;
 const verification = {
   schemaVersion: 1,
   localStatus: localPassed ? "PASS" : "FAIL",
-  promotionStatus: promotionPassed ? "PASS" : "FAIL_UNVERIFIED",
+  promotionStatus: "FAIL_UNVERIFIED",
   lockfileSha256: inventory.lockfileSha256,
   sourceSetSha256,
   distSha256: distDigest,
@@ -405,9 +327,7 @@ const verification = {
   dependencyDiff,
   highRiskReview: reviewResult.highRisk,
   vulnerabilityStatus: vulnerabilityReport.status,
-  provenanceAttestationStatus: attestationPassed
-    ? "PASS"
-    : "FAIL_UNVERIFIED",
+  provenanceAttestationStatus: "FAIL_UNVERIFIED",
   failures: localFailures,
 };
 const bundleReport = {