fix: promote immutable verified release bundles

scripts/verify-supply-chain-artifacts.ts

@@ -1,6 +1,5 @@
 import { createHash } from "node:crypto";
-import { mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
-import path from "node:path";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
 
 import {
   isValidSha512Integrity,
@@ -9,6 +8,10 @@ import {
   verifySupplyChainCoherence,
 } from "./lib/supply-chain.ts";
 import { assertMatchesJsonSchema } from "./lib/json-schema.ts";
+import {
+  collectDistOutputs,
+  distSha256,
+} from "./lib/release-candidate.ts";
 
 type Document = Record<string, unknown>;
 
@@ -30,17 +33,6 @@ async function readDocument(file: string): Promise<Document> {
   return parseDocument(await readFile(file, "utf8"), file);
 }
 
-async function filesWithin(directory: string): Promise<string[]> {
-  const entries = await readdir(directory, { withFileTypes: true });
-  const nested: string[][] = await Promise.all(
-    entries.map((entry) => {
-      const target = path.join(directory, entry.name);
-      return entry.isDirectory() ? filesWithin(target) : [target];
-    }),
-  );
-  return nested.flat().sort();
-}
-
 const inventory = await readDocument(
   "artifacts/release/dependency-inventory.json",
 );
@@ -72,24 +64,18 @@ const lockfileText = await readFile("pnpm-lock.yaml", "utf8");
 const lockfileSha256 = createHash("sha256")
   .update(lockfileText)
   .digest("hex");
-const outputs = await Promise.all(
-  (await filesWithin("dist")).map(async (file) => {
-    const content = await readFile(file);
-    return {
-      path: file.replaceAll("\\", "/"),
-      bytes: (await stat(file)).size,
-      sha256: createHash("sha256").update(content).digest("hex"),
-    };
-  }),
-);
-const distDigest = supplyChainDigest(outputs);
+const outputs = await collectDistOutputs();
+const distDigest = distSha256(outputs);
 const coherence = verifySupplyChainCoherence(
   sbom,
   inventory,
   provenance,
   distDigest,
 );
-const failures: string[] = [...artifactSchemaFailures, ...coherence.failures];
+const failures: string[] = [
+  ...artifactSchemaFailures,
+  ...coherence.failures,
+];
 if (
   inventory.lockfileSha256 !== lockfileSha256 ||
   verification.lockfileSha256 !== lockfileSha256