feat: verify frontend supply chain

2026-07-26 17:37:51 +09:00
parent a64708f3de
commit 8b4f875c1c
35 changed files with 8910 additions and 141 deletions
@@ -0,0 +1,121 @@
+import { createHash } from "node:crypto";
+import { mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
+import path from "node:path";
+
+import {
+  isValidSha512Integrity,
+  parsePnpmLockfilePackages,
+  supplyChainDigest,
+  verifySupplyChainCoherence,
+} from "./lib/supply-chain.mjs";
+
+/** @param {string} directory @returns {Promise<string[]>} */
+async function filesWithin(directory) {
+  const entries = await readdir(directory, { withFileTypes: true });
+  const nested = /** @type {string[][]} */ (await Promise.all(
+    entries.map((entry) => {
+      const target = path.join(directory, entry.name);
+      return entry.isDirectory() ? filesWithin(target) : [target];
+    }),
+  ));
+  return nested.flat().sort();
+}
+
+const inventory = JSON.parse(
+  await readFile("artifacts/release/dependency-inventory.json", "utf8"),
+);
+const sbom = JSON.parse(
+  await readFile("artifacts/release/sbom.cdx.json", "utf8"),
+);
+const provenance = JSON.parse(
+  await readFile("artifacts/release/provenance.json", "utf8"),
+);
+const verification = JSON.parse(
+  await readFile(
+    "artifacts/security/supply-chain-verification.json",
+    "utf8",
+  ),
+);
+const lockfileText = await readFile("pnpm-lock.yaml", "utf8");
+const lockfileSha256 = createHash("sha256")
+  .update(lockfileText)
+  .digest("hex");
+const outputs = await Promise.all(
+  (await filesWithin("dist")).map(async (file) => {
+    const content = await readFile(file);
+    return {
+      path: file.replaceAll("\\", "/"),
+      bytes: (await stat(file)).size,
+      sha256: createHash("sha256").update(content).digest("hex"),
+    };
+  }),
+);
+const distDigest = supplyChainDigest(outputs);
+const coherence = verifySupplyChainCoherence(
+  sbom,
+  inventory,
+  provenance,
+  distDigest,
+);
+const failures = [...coherence.failures];
+if (
+  inventory.lockfileSha256 !== lockfileSha256 ||
+  verification.lockfileSha256 !== lockfileSha256
+) {
+  failures.push("inventory/verification lockfile digest mismatch");
+}
+if (
+  verification.distSha256 !== distDigest ||
+  verification.sbomSha256 !== supplyChainDigest(sbom)
+) {
+  failures.push("verification digest set is incoherent");
+}
+const lockRows = parsePnpmLockfilePackages(lockfileText);
+const inventoryRows =
+  /** @type {Array<Record<string, unknown>>} */ (
+    inventory.dependencies ?? []
+  );
+const inventoryByIdentity = new Map(
+  inventoryRows.map((entry) => [
+    `${entry.name}@${entry.version}`,
+    entry,
+  ]),
+);
+if (lockRows.length !== inventoryRows.length) {
+  failures.push("transitive dependency count differs from lockfile");
+}
+for (const lockRow of lockRows) {
+  const identity = `${lockRow.name}@${lockRow.version}`;
+  const dependency = inventoryByIdentity.get(identity);
+  if (
+    !dependency ||
+    dependency.integrity !== lockRow.integrity ||
+    !isValidSha512Integrity(lockRow.integrity)
+  ) {
+    failures.push(`lockfile inventory integrity mismatch: ${identity}`);
+  }
+}
+
+const report = {
+  schemaVersion: 1,
+  status: failures.length === 0 ? "PASS" : "FAIL",
+  dependencyCount: inventoryRows.length,
+  lockfileSha256,
+  distSha256: distDigest,
+  sbomSha256: supplyChainDigest(sbom),
+  failures,
+};
+await mkdir("artifacts/security", { recursive: true });
+await writeFile(
+  "artifacts/security/supply-chain-coherence.json",
+  `${JSON.stringify(report, null, 2)}\n`,
+);
+if (failures.length > 0) {
+  process.stderr.write(
+    `Supply-chain artifact coherence failed:\n- ${failures.join("\n- ")}\n`,
+  );
+  process.exit(1);
+}
+process.stdout.write(
+  `Supply-chain artifact coherence: PASS (${inventoryRows.length} dependencies)\n`,
+);