feat: verify frontend supply chain
This commit is contained in:
donghyeon-ka
@@ -0,0 +1,547 @@
|
||||
import { createHash } from "node:crypto";
|
||||
import { readFile } from "node:fs/promises";
|
||||
|
||||
/** @param {unknown} value @returns {unknown} */
|
||||
export function canonicalizeSupplyChainValue(value) {
|
||||
if (Array.isArray(value)) {
|
||||
return value
|
||||
.map(canonicalizeSupplyChainValue)
|
||||
.sort((left, right) =>
|
||||
JSON.stringify(left).localeCompare(JSON.stringify(right)),
|
||||
);
|
||||
}
|
||||
if (value && typeof value === "object") {
|
||||
return Object.fromEntries(
|
||||
Object.entries(value)
|
||||
.sort(([left], [right]) => left.localeCompare(right))
|
||||
.map(([key, item]) => [key, canonicalizeSupplyChainValue(item)]),
|
||||
);
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
/** @param {unknown} value */
|
||||
export function supplyChainDigest(value) {
|
||||
return createHash("sha256")
|
||||
.update(JSON.stringify(canonicalizeSupplyChainValue(value)))
|
||||
.digest("hex");
|
||||
}
|
||||
|
||||
/** @param {string} lockfile */
|
||||
export function parsePnpmLockfilePackages(lockfile) {
|
||||
const entries =
|
||||
/** @type {Array<{name: string, version: string, integrity: string}>} */ (
|
||||
[]
|
||||
);
|
||||
let inPackages = false;
|
||||
/** @type {{name: string, version: string, integrity: string} | null} */
|
||||
let current = null;
|
||||
|
||||
for (const line of lockfile.split(/\r?\n/)) {
|
||||
if (line === "packages:") {
|
||||
inPackages = true;
|
||||
continue;
|
||||
}
|
||||
if (line === "snapshots:") {
|
||||
if (current) entries.push(current);
|
||||
break;
|
||||
}
|
||||
if (!inPackages) continue;
|
||||
const packageMatch = line.match(/^ {2}(\S.*):$/);
|
||||
if (packageMatch) {
|
||||
if (current) entries.push(current);
|
||||
const key = packageMatch[1].replace(/^['"]|['"]$/g, "");
|
||||
const separator = key.lastIndexOf("@");
|
||||
current = {
|
||||
name: key.slice(0, separator),
|
||||
version: key.slice(separator + 1),
|
||||
integrity: "",
|
||||
};
|
||||
continue;
|
||||
}
|
||||
const integrityMatch = line.match(/\bintegrity:\s*([^,}\s]+)/);
|
||||
if (current && integrityMatch) {
|
||||
current.integrity = integrityMatch[1];
|
||||
}
|
||||
}
|
||||
return entries.sort((left, right) =>
|
||||
`${left.name}@${left.version}`.localeCompare(
|
||||
`${right.name}@${right.version}`,
|
||||
),
|
||||
);
|
||||
}
|
||||
|
||||
/** @param {string} integrity */
|
||||
export function isValidSha512Integrity(integrity) {
|
||||
if (!integrity.startsWith("sha512-")) return false;
|
||||
try {
|
||||
return Buffer.from(integrity.slice("sha512-".length), "base64").length === 64;
|
||||
} catch {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {unknown} raw
|
||||
* @returns {string}
|
||||
*/
|
||||
export function normalizeLicense(raw) {
|
||||
if (typeof raw === "string" && raw.trim()) return raw.trim();
|
||||
if (
|
||||
raw &&
|
||||
typeof raw === "object" &&
|
||||
"type" in raw &&
|
||||
typeof raw.type === "string"
|
||||
) {
|
||||
return raw.type;
|
||||
}
|
||||
if (Array.isArray(raw)) {
|
||||
const licenses = raw.map(normalizeLicense).filter(
|
||||
(license) => license !== "NOASSERTION",
|
||||
);
|
||||
return licenses.length > 0 ? licenses.join(" OR ") : "NOASSERTION";
|
||||
}
|
||||
return "NOASSERTION";
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {Record<string, unknown>} root
|
||||
* @param {Readonly<Record<string, string>>} directProduction
|
||||
* @param {Readonly<Record<string, string>>} directDevelopment
|
||||
*/
|
||||
export async function flattenPnpmDependencyTree(
|
||||
root,
|
||||
directProduction,
|
||||
directDevelopment,
|
||||
) {
|
||||
const records =
|
||||
/** @type {Map<string, {
|
||||
* name: string,
|
||||
* version: string,
|
||||
* direct: boolean,
|
||||
* scope: "production" | "development",
|
||||
* optional: boolean,
|
||||
* packagePath: string,
|
||||
* dependencies: Set<string>
|
||||
* }>} */ (new Map());
|
||||
const directIds = new Set();
|
||||
for (const [name, rawDependency] of Object.entries(
|
||||
/** @type {Record<string, unknown>} */ (root.dependencies ?? {}),
|
||||
)) {
|
||||
if (
|
||||
Object.hasOwn(directProduction, name) &&
|
||||
rawDependency &&
|
||||
typeof rawDependency === "object" &&
|
||||
!Array.isArray(rawDependency)
|
||||
) {
|
||||
directIds.add(
|
||||
`${name}@${String(
|
||||
/** @type {Record<string, unknown>} */ (rawDependency).version ?? "",
|
||||
)}`,
|
||||
);
|
||||
}
|
||||
}
|
||||
for (const [name, rawDependency] of Object.entries(
|
||||
/** @type {Record<string, unknown>} */ (root.devDependencies ?? {}),
|
||||
)) {
|
||||
if (
|
||||
Object.hasOwn(directDevelopment, name) &&
|
||||
rawDependency &&
|
||||
typeof rawDependency === "object" &&
|
||||
!Array.isArray(rawDependency)
|
||||
) {
|
||||
directIds.add(
|
||||
`${name}@${String(
|
||||
/** @type {Record<string, unknown>} */ (rawDependency).version ?? "",
|
||||
)}`,
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {Record<string, unknown>} node
|
||||
* @param {"production" | "development"} scope
|
||||
* @param {boolean} optionalPath
|
||||
*/
|
||||
function visit(node, scope, optionalPath) {
|
||||
for (const [groupName, group] of Object.entries({
|
||||
dependencies: node.dependencies,
|
||||
devDependencies: node.devDependencies,
|
||||
optionalDependencies: node.optionalDependencies,
|
||||
})) {
|
||||
if (!group || typeof group !== "object" || Array.isArray(group)) continue;
|
||||
for (const [name, rawDependency] of Object.entries(group)) {
|
||||
if (
|
||||
!rawDependency ||
|
||||
typeof rawDependency !== "object" ||
|
||||
Array.isArray(rawDependency)
|
||||
) {
|
||||
continue;
|
||||
}
|
||||
const dependency =
|
||||
/** @type {Record<string, unknown>} */ (rawDependency);
|
||||
const version = String(dependency.version ?? "");
|
||||
const packagePath = String(dependency.path ?? "");
|
||||
const identity = `${name}@${version}`;
|
||||
const childScope =
|
||||
scope === "production" && groupName !== "devDependencies"
|
||||
? "production"
|
||||
: "development";
|
||||
const childOptional =
|
||||
optionalPath || groupName === "optionalDependencies";
|
||||
const previous = records.get(identity);
|
||||
const dependencies = previous?.dependencies ?? new Set();
|
||||
for (const childGroup of [
|
||||
dependency.dependencies,
|
||||
dependency.optionalDependencies,
|
||||
]) {
|
||||
if (
|
||||
!childGroup ||
|
||||
typeof childGroup !== "object" ||
|
||||
Array.isArray(childGroup)
|
||||
) {
|
||||
continue;
|
||||
}
|
||||
for (const [childName, rawChild] of Object.entries(childGroup)) {
|
||||
if (
|
||||
rawChild &&
|
||||
typeof rawChild === "object" &&
|
||||
!Array.isArray(rawChild)
|
||||
) {
|
||||
dependencies.add(
|
||||
`${childName}@${String(rawChild.version ?? "")}`,
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
records.set(identity, {
|
||||
name,
|
||||
version,
|
||||
direct: directIds.has(identity),
|
||||
scope:
|
||||
previous?.scope === "production" || childScope === "production"
|
||||
? "production"
|
||||
: "development",
|
||||
optional: previous ? previous.optional && childOptional : childOptional,
|
||||
packagePath: previous?.packagePath || packagePath,
|
||||
dependencies,
|
||||
});
|
||||
visit(dependency, childScope, childOptional);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
const productionRoot = {
|
||||
dependencies: Object.fromEntries(
|
||||
Object.entries(
|
||||
/** @type {Record<string, unknown>} */ (root.dependencies ?? {}),
|
||||
).filter(([name]) => Object.hasOwn(directProduction, name)),
|
||||
),
|
||||
};
|
||||
const developmentRoot = {
|
||||
devDependencies: Object.fromEntries(
|
||||
Object.entries(
|
||||
/** @type {Record<string, unknown>} */ (root.devDependencies ?? {}),
|
||||
).filter(([name]) => Object.hasOwn(directDevelopment, name)),
|
||||
),
|
||||
};
|
||||
visit(productionRoot, "production", false);
|
||||
visit(developmentRoot, "development", false);
|
||||
|
||||
const result = [];
|
||||
for (const record of records.values()) {
|
||||
let license = "NOASSERTION";
|
||||
let optional = record.optional;
|
||||
if (record.packagePath) {
|
||||
try {
|
||||
const manifest = JSON.parse(
|
||||
await readFile(`${record.packagePath}/package.json`, "utf8"),
|
||||
);
|
||||
license = normalizeLicense(manifest.license ?? manifest.licenses);
|
||||
} catch {
|
||||
// Platform-specific optional packages may not be materialized locally.
|
||||
optional = true;
|
||||
}
|
||||
}
|
||||
result.push({
|
||||
name: record.name,
|
||||
version: record.version,
|
||||
direct: record.direct,
|
||||
scope: record.scope,
|
||||
optional,
|
||||
license,
|
||||
dependencies: [...record.dependencies].sort(),
|
||||
});
|
||||
}
|
||||
return result.sort((left, right) =>
|
||||
`${left.name}@${left.version}`.localeCompare(
|
||||
`${right.name}@${right.version}`,
|
||||
),
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {Readonly<Record<string, unknown>>} before
|
||||
* @param {Readonly<Record<string, unknown>>} after
|
||||
*/
|
||||
export function diffDependencyInventories(before, after) {
|
||||
const beforeRows =
|
||||
/** @type {Array<Record<string, unknown>>} */ (before.dependencies ?? []);
|
||||
const afterRows =
|
||||
/** @type {Array<Record<string, unknown>>} */ (after.dependencies ?? []);
|
||||
const beforeMap = new Map(
|
||||
beforeRows.map((row) => [`${row.name}@${row.version}`, row]),
|
||||
);
|
||||
const afterMap = new Map(
|
||||
afterRows.map((row) => [`${row.name}@${row.version}`, row]),
|
||||
);
|
||||
const added = [...afterMap.keys()].filter((key) => !beforeMap.has(key));
|
||||
const removed = [...beforeMap.keys()].filter((key) => !afterMap.has(key));
|
||||
const changed = [];
|
||||
for (const key of [...beforeMap.keys()].filter((item) => afterMap.has(item))) {
|
||||
if (
|
||||
supplyChainDigest(beforeMap.get(key)) !==
|
||||
supplyChainDigest(afterMap.get(key))
|
||||
) {
|
||||
changed.push(key);
|
||||
}
|
||||
}
|
||||
const upgrades = [];
|
||||
for (const removedKey of removed) {
|
||||
const previous = beforeMap.get(removedKey);
|
||||
const replacement = added.find(
|
||||
(addedKey) => afterMap.get(addedKey)?.name === previous?.name,
|
||||
);
|
||||
if (replacement) {
|
||||
upgrades.push({
|
||||
name: previous?.name,
|
||||
from: previous?.version,
|
||||
to: afterMap.get(replacement)?.version,
|
||||
});
|
||||
}
|
||||
}
|
||||
return Object.freeze({
|
||||
added: Object.freeze(added.sort()),
|
||||
removed: Object.freeze(removed.sort()),
|
||||
changed: Object.freeze(changed.sort()),
|
||||
upgrades: Object.freeze(
|
||||
upgrades.sort((left, right) =>
|
||||
String(left.name).localeCompare(String(right.name)),
|
||||
),
|
||||
),
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {Readonly<Record<string, unknown>>} inventory
|
||||
* @param {Readonly<Record<string, unknown>>} policy
|
||||
*/
|
||||
export function validateLicensePolicy(inventory, policy) {
|
||||
const allowed = new Set(
|
||||
/** @type {string[]} */ (policy.allowedLicenses ?? []),
|
||||
);
|
||||
const denied = /** @type {string[]} */ (policy.deniedLicensePatterns ?? []);
|
||||
const failures = [];
|
||||
const results = [];
|
||||
for (const dependency of /** @type {Array<Record<string, unknown>>} */ (
|
||||
inventory.dependencies ?? []
|
||||
)) {
|
||||
const license = String(dependency.license ?? "NOASSERTION");
|
||||
const explicitlyDenied = denied.some((pattern) =>
|
||||
new RegExp(pattern, "i").test(license),
|
||||
);
|
||||
const unknownAccepted =
|
||||
license === "NOASSERTION" && dependency.optional === true;
|
||||
const passed =
|
||||
!explicitlyDenied && (allowed.has(license) || unknownAccepted);
|
||||
results.push({
|
||||
package: `${dependency.name}@${dependency.version}`,
|
||||
license,
|
||||
passed,
|
||||
reason: unknownAccepted ? "platform-optional-not-materialized" : null,
|
||||
});
|
||||
if (!passed) {
|
||||
failures.push(
|
||||
`${dependency.name}@${dependency.version} has disallowed license ${license}`,
|
||||
);
|
||||
}
|
||||
}
|
||||
return Object.freeze({
|
||||
passed: failures.length === 0,
|
||||
failures: Object.freeze(failures),
|
||||
results: Object.freeze(results),
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {ReturnType<typeof diffDependencyInventories>} diff
|
||||
* @param {Readonly<Record<string, unknown>>} inventory
|
||||
* @param {Readonly<Record<string, unknown>>} evidenceFile
|
||||
*/
|
||||
export function validateDependencyReview(diff, inventory, evidenceFile) {
|
||||
const rows =
|
||||
/** @type {Array<Record<string, unknown>>} */ (inventory.dependencies ?? []);
|
||||
const byIdentity = new Map(
|
||||
rows.map((row) => [`${row.name}@${row.version}`, row]),
|
||||
);
|
||||
const evidence = new Map(
|
||||
/** @type {Array<Record<string, unknown>>} */ (
|
||||
evidenceFile.changes ?? []
|
||||
).map((entry) => [entry.changeId, entry]),
|
||||
);
|
||||
const highRisk = diff.added.filter((identity) => {
|
||||
const row = byIdentity.get(identity);
|
||||
return row?.direct === true && row.scope === "production";
|
||||
});
|
||||
const failures = [];
|
||||
for (const identity of highRisk) {
|
||||
const changeId = `add:${identity}`;
|
||||
const entry = evidence.get(changeId);
|
||||
if (!entry) {
|
||||
failures.push(`high-risk dependency missing review: ${changeId}`);
|
||||
continue;
|
||||
}
|
||||
for (const field of ["owner", "reviewer", "reason", "rollback"]) {
|
||||
if (typeof entry[field] !== "string" || !entry[field].trim()) {
|
||||
failures.push(`${changeId} missing ${field}`);
|
||||
}
|
||||
}
|
||||
if (entry.owner === entry.reviewer) {
|
||||
failures.push(`${changeId} may not be self-approved`);
|
||||
}
|
||||
}
|
||||
return Object.freeze({
|
||||
passed: failures.length === 0,
|
||||
highRisk: Object.freeze(highRisk),
|
||||
failures: Object.freeze(failures),
|
||||
});
|
||||
}
|
||||
|
||||
const severityRank = new Map([
|
||||
["unknown", 0],
|
||||
["low", 1],
|
||||
["moderate", 2],
|
||||
["high", 3],
|
||||
["critical", 4],
|
||||
]);
|
||||
|
||||
/**
|
||||
* @param {Readonly<Record<string, unknown>>} report
|
||||
* @param {Readonly<Record<string, unknown>>} policy
|
||||
* @param {Readonly<Record<string, unknown>>} exceptionFile
|
||||
* @param {string} lockfileSha256
|
||||
* @param {Date} [now]
|
||||
*/
|
||||
export function validateVulnerabilityReport(
|
||||
report,
|
||||
policy,
|
||||
exceptionFile,
|
||||
lockfileSha256,
|
||||
now = new Date(),
|
||||
) {
|
||||
const failures = [];
|
||||
if (report.scannedLockfileSha256 !== lockfileSha256) {
|
||||
failures.push("vulnerability report lockfile digest mismatch");
|
||||
}
|
||||
if (typeof report.provider !== "string" || !report.provider.trim()) {
|
||||
failures.push("vulnerability report provider missing");
|
||||
}
|
||||
const threshold = severityRank.get(String(policy.blockAtSeverity)) ?? 3;
|
||||
const exceptions =
|
||||
/** @type {Array<Record<string, unknown>>} */ (
|
||||
exceptionFile.exceptions ?? []
|
||||
);
|
||||
const blocking = [];
|
||||
for (const finding of /** @type {Array<Record<string, unknown>>} */ (
|
||||
report.findings ?? []
|
||||
)) {
|
||||
const severity = String(finding.severity ?? "unknown").toLowerCase();
|
||||
if ((severityRank.get(severity) ?? 0) < threshold) continue;
|
||||
const exception = exceptions.find(
|
||||
(entry) =>
|
||||
entry.vulnerabilityId === finding.id &&
|
||||
entry.packageName === finding.packageName,
|
||||
);
|
||||
const expiry =
|
||||
typeof exception?.expiresAt === "string"
|
||||
? Date.parse(exception.expiresAt)
|
||||
: Number.NaN;
|
||||
const validException =
|
||||
exception &&
|
||||
typeof exception.owner === "string" &&
|
||||
exception.owner.trim() &&
|
||||
typeof exception.reviewer === "string" &&
|
||||
exception.reviewer.trim() &&
|
||||
exception.owner !== exception.reviewer &&
|
||||
typeof exception.reason === "string" &&
|
||||
exception.reason.trim() &&
|
||||
Number.isFinite(expiry) &&
|
||||
expiry > now.getTime();
|
||||
if (!validException) {
|
||||
blocking.push(
|
||||
`${finding.id}:${finding.packageName}@${finding.version}:${severity}`,
|
||||
);
|
||||
}
|
||||
}
|
||||
return Object.freeze({
|
||||
passed: failures.length === 0 && blocking.length === 0,
|
||||
failures: Object.freeze(failures),
|
||||
blocking: Object.freeze(blocking),
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {Readonly<Record<string, unknown>>} sbom
|
||||
* @param {Readonly<Record<string, unknown>>} inventory
|
||||
* @param {Readonly<Record<string, unknown>>} provenance
|
||||
* @param {string} distDigest
|
||||
*/
|
||||
export function verifySupplyChainCoherence(
|
||||
sbom,
|
||||
inventory,
|
||||
provenance,
|
||||
distDigest,
|
||||
) {
|
||||
const failures = [];
|
||||
const componentCount = Array.isArray(sbom.components)
|
||||
? sbom.components.length
|
||||
: -1;
|
||||
const dependencyCount = Array.isArray(inventory.dependencies)
|
||||
? inventory.dependencies.length
|
||||
: -2;
|
||||
if (componentCount !== dependencyCount) {
|
||||
failures.push("SBOM component count does not match inventory");
|
||||
}
|
||||
const metadata =
|
||||
/** @type {Record<string, unknown>} */ (sbom.metadata ?? {});
|
||||
const properties =
|
||||
/** @type {Array<{name?: string, value?: string}>} */ (
|
||||
metadata.properties ?? []
|
||||
);
|
||||
if (properties.find(
|
||||
/** @param {{name?: string, value?: string}} property */
|
||||
(property) =>
|
||||
property.name === "ca:lockfileSha256" &&
|
||||
property.value === inventory.lockfileSha256,
|
||||
) === undefined) {
|
||||
failures.push("SBOM lockfile digest does not match inventory");
|
||||
}
|
||||
const subject =
|
||||
/** @type {Array<Record<string, unknown>>} */ (provenance.subject ?? [])[0];
|
||||
const subjectDigest =
|
||||
/** @type {Record<string, unknown>} */ (subject?.digest ?? {});
|
||||
if (subjectDigest.sha256 !== distDigest) {
|
||||
failures.push("provenance subject does not match built dist digest");
|
||||
}
|
||||
const predicate =
|
||||
/** @type {Record<string, unknown>} */ (provenance.predicate ?? {});
|
||||
const materials =
|
||||
/** @type {Record<string, unknown>} */ (predicate.materials ?? {});
|
||||
if (materials.lockfileSha256 !== inventory.lockfileSha256) {
|
||||
failures.push("provenance lockfile material does not match inventory");
|
||||
}
|
||||
return Object.freeze({
|
||||
passed: failures.length === 0,
|
||||
failures: Object.freeze(failures),
|
||||
});
|
||||
}
|
||||
Reference in New Issue
Block a user