feat: verify frontend supply chain
This commit is contained in:
donghyeon-ka
+30
-5
@@ -58,7 +58,10 @@
|
|||||||
"gates": {
|
"gates": {
|
||||||
"FE-GATE-001": {
|
"FE-GATE-001": {
|
||||||
"name": "manifest-lockfile",
|
"name": "manifest-lockfile",
|
||||||
"steps": [{ "script": "verify:lockfile", "expect": "pass" }],
|
"steps": [
|
||||||
|
{ "script": "verify:lockfile", "expect": "pass" },
|
||||||
|
{ "script": "check:frozen-lockfile:fixture", "expect": "pass" }
|
||||||
|
],
|
||||||
"logPath": "artifacts/quality/install.txt",
|
"logPath": "artifacts/quality/install.txt",
|
||||||
"evidence": ["artifacts/quality/install.txt"],
|
"evidence": ["artifacts/quality/install.txt"],
|
||||||
"retentionClass": "merge-cycle"
|
"retentionClass": "merge-cycle"
|
||||||
@@ -239,14 +242,32 @@
|
|||||||
"FE-GATE-013": {
|
"FE-GATE-013": {
|
||||||
"name": "security",
|
"name": "security",
|
||||||
"steps": [
|
"steps": [
|
||||||
|
{ "script": "verify:reproducible-build", "expect": "pass" },
|
||||||
{ "script": "build:release", "expect": "pass" },
|
{ "script": "build:release", "expect": "pass" },
|
||||||
|
{ "script": "verify:supply-chain", "expect": "pass" },
|
||||||
|
{ "script": "check:supply-chain:fixtures", "expect": "pass" },
|
||||||
|
{
|
||||||
|
"script": "check:supply-chain:provider-fixtures",
|
||||||
|
"expect": "pass"
|
||||||
|
},
|
||||||
|
{ "script": "scan:security:fixture", "expect": "fail" },
|
||||||
{ "script": "check:browser-security", "expect": "pass" }
|
{ "script": "check:browser-security", "expect": "pass" }
|
||||||
],
|
],
|
||||||
"logPath": "artifacts/quality/gates/FE-GATE-013.txt",
|
"logPath": "artifacts/quality/gates/FE-GATE-013.txt",
|
||||||
"evidence": [
|
"evidence": [
|
||||||
"artifacts/security/scan.sarif",
|
"artifacts/security/scan.sarif",
|
||||||
|
"artifacts/security/scan-fixture.sarif",
|
||||||
"artifacts/release/dependency-inventory.json",
|
"artifacts/release/dependency-inventory.json",
|
||||||
"artifacts/security/dependency-diff.json"
|
"artifacts/release/sbom.cdx.json",
|
||||||
|
"artifacts/release/provenance.json",
|
||||||
|
"artifacts/release/reproducible-build.json",
|
||||||
|
"artifacts/security/dependency-diff.json",
|
||||||
|
"artifacts/security/license-report.json",
|
||||||
|
"artifacts/security/vulnerability-report.json",
|
||||||
|
"artifacts/security/supply-chain-verification.json",
|
||||||
|
"artifacts/security/supply-chain-coherence.json",
|
||||||
|
"artifacts/security/supply-chain-fixtures.json",
|
||||||
|
"artifacts/security/supply-chain-provider-fixtures.json"
|
||||||
],
|
],
|
||||||
"retentionClass": "release-coherence"
|
"retentionClass": "release-coherence"
|
||||||
},
|
},
|
||||||
@@ -260,11 +281,15 @@
|
|||||||
"FE-GATE-015": {
|
"FE-GATE-015": {
|
||||||
"name": "release-coherence",
|
"name": "release-coherence",
|
||||||
"steps": [
|
"steps": [
|
||||||
{ "script": "build", "expect": "pass" },
|
{ "script": "build:release", "expect": "pass" },
|
||||||
{ "script": "verify:release", "expect": "pass" }
|
{ "script": "verify:release", "expect": "pass" },
|
||||||
|
{ "script": "verify:supply-chain:promotion", "expect": "pass" }
|
||||||
],
|
],
|
||||||
"logPath": "artifacts/quality/gates/FE-GATE-015.txt",
|
"logPath": "artifacts/quality/gates/FE-GATE-015.txt",
|
||||||
"evidence": ["artifacts/release/verification.json"],
|
"evidence": [
|
||||||
|
"artifacts/release/verification.json",
|
||||||
|
"artifacts/security/promotion-verification.json"
|
||||||
|
],
|
||||||
"retentionClass": "release-coherence"
|
"retentionClass": "release-coherence"
|
||||||
},
|
},
|
||||||
"FE-GATE-016": {
|
"FE-GATE-016": {
|
||||||
|
|||||||
@@ -0,0 +1,7 @@
|
|||||||
|
{
|
||||||
|
"schemaVersion": 1,
|
||||||
|
"snapshotDigest": "ce4fa9b7944f27553067228bd6c9e73e7dc05875c283255b50d7eb3ad2923f6d",
|
||||||
|
"owner": "frontend-platform",
|
||||||
|
"reason": "RP-11-initial-transitive-inventory",
|
||||||
|
"approvedAt": "2026-07-26T08:27:17.874Z"
|
||||||
|
}
|
||||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,4 @@
|
|||||||
|
{
|
||||||
|
"schemaVersion": 1,
|
||||||
|
"changes": []
|
||||||
|
}
|
||||||
@@ -0,0 +1,24 @@
|
|||||||
|
{
|
||||||
|
"schemaVersion": 1,
|
||||||
|
"allowedLicenses": [
|
||||||
|
"(MIT OR CC0-1.0)",
|
||||||
|
"0BSD",
|
||||||
|
"Apache-2.0",
|
||||||
|
"BSD-2-Clause",
|
||||||
|
"BSD-3-Clause",
|
||||||
|
"BlueOak-1.0.0",
|
||||||
|
"CC-BY-4.0",
|
||||||
|
"CC0-1.0",
|
||||||
|
"ISC",
|
||||||
|
"MIT",
|
||||||
|
"MIT-0",
|
||||||
|
"MPL-2.0"
|
||||||
|
],
|
||||||
|
"deniedLicensePatterns": [
|
||||||
|
"(^|\\s)AGPL",
|
||||||
|
"(^|\\s)GPL",
|
||||||
|
"SSPL",
|
||||||
|
"BUSL"
|
||||||
|
],
|
||||||
|
"unknownLicensePolicy": "allow-only-unmaterialized-platform-optional"
|
||||||
|
}
|
||||||
@@ -0,0 +1,30 @@
|
|||||||
|
{
|
||||||
|
"schemaVersion": 1,
|
||||||
|
"trackedRoots": [
|
||||||
|
"src",
|
||||||
|
"scripts",
|
||||||
|
"tests",
|
||||||
|
"config",
|
||||||
|
"public",
|
||||||
|
"schemas",
|
||||||
|
".storybook",
|
||||||
|
"package.json",
|
||||||
|
"pnpm-lock.yaml",
|
||||||
|
"vite.config.js",
|
||||||
|
"vitest.config.js",
|
||||||
|
"playwright.config.js"
|
||||||
|
],
|
||||||
|
"generatedRoots": ["dist", "artifacts/release"],
|
||||||
|
"excludedPaths": [
|
||||||
|
"tests/fixtures/security/secret-detection/forbidden"
|
||||||
|
],
|
||||||
|
"allowlist": [
|
||||||
|
{
|
||||||
|
"path": "tests/fixtures/security/secret-detection/allowed/test-credentials.ts",
|
||||||
|
"ruleId": "assigned-secret",
|
||||||
|
"owner": "frontend-platform",
|
||||||
|
"reason": "Synthetic credential verifies the scoped test-only allowlist.",
|
||||||
|
"expiresAt": "2027-07-26T00:00:00.000Z"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
@@ -0,0 +1,4 @@
|
|||||||
|
{
|
||||||
|
"schemaVersion": 1,
|
||||||
|
"exceptions": []
|
||||||
|
}
|
||||||
@@ -0,0 +1,8 @@
|
|||||||
|
{
|
||||||
|
"schemaVersion": 1,
|
||||||
|
"providerMode": "external-file",
|
||||||
|
"inputEnvironment": "VULNERABILITY_REPORT_PATH",
|
||||||
|
"blockAtSeverity": "high",
|
||||||
|
"allowedSeverities": ["unknown", "low", "moderate", "high", "critical"],
|
||||||
|
"missingProviderStatus": "FAIL_UNVERIFIED"
|
||||||
|
}
|
||||||
@@ -0,0 +1,103 @@
|
|||||||
|
# VD-09: 공급망 inventory, license, vulnerability, SBOM과 provenance
|
||||||
|
|
||||||
|
- 상태: Accepted
|
||||||
|
- 결정일: 2026-07-26
|
||||||
|
- 적용 브랜치: `feature-frontend-supply-chain-verification`
|
||||||
|
- 재검토: 조직 vulnerability scanner, signing/attestation provider와 dependency
|
||||||
|
exception 승인 체계가 선정될 때
|
||||||
|
|
||||||
|
## 배경
|
||||||
|
|
||||||
|
기존 release script는 `package.json`의 직접 dependency 이름과 버전, lockfile
|
||||||
|
전체 digest, `dist` checksum만 기록했다. 전이 dependency, 패키지별 integrity와
|
||||||
|
license, 실제 baseline diff가 없었고 `highRiskUnreviewed: []`는 계산 결과가 아닌
|
||||||
|
고정값이었다. secret scan도 `src`와 `dist`만 검사해 config, scripts, test와
|
||||||
|
generated release metadata를 놓쳤다.
|
||||||
|
|
||||||
|
반면 저장소에는 조직이 선택한 vulnerability source, severity exception 승인자,
|
||||||
|
signing identity와 attestation 저장소가 없다. 외부 provider가 없는 상태를 빈
|
||||||
|
finding과 서명 성공으로 표현하면 local 검증과 release promotion을 혼동한다.
|
||||||
|
|
||||||
|
## 결정
|
||||||
|
|
||||||
|
1. `pnpm-lock.yaml`의 모든 `packages` row와 `pnpm list --depth Infinity`의 실제
|
||||||
|
graph를 결합해 직접/전이, production/development, required/platform-optional,
|
||||||
|
version, SHA-512 SRI, license와 dependency edge를 기록한다.
|
||||||
|
2. inventory row 수는 lockfile package row 수와 같아야 한다. 누락된 전이
|
||||||
|
dependency, malformed integrity와 non-optional `NOASSERTION`은 local gate를
|
||||||
|
실패시킨다.
|
||||||
|
3. license는 설치된 package manifest에서 읽고 closed allow/deny policy로
|
||||||
|
검사한다. 현재 OS에 materialize되지 않은 platform optional만
|
||||||
|
`NOASSERTION`과 그 이유를 명시적으로 허용한다.
|
||||||
|
4. 승인 dependency baseline과 approval digest를 보존하고 현재 lock inventory와
|
||||||
|
actual add/remove/change/upgrade diff를 계산한다. 새 direct production
|
||||||
|
dependency는 owner와 서로 다른 reviewer, reason과 rollback evidence가
|
||||||
|
필요하다.
|
||||||
|
5. inventory를 CycloneDX 1.6 SBOM으로 투영한다. component 수, lockfile digest,
|
||||||
|
SRI, license와 dependency edge가 inventory와 일치해야 한다.
|
||||||
|
6. local in-toto/SLSA 형태 provenance statement는 source set, lockfile, SBOM과
|
||||||
|
`dist` digest를 연결하되 `LOCAL_UNSIGNED`로 표시한다. 외부 attestation은
|
||||||
|
provider, signer와 동일 dist subject digest가 있어야 한다.
|
||||||
|
7. vulnerability adapter는 `VULNERABILITY_REPORT_PATH`가 가리키는
|
||||||
|
machine-readable provider report를 검증한다. report의 lock digest, provider,
|
||||||
|
severity와 exception owner/reviewer/reason/expiry가 유효해야 한다.
|
||||||
|
8. provider report가 없으면 local inventory/license/SBOM/coherence는 `PASS`,
|
||||||
|
promotion은 `FAIL_UNVERIFIED`다. 빈 finding을 만들어 vulnerability PASS로
|
||||||
|
표시하지 않는다.
|
||||||
|
9. secret scan은 source, scripts, tests, tracked config/schema, public, `dist`와
|
||||||
|
generated release metadata를 검사한다. allowlist는 test path에만 허용하며
|
||||||
|
owner, reason과 expiry가 필요하다. 발견한 secret 원문은 artifact에 쓰지 않고
|
||||||
|
rule, path, line과 fingerprint만 남긴다.
|
||||||
|
10. `SOURCE_DATE_EPOCH`를 지원하고 같은 source/lock/config의 production build를
|
||||||
|
두 번 실행해 전체 dist digest 일치를 검증한 뒤 일반 build를 복원한다.
|
||||||
|
|
||||||
|
## 실행 경계와 증적
|
||||||
|
|
||||||
|
```text
|
||||||
|
package.json + frozen pnpm-lock.yaml + installed graph
|
||||||
|
-> deterministic dependency inventory
|
||||||
|
-> license policy + approved actual baseline diff
|
||||||
|
-> CycloneDX SBOM
|
||||||
|
|
||||||
|
source/config/lock + production dist
|
||||||
|
-> local provenance statement
|
||||||
|
-> optional vulnerability/attestation provider inputs
|
||||||
|
-> LOCAL PASS | promotion PASS/FAIL_UNVERIFIED
|
||||||
|
```
|
||||||
|
|
||||||
|
- policy: `config/security/`
|
||||||
|
- generator: `scripts/generate-supply-chain.mjs`
|
||||||
|
- coherence: `scripts/verify-supply-chain-artifacts.mjs`
|
||||||
|
- secret scan: `scripts/security-scan.mjs`
|
||||||
|
- reproducibility: `scripts/verify-reproducible-build.mjs`
|
||||||
|
- inventory: `artifacts/release/dependency-inventory.json`
|
||||||
|
- SBOM/provenance: `artifacts/release/sbom.cdx.json`,
|
||||||
|
`artifacts/release/provenance.json`
|
||||||
|
- local/promotion status:
|
||||||
|
`artifacts/security/supply-chain-verification.json`
|
||||||
|
|
||||||
|
## 검증
|
||||||
|
|
||||||
|
- 현재 lockfile의 561개 package row와 inventory row가 양방향 일치한다.
|
||||||
|
- ordering-only digest, removal, integrity tamper, baseline tamper, high-risk
|
||||||
|
self approval, denied license, critical vulnerability와 만료 exception,
|
||||||
|
provider/digest 오류, SBOM/provenance 불일치 fixture를 검사한다.
|
||||||
|
- synthetic provider/attestation fixture는 promotion `PASS`를 증명한 후 기본
|
||||||
|
`FAIL_UNVERIFIED` 상태를 복원한다.
|
||||||
|
- frozen install은 manifest/lock mismatch fixture를 실제 pnpm으로 거절한다.
|
||||||
|
- source/config/dist 각각의 synthetic secret fixture가 실제 scan을 실패시키고
|
||||||
|
scoped test allowlist만 통과한다.
|
||||||
|
|
||||||
|
## 한계와 재검토 조건
|
||||||
|
|
||||||
|
로컬 manifest license는 법률 검토가 아니며 vulnerability report도 외부 scanner가
|
||||||
|
제공한 데이터의 최신성 자체를 보증하지 않는다. 실제 프로젝트는 provider 버전,
|
||||||
|
database freshness, network outage, exception 승인 조직, signing identity,
|
||||||
|
attestation transparency/retention과 비밀 관리를 결정해야 한다.
|
||||||
|
|
||||||
|
## Rollback
|
||||||
|
|
||||||
|
외부 scanner/attestor adapter는 환경 입력을 제거하면 즉시
|
||||||
|
`FAIL_UNVERIFIED`로 돌아간다. local inventory, lock integrity, license, SBOM,
|
||||||
|
secret, reproducibility와 actual diff gate는 유지한다. scanner 장애를 이유로
|
||||||
|
promotion을 PASS로 변경하지 않는다.
|
||||||
@@ -39,16 +39,15 @@ recovery 계약, 제거 가능한 reference 수직 슬라이스, form/page, desi
|
|||||||
i18n 실행 경계와 diagnostics/telemetry production wiring은 구현됐다. 현재 선행 해결
|
i18n 실행 경계와 diagnostics/telemetry production wiring은 구현됐다. 현재 선행 해결
|
||||||
대상은 다음과 같다.
|
대상은 다음과 같다.
|
||||||
|
|
||||||
1. 공급망의 transitive inventory/license/vulnerability/SBOM/provenance 검증
|
1. optional adapter의 opt-in 경계와 제거 가능한 recipe
|
||||||
2. optional adapter의 opt-in 경계와 제거 가능한 recipe
|
|
||||||
|
|
||||||
따라서 현재 상태를 “프론트 공통부가 모두 구현됐다”고 표현하면 범위가 과장된다.
|
따라서 현재 상태를 “프론트 공통부가 모두 구현됐다”고 표현하면 범위가 과장된다.
|
||||||
더 정확한 표현은 다음과 같다.
|
더 정확한 표현은 다음과 같다.
|
||||||
|
|
||||||
> application API, 서버 상태, 폼, 라우팅, 페이지, 디자인 시스템과 테스트 증적의
|
> application API, 서버 상태, 폼, 라우팅, 페이지, 디자인 시스템, 테스트와
|
||||||
> 표준 수직 경로는 갖춰졌다. 현재 남은 저장소 내부 범위는 공급망 검증과
|
> local 공급망 증적의 표준 수직 경로는 갖춰졌다. 현재 남은 저장소 내부 범위는
|
||||||
> opt-in adapter recipe이며 실제 hosting·IdP·운영 provider는 프로젝트 통합
|
> opt-in adapter recipe이며 실제 hosting·IdP·취약점/서명/운영 provider는
|
||||||
> 범위다.
|
> 프로젝트 통합 범위다.
|
||||||
|
|
||||||
## 3. 판정 기준
|
## 3. 판정 기준
|
||||||
|
|
||||||
@@ -89,7 +88,7 @@ i18n 실행 경계와 diagnostics/telemetry production wiring은 구현됐다.
|
|||||||
| UI 회귀 검증 | 준비됨 | dev-only Storybook interaction/axe와 pinned Chromium visual baseline 4종 | cloud review와 다중 OS/device는 프로젝트 선택 |
|
| UI 회귀 검증 | 준비됨 | dev-only Storybook interaction/axe와 pinned Chromium visual baseline 4종 | cloud review와 다중 OS/device는 프로젝트 선택 |
|
||||||
| 샘플 제거 | 준비됨 | feature/catalog/test 제거 후 type/architecture/registry/test/home/build 9단계 검증 | 새 contribution도 같은 제거 gate에 포함 |
|
| 샘플 제거 | 준비됨 | feature/catalog/test 제거 후 type/architecture/registry/test/home/build 9단계 검증 | 새 contribution도 같은 제거 gate에 포함 |
|
||||||
| registry·compatibility 집행 | 준비됨 | 10개 registry type/reference/consumer/orphan, 승인 digest와 actual semantic diff, breaking evidence | public 계약 변경 시 baseline review 유지 |
|
| registry·compatibility 집행 | 준비됨 | 10개 registry type/reference/consumer/orphan, 승인 digest와 actual semantic diff, breaking evidence | public 계약 변경 시 baseline review 유지 |
|
||||||
| 공급망 검사 | 부분 준비 | lockfile·문서·gate는 있으나 실제 transitive 취약점/license/SBOM 깊이가 부족 | pinned scanner와 policy exception/증적 연결 |
|
| 공급망 검사 | 준비됨/프로젝트 선택 | 561개 transitive inventory/integrity/license, actual diff, CycloneDX, local provenance, secret/reproducible build gate | 실제 vulnerability scanner와 signed attestation 없이는 promotion `FAIL_UNVERIFIED` |
|
||||||
| realtime·offline·file 등 | 프로젝트 선택 | 현재 없음 | port/adapter recipe와 선택 기준 제공 |
|
| realtime·offline·file 등 | 프로젝트 선택 | 현재 없음 | port/adapter recipe와 선택 기준 제공 |
|
||||||
|
|
||||||
## 5. 우선순위별 발견 사항
|
## 5. 우선순위별 발견 사항
|
||||||
|
|||||||
@@ -892,6 +892,31 @@ owner와 만료 시한이 있는 quarantine만 허용한다.
|
|||||||
RP-11은 P1 최종 저장소 기준선이다. scanner outage를 무검증 승인으로 우회하지
|
RP-11은 P1 최종 저장소 기준선이다. scanner outage를 무검증 승인으로 우회하지
|
||||||
않고 promotion을 보류한다.
|
않고 promotion을 보류한다.
|
||||||
|
|
||||||
|
**구현 증거 (2026-07-26)**
|
||||||
|
|
||||||
|
- VD-09에서 frozen pnpm graph와 lockfile을 local SSOT로, package manifest
|
||||||
|
license policy와 CycloneDX 1.6을 local evidence로 채택했다. 외부 vulnerability
|
||||||
|
report와 signed attestation이 없으면 promotion은 `FAIL_UNVERIFIED`다.
|
||||||
|
- 현재 직접 35개, 전체 전이 561개 dependency의 name/version, direct/scope/
|
||||||
|
optional, SHA-512 integrity, license와 dependency edge를 deterministic
|
||||||
|
inventory로 생성한다. lockfile row와 inventory가 양방향 일치하지 않으면
|
||||||
|
실패한다.
|
||||||
|
- 승인 baseline digest와 actual add/remove/change/upgrade diff를 계산하고 새
|
||||||
|
direct production dependency에는 owner와 다른 reviewer, reason과 rollback을
|
||||||
|
요구한다.
|
||||||
|
- CycloneDX SBOM component/edge와 local in-toto/SLSA 형태 provenance의
|
||||||
|
source/lock/SBOM/dist digest를 coherence gate로 다시 계산한다.
|
||||||
|
- license allow/deny, vulnerability severity와 독립·만료 exception 정책,
|
||||||
|
provider lock digest와 attestation subject를 machine-readable하게 검증한다.
|
||||||
|
provider fixture는 promotion PASS를 증명한 뒤 unconfigured
|
||||||
|
`FAIL_UNVERIFIED`를 복원한다.
|
||||||
|
- secret scan을 source/scripts/tests/config/schema/public/dist/generated release
|
||||||
|
metadata로 확장하고 원문 대신 rule/path/line/fingerprint만 SARIF에 남긴다.
|
||||||
|
test-only allowlist도 owner/reason/expiry를 강제한다.
|
||||||
|
- `SOURCE_DATE_EPOCH` 기반 동일 build 2회 digest, 실제 frozen install mismatch,
|
||||||
|
transitive omission/integrity/baseline/self-review/license/vulnerability/
|
||||||
|
provider/SBOM/provenance/secret negative fixture를 blocking gate에 연결했다.
|
||||||
|
|
||||||
## 9. P1 exit gate
|
## 9. P1 exit gate
|
||||||
|
|
||||||
- 현실적인 form의 validation/dirty/pending/422/conflict가 작동한다.
|
- 현실적인 form의 validation/dirty/pending/422/conflict가 작동한다.
|
||||||
|
|||||||
@@ -1,18 +1,47 @@
|
|||||||
# Build and supply-chain gate
|
# Build and supply-chain gate
|
||||||
|
|
||||||
Merge and release controls:
|
## Local blocking controls
|
||||||
|
|
||||||
- frozen `pnpm-lock.yaml` installation; drift is blocking
|
- `pnpm install --frozen-lockfile` and a real manifest/lock mismatch fixture
|
||||||
- clean production build with hashed assets and build manifest
|
- all direct and transitive lockfile rows with package SHA-512 integrity
|
||||||
- machine-readable bundle sizes and checksums
|
- production/development, direct/transitive and platform-optional classification
|
||||||
- source plus built-asset credential-pattern scan
|
- package-manifest license allow/deny policy
|
||||||
- direct dependency inventory and lockfile digest
|
- approved inventory baseline digest and actual add/remove/change/upgrade diff
|
||||||
- base/head dependency diff review record
|
- independent review for new direct production dependencies
|
||||||
|
- CycloneDX 1.6 SBOM and inventory component/edge coherence
|
||||||
|
- source/lock/SBOM/dist-linked local provenance statement
|
||||||
|
- source, scripts, tests, tracked config/schema, public, built asset and generated
|
||||||
|
release metadata secret scan
|
||||||
|
- two-build `SOURCE_DATE_EPOCH` reproducibility check
|
||||||
|
|
||||||
Organization-specific vulnerability severity, denied-license list, SBOM format,
|
The canonical commands are:
|
||||||
and scanner selection remain policy inputs. An approved suppression must record
|
|
||||||
reason, owner, expiry, affected package, and compensating control. Expired
|
|
||||||
suppressions are blocking.
|
|
||||||
|
|
||||||
`artifacts/security/dependency-diff.json` is a local baseline. CI replaces it
|
```bash
|
||||||
with the actual base/head direct and transitive lockfile diff before release.
|
corepack pnpm verify:lockfile
|
||||||
|
corepack pnpm verify:reproducible-build
|
||||||
|
corepack pnpm build:release
|
||||||
|
corepack pnpm verify:supply-chain
|
||||||
|
corepack pnpm check:supply-chain:fixtures
|
||||||
|
```
|
||||||
|
|
||||||
|
`config/security/dependency-baseline.json` is the approved local baseline.
|
||||||
|
Changing it requires `DEPENDENCY_BASELINE_OWNER` and
|
||||||
|
`DEPENDENCY_BASELINE_REASON`; editing the digest or hardcoding an empty diff is
|
||||||
|
rejected.
|
||||||
|
|
||||||
|
## External promotion controls
|
||||||
|
|
||||||
|
The vulnerability adapter reads the file named by
|
||||||
|
`VULNERABILITY_REPORT_PATH`. It requires a provider, the exact lockfile digest,
|
||||||
|
severity findings and valid independent, unexpired exception evidence.
|
||||||
|
`PROVENANCE_ATTESTATION_PATH` must name a provider, signer and the exact built
|
||||||
|
dist subject digest.
|
||||||
|
|
||||||
|
If either provider input is absent, local verification remains meaningful but
|
||||||
|
`artifacts/security/supply-chain-verification.json` records
|
||||||
|
`promotionStatus: FAIL_UNVERIFIED`. `verify:supply-chain:promotion` then exits
|
||||||
|
non-zero. Scanner or signing outages are not converted to an empty PASS.
|
||||||
|
|
||||||
|
Approved vulnerability exceptions require vulnerability/package identity,
|
||||||
|
owner, a different reviewer, reason and expiry. Expired or self-approved
|
||||||
|
exceptions are blocking.
|
||||||
|
|||||||
@@ -58,8 +58,16 @@
|
|||||||
"check:coverage:fixture": "node scripts/check-risk-coverage.mjs --summary tests/fixtures/coverage/below-threshold.json --artifact artifacts/quality/risk-coverage-fixture.json",
|
"check:coverage:fixture": "node scripts/check-risk-coverage.mjs --summary tests/fixtures/coverage/below-threshold.json --artifact artifacts/quality/risk-coverage-fixture.json",
|
||||||
"test:all": "corepack pnpm test:runtime-schema && corepack pnpm test:unit && corepack pnpm test:component && corepack pnpm test:integration && corepack pnpm test:reference-feature",
|
"test:all": "corepack pnpm test:runtime-schema && corepack pnpm test:unit && corepack pnpm test:component && corepack pnpm test:integration && corepack pnpm test:reference-feature",
|
||||||
"verify:lockfile": "corepack pnpm install --frozen-lockfile",
|
"verify:lockfile": "corepack pnpm install --frozen-lockfile",
|
||||||
|
"check:frozen-lockfile:fixture": "node scripts/check-frozen-lockfile-fixture.mjs",
|
||||||
"generate:supply-chain": "node scripts/generate-supply-chain.mjs",
|
"generate:supply-chain": "node scripts/generate-supply-chain.mjs",
|
||||||
|
"verify:supply-chain": "node scripts/verify-supply-chain-artifacts.mjs",
|
||||||
|
"update:dependency-baseline": "node scripts/update-dependency-baseline.mjs",
|
||||||
|
"check:supply-chain:fixtures": "node scripts/check-supply-chain-fixtures.mjs",
|
||||||
|
"check:supply-chain:provider-fixtures": "node scripts/check-supply-chain-provider-fixtures.mjs",
|
||||||
|
"verify:supply-chain:promotion": "node scripts/verify-supply-chain-promotion.mjs",
|
||||||
|
"verify:reproducible-build": "node scripts/verify-reproducible-build.mjs",
|
||||||
"scan:security": "node scripts/security-scan.mjs",
|
"scan:security": "node scripts/security-scan.mjs",
|
||||||
|
"scan:security:fixture": "node scripts/security-scan.mjs --policy tests/fixtures/security/secret-detection/forbidden-policy.json --artifact artifacts/security/scan-fixture.sarif",
|
||||||
"check:browser-security": "node scripts/check-browser-security.mjs",
|
"check:browser-security": "node scripts/check-browser-security.mjs",
|
||||||
"check:registries": "node scripts/check-registries.mjs",
|
"check:registries": "node scripts/check-registries.mjs",
|
||||||
"check:registries:structure": "node scripts/check-registries.mjs --no-baseline",
|
"check:registries:structure": "node scripts/check-registries.mjs --no-baseline",
|
||||||
|
|||||||
@@ -0,0 +1,60 @@
|
|||||||
|
{
|
||||||
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
||||||
|
"$id": "https://clean-architecture-frontend.local/schemas/dependency-inventory.schema.json",
|
||||||
|
"type": "object",
|
||||||
|
"additionalProperties": false,
|
||||||
|
"required": [
|
||||||
|
"schemaVersion",
|
||||||
|
"packageManager",
|
||||||
|
"lockfileSha256",
|
||||||
|
"dependencyCount",
|
||||||
|
"directDependencyCount",
|
||||||
|
"dependencies"
|
||||||
|
],
|
||||||
|
"properties": {
|
||||||
|
"schemaVersion": { "const": 2 },
|
||||||
|
"packageManager": { "type": "string", "minLength": 1 },
|
||||||
|
"lockfileSha256": {
|
||||||
|
"type": "string",
|
||||||
|
"pattern": "^[a-f0-9]{64}$"
|
||||||
|
},
|
||||||
|
"dependencyCount": { "type": "integer", "minimum": 1 },
|
||||||
|
"directDependencyCount": { "type": "integer", "minimum": 1 },
|
||||||
|
"dependencies": {
|
||||||
|
"type": "array",
|
||||||
|
"minItems": 1,
|
||||||
|
"items": {
|
||||||
|
"type": "object",
|
||||||
|
"additionalProperties": false,
|
||||||
|
"required": [
|
||||||
|
"name",
|
||||||
|
"version",
|
||||||
|
"direct",
|
||||||
|
"scope",
|
||||||
|
"optional",
|
||||||
|
"license",
|
||||||
|
"integrity",
|
||||||
|
"dependencies"
|
||||||
|
],
|
||||||
|
"properties": {
|
||||||
|
"name": { "type": "string", "minLength": 1 },
|
||||||
|
"version": { "type": "string", "minLength": 1 },
|
||||||
|
"direct": { "type": "boolean" },
|
||||||
|
"scope": {
|
||||||
|
"enum": ["production", "development"]
|
||||||
|
},
|
||||||
|
"optional": { "type": "boolean" },
|
||||||
|
"license": { "type": "string", "minLength": 1 },
|
||||||
|
"integrity": {
|
||||||
|
"type": "string",
|
||||||
|
"pattern": "^sha512-"
|
||||||
|
},
|
||||||
|
"dependencies": {
|
||||||
|
"type": "array",
|
||||||
|
"items": { "type": "string", "minLength": 1 }
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,55 @@
|
|||||||
|
{
|
||||||
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
||||||
|
"$id": "https://clean-architecture-frontend.local/schemas/supply-chain-verification.schema.json",
|
||||||
|
"type": "object",
|
||||||
|
"additionalProperties": false,
|
||||||
|
"required": [
|
||||||
|
"schemaVersion",
|
||||||
|
"localStatus",
|
||||||
|
"promotionStatus",
|
||||||
|
"lockfileSha256",
|
||||||
|
"sourceSetSha256",
|
||||||
|
"distSha256",
|
||||||
|
"sbomSha256",
|
||||||
|
"dependencyDiff",
|
||||||
|
"highRiskReview",
|
||||||
|
"vulnerabilityStatus",
|
||||||
|
"provenanceAttestationStatus",
|
||||||
|
"failures"
|
||||||
|
],
|
||||||
|
"properties": {
|
||||||
|
"schemaVersion": { "const": 1 },
|
||||||
|
"localStatus": { "enum": ["PASS", "FAIL"] },
|
||||||
|
"promotionStatus": {
|
||||||
|
"enum": ["PASS", "FAIL_UNVERIFIED"]
|
||||||
|
},
|
||||||
|
"lockfileSha256": {
|
||||||
|
"type": "string",
|
||||||
|
"pattern": "^[a-f0-9]{64}$"
|
||||||
|
},
|
||||||
|
"sourceSetSha256": {
|
||||||
|
"type": "string",
|
||||||
|
"pattern": "^[a-f0-9]{64}$"
|
||||||
|
},
|
||||||
|
"distSha256": {
|
||||||
|
"type": "string",
|
||||||
|
"pattern": "^[a-f0-9]{64}$"
|
||||||
|
},
|
||||||
|
"sbomSha256": {
|
||||||
|
"type": "string",
|
||||||
|
"pattern": "^[a-f0-9]{64}$"
|
||||||
|
},
|
||||||
|
"dependencyDiff": { "type": "object" },
|
||||||
|
"highRiskReview": { "type": "array" },
|
||||||
|
"vulnerabilityStatus": {
|
||||||
|
"enum": ["PASS", "FAIL", "FAIL_UNVERIFIED"]
|
||||||
|
},
|
||||||
|
"provenanceAttestationStatus": {
|
||||||
|
"enum": ["PASS", "FAIL_UNVERIFIED"]
|
||||||
|
},
|
||||||
|
"failures": {
|
||||||
|
"type": "array",
|
||||||
|
"items": { "type": "string" }
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,39 @@
|
|||||||
|
import { spawnSync } from "node:child_process";
|
||||||
|
import { cp, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
|
||||||
|
import { tmpdir } from "node:os";
|
||||||
|
import path from "node:path";
|
||||||
|
|
||||||
|
const fixtureRoot = await mkdtemp(
|
||||||
|
path.join(tmpdir(), "ca-frontend-frozen-lockfile-"),
|
||||||
|
);
|
||||||
|
try {
|
||||||
|
await cp("pnpm-lock.yaml", path.join(fixtureRoot, "pnpm-lock.yaml"));
|
||||||
|
const manifest = JSON.parse(await readFile("package.json", "utf8"));
|
||||||
|
manifest.dependencies.react = "0.0.0-invalid-fixture";
|
||||||
|
await writeFile(
|
||||||
|
path.join(fixtureRoot, "package.json"),
|
||||||
|
`${JSON.stringify(manifest, null, 2)}\n`,
|
||||||
|
);
|
||||||
|
const result = spawnSync(
|
||||||
|
"corepack",
|
||||||
|
[
|
||||||
|
"pnpm",
|
||||||
|
"install",
|
||||||
|
"--frozen-lockfile",
|
||||||
|
"--lockfile-only",
|
||||||
|
"--ignore-scripts",
|
||||||
|
],
|
||||||
|
{
|
||||||
|
cwd: fixtureRoot,
|
||||||
|
encoding: "utf8",
|
||||||
|
},
|
||||||
|
);
|
||||||
|
if (result.status === 0) {
|
||||||
|
process.stderr.write("Tampered manifest unexpectedly passed frozen install.\n");
|
||||||
|
process.exitCode = 1;
|
||||||
|
} else {
|
||||||
|
process.stdout.write("Frozen lockfile mismatch fixture: rejected PASS\n");
|
||||||
|
}
|
||||||
|
} finally {
|
||||||
|
await rm(fixtureRoot, { recursive: true, force: true });
|
||||||
|
}
|
||||||
@@ -0,0 +1,148 @@
|
|||||||
|
import { mkdir, writeFile } from "node:fs/promises";
|
||||||
|
|
||||||
|
import {
|
||||||
|
diffDependencyInventories,
|
||||||
|
isValidSha512Integrity,
|
||||||
|
supplyChainDigest,
|
||||||
|
validateDependencyReview,
|
||||||
|
validateLicensePolicy,
|
||||||
|
validateVulnerabilityReport,
|
||||||
|
verifySupplyChainCoherence,
|
||||||
|
} from "./lib/supply-chain.mjs";
|
||||||
|
|
||||||
|
const integrity = `sha512-${Buffer.alloc(64, 1).toString("base64")}`;
|
||||||
|
const baseDependency = {
|
||||||
|
name: "base",
|
||||||
|
version: "1.0.0",
|
||||||
|
direct: false,
|
||||||
|
scope: "production",
|
||||||
|
optional: false,
|
||||||
|
license: "MIT",
|
||||||
|
integrity,
|
||||||
|
dependencies: [],
|
||||||
|
};
|
||||||
|
const directDependency = {
|
||||||
|
...baseDependency,
|
||||||
|
name: "new-direct",
|
||||||
|
direct: true,
|
||||||
|
};
|
||||||
|
const before = { dependencies: [baseDependency] };
|
||||||
|
const after = { dependencies: [baseDependency, directDependency] };
|
||||||
|
const diff = diffDependencyInventories(before, after);
|
||||||
|
const selfReview = validateDependencyReview(diff, after, {
|
||||||
|
changes: [
|
||||||
|
{
|
||||||
|
changeId: "add:new-direct@1.0.0",
|
||||||
|
owner: "same-person",
|
||||||
|
reviewer: "same-person",
|
||||||
|
reason: "fixture",
|
||||||
|
rollback: "remove",
|
||||||
|
},
|
||||||
|
],
|
||||||
|
});
|
||||||
|
const deniedLicense = validateLicensePolicy(
|
||||||
|
{
|
||||||
|
dependencies: [{ ...baseDependency, license: "AGPL-3.0" }],
|
||||||
|
},
|
||||||
|
{
|
||||||
|
allowedLicenses: ["MIT"],
|
||||||
|
deniedLicensePatterns: ["AGPL"],
|
||||||
|
},
|
||||||
|
);
|
||||||
|
const vulnerable = validateVulnerabilityReport(
|
||||||
|
{
|
||||||
|
provider: "fixture",
|
||||||
|
scannedLockfileSha256: "lock",
|
||||||
|
findings: [
|
||||||
|
{
|
||||||
|
id: "CVE-FIXTURE",
|
||||||
|
packageName: "base",
|
||||||
|
version: "1.0.0",
|
||||||
|
severity: "critical",
|
||||||
|
},
|
||||||
|
],
|
||||||
|
},
|
||||||
|
{ blockAtSeverity: "high" },
|
||||||
|
{
|
||||||
|
exceptions: [
|
||||||
|
{
|
||||||
|
vulnerabilityId: "CVE-FIXTURE",
|
||||||
|
packageName: "base",
|
||||||
|
owner: "owner",
|
||||||
|
reviewer: "reviewer",
|
||||||
|
reason: "expired fixture",
|
||||||
|
expiresAt: "2000-01-01T00:00:00.000Z",
|
||||||
|
},
|
||||||
|
],
|
||||||
|
},
|
||||||
|
"lock",
|
||||||
|
new Date("2026-07-26T00:00:00.000Z"),
|
||||||
|
);
|
||||||
|
const mismatchedCoherence = verifySupplyChainCoherence(
|
||||||
|
{
|
||||||
|
components: [],
|
||||||
|
metadata: {
|
||||||
|
properties: [{ name: "ca:lockfileSha256", value: "wrong" }],
|
||||||
|
},
|
||||||
|
},
|
||||||
|
{ dependencies: [baseDependency], lockfileSha256: "lock" },
|
||||||
|
{
|
||||||
|
subject: [{ digest: { sha256: "wrong" } }],
|
||||||
|
predicate: { materials: { lockfileSha256: "wrong" } },
|
||||||
|
},
|
||||||
|
"dist",
|
||||||
|
);
|
||||||
|
const orderingStable =
|
||||||
|
supplyChainDigest({ dependencies: [baseDependency, directDependency] }) ===
|
||||||
|
supplyChainDigest({ dependencies: [directDependency, baseDependency] });
|
||||||
|
const approvedDigest = supplyChainDigest(before);
|
||||||
|
const tamperedBaselineRejected =
|
||||||
|
approvedDigest !==
|
||||||
|
supplyChainDigest({
|
||||||
|
dependencies: [{ ...baseDependency, version: "9.9.9-tampered" }],
|
||||||
|
});
|
||||||
|
const providerFailure = validateVulnerabilityReport(
|
||||||
|
{
|
||||||
|
provider: "",
|
||||||
|
scannedLockfileSha256: "wrong",
|
||||||
|
findings: [],
|
||||||
|
},
|
||||||
|
{ blockAtSeverity: "high" },
|
||||||
|
{ exceptions: [] },
|
||||||
|
"lock",
|
||||||
|
);
|
||||||
|
const results = [
|
||||||
|
{
|
||||||
|
id: "transitive-removal-is-real-diff",
|
||||||
|
passed:
|
||||||
|
diffDependencyInventories(after, before).removed[0] ===
|
||||||
|
"new-direct@1.0.0",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
id: "tampered-integrity-rejected",
|
||||||
|
passed: !isValidSha512Integrity("sha512-dGFtcGVyZWQ="),
|
||||||
|
},
|
||||||
|
{ id: "high-risk-self-approval-rejected", passed: !selfReview.passed },
|
||||||
|
{ id: "denied-license-rejected", passed: !deniedLicense.passed },
|
||||||
|
{
|
||||||
|
id: "critical-vulnerability-expired-exception-rejected",
|
||||||
|
passed: !vulnerable.passed,
|
||||||
|
},
|
||||||
|
{ id: "sbom-provenance-mismatch-rejected", passed: !mismatchedCoherence.passed },
|
||||||
|
{ id: "dependency-ordering-deterministic", passed: orderingStable },
|
||||||
|
{ id: "baseline-digest-tamper-rejected", passed: tamperedBaselineRejected },
|
||||||
|
{
|
||||||
|
id: "vulnerability-provider-evidence-invalid",
|
||||||
|
passed: !providerFailure.passed,
|
||||||
|
},
|
||||||
|
];
|
||||||
|
await mkdir("artifacts/security", { recursive: true });
|
||||||
|
await writeFile(
|
||||||
|
"artifacts/security/supply-chain-fixtures.json",
|
||||||
|
`${JSON.stringify({ schemaVersion: 1, results }, null, 2)}\n`,
|
||||||
|
);
|
||||||
|
if (results.some((result) => !result.passed)) {
|
||||||
|
process.stderr.write("Supply-chain negative fixture failed.\n");
|
||||||
|
process.exit(1);
|
||||||
|
}
|
||||||
|
process.stdout.write(`Supply-chain fixtures: ${results.length} PASS\n`);
|
||||||
@@ -0,0 +1,105 @@
|
|||||||
|
import { spawnSync } from "node:child_process";
|
||||||
|
import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
|
||||||
|
import path from "node:path";
|
||||||
|
|
||||||
|
const fixtureDirectory = path.resolve(".tmp/supply-chain-provider-fixture");
|
||||||
|
await rm(fixtureDirectory, { recursive: true, force: true });
|
||||||
|
await mkdir(fixtureDirectory, { recursive: true });
|
||||||
|
const inventory = JSON.parse(
|
||||||
|
await readFile("artifacts/release/dependency-inventory.json", "utf8"),
|
||||||
|
);
|
||||||
|
const verification = JSON.parse(
|
||||||
|
await readFile(
|
||||||
|
"artifacts/security/supply-chain-verification.json",
|
||||||
|
"utf8",
|
||||||
|
),
|
||||||
|
);
|
||||||
|
const vulnerabilityPath = path.join(
|
||||||
|
fixtureDirectory,
|
||||||
|
"vulnerability-report.json",
|
||||||
|
);
|
||||||
|
const attestationPath = path.join(fixtureDirectory, "attestation.json");
|
||||||
|
await writeFile(
|
||||||
|
vulnerabilityPath,
|
||||||
|
`${JSON.stringify(
|
||||||
|
{
|
||||||
|
schemaVersion: 1,
|
||||||
|
provider: "fixture-scanner",
|
||||||
|
scannedLockfileSha256: inventory.lockfileSha256,
|
||||||
|
generatedAt: "2026-07-26T00:00:00.000Z",
|
||||||
|
findings: [],
|
||||||
|
},
|
||||||
|
null,
|
||||||
|
2,
|
||||||
|
)}\n`,
|
||||||
|
);
|
||||||
|
await writeFile(
|
||||||
|
attestationPath,
|
||||||
|
`${JSON.stringify(
|
||||||
|
{
|
||||||
|
schemaVersion: 1,
|
||||||
|
provider: "fixture-attestor",
|
||||||
|
signer: "fixture-workload-identity",
|
||||||
|
subject: {
|
||||||
|
name: "dist",
|
||||||
|
digest: { sha256: verification.distSha256 },
|
||||||
|
},
|
||||||
|
},
|
||||||
|
null,
|
||||||
|
2,
|
||||||
|
)}\n`,
|
||||||
|
);
|
||||||
|
const providerRun = spawnSync(
|
||||||
|
"node",
|
||||||
|
["scripts/generate-supply-chain.mjs"],
|
||||||
|
{
|
||||||
|
env: {
|
||||||
|
...process.env,
|
||||||
|
VULNERABILITY_REPORT_PATH: vulnerabilityPath,
|
||||||
|
PROVENANCE_ATTESTATION_PATH: attestationPath,
|
||||||
|
},
|
||||||
|
encoding: "utf8",
|
||||||
|
},
|
||||||
|
);
|
||||||
|
let promotionStatus = "MISSING";
|
||||||
|
if (providerRun.status === 0) {
|
||||||
|
promotionStatus = JSON.parse(
|
||||||
|
await readFile(
|
||||||
|
"artifacts/security/supply-chain-verification.json",
|
||||||
|
"utf8",
|
||||||
|
),
|
||||||
|
).promotionStatus;
|
||||||
|
}
|
||||||
|
const restore = spawnSync(
|
||||||
|
"node",
|
||||||
|
["scripts/generate-supply-chain.mjs"],
|
||||||
|
{ encoding: "utf8" },
|
||||||
|
);
|
||||||
|
await rm(fixtureDirectory, { recursive: true, force: true });
|
||||||
|
const passed =
|
||||||
|
providerRun.status === 0 &&
|
||||||
|
promotionStatus === "PASS" &&
|
||||||
|
restore.status === 0;
|
||||||
|
await writeFile(
|
||||||
|
"artifacts/security/supply-chain-provider-fixtures.json",
|
||||||
|
`${JSON.stringify(
|
||||||
|
{
|
||||||
|
schemaVersion: 1,
|
||||||
|
providerAccepted: providerRun.status === 0,
|
||||||
|
promotionStatus,
|
||||||
|
unverifiedDefaultRestored: restore.status === 0,
|
||||||
|
status: passed ? "PASS" : "FAIL",
|
||||||
|
},
|
||||||
|
null,
|
||||||
|
2,
|
||||||
|
)}\n`,
|
||||||
|
);
|
||||||
|
if (!passed) {
|
||||||
|
process.stderr.write(
|
||||||
|
`Supply-chain provider fixture failed: ${providerRun.stderr || restore.stderr}\n`,
|
||||||
|
);
|
||||||
|
process.exit(1);
|
||||||
|
}
|
||||||
|
process.stdout.write(
|
||||||
|
"Supply-chain provider fixture: verified PASS and unconfigured default restored\n",
|
||||||
|
);
|
||||||
@@ -15,7 +15,13 @@ const buildId = process.env.VITE_BUILD_ID ?? "local-build";
|
|||||||
const commitSha = process.env.VITE_COMMIT_SHA ?? "local";
|
const commitSha = process.env.VITE_COMMIT_SHA ?? "local";
|
||||||
const releaseId = process.env.RELEASE_ID ?? "local-release";
|
const releaseId = process.env.RELEASE_ID ?? "local-release";
|
||||||
const runnerImage = process.env.CI_RUNNER_IMAGE ?? `${process.platform}-${process.arch}`;
|
const runnerImage = process.env.CI_RUNNER_IMAGE ?? `${process.platform}-${process.arch}`;
|
||||||
const builtAt = new Date().toISOString();
|
const buildTime = process.env.SOURCE_DATE_EPOCH
|
||||||
|
? new Date(Number(process.env.SOURCE_DATE_EPOCH) * 1_000)
|
||||||
|
: new Date();
|
||||||
|
if (!Number.isFinite(buildTime.getTime())) {
|
||||||
|
throw new Error("SOURCE_DATE_EPOCH must be epoch seconds");
|
||||||
|
}
|
||||||
|
const builtAt = buildTime.toISOString();
|
||||||
const viteManifest = await readFile("dist/.vite/manifest.json", "utf8");
|
const viteManifest = await readFile("dist/.vite/manifest.json", "utf8");
|
||||||
const viteManifestObject =
|
const viteManifestObject =
|
||||||
/** @type {Record<string, {file: string, name?: string, isDynamicEntry?: boolean}>} */ (
|
/** @type {Record<string, {file: string, name?: string, isDynamicEntry?: boolean}>} */ (
|
||||||
|
|||||||
@@ -1,3 +1,4 @@
|
|||||||
|
import { spawnSync } from "node:child_process";
|
||||||
import { createHash } from "node:crypto";
|
import { createHash } from "node:crypto";
|
||||||
import { gzipSync } from "node:zlib";
|
import { gzipSync } from "node:zlib";
|
||||||
import {
|
import {
|
||||||
@@ -9,8 +10,21 @@ import {
|
|||||||
} from "node:fs/promises";
|
} from "node:fs/promises";
|
||||||
import path from "node:path";
|
import path from "node:path";
|
||||||
|
|
||||||
|
import {
|
||||||
|
diffDependencyInventories,
|
||||||
|
flattenPnpmDependencyTree,
|
||||||
|
isValidSha512Integrity,
|
||||||
|
parsePnpmLockfilePackages,
|
||||||
|
supplyChainDigest,
|
||||||
|
validateDependencyReview,
|
||||||
|
validateLicensePolicy,
|
||||||
|
validateVulnerabilityReport,
|
||||||
|
verifySupplyChainCoherence,
|
||||||
|
} from "./lib/supply-chain.mjs";
|
||||||
|
|
||||||
/** @param {string} directory @returns {Promise<string[]>} */
|
/** @param {string} directory @returns {Promise<string[]>} */
|
||||||
async function filesWithin(directory) {
|
async function filesWithin(directory) {
|
||||||
|
try {
|
||||||
const entries = await readdir(directory, { withFileTypes: true });
|
const entries = await readdir(directory, { withFileTypes: true });
|
||||||
const nested = /** @type {string[][]} */ (await Promise.all(
|
const nested = /** @type {string[][]} */ (await Promise.all(
|
||||||
entries.map((entry) => {
|
entries.map((entry) => {
|
||||||
@@ -19,37 +33,381 @@ async function filesWithin(directory) {
|
|||||||
}),
|
}),
|
||||||
));
|
));
|
||||||
return nested.flat().sort();
|
return nested.flat().sort();
|
||||||
|
} catch {
|
||||||
|
return [];
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/** @param {string} file */
|
||||||
|
async function sha256File(file) {
|
||||||
|
return createHash("sha256").update(await readFile(file)).digest("hex");
|
||||||
|
}
|
||||||
|
|
||||||
|
/** @param {string[]} files */
|
||||||
|
async function digestFileSet(files) {
|
||||||
|
const rows = await Promise.all(
|
||||||
|
files.sort().map(async (file) => ({
|
||||||
|
path: file.replaceAll("\\", "/"),
|
||||||
|
sha256: await sha256File(file),
|
||||||
|
})),
|
||||||
|
);
|
||||||
|
return supplyChainDigest(rows);
|
||||||
|
}
|
||||||
|
|
||||||
|
/** @param {string} file @returns {Promise<Record<string, unknown> | null>} */
|
||||||
|
async function optionalJson(file) {
|
||||||
|
try {
|
||||||
|
return JSON.parse(await readFile(file, "utf8"));
|
||||||
|
} catch {
|
||||||
|
return null;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
export async function buildDependencyInventory() {
|
||||||
|
const packageJson = JSON.parse(await readFile("package.json", "utf8"));
|
||||||
|
const lockfileText = await readFile("pnpm-lock.yaml", "utf8");
|
||||||
|
const lockfileSha256 = createHash("sha256")
|
||||||
|
.update(lockfileText)
|
||||||
|
.digest("hex");
|
||||||
|
const listed = spawnSync(
|
||||||
|
"corepack",
|
||||||
|
["pnpm", "list", "--json", "--depth", "Infinity"],
|
||||||
|
{
|
||||||
|
encoding: "utf8",
|
||||||
|
maxBuffer: 32 * 1024 * 1024,
|
||||||
|
},
|
||||||
|
);
|
||||||
|
if (listed.status !== 0) {
|
||||||
|
throw new Error(`pnpm dependency graph failed: ${listed.stderr}`);
|
||||||
|
}
|
||||||
|
const roots = JSON.parse(listed.stdout);
|
||||||
|
const root = roots[0];
|
||||||
|
const flattened = await flattenPnpmDependencyTree(
|
||||||
|
root,
|
||||||
|
packageJson.dependencies ?? {},
|
||||||
|
packageJson.devDependencies ?? {},
|
||||||
|
);
|
||||||
|
const lockRows = parsePnpmLockfilePackages(lockfileText);
|
||||||
|
const lockByIdentity = new Map(
|
||||||
|
lockRows.map((row) => [`${row.name}@${row.version}`, row]),
|
||||||
|
);
|
||||||
|
const failures = [];
|
||||||
|
const dependencies = flattened.map((dependency) => {
|
||||||
|
const identity = `${dependency.name}@${dependency.version}`;
|
||||||
|
const lockRow = lockByIdentity.get(identity);
|
||||||
|
if (!lockRow) failures.push(`dependency missing from lockfile: ${identity}`);
|
||||||
|
if (lockRow && !isValidSha512Integrity(lockRow.integrity)) {
|
||||||
|
failures.push(`dependency has invalid sha512 integrity: ${identity}`);
|
||||||
|
}
|
||||||
|
return {
|
||||||
|
...dependency,
|
||||||
|
integrity: lockRow?.integrity ?? "missing",
|
||||||
|
};
|
||||||
|
});
|
||||||
|
const inventoryIds = new Set(
|
||||||
|
dependencies.map((dependency) => `${dependency.name}@${dependency.version}`),
|
||||||
|
);
|
||||||
|
for (const lockRow of lockRows) {
|
||||||
|
const identity = `${lockRow.name}@${lockRow.version}`;
|
||||||
|
if (!inventoryIds.has(identity)) {
|
||||||
|
failures.push(`transitive lockfile dependency omitted: ${identity}`);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if (failures.length > 0) {
|
||||||
|
throw new Error(failures.join("\n"));
|
||||||
|
}
|
||||||
|
return {
|
||||||
|
schemaVersion: 2,
|
||||||
|
packageManager: packageJson.packageManager,
|
||||||
|
lockfileSha256,
|
||||||
|
dependencyCount: dependencies.length,
|
||||||
|
directDependencyCount: dependencies.filter((entry) => entry.direct).length,
|
||||||
|
dependencies,
|
||||||
|
};
|
||||||
}
|
}
|
||||||
|
|
||||||
const packageJson = JSON.parse(await readFile("package.json", "utf8"));
|
const packageJson = JSON.parse(await readFile("package.json", "utf8"));
|
||||||
const lockfile = await readFile("pnpm-lock.yaml");
|
|
||||||
const outputFiles = await filesWithin("dist");
|
const outputFiles = await filesWithin("dist");
|
||||||
|
if (outputFiles.length === 0) {
|
||||||
|
throw new Error("dist is missing; run the production build first");
|
||||||
|
}
|
||||||
const outputs = await Promise.all(
|
const outputs = await Promise.all(
|
||||||
outputFiles.map(async (outputFile) => {
|
outputFiles.map(async (outputFile) => {
|
||||||
const content = await readFile(outputFile);
|
const content = await readFile(outputFile);
|
||||||
const metadata = await stat(outputFile);
|
const metadata = await stat(outputFile);
|
||||||
return {
|
return {
|
||||||
path: outputFile,
|
path: outputFile.replaceAll("\\", "/"),
|
||||||
bytes: metadata.size,
|
bytes: metadata.size,
|
||||||
gzipBytes: gzipSync(content).byteLength,
|
gzipBytes: gzipSync(content).byteLength,
|
||||||
sha256: createHash("sha256").update(content).digest("hex"),
|
sha256: createHash("sha256").update(content).digest("hex"),
|
||||||
};
|
};
|
||||||
}),
|
}),
|
||||||
);
|
);
|
||||||
|
const distDigest = supplyChainDigest(
|
||||||
|
outputs.map(({ path: outputPath, bytes, sha256 }) => ({
|
||||||
|
path: outputPath,
|
||||||
|
bytes,
|
||||||
|
sha256,
|
||||||
|
})),
|
||||||
|
);
|
||||||
|
const inventory = await buildDependencyInventory();
|
||||||
|
const licensePolicy = JSON.parse(
|
||||||
|
await readFile("config/security/dependency-policy.json", "utf8"),
|
||||||
|
);
|
||||||
|
const licenseResult = validateLicensePolicy(inventory, licensePolicy);
|
||||||
|
|
||||||
const dependencies = {
|
const baseline = await optionalJson(
|
||||||
...packageJson.dependencies,
|
"config/security/dependency-baseline.json",
|
||||||
...packageJson.devDependencies,
|
);
|
||||||
|
const baselineApproval = await optionalJson(
|
||||||
|
"config/security/dependency-baseline.approval.json",
|
||||||
|
);
|
||||||
|
const dependencyEvidence = JSON.parse(
|
||||||
|
await readFile(
|
||||||
|
"config/security/dependency-change-evidence.json",
|
||||||
|
"utf8",
|
||||||
|
),
|
||||||
|
);
|
||||||
|
const skipsBaseline = process.argv.includes("--no-baseline");
|
||||||
|
const baselineFailures = [];
|
||||||
|
let dependencyDiff =
|
||||||
|
/** @type {ReturnType<typeof diffDependencyInventories>} */ ({
|
||||||
|
added: [],
|
||||||
|
removed: [],
|
||||||
|
changed: [],
|
||||||
|
upgrades: [],
|
||||||
|
});
|
||||||
|
let reviewResult =
|
||||||
|
/** @type {ReturnType<typeof validateDependencyReview>} */ ({
|
||||||
|
passed: skipsBaseline,
|
||||||
|
highRisk: [],
|
||||||
|
failures: skipsBaseline ? [] : ["dependency baseline unavailable"],
|
||||||
|
});
|
||||||
|
if (baseline && baselineApproval) {
|
||||||
|
const actualBaselineDigest = supplyChainDigest(baseline);
|
||||||
|
if (
|
||||||
|
baselineApproval.schemaVersion !== 1 ||
|
||||||
|
baselineApproval.snapshotDigest !== actualBaselineDigest ||
|
||||||
|
typeof baselineApproval.owner !== "string" ||
|
||||||
|
!baselineApproval.owner
|
||||||
|
) {
|
||||||
|
baselineFailures.push("dependency baseline approval digest mismatch");
|
||||||
|
}
|
||||||
|
dependencyDiff = diffDependencyInventories(baseline, inventory);
|
||||||
|
reviewResult = validateDependencyReview(
|
||||||
|
dependencyDiff,
|
||||||
|
inventory,
|
||||||
|
dependencyEvidence,
|
||||||
|
);
|
||||||
|
} else if (!skipsBaseline) {
|
||||||
|
baselineFailures.push("dependency baseline and approval are required");
|
||||||
|
}
|
||||||
|
|
||||||
|
const vulnerabilityPolicy = JSON.parse(
|
||||||
|
await readFile("config/security/vulnerability-policy.json", "utf8"),
|
||||||
|
);
|
||||||
|
const vulnerabilityExceptions = JSON.parse(
|
||||||
|
await readFile("config/security/vulnerability-exceptions.json", "utf8"),
|
||||||
|
);
|
||||||
|
const vulnerabilityInput = process.env.VULNERABILITY_REPORT_PATH
|
||||||
|
? await optionalJson(process.env.VULNERABILITY_REPORT_PATH)
|
||||||
|
: null;
|
||||||
|
const vulnerabilityResult = vulnerabilityInput
|
||||||
|
? validateVulnerabilityReport(
|
||||||
|
vulnerabilityInput,
|
||||||
|
vulnerabilityPolicy,
|
||||||
|
vulnerabilityExceptions,
|
||||||
|
inventory.lockfileSha256,
|
||||||
|
)
|
||||||
|
: {
|
||||||
|
passed: false,
|
||||||
|
failures: ["external vulnerability provider report is missing"],
|
||||||
|
blocking: [],
|
||||||
|
};
|
||||||
|
const vulnerabilityReport = {
|
||||||
|
schemaVersion: 1,
|
||||||
|
provider: vulnerabilityInput?.provider ?? "UNCONFIGURED",
|
||||||
|
scannedLockfileSha256:
|
||||||
|
vulnerabilityInput?.scannedLockfileSha256 ?? inventory.lockfileSha256,
|
||||||
|
status: vulnerabilityInput
|
||||||
|
? vulnerabilityResult.passed
|
||||||
|
? "PASS"
|
||||||
|
: "FAIL"
|
||||||
|
: "FAIL_UNVERIFIED",
|
||||||
|
findings: vulnerabilityInput?.findings ?? [],
|
||||||
|
exceptionsApplied:
|
||||||
|
vulnerabilityInput && vulnerabilityResult.passed
|
||||||
|
? vulnerabilityExceptions.exceptions
|
||||||
|
: [],
|
||||||
|
failures: vulnerabilityResult.failures,
|
||||||
|
blocking: vulnerabilityResult.blocking,
|
||||||
|
};
|
||||||
|
|
||||||
|
const sourceFiles = (
|
||||||
|
await Promise.all(
|
||||||
|
[
|
||||||
|
"src",
|
||||||
|
"scripts",
|
||||||
|
"config",
|
||||||
|
"public",
|
||||||
|
"schemas",
|
||||||
|
"package.json",
|
||||||
|
"pnpm-lock.yaml",
|
||||||
|
"vite.config.js",
|
||||||
|
].map(async (target) => {
|
||||||
|
try {
|
||||||
|
const metadata = await stat(target);
|
||||||
|
return metadata.isDirectory() ? filesWithin(target) : [target];
|
||||||
|
} catch {
|
||||||
|
return [];
|
||||||
|
}
|
||||||
|
}),
|
||||||
|
)
|
||||||
|
).flat();
|
||||||
|
const sourceSetSha256 = await digestFileSet(sourceFiles);
|
||||||
|
|
||||||
|
const components = inventory.dependencies.map((dependency) => ({
|
||||||
|
type: "library",
|
||||||
|
"bom-ref": `pkg:npm/${encodeURIComponent(dependency.name)}@${dependency.version}`,
|
||||||
|
name: dependency.name,
|
||||||
|
version: dependency.version,
|
||||||
|
scope: dependency.optional ? "optional" : "required",
|
||||||
|
hashes: [
|
||||||
|
{
|
||||||
|
alg: "SHA-512",
|
||||||
|
content: dependency.integrity.slice("sha512-".length),
|
||||||
|
},
|
||||||
|
],
|
||||||
|
licenses:
|
||||||
|
dependency.license === "NOASSERTION"
|
||||||
|
? [{ expression: "NOASSERTION" }]
|
||||||
|
: [{ expression: dependency.license }],
|
||||||
|
properties: [
|
||||||
|
{ name: "ca:direct", value: String(dependency.direct) },
|
||||||
|
{ name: "ca:scope", value: dependency.scope },
|
||||||
|
],
|
||||||
|
}));
|
||||||
|
const serialSeed = supplyChainDigest({
|
||||||
|
lockfileSha256: inventory.lockfileSha256,
|
||||||
|
components: components.map((component) => component["bom-ref"]),
|
||||||
|
});
|
||||||
|
const sbom = {
|
||||||
|
bomFormat: "CycloneDX",
|
||||||
|
specVersion: "1.6",
|
||||||
|
serialNumber: `urn:uuid:${serialSeed.slice(0, 8)}-${serialSeed.slice(8, 12)}-${serialSeed.slice(12, 16)}-${serialSeed.slice(16, 20)}-${serialSeed.slice(20, 32)}`,
|
||||||
|
version: 1,
|
||||||
|
metadata: {
|
||||||
|
component: {
|
||||||
|
type: "application",
|
||||||
|
name: packageJson.name,
|
||||||
|
version: packageJson.version,
|
||||||
|
},
|
||||||
|
properties: [
|
||||||
|
{
|
||||||
|
name: "ca:lockfileSha256",
|
||||||
|
value: inventory.lockfileSha256,
|
||||||
|
},
|
||||||
|
],
|
||||||
|
},
|
||||||
|
components,
|
||||||
|
dependencies: inventory.dependencies.map((dependency) => ({
|
||||||
|
ref: `pkg:npm/${encodeURIComponent(dependency.name)}@${dependency.version}`,
|
||||||
|
dependsOn: dependency.dependencies.map((identity) => {
|
||||||
|
const separator = identity.lastIndexOf("@");
|
||||||
|
return `pkg:npm/${encodeURIComponent(identity.slice(0, separator))}@${identity.slice(separator + 1)}`;
|
||||||
|
}),
|
||||||
|
})),
|
||||||
|
};
|
||||||
|
|
||||||
|
const provenance = {
|
||||||
|
_type: "https://in-toto.io/Statement/v1",
|
||||||
|
subject: [{ name: "dist", digest: { sha256: distDigest } }],
|
||||||
|
predicateType: "https://slsa.dev/provenance/v1",
|
||||||
|
predicate: {
|
||||||
|
buildDefinition: {
|
||||||
|
buildType: "https://vite.dev/build/v1",
|
||||||
|
externalParameters: {
|
||||||
|
nodeVersion: process.version,
|
||||||
|
packageManager: packageJson.packageManager,
|
||||||
|
},
|
||||||
|
internalParameters: {
|
||||||
|
sourceSetSha256,
|
||||||
|
},
|
||||||
|
resolvedDependencies: [
|
||||||
|
{
|
||||||
|
uri: "pnpm-lock.yaml",
|
||||||
|
digest: { sha256: inventory.lockfileSha256 },
|
||||||
|
},
|
||||||
|
],
|
||||||
|
},
|
||||||
|
runDetails: {
|
||||||
|
builder: { id: "local:clean-architecture-frontend-template" },
|
||||||
|
metadata: { invocationId: "LOCAL_UNSIGNED" },
|
||||||
|
},
|
||||||
|
materials: {
|
||||||
|
lockfileSha256: inventory.lockfileSha256,
|
||||||
|
sourceSetSha256,
|
||||||
|
sbomSha256: supplyChainDigest(sbom),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
};
|
||||||
|
const coherence = verifySupplyChainCoherence(
|
||||||
|
sbom,
|
||||||
|
inventory,
|
||||||
|
provenance,
|
||||||
|
distDigest,
|
||||||
|
);
|
||||||
|
|
||||||
|
const attestationInput = process.env.PROVENANCE_ATTESTATION_PATH
|
||||||
|
? await optionalJson(process.env.PROVENANCE_ATTESTATION_PATH)
|
||||||
|
: null;
|
||||||
|
const attestationSubject =
|
||||||
|
/** @type {Record<string, unknown>} */ (
|
||||||
|
/** @type {Record<string, unknown>} */ (
|
||||||
|
attestationInput?.subject ?? {}
|
||||||
|
).digest ?? {}
|
||||||
|
);
|
||||||
|
const attestationPassed =
|
||||||
|
attestationSubject.sha256 === distDigest &&
|
||||||
|
typeof attestationInput?.provider === "string" &&
|
||||||
|
Boolean(attestationInput.provider) &&
|
||||||
|
typeof attestationInput?.signer === "string" &&
|
||||||
|
Boolean(attestationInput.signer);
|
||||||
|
const localFailures = [
|
||||||
|
...licenseResult.failures,
|
||||||
|
...baselineFailures,
|
||||||
|
...reviewResult.failures,
|
||||||
|
...coherence.failures,
|
||||||
|
];
|
||||||
|
if (vulnerabilityInput && !vulnerabilityResult.passed) {
|
||||||
|
localFailures.push(
|
||||||
|
...vulnerabilityResult.failures,
|
||||||
|
...vulnerabilityResult.blocking,
|
||||||
|
);
|
||||||
|
}
|
||||||
|
const localPassed = localFailures.length === 0;
|
||||||
|
const promotionPassed =
|
||||||
|
localPassed && vulnerabilityResult.passed && attestationPassed;
|
||||||
|
const verification = {
|
||||||
|
schemaVersion: 1,
|
||||||
|
localStatus: localPassed ? "PASS" : "FAIL",
|
||||||
|
promotionStatus: promotionPassed ? "PASS" : "FAIL_UNVERIFIED",
|
||||||
|
lockfileSha256: inventory.lockfileSha256,
|
||||||
|
sourceSetSha256,
|
||||||
|
distSha256: distDigest,
|
||||||
|
sbomSha256: supplyChainDigest(sbom),
|
||||||
|
dependencyDiff,
|
||||||
|
highRiskReview: reviewResult.highRisk,
|
||||||
|
vulnerabilityStatus: vulnerabilityReport.status,
|
||||||
|
provenanceAttestationStatus: attestationPassed
|
||||||
|
? "PASS"
|
||||||
|
: "FAIL_UNVERIFIED",
|
||||||
|
failures: localFailures,
|
||||||
};
|
};
|
||||||
const inventory = Object.entries(dependencies)
|
|
||||||
.sort(([left], [right]) => left.localeCompare(right))
|
|
||||||
.map(([name, version]) => ({ name, version, direct: true }));
|
|
||||||
|
|
||||||
await mkdir("artifacts/performance", { recursive: true });
|
await mkdir("artifacts/performance", { recursive: true });
|
||||||
await mkdir("artifacts/release", { recursive: true });
|
await mkdir("artifacts/release", { recursive: true });
|
||||||
await mkdir("artifacts/security", { recursive: true });
|
await mkdir("artifacts/security", { recursive: true });
|
||||||
|
|
||||||
await writeFile(
|
await writeFile(
|
||||||
"artifacts/performance/bundle.json",
|
"artifacts/performance/bundle.json",
|
||||||
`${JSON.stringify(
|
`${JSON.stringify(
|
||||||
@@ -59,7 +417,8 @@ await writeFile(
|
|||||||
context: {
|
context: {
|
||||||
nodeVersion: process.version,
|
nodeVersion: process.version,
|
||||||
packageManager: packageJson.packageManager,
|
packageManager: packageJson.packageManager,
|
||||||
runnerImage: process.env.CI_RUNNER_IMAGE ?? `${process.platform}-${process.arch}`,
|
runnerImage:
|
||||||
|
process.env.CI_RUNNER_IMAGE ?? `${process.platform}-${process.arch}`,
|
||||||
},
|
},
|
||||||
outputs,
|
outputs,
|
||||||
},
|
},
|
||||||
@@ -67,36 +426,66 @@ await writeFile(
|
|||||||
2,
|
2,
|
||||||
)}\n`,
|
)}\n`,
|
||||||
);
|
);
|
||||||
|
|
||||||
await writeFile(
|
await writeFile(
|
||||||
"artifacts/release/dependency-inventory.json",
|
"artifacts/release/dependency-inventory.json",
|
||||||
`${JSON.stringify(
|
`${JSON.stringify(inventory, null, 2)}\n`,
|
||||||
{
|
);
|
||||||
schemaVersion: 1,
|
await writeFile(
|
||||||
lockfileSha256: createHash("sha256").update(lockfile).digest("hex"),
|
"artifacts/release/sbom.cdx.json",
|
||||||
dependencies: inventory,
|
`${JSON.stringify(sbom, null, 2)}\n`,
|
||||||
},
|
);
|
||||||
null,
|
await writeFile(
|
||||||
2,
|
"artifacts/release/provenance.json",
|
||||||
)}\n`,
|
`${JSON.stringify(provenance, null, 2)}\n`,
|
||||||
);
|
);
|
||||||
|
|
||||||
await writeFile(
|
await writeFile(
|
||||||
"artifacts/release/checksums.txt",
|
"artifacts/release/checksums.txt",
|
||||||
`${outputs.map((output) => `${output.sha256} ${output.path}`).join("\n")}\n`,
|
`${outputs.map((output) => `${output.sha256} ${output.path}`).join("\n")}\n`,
|
||||||
);
|
);
|
||||||
|
|
||||||
await writeFile(
|
await writeFile(
|
||||||
"artifacts/security/dependency-diff.json",
|
"artifacts/security/dependency-diff.json",
|
||||||
`${JSON.stringify(
|
`${JSON.stringify(
|
||||||
{
|
{
|
||||||
schemaVersion: 1,
|
schemaVersion: 2,
|
||||||
reviewStatus: "local-baseline",
|
baselineDigest: baseline ? supplyChainDigest(baseline) : null,
|
||||||
directDependencies: inventory.length,
|
currentDigest: supplyChainDigest(inventory),
|
||||||
highRiskUnreviewed: [],
|
...dependencyDiff,
|
||||||
lockfileSha256: createHash("sha256").update(lockfile).digest("hex"),
|
highRisk: reviewResult.highRisk,
|
||||||
|
reviewFailures: reviewResult.failures,
|
||||||
},
|
},
|
||||||
null,
|
null,
|
||||||
2,
|
2,
|
||||||
)}\n`,
|
)}\n`,
|
||||||
);
|
);
|
||||||
|
await writeFile(
|
||||||
|
"artifacts/security/license-report.json",
|
||||||
|
`${JSON.stringify(
|
||||||
|
{
|
||||||
|
schemaVersion: 1,
|
||||||
|
status: licenseResult.passed ? "PASS" : "FAIL",
|
||||||
|
dependencyCount: inventory.dependencyCount,
|
||||||
|
results: licenseResult.results,
|
||||||
|
failures: licenseResult.failures,
|
||||||
|
},
|
||||||
|
null,
|
||||||
|
2,
|
||||||
|
)}\n`,
|
||||||
|
);
|
||||||
|
await writeFile(
|
||||||
|
"artifacts/security/vulnerability-report.json",
|
||||||
|
`${JSON.stringify(vulnerabilityReport, null, 2)}\n`,
|
||||||
|
);
|
||||||
|
await writeFile(
|
||||||
|
"artifacts/security/supply-chain-verification.json",
|
||||||
|
`${JSON.stringify(verification, null, 2)}\n`,
|
||||||
|
);
|
||||||
|
|
||||||
|
if (!localPassed) {
|
||||||
|
process.stderr.write(
|
||||||
|
`Local supply-chain verification failed:\n- ${localFailures.join("\n- ")}\n`,
|
||||||
|
);
|
||||||
|
process.exit(1);
|
||||||
|
}
|
||||||
|
process.stdout.write(
|
||||||
|
`Supply chain: LOCAL PASS (${inventory.dependencyCount} dependencies); promotion=${verification.promotionStatus}\n`,
|
||||||
|
);
|
||||||
|
|||||||
@@ -0,0 +1,547 @@
|
|||||||
|
import { createHash } from "node:crypto";
|
||||||
|
import { readFile } from "node:fs/promises";
|
||||||
|
|
||||||
|
/** @param {unknown} value @returns {unknown} */
|
||||||
|
export function canonicalizeSupplyChainValue(value) {
|
||||||
|
if (Array.isArray(value)) {
|
||||||
|
return value
|
||||||
|
.map(canonicalizeSupplyChainValue)
|
||||||
|
.sort((left, right) =>
|
||||||
|
JSON.stringify(left).localeCompare(JSON.stringify(right)),
|
||||||
|
);
|
||||||
|
}
|
||||||
|
if (value && typeof value === "object") {
|
||||||
|
return Object.fromEntries(
|
||||||
|
Object.entries(value)
|
||||||
|
.sort(([left], [right]) => left.localeCompare(right))
|
||||||
|
.map(([key, item]) => [key, canonicalizeSupplyChainValue(item)]),
|
||||||
|
);
|
||||||
|
}
|
||||||
|
return value;
|
||||||
|
}
|
||||||
|
|
||||||
|
/** @param {unknown} value */
|
||||||
|
export function supplyChainDigest(value) {
|
||||||
|
return createHash("sha256")
|
||||||
|
.update(JSON.stringify(canonicalizeSupplyChainValue(value)))
|
||||||
|
.digest("hex");
|
||||||
|
}
|
||||||
|
|
||||||
|
/** @param {string} lockfile */
|
||||||
|
export function parsePnpmLockfilePackages(lockfile) {
|
||||||
|
const entries =
|
||||||
|
/** @type {Array<{name: string, version: string, integrity: string}>} */ (
|
||||||
|
[]
|
||||||
|
);
|
||||||
|
let inPackages = false;
|
||||||
|
/** @type {{name: string, version: string, integrity: string} | null} */
|
||||||
|
let current = null;
|
||||||
|
|
||||||
|
for (const line of lockfile.split(/\r?\n/)) {
|
||||||
|
if (line === "packages:") {
|
||||||
|
inPackages = true;
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
if (line === "snapshots:") {
|
||||||
|
if (current) entries.push(current);
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
if (!inPackages) continue;
|
||||||
|
const packageMatch = line.match(/^ {2}(\S.*):$/);
|
||||||
|
if (packageMatch) {
|
||||||
|
if (current) entries.push(current);
|
||||||
|
const key = packageMatch[1].replace(/^['"]|['"]$/g, "");
|
||||||
|
const separator = key.lastIndexOf("@");
|
||||||
|
current = {
|
||||||
|
name: key.slice(0, separator),
|
||||||
|
version: key.slice(separator + 1),
|
||||||
|
integrity: "",
|
||||||
|
};
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
const integrityMatch = line.match(/\bintegrity:\s*([^,}\s]+)/);
|
||||||
|
if (current && integrityMatch) {
|
||||||
|
current.integrity = integrityMatch[1];
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return entries.sort((left, right) =>
|
||||||
|
`${left.name}@${left.version}`.localeCompare(
|
||||||
|
`${right.name}@${right.version}`,
|
||||||
|
),
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
/** @param {string} integrity */
|
||||||
|
export function isValidSha512Integrity(integrity) {
|
||||||
|
if (!integrity.startsWith("sha512-")) return false;
|
||||||
|
try {
|
||||||
|
return Buffer.from(integrity.slice("sha512-".length), "base64").length === 64;
|
||||||
|
} catch {
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* @param {unknown} raw
|
||||||
|
* @returns {string}
|
||||||
|
*/
|
||||||
|
export function normalizeLicense(raw) {
|
||||||
|
if (typeof raw === "string" && raw.trim()) return raw.trim();
|
||||||
|
if (
|
||||||
|
raw &&
|
||||||
|
typeof raw === "object" &&
|
||||||
|
"type" in raw &&
|
||||||
|
typeof raw.type === "string"
|
||||||
|
) {
|
||||||
|
return raw.type;
|
||||||
|
}
|
||||||
|
if (Array.isArray(raw)) {
|
||||||
|
const licenses = raw.map(normalizeLicense).filter(
|
||||||
|
(license) => license !== "NOASSERTION",
|
||||||
|
);
|
||||||
|
return licenses.length > 0 ? licenses.join(" OR ") : "NOASSERTION";
|
||||||
|
}
|
||||||
|
return "NOASSERTION";
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* @param {Record<string, unknown>} root
|
||||||
|
* @param {Readonly<Record<string, string>>} directProduction
|
||||||
|
* @param {Readonly<Record<string, string>>} directDevelopment
|
||||||
|
*/
|
||||||
|
export async function flattenPnpmDependencyTree(
|
||||||
|
root,
|
||||||
|
directProduction,
|
||||||
|
directDevelopment,
|
||||||
|
) {
|
||||||
|
const records =
|
||||||
|
/** @type {Map<string, {
|
||||||
|
* name: string,
|
||||||
|
* version: string,
|
||||||
|
* direct: boolean,
|
||||||
|
* scope: "production" | "development",
|
||||||
|
* optional: boolean,
|
||||||
|
* packagePath: string,
|
||||||
|
* dependencies: Set<string>
|
||||||
|
* }>} */ (new Map());
|
||||||
|
const directIds = new Set();
|
||||||
|
for (const [name, rawDependency] of Object.entries(
|
||||||
|
/** @type {Record<string, unknown>} */ (root.dependencies ?? {}),
|
||||||
|
)) {
|
||||||
|
if (
|
||||||
|
Object.hasOwn(directProduction, name) &&
|
||||||
|
rawDependency &&
|
||||||
|
typeof rawDependency === "object" &&
|
||||||
|
!Array.isArray(rawDependency)
|
||||||
|
) {
|
||||||
|
directIds.add(
|
||||||
|
`${name}@${String(
|
||||||
|
/** @type {Record<string, unknown>} */ (rawDependency).version ?? "",
|
||||||
|
)}`,
|
||||||
|
);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
for (const [name, rawDependency] of Object.entries(
|
||||||
|
/** @type {Record<string, unknown>} */ (root.devDependencies ?? {}),
|
||||||
|
)) {
|
||||||
|
if (
|
||||||
|
Object.hasOwn(directDevelopment, name) &&
|
||||||
|
rawDependency &&
|
||||||
|
typeof rawDependency === "object" &&
|
||||||
|
!Array.isArray(rawDependency)
|
||||||
|
) {
|
||||||
|
directIds.add(
|
||||||
|
`${name}@${String(
|
||||||
|
/** @type {Record<string, unknown>} */ (rawDependency).version ?? "",
|
||||||
|
)}`,
|
||||||
|
);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* @param {Record<string, unknown>} node
|
||||||
|
* @param {"production" | "development"} scope
|
||||||
|
* @param {boolean} optionalPath
|
||||||
|
*/
|
||||||
|
function visit(node, scope, optionalPath) {
|
||||||
|
for (const [groupName, group] of Object.entries({
|
||||||
|
dependencies: node.dependencies,
|
||||||
|
devDependencies: node.devDependencies,
|
||||||
|
optionalDependencies: node.optionalDependencies,
|
||||||
|
})) {
|
||||||
|
if (!group || typeof group !== "object" || Array.isArray(group)) continue;
|
||||||
|
for (const [name, rawDependency] of Object.entries(group)) {
|
||||||
|
if (
|
||||||
|
!rawDependency ||
|
||||||
|
typeof rawDependency !== "object" ||
|
||||||
|
Array.isArray(rawDependency)
|
||||||
|
) {
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
const dependency =
|
||||||
|
/** @type {Record<string, unknown>} */ (rawDependency);
|
||||||
|
const version = String(dependency.version ?? "");
|
||||||
|
const packagePath = String(dependency.path ?? "");
|
||||||
|
const identity = `${name}@${version}`;
|
||||||
|
const childScope =
|
||||||
|
scope === "production" && groupName !== "devDependencies"
|
||||||
|
? "production"
|
||||||
|
: "development";
|
||||||
|
const childOptional =
|
||||||
|
optionalPath || groupName === "optionalDependencies";
|
||||||
|
const previous = records.get(identity);
|
||||||
|
const dependencies = previous?.dependencies ?? new Set();
|
||||||
|
for (const childGroup of [
|
||||||
|
dependency.dependencies,
|
||||||
|
dependency.optionalDependencies,
|
||||||
|
]) {
|
||||||
|
if (
|
||||||
|
!childGroup ||
|
||||||
|
typeof childGroup !== "object" ||
|
||||||
|
Array.isArray(childGroup)
|
||||||
|
) {
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
for (const [childName, rawChild] of Object.entries(childGroup)) {
|
||||||
|
if (
|
||||||
|
rawChild &&
|
||||||
|
typeof rawChild === "object" &&
|
||||||
|
!Array.isArray(rawChild)
|
||||||
|
) {
|
||||||
|
dependencies.add(
|
||||||
|
`${childName}@${String(rawChild.version ?? "")}`,
|
||||||
|
);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
records.set(identity, {
|
||||||
|
name,
|
||||||
|
version,
|
||||||
|
direct: directIds.has(identity),
|
||||||
|
scope:
|
||||||
|
previous?.scope === "production" || childScope === "production"
|
||||||
|
? "production"
|
||||||
|
: "development",
|
||||||
|
optional: previous ? previous.optional && childOptional : childOptional,
|
||||||
|
packagePath: previous?.packagePath || packagePath,
|
||||||
|
dependencies,
|
||||||
|
});
|
||||||
|
visit(dependency, childScope, childOptional);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
const productionRoot = {
|
||||||
|
dependencies: Object.fromEntries(
|
||||||
|
Object.entries(
|
||||||
|
/** @type {Record<string, unknown>} */ (root.dependencies ?? {}),
|
||||||
|
).filter(([name]) => Object.hasOwn(directProduction, name)),
|
||||||
|
),
|
||||||
|
};
|
||||||
|
const developmentRoot = {
|
||||||
|
devDependencies: Object.fromEntries(
|
||||||
|
Object.entries(
|
||||||
|
/** @type {Record<string, unknown>} */ (root.devDependencies ?? {}),
|
||||||
|
).filter(([name]) => Object.hasOwn(directDevelopment, name)),
|
||||||
|
),
|
||||||
|
};
|
||||||
|
visit(productionRoot, "production", false);
|
||||||
|
visit(developmentRoot, "development", false);
|
||||||
|
|
||||||
|
const result = [];
|
||||||
|
for (const record of records.values()) {
|
||||||
|
let license = "NOASSERTION";
|
||||||
|
let optional = record.optional;
|
||||||
|
if (record.packagePath) {
|
||||||
|
try {
|
||||||
|
const manifest = JSON.parse(
|
||||||
|
await readFile(`${record.packagePath}/package.json`, "utf8"),
|
||||||
|
);
|
||||||
|
license = normalizeLicense(manifest.license ?? manifest.licenses);
|
||||||
|
} catch {
|
||||||
|
// Platform-specific optional packages may not be materialized locally.
|
||||||
|
optional = true;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
result.push({
|
||||||
|
name: record.name,
|
||||||
|
version: record.version,
|
||||||
|
direct: record.direct,
|
||||||
|
scope: record.scope,
|
||||||
|
optional,
|
||||||
|
license,
|
||||||
|
dependencies: [...record.dependencies].sort(),
|
||||||
|
});
|
||||||
|
}
|
||||||
|
return result.sort((left, right) =>
|
||||||
|
`${left.name}@${left.version}`.localeCompare(
|
||||||
|
`${right.name}@${right.version}`,
|
||||||
|
),
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* @param {Readonly<Record<string, unknown>>} before
|
||||||
|
* @param {Readonly<Record<string, unknown>>} after
|
||||||
|
*/
|
||||||
|
export function diffDependencyInventories(before, after) {
|
||||||
|
const beforeRows =
|
||||||
|
/** @type {Array<Record<string, unknown>>} */ (before.dependencies ?? []);
|
||||||
|
const afterRows =
|
||||||
|
/** @type {Array<Record<string, unknown>>} */ (after.dependencies ?? []);
|
||||||
|
const beforeMap = new Map(
|
||||||
|
beforeRows.map((row) => [`${row.name}@${row.version}`, row]),
|
||||||
|
);
|
||||||
|
const afterMap = new Map(
|
||||||
|
afterRows.map((row) => [`${row.name}@${row.version}`, row]),
|
||||||
|
);
|
||||||
|
const added = [...afterMap.keys()].filter((key) => !beforeMap.has(key));
|
||||||
|
const removed = [...beforeMap.keys()].filter((key) => !afterMap.has(key));
|
||||||
|
const changed = [];
|
||||||
|
for (const key of [...beforeMap.keys()].filter((item) => afterMap.has(item))) {
|
||||||
|
if (
|
||||||
|
supplyChainDigest(beforeMap.get(key)) !==
|
||||||
|
supplyChainDigest(afterMap.get(key))
|
||||||
|
) {
|
||||||
|
changed.push(key);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
const upgrades = [];
|
||||||
|
for (const removedKey of removed) {
|
||||||
|
const previous = beforeMap.get(removedKey);
|
||||||
|
const replacement = added.find(
|
||||||
|
(addedKey) => afterMap.get(addedKey)?.name === previous?.name,
|
||||||
|
);
|
||||||
|
if (replacement) {
|
||||||
|
upgrades.push({
|
||||||
|
name: previous?.name,
|
||||||
|
from: previous?.version,
|
||||||
|
to: afterMap.get(replacement)?.version,
|
||||||
|
});
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return Object.freeze({
|
||||||
|
added: Object.freeze(added.sort()),
|
||||||
|
removed: Object.freeze(removed.sort()),
|
||||||
|
changed: Object.freeze(changed.sort()),
|
||||||
|
upgrades: Object.freeze(
|
||||||
|
upgrades.sort((left, right) =>
|
||||||
|
String(left.name).localeCompare(String(right.name)),
|
||||||
|
),
|
||||||
|
),
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* @param {Readonly<Record<string, unknown>>} inventory
|
||||||
|
* @param {Readonly<Record<string, unknown>>} policy
|
||||||
|
*/
|
||||||
|
export function validateLicensePolicy(inventory, policy) {
|
||||||
|
const allowed = new Set(
|
||||||
|
/** @type {string[]} */ (policy.allowedLicenses ?? []),
|
||||||
|
);
|
||||||
|
const denied = /** @type {string[]} */ (policy.deniedLicensePatterns ?? []);
|
||||||
|
const failures = [];
|
||||||
|
const results = [];
|
||||||
|
for (const dependency of /** @type {Array<Record<string, unknown>>} */ (
|
||||||
|
inventory.dependencies ?? []
|
||||||
|
)) {
|
||||||
|
const license = String(dependency.license ?? "NOASSERTION");
|
||||||
|
const explicitlyDenied = denied.some((pattern) =>
|
||||||
|
new RegExp(pattern, "i").test(license),
|
||||||
|
);
|
||||||
|
const unknownAccepted =
|
||||||
|
license === "NOASSERTION" && dependency.optional === true;
|
||||||
|
const passed =
|
||||||
|
!explicitlyDenied && (allowed.has(license) || unknownAccepted);
|
||||||
|
results.push({
|
||||||
|
package: `${dependency.name}@${dependency.version}`,
|
||||||
|
license,
|
||||||
|
passed,
|
||||||
|
reason: unknownAccepted ? "platform-optional-not-materialized" : null,
|
||||||
|
});
|
||||||
|
if (!passed) {
|
||||||
|
failures.push(
|
||||||
|
`${dependency.name}@${dependency.version} has disallowed license ${license}`,
|
||||||
|
);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return Object.freeze({
|
||||||
|
passed: failures.length === 0,
|
||||||
|
failures: Object.freeze(failures),
|
||||||
|
results: Object.freeze(results),
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* @param {ReturnType<typeof diffDependencyInventories>} diff
|
||||||
|
* @param {Readonly<Record<string, unknown>>} inventory
|
||||||
|
* @param {Readonly<Record<string, unknown>>} evidenceFile
|
||||||
|
*/
|
||||||
|
export function validateDependencyReview(diff, inventory, evidenceFile) {
|
||||||
|
const rows =
|
||||||
|
/** @type {Array<Record<string, unknown>>} */ (inventory.dependencies ?? []);
|
||||||
|
const byIdentity = new Map(
|
||||||
|
rows.map((row) => [`${row.name}@${row.version}`, row]),
|
||||||
|
);
|
||||||
|
const evidence = new Map(
|
||||||
|
/** @type {Array<Record<string, unknown>>} */ (
|
||||||
|
evidenceFile.changes ?? []
|
||||||
|
).map((entry) => [entry.changeId, entry]),
|
||||||
|
);
|
||||||
|
const highRisk = diff.added.filter((identity) => {
|
||||||
|
const row = byIdentity.get(identity);
|
||||||
|
return row?.direct === true && row.scope === "production";
|
||||||
|
});
|
||||||
|
const failures = [];
|
||||||
|
for (const identity of highRisk) {
|
||||||
|
const changeId = `add:${identity}`;
|
||||||
|
const entry = evidence.get(changeId);
|
||||||
|
if (!entry) {
|
||||||
|
failures.push(`high-risk dependency missing review: ${changeId}`);
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
for (const field of ["owner", "reviewer", "reason", "rollback"]) {
|
||||||
|
if (typeof entry[field] !== "string" || !entry[field].trim()) {
|
||||||
|
failures.push(`${changeId} missing ${field}`);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if (entry.owner === entry.reviewer) {
|
||||||
|
failures.push(`${changeId} may not be self-approved`);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return Object.freeze({
|
||||||
|
passed: failures.length === 0,
|
||||||
|
highRisk: Object.freeze(highRisk),
|
||||||
|
failures: Object.freeze(failures),
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
const severityRank = new Map([
|
||||||
|
["unknown", 0],
|
||||||
|
["low", 1],
|
||||||
|
["moderate", 2],
|
||||||
|
["high", 3],
|
||||||
|
["critical", 4],
|
||||||
|
]);
|
||||||
|
|
||||||
|
/**
|
||||||
|
* @param {Readonly<Record<string, unknown>>} report
|
||||||
|
* @param {Readonly<Record<string, unknown>>} policy
|
||||||
|
* @param {Readonly<Record<string, unknown>>} exceptionFile
|
||||||
|
* @param {string} lockfileSha256
|
||||||
|
* @param {Date} [now]
|
||||||
|
*/
|
||||||
|
export function validateVulnerabilityReport(
|
||||||
|
report,
|
||||||
|
policy,
|
||||||
|
exceptionFile,
|
||||||
|
lockfileSha256,
|
||||||
|
now = new Date(),
|
||||||
|
) {
|
||||||
|
const failures = [];
|
||||||
|
if (report.scannedLockfileSha256 !== lockfileSha256) {
|
||||||
|
failures.push("vulnerability report lockfile digest mismatch");
|
||||||
|
}
|
||||||
|
if (typeof report.provider !== "string" || !report.provider.trim()) {
|
||||||
|
failures.push("vulnerability report provider missing");
|
||||||
|
}
|
||||||
|
const threshold = severityRank.get(String(policy.blockAtSeverity)) ?? 3;
|
||||||
|
const exceptions =
|
||||||
|
/** @type {Array<Record<string, unknown>>} */ (
|
||||||
|
exceptionFile.exceptions ?? []
|
||||||
|
);
|
||||||
|
const blocking = [];
|
||||||
|
for (const finding of /** @type {Array<Record<string, unknown>>} */ (
|
||||||
|
report.findings ?? []
|
||||||
|
)) {
|
||||||
|
const severity = String(finding.severity ?? "unknown").toLowerCase();
|
||||||
|
if ((severityRank.get(severity) ?? 0) < threshold) continue;
|
||||||
|
const exception = exceptions.find(
|
||||||
|
(entry) =>
|
||||||
|
entry.vulnerabilityId === finding.id &&
|
||||||
|
entry.packageName === finding.packageName,
|
||||||
|
);
|
||||||
|
const expiry =
|
||||||
|
typeof exception?.expiresAt === "string"
|
||||||
|
? Date.parse(exception.expiresAt)
|
||||||
|
: Number.NaN;
|
||||||
|
const validException =
|
||||||
|
exception &&
|
||||||
|
typeof exception.owner === "string" &&
|
||||||
|
exception.owner.trim() &&
|
||||||
|
typeof exception.reviewer === "string" &&
|
||||||
|
exception.reviewer.trim() &&
|
||||||
|
exception.owner !== exception.reviewer &&
|
||||||
|
typeof exception.reason === "string" &&
|
||||||
|
exception.reason.trim() &&
|
||||||
|
Number.isFinite(expiry) &&
|
||||||
|
expiry > now.getTime();
|
||||||
|
if (!validException) {
|
||||||
|
blocking.push(
|
||||||
|
`${finding.id}:${finding.packageName}@${finding.version}:${severity}`,
|
||||||
|
);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return Object.freeze({
|
||||||
|
passed: failures.length === 0 && blocking.length === 0,
|
||||||
|
failures: Object.freeze(failures),
|
||||||
|
blocking: Object.freeze(blocking),
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* @param {Readonly<Record<string, unknown>>} sbom
|
||||||
|
* @param {Readonly<Record<string, unknown>>} inventory
|
||||||
|
* @param {Readonly<Record<string, unknown>>} provenance
|
||||||
|
* @param {string} distDigest
|
||||||
|
*/
|
||||||
|
export function verifySupplyChainCoherence(
|
||||||
|
sbom,
|
||||||
|
inventory,
|
||||||
|
provenance,
|
||||||
|
distDigest,
|
||||||
|
) {
|
||||||
|
const failures = [];
|
||||||
|
const componentCount = Array.isArray(sbom.components)
|
||||||
|
? sbom.components.length
|
||||||
|
: -1;
|
||||||
|
const dependencyCount = Array.isArray(inventory.dependencies)
|
||||||
|
? inventory.dependencies.length
|
||||||
|
: -2;
|
||||||
|
if (componentCount !== dependencyCount) {
|
||||||
|
failures.push("SBOM component count does not match inventory");
|
||||||
|
}
|
||||||
|
const metadata =
|
||||||
|
/** @type {Record<string, unknown>} */ (sbom.metadata ?? {});
|
||||||
|
const properties =
|
||||||
|
/** @type {Array<{name?: string, value?: string}>} */ (
|
||||||
|
metadata.properties ?? []
|
||||||
|
);
|
||||||
|
if (properties.find(
|
||||||
|
/** @param {{name?: string, value?: string}} property */
|
||||||
|
(property) =>
|
||||||
|
property.name === "ca:lockfileSha256" &&
|
||||||
|
property.value === inventory.lockfileSha256,
|
||||||
|
) === undefined) {
|
||||||
|
failures.push("SBOM lockfile digest does not match inventory");
|
||||||
|
}
|
||||||
|
const subject =
|
||||||
|
/** @type {Array<Record<string, unknown>>} */ (provenance.subject ?? [])[0];
|
||||||
|
const subjectDigest =
|
||||||
|
/** @type {Record<string, unknown>} */ (subject?.digest ?? {});
|
||||||
|
if (subjectDigest.sha256 !== distDigest) {
|
||||||
|
failures.push("provenance subject does not match built dist digest");
|
||||||
|
}
|
||||||
|
const predicate =
|
||||||
|
/** @type {Record<string, unknown>} */ (provenance.predicate ?? {});
|
||||||
|
const materials =
|
||||||
|
/** @type {Record<string, unknown>} */ (predicate.materials ?? {});
|
||||||
|
if (materials.lockfileSha256 !== inventory.lockfileSha256) {
|
||||||
|
failures.push("provenance lockfile material does not match inventory");
|
||||||
|
}
|
||||||
|
return Object.freeze({
|
||||||
|
passed: failures.length === 0,
|
||||||
|
failures: Object.freeze(failures),
|
||||||
|
});
|
||||||
|
}
|
||||||
+133
-28
@@ -1,10 +1,37 @@
|
|||||||
import { mkdir, readFile, readdir, writeFile } from "node:fs/promises";
|
import { createHash } from "node:crypto";
|
||||||
|
import { mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
|
||||||
import path from "node:path";
|
import path from "node:path";
|
||||||
|
|
||||||
const scanRoots = ["src", "dist"];
|
/** @param {string} name @param {string} fallback */
|
||||||
const findings = /** @type {Array<{ruleId: string, file: string}>} */ ([]);
|
function argumentValue(name, fallback) {
|
||||||
|
const index = process.argv.indexOf(name);
|
||||||
|
return index >= 0 && process.argv[index + 1]
|
||||||
|
? process.argv[index + 1]
|
||||||
|
: fallback;
|
||||||
|
}
|
||||||
|
|
||||||
|
const policyPath = argumentValue(
|
||||||
|
"--policy",
|
||||||
|
"config/security/secret-scan-policy.json",
|
||||||
|
);
|
||||||
|
const artifactPath = argumentValue(
|
||||||
|
"--artifact",
|
||||||
|
"artifacts/security/scan.sarif",
|
||||||
|
);
|
||||||
|
const policy = JSON.parse(await readFile(policyPath, "utf8"));
|
||||||
|
const findings =
|
||||||
|
/** @type {Array<{
|
||||||
|
* ruleId: string,
|
||||||
|
* file: string,
|
||||||
|
* line: number,
|
||||||
|
* fingerprint: string
|
||||||
|
* }>} */ ([]);
|
||||||
|
const policyFailures = [];
|
||||||
const patterns = [
|
const patterns = [
|
||||||
{ id: "private-key", expression: /-----BEGIN (?:RSA |EC )?PRIVATE KEY-----/g },
|
{
|
||||||
|
id: "private-key",
|
||||||
|
expression: /-----BEGIN (?:RSA |EC )?PRIVATE KEY-----/g,
|
||||||
|
},
|
||||||
{ id: "aws-access-key", expression: /\bAKIA[0-9A-Z]{16}\b/g },
|
{ id: "aws-access-key", expression: /\bAKIA[0-9A-Z]{16}\b/g },
|
||||||
{ id: "github-token", expression: /\bgh[pousr]_[A-Za-z0-9_]{30,}\b/g },
|
{ id: "github-token", expression: /\bgh[pousr]_[A-Za-z0-9_]{30,}\b/g },
|
||||||
{
|
{
|
||||||
@@ -14,35 +41,101 @@ const patterns = [
|
|||||||
},
|
},
|
||||||
];
|
];
|
||||||
|
|
||||||
/** @param {string} directory @returns {Promise<string[]>} */
|
/** @param {string} target @returns {Promise<string[]>} */
|
||||||
async function filesWithin(directory) {
|
async function filesWithin(target) {
|
||||||
const entries = await readdir(directory, { withFileTypes: true });
|
try {
|
||||||
|
const metadata = await stat(target);
|
||||||
|
if (metadata.isFile()) return [target];
|
||||||
|
const entries = await readdir(target, { withFileTypes: true });
|
||||||
const nested = /** @type {string[][]} */ (await Promise.all(
|
const nested = /** @type {string[][]} */ (await Promise.all(
|
||||||
entries.map((entry) => {
|
entries.map((entry) => {
|
||||||
const target = path.join(directory, entry.name);
|
const child = path.join(target, entry.name);
|
||||||
return entry.isDirectory() ? filesWithin(target) : [target];
|
return entry.isDirectory() ? filesWithin(child) : [child];
|
||||||
}),
|
}),
|
||||||
));
|
));
|
||||||
return nested.flat();
|
return nested.flat();
|
||||||
|
} catch {
|
||||||
|
return [];
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
for (const root of scanRoots) {
|
const excluded = new Set(
|
||||||
for (const scanFile of await filesWithin(root)) {
|
/** @type {string[]} */ (policy.excludedPaths ?? []).map((entry) =>
|
||||||
if (/\.(png|jpg|jpeg|gif|woff2?|zip)$/i.test(scanFile)) continue;
|
entry.replaceAll("\\", "/"),
|
||||||
const content = await readFile(scanFile, "utf8");
|
),
|
||||||
|
);
|
||||||
|
const allowlist =
|
||||||
|
/** @type {Array<{
|
||||||
|
* path: string,
|
||||||
|
* ruleId: string,
|
||||||
|
* owner: string,
|
||||||
|
* reason: string,
|
||||||
|
* expiresAt: string
|
||||||
|
* }>} */ (policy.allowlist ?? []);
|
||||||
|
for (const entry of allowlist) {
|
||||||
|
const expiry = Date.parse(entry.expiresAt);
|
||||||
|
if (
|
||||||
|
!entry.path.startsWith("tests/") ||
|
||||||
|
!entry.owner?.trim() ||
|
||||||
|
!entry.reason?.trim() ||
|
||||||
|
!Number.isFinite(expiry) ||
|
||||||
|
expiry <= Date.now()
|
||||||
|
) {
|
||||||
|
policyFailures.push(
|
||||||
|
`invalid or expired secret allowlist entry: ${entry.path}:${entry.ruleId}`,
|
||||||
|
);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
const roots = [
|
||||||
|
...(/** @type {string[]} */ (policy.trackedRoots ?? [])),
|
||||||
|
...(/** @type {string[]} */ (policy.generatedRoots ?? [])),
|
||||||
|
];
|
||||||
|
const scanFiles = (
|
||||||
|
await Promise.all(roots.map((root) => filesWithin(root)))
|
||||||
|
).flat();
|
||||||
|
for (const scanFile of [...new Set(scanFiles)].sort()) {
|
||||||
|
const normalized = scanFile.replaceAll("\\", "/");
|
||||||
|
if (
|
||||||
|
[...excluded].some(
|
||||||
|
(entry) => normalized === entry || normalized.startsWith(`${entry}/`),
|
||||||
|
) ||
|
||||||
|
/\.(?:png|jpe?g|gif|webp|woff2?|zip|gz|sarif)$/i.test(normalized)
|
||||||
|
) {
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
let content;
|
||||||
|
try {
|
||||||
|
content = await readFile(scanFile, "utf8");
|
||||||
|
} catch {
|
||||||
|
continue;
|
||||||
|
}
|
||||||
for (const pattern of patterns) {
|
for (const pattern of patterns) {
|
||||||
pattern.expression.lastIndex = 0;
|
pattern.expression.lastIndex = 0;
|
||||||
if (pattern.expression.test(content)) {
|
for (const match of content.matchAll(pattern.expression)) {
|
||||||
findings.push({ ruleId: pattern.id, file: scanFile });
|
const isAllowed = allowlist.some(
|
||||||
}
|
(entry) =>
|
||||||
|
entry.path === normalized &&
|
||||||
|
entry.ruleId === pattern.id &&
|
||||||
|
Date.parse(entry.expiresAt) > Date.now(),
|
||||||
|
);
|
||||||
|
if (isAllowed) continue;
|
||||||
|
const prefix = content.slice(0, match.index);
|
||||||
|
findings.push({
|
||||||
|
ruleId: pattern.id,
|
||||||
|
file: normalized,
|
||||||
|
line: prefix.split(/\r?\n/).length,
|
||||||
|
fingerprint: createHash("sha256")
|
||||||
|
.update(`${pattern.id}:${normalized}:${String(match.index)}`)
|
||||||
|
.digest("hex"),
|
||||||
|
});
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
const sarif = {
|
const sarif = {
|
||||||
version: "2.1.0",
|
version: "2.1.0",
|
||||||
$schema:
|
$schema: "https://json.schemastore.org/sarif-2.1.0.json",
|
||||||
"https://json.schemastore.org/sarif-2.1.0.json",
|
|
||||||
runs: [
|
runs: [
|
||||||
{
|
{
|
||||||
tool: {
|
tool: {
|
||||||
@@ -54,29 +147,41 @@ const sarif = {
|
|||||||
})),
|
})),
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
results: findings.map((finding) => ({
|
results: [
|
||||||
|
...findings.map((finding) => ({
|
||||||
ruleId: finding.ruleId,
|
ruleId: finding.ruleId,
|
||||||
message: { text: "Potential secret material must be removed." },
|
message: {
|
||||||
|
text: "Potential secret material must be removed.",
|
||||||
|
},
|
||||||
|
partialFingerprints: {
|
||||||
|
primaryLocationLineHash: finding.fingerprint,
|
||||||
|
},
|
||||||
locations: [
|
locations: [
|
||||||
{
|
{
|
||||||
physicalLocation: {
|
physicalLocation: {
|
||||||
artifactLocation: { uri: finding.file },
|
artifactLocation: { uri: finding.file },
|
||||||
|
region: { startLine: finding.line },
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
],
|
],
|
||||||
})),
|
})),
|
||||||
|
...policyFailures.map((failure) => ({
|
||||||
|
ruleId: "invalid-allowlist",
|
||||||
|
message: { text: failure },
|
||||||
|
})),
|
||||||
|
],
|
||||||
},
|
},
|
||||||
],
|
],
|
||||||
};
|
};
|
||||||
|
|
||||||
await mkdir("artifacts/security", { recursive: true });
|
await mkdir(path.dirname(artifactPath), { recursive: true });
|
||||||
await writeFile(
|
await writeFile(artifactPath, `${JSON.stringify(sarif, null, 2)}\n`);
|
||||||
"artifacts/security/scan.sarif",
|
if (findings.length > 0 || policyFailures.length > 0) {
|
||||||
`${JSON.stringify(sarif, null, 2)}\n`,
|
process.stderr.write(
|
||||||
|
`Security scan found ${findings.length + policyFailures.length} blocking result(s).\n`,
|
||||||
);
|
);
|
||||||
|
|
||||||
if (findings.length > 0) {
|
|
||||||
process.stderr.write(`Security scan found ${findings.length} blocking result(s).\n`);
|
|
||||||
process.exit(1);
|
process.exit(1);
|
||||||
}
|
}
|
||||||
process.stdout.write("Source and built-asset secret scan: PASS\n");
|
process.stdout.write(
|
||||||
|
`Tracked source, config, built asset and artifact secret scan: PASS (${scanFiles.length} files)\n`,
|
||||||
|
);
|
||||||
|
|||||||
@@ -18,6 +18,7 @@ const featureOwnedPaths = [
|
|||||||
featureSource,
|
featureSource,
|
||||||
featureTests,
|
featureTests,
|
||||||
"tests/e2e/reference-form.spec.js",
|
"tests/e2e/reference-form.spec.js",
|
||||||
|
"tests/e2e/reference-route.spec.js",
|
||||||
"tests/mocks",
|
"tests/mocks",
|
||||||
];
|
];
|
||||||
const copyTargets = [
|
const copyTargets = [
|
||||||
|
|||||||
@@ -0,0 +1,47 @@
|
|||||||
|
import { spawnSync } from "node:child_process";
|
||||||
|
import { readFile, writeFile } from "node:fs/promises";
|
||||||
|
|
||||||
|
import { supplyChainDigest } from "./lib/supply-chain.mjs";
|
||||||
|
|
||||||
|
const owner = process.env.DEPENDENCY_BASELINE_OWNER;
|
||||||
|
const reason = process.env.DEPENDENCY_BASELINE_REASON;
|
||||||
|
if (!owner?.trim() || !reason?.trim()) {
|
||||||
|
process.stderr.write(
|
||||||
|
"DEPENDENCY_BASELINE_OWNER and DEPENDENCY_BASELINE_REASON are required.\n",
|
||||||
|
);
|
||||||
|
process.exit(2);
|
||||||
|
}
|
||||||
|
|
||||||
|
const commands = /** @type {Array<[string, string[]]>} */ ([
|
||||||
|
["corepack", ["pnpm", "build"]],
|
||||||
|
["node", ["scripts/generate-supply-chain.mjs", "--no-baseline"]],
|
||||||
|
]);
|
||||||
|
for (const [command, args] of commands) {
|
||||||
|
const result = spawnSync(command, args, { stdio: "inherit" });
|
||||||
|
if (result.status !== 0) process.exit(result.status ?? 1);
|
||||||
|
}
|
||||||
|
|
||||||
|
const inventory = JSON.parse(
|
||||||
|
await readFile("artifacts/release/dependency-inventory.json", "utf8"),
|
||||||
|
);
|
||||||
|
await writeFile(
|
||||||
|
"config/security/dependency-baseline.json",
|
||||||
|
`${JSON.stringify(inventory, null, 2)}\n`,
|
||||||
|
);
|
||||||
|
await writeFile(
|
||||||
|
"config/security/dependency-baseline.approval.json",
|
||||||
|
`${JSON.stringify(
|
||||||
|
{
|
||||||
|
schemaVersion: 1,
|
||||||
|
snapshotDigest: supplyChainDigest(inventory),
|
||||||
|
owner,
|
||||||
|
reason,
|
||||||
|
approvedAt: new Date().toISOString(),
|
||||||
|
},
|
||||||
|
null,
|
||||||
|
2,
|
||||||
|
)}\n`,
|
||||||
|
);
|
||||||
|
process.stdout.write(
|
||||||
|
`Dependency baseline approved: ${inventory.dependencyCount} packages\n`,
|
||||||
|
);
|
||||||
@@ -0,0 +1,76 @@
|
|||||||
|
import { spawnSync } from "node:child_process";
|
||||||
|
import { mkdir, readFile, readdir, writeFile } from "node:fs/promises";
|
||||||
|
import path from "node:path";
|
||||||
|
|
||||||
|
import { supplyChainDigest } from "./lib/supply-chain.mjs";
|
||||||
|
|
||||||
|
/** @param {string} directory @returns {Promise<string[]>} */
|
||||||
|
async function filesWithin(directory) {
|
||||||
|
const entries = await readdir(directory, { withFileTypes: true });
|
||||||
|
const nested = /** @type {string[][]} */ (await Promise.all(
|
||||||
|
entries.map((entry) => {
|
||||||
|
const target = path.join(directory, entry.name);
|
||||||
|
return entry.isDirectory() ? filesWithin(target) : [target];
|
||||||
|
}),
|
||||||
|
));
|
||||||
|
return nested.flat().sort();
|
||||||
|
}
|
||||||
|
|
||||||
|
async function distDigest() {
|
||||||
|
const rows = await Promise.all(
|
||||||
|
(await filesWithin("dist")).map(async (file) => ({
|
||||||
|
path: path.relative("dist", file).replaceAll("\\", "/"),
|
||||||
|
bytes: (await readFile(file)).byteLength,
|
||||||
|
content: supplyChainDigest(await readFile(file)),
|
||||||
|
})),
|
||||||
|
);
|
||||||
|
return supplyChainDigest(rows);
|
||||||
|
}
|
||||||
|
|
||||||
|
function build(environment = process.env) {
|
||||||
|
return spawnSync("corepack", ["pnpm", "build"], {
|
||||||
|
env: environment,
|
||||||
|
encoding: "utf8",
|
||||||
|
maxBuffer: 16 * 1024 * 1024,
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
const deterministicEnvironment = {
|
||||||
|
...process.env,
|
||||||
|
SOURCE_DATE_EPOCH: "946684800",
|
||||||
|
};
|
||||||
|
const firstBuild = build(deterministicEnvironment);
|
||||||
|
const firstDigest = firstBuild.status === 0 ? await distDigest() : "BUILD_FAILED";
|
||||||
|
const secondBuild = build(deterministicEnvironment);
|
||||||
|
const secondDigest =
|
||||||
|
secondBuild.status === 0 ? await distDigest() : "BUILD_FAILED";
|
||||||
|
const restoreBuild = build();
|
||||||
|
const passed =
|
||||||
|
firstBuild.status === 0 &&
|
||||||
|
secondBuild.status === 0 &&
|
||||||
|
restoreBuild.status === 0 &&
|
||||||
|
firstDigest === secondDigest;
|
||||||
|
|
||||||
|
await mkdir("artifacts/release", { recursive: true });
|
||||||
|
await writeFile(
|
||||||
|
"artifacts/release/reproducible-build.json",
|
||||||
|
`${JSON.stringify(
|
||||||
|
{
|
||||||
|
schemaVersion: 1,
|
||||||
|
sourceDateEpoch: deterministicEnvironment.SOURCE_DATE_EPOCH,
|
||||||
|
firstDigest,
|
||||||
|
secondDigest,
|
||||||
|
restored: restoreBuild.status === 0,
|
||||||
|
status: passed ? "PASS" : "FAIL",
|
||||||
|
},
|
||||||
|
null,
|
||||||
|
2,
|
||||||
|
)}\n`,
|
||||||
|
);
|
||||||
|
if (!passed) {
|
||||||
|
process.stderr.write(
|
||||||
|
`Reproducible build failed: first=${firstDigest} second=${secondDigest}\n`,
|
||||||
|
);
|
||||||
|
process.exit(1);
|
||||||
|
}
|
||||||
|
process.stdout.write(`Reproducible build: PASS (${firstDigest})\n`);
|
||||||
@@ -0,0 +1,121 @@
|
|||||||
|
import { createHash } from "node:crypto";
|
||||||
|
import { mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
|
||||||
|
import path from "node:path";
|
||||||
|
|
||||||
|
import {
|
||||||
|
isValidSha512Integrity,
|
||||||
|
parsePnpmLockfilePackages,
|
||||||
|
supplyChainDigest,
|
||||||
|
verifySupplyChainCoherence,
|
||||||
|
} from "./lib/supply-chain.mjs";
|
||||||
|
|
||||||
|
/** @param {string} directory @returns {Promise<string[]>} */
|
||||||
|
async function filesWithin(directory) {
|
||||||
|
const entries = await readdir(directory, { withFileTypes: true });
|
||||||
|
const nested = /** @type {string[][]} */ (await Promise.all(
|
||||||
|
entries.map((entry) => {
|
||||||
|
const target = path.join(directory, entry.name);
|
||||||
|
return entry.isDirectory() ? filesWithin(target) : [target];
|
||||||
|
}),
|
||||||
|
));
|
||||||
|
return nested.flat().sort();
|
||||||
|
}
|
||||||
|
|
||||||
|
const inventory = JSON.parse(
|
||||||
|
await readFile("artifacts/release/dependency-inventory.json", "utf8"),
|
||||||
|
);
|
||||||
|
const sbom = JSON.parse(
|
||||||
|
await readFile("artifacts/release/sbom.cdx.json", "utf8"),
|
||||||
|
);
|
||||||
|
const provenance = JSON.parse(
|
||||||
|
await readFile("artifacts/release/provenance.json", "utf8"),
|
||||||
|
);
|
||||||
|
const verification = JSON.parse(
|
||||||
|
await readFile(
|
||||||
|
"artifacts/security/supply-chain-verification.json",
|
||||||
|
"utf8",
|
||||||
|
),
|
||||||
|
);
|
||||||
|
const lockfileText = await readFile("pnpm-lock.yaml", "utf8");
|
||||||
|
const lockfileSha256 = createHash("sha256")
|
||||||
|
.update(lockfileText)
|
||||||
|
.digest("hex");
|
||||||
|
const outputs = await Promise.all(
|
||||||
|
(await filesWithin("dist")).map(async (file) => {
|
||||||
|
const content = await readFile(file);
|
||||||
|
return {
|
||||||
|
path: file.replaceAll("\\", "/"),
|
||||||
|
bytes: (await stat(file)).size,
|
||||||
|
sha256: createHash("sha256").update(content).digest("hex"),
|
||||||
|
};
|
||||||
|
}),
|
||||||
|
);
|
||||||
|
const distDigest = supplyChainDigest(outputs);
|
||||||
|
const coherence = verifySupplyChainCoherence(
|
||||||
|
sbom,
|
||||||
|
inventory,
|
||||||
|
provenance,
|
||||||
|
distDigest,
|
||||||
|
);
|
||||||
|
const failures = [...coherence.failures];
|
||||||
|
if (
|
||||||
|
inventory.lockfileSha256 !== lockfileSha256 ||
|
||||||
|
verification.lockfileSha256 !== lockfileSha256
|
||||||
|
) {
|
||||||
|
failures.push("inventory/verification lockfile digest mismatch");
|
||||||
|
}
|
||||||
|
if (
|
||||||
|
verification.distSha256 !== distDigest ||
|
||||||
|
verification.sbomSha256 !== supplyChainDigest(sbom)
|
||||||
|
) {
|
||||||
|
failures.push("verification digest set is incoherent");
|
||||||
|
}
|
||||||
|
const lockRows = parsePnpmLockfilePackages(lockfileText);
|
||||||
|
const inventoryRows =
|
||||||
|
/** @type {Array<Record<string, unknown>>} */ (
|
||||||
|
inventory.dependencies ?? []
|
||||||
|
);
|
||||||
|
const inventoryByIdentity = new Map(
|
||||||
|
inventoryRows.map((entry) => [
|
||||||
|
`${entry.name}@${entry.version}`,
|
||||||
|
entry,
|
||||||
|
]),
|
||||||
|
);
|
||||||
|
if (lockRows.length !== inventoryRows.length) {
|
||||||
|
failures.push("transitive dependency count differs from lockfile");
|
||||||
|
}
|
||||||
|
for (const lockRow of lockRows) {
|
||||||
|
const identity = `${lockRow.name}@${lockRow.version}`;
|
||||||
|
const dependency = inventoryByIdentity.get(identity);
|
||||||
|
if (
|
||||||
|
!dependency ||
|
||||||
|
dependency.integrity !== lockRow.integrity ||
|
||||||
|
!isValidSha512Integrity(lockRow.integrity)
|
||||||
|
) {
|
||||||
|
failures.push(`lockfile inventory integrity mismatch: ${identity}`);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
const report = {
|
||||||
|
schemaVersion: 1,
|
||||||
|
status: failures.length === 0 ? "PASS" : "FAIL",
|
||||||
|
dependencyCount: inventoryRows.length,
|
||||||
|
lockfileSha256,
|
||||||
|
distSha256: distDigest,
|
||||||
|
sbomSha256: supplyChainDigest(sbom),
|
||||||
|
failures,
|
||||||
|
};
|
||||||
|
await mkdir("artifacts/security", { recursive: true });
|
||||||
|
await writeFile(
|
||||||
|
"artifacts/security/supply-chain-coherence.json",
|
||||||
|
`${JSON.stringify(report, null, 2)}\n`,
|
||||||
|
);
|
||||||
|
if (failures.length > 0) {
|
||||||
|
process.stderr.write(
|
||||||
|
`Supply-chain artifact coherence failed:\n- ${failures.join("\n- ")}\n`,
|
||||||
|
);
|
||||||
|
process.exit(1);
|
||||||
|
}
|
||||||
|
process.stdout.write(
|
||||||
|
`Supply-chain artifact coherence: PASS (${inventoryRows.length} dependencies)\n`,
|
||||||
|
);
|
||||||
@@ -0,0 +1,30 @@
|
|||||||
|
import { mkdir, readFile, writeFile } from "node:fs/promises";
|
||||||
|
|
||||||
|
const verification = JSON.parse(
|
||||||
|
await readFile(
|
||||||
|
"artifacts/security/supply-chain-verification.json",
|
||||||
|
"utf8",
|
||||||
|
),
|
||||||
|
);
|
||||||
|
const passed = verification.promotionStatus === "PASS";
|
||||||
|
const report = {
|
||||||
|
schemaVersion: 1,
|
||||||
|
status: passed ? "PASS" : "FAIL_UNVERIFIED",
|
||||||
|
vulnerabilityStatus: verification.vulnerabilityStatus,
|
||||||
|
provenanceAttestationStatus:
|
||||||
|
verification.provenanceAttestationStatus,
|
||||||
|
lockfileSha256: verification.lockfileSha256,
|
||||||
|
distSha256: verification.distSha256,
|
||||||
|
};
|
||||||
|
await mkdir("artifacts/security", { recursive: true });
|
||||||
|
await writeFile(
|
||||||
|
"artifacts/security/promotion-verification.json",
|
||||||
|
`${JSON.stringify(report, null, 2)}\n`,
|
||||||
|
);
|
||||||
|
if (!passed) {
|
||||||
|
process.stderr.write(
|
||||||
|
"Supply-chain promotion is FAIL_UNVERIFIED: external vulnerability and signed provenance evidence are required.\n",
|
||||||
|
);
|
||||||
|
process.exit(1);
|
||||||
|
}
|
||||||
|
process.stdout.write("Supply-chain promotion evidence: PASS\n");
|
||||||
@@ -1,6 +1,4 @@
|
|||||||
import { expect, test } from "../support/browser/strict-browser-test.js";
|
import { expect, test } from "../support/browser/strict-browser-test.js";
|
||||||
import { successEnvelope } from "../mocks/contracts/envelopes.js";
|
|
||||||
import { ROUTE_REGISTRY } from "../../src/features/installed-feature-contracts.js";
|
|
||||||
|
|
||||||
test("boots the public app shell", async ({ page }) => {
|
test("boots the public app shell", async ({ page }) => {
|
||||||
await page.goto("/");
|
await page.goto("/");
|
||||||
@@ -26,39 +24,6 @@ test("navigates to a registry-backed example without a page reload", async ({
|
|||||||
).toBeFocused();
|
).toBeFocused();
|
||||||
});
|
});
|
||||||
|
|
||||||
test("opens the protected integration route through the local demo seam", async ({
|
|
||||||
page,
|
|
||||||
}) => {
|
|
||||||
const protectedRoute = Object.values(ROUTE_REGISTRY).find(
|
|
||||||
(definition) => definition.access === "integration-defined",
|
|
||||||
);
|
|
||||||
if (!protectedRoute) throw new Error("An integration route is required");
|
|
||||||
await page.route(
|
|
||||||
"http://localhost:8080/api/reference-resources?*",
|
|
||||||
(route) =>
|
|
||||||
route.fulfill({
|
|
||||||
json: successEnvelope([
|
|
||||||
{
|
|
||||||
id: "browser-reference",
|
|
||||||
name: "Browser reference",
|
|
||||||
createdAt: "2026-07-26T00:00:00.000Z",
|
|
||||||
},
|
|
||||||
]),
|
|
||||||
}),
|
|
||||||
);
|
|
||||||
await page.goto(protectedRoute.path);
|
|
||||||
await expect(
|
|
||||||
page.getByRole("heading", { name: "세션이 필요합니다." }),
|
|
||||||
).toBeVisible();
|
|
||||||
|
|
||||||
await page.getByRole("button", { name: "로그인 시작" }).click();
|
|
||||||
|
|
||||||
await expect(
|
|
||||||
page.getByRole("heading", { name: protectedRoute.title }),
|
|
||||||
).toBeVisible();
|
|
||||||
await expect(page.getByText("인증됨")).toBeVisible();
|
|
||||||
});
|
|
||||||
|
|
||||||
test("provides an escape-dismissible mobile navigation", async ({ page }) => {
|
test("provides an escape-dismissible mobile navigation", async ({ page }) => {
|
||||||
await page.setViewportSize({ width: 390, height: 844 });
|
await page.setViewportSize({ width: 390, height: 844 });
|
||||||
await page.goto("/");
|
await page.goto("/");
|
||||||
|
|||||||
@@ -0,0 +1,36 @@
|
|||||||
|
import { expect, test } from "../support/browser/strict-browser-test.js";
|
||||||
|
import { successEnvelope } from "../mocks/contracts/envelopes.js";
|
||||||
|
import { ROUTE_REGISTRY } from "../../src/features/installed-feature-contracts.js";
|
||||||
|
|
||||||
|
test("opens the protected integration route through the local demo seam", async ({
|
||||||
|
page,
|
||||||
|
}) => {
|
||||||
|
const protectedRoute = Object.values(ROUTE_REGISTRY).find(
|
||||||
|
(definition) => definition.access === "integration-defined",
|
||||||
|
);
|
||||||
|
if (!protectedRoute) throw new Error("An integration route is required");
|
||||||
|
await page.route(
|
||||||
|
"http://localhost:8080/api/reference-resources?*",
|
||||||
|
(route) =>
|
||||||
|
route.fulfill({
|
||||||
|
json: successEnvelope([
|
||||||
|
{
|
||||||
|
id: "browser-reference",
|
||||||
|
name: "Browser reference",
|
||||||
|
createdAt: "2026-07-26T00:00:00.000Z",
|
||||||
|
},
|
||||||
|
]),
|
||||||
|
}),
|
||||||
|
);
|
||||||
|
await page.goto(protectedRoute.path);
|
||||||
|
await expect(
|
||||||
|
page.getByRole("heading", { name: "세션이 필요합니다." }),
|
||||||
|
).toBeVisible();
|
||||||
|
|
||||||
|
await page.getByRole("button", { name: "로그인 시작" }).click();
|
||||||
|
|
||||||
|
await expect(
|
||||||
|
page.getByRole("heading", { name: protectedRoute.title }),
|
||||||
|
).toBeVisible();
|
||||||
|
await expect(page.getByText("인증됨")).toBeVisible();
|
||||||
|
});
|
||||||
@@ -0,0 +1 @@
|
|||||||
|
export const client_secret = "fixture-only-secret-value";
|
||||||
@@ -0,0 +1,9 @@
|
|||||||
|
{
|
||||||
|
"schemaVersion": 1,
|
||||||
|
"trackedRoots": [
|
||||||
|
"tests/fixtures/security/secret-detection/forbidden"
|
||||||
|
],
|
||||||
|
"generatedRoots": [],
|
||||||
|
"excludedPaths": [],
|
||||||
|
"allowlist": []
|
||||||
|
}
|
||||||
@@ -0,0 +1,3 @@
|
|||||||
|
{
|
||||||
|
"client_secret": "synthetic-forbidden-secret"
|
||||||
|
}
|
||||||
@@ -0,0 +1 @@
|
|||||||
|
globalThis.password = "synthetic-built-secret";
|
||||||
@@ -0,0 +1 @@
|
|||||||
|
export const leaked = "AKIAABCDEFGHIJKLMNOP";
|
||||||
@@ -0,0 +1,89 @@
|
|||||||
|
import { describe, expect, it } from "vitest";
|
||||||
|
|
||||||
|
import {
|
||||||
|
diffDependencyInventories,
|
||||||
|
isValidSha512Integrity,
|
||||||
|
parsePnpmLockfilePackages,
|
||||||
|
supplyChainDigest,
|
||||||
|
validateDependencyReview,
|
||||||
|
validateLicensePolicy,
|
||||||
|
} from "../../scripts/lib/supply-chain.mjs";
|
||||||
|
|
||||||
|
const integrity = `sha512-${Buffer.alloc(64, 7).toString("base64")}`;
|
||||||
|
const dependency = {
|
||||||
|
name: "fixture",
|
||||||
|
version: "1.0.0",
|
||||||
|
direct: true,
|
||||||
|
scope: "production",
|
||||||
|
optional: false,
|
||||||
|
license: "MIT",
|
||||||
|
integrity,
|
||||||
|
dependencies: [],
|
||||||
|
};
|
||||||
|
|
||||||
|
describe("supply-chain policy", () => {
|
||||||
|
it("parses every top-level lockfile package and validates SRI", () => {
|
||||||
|
const parsed = parsePnpmLockfilePackages(`
|
||||||
|
packages:
|
||||||
|
|
||||||
|
'@scope/one@1.0.0':
|
||||||
|
resolution: {integrity: ${integrity}}
|
||||||
|
|
||||||
|
two@2.0.0:
|
||||||
|
resolution: {integrity: ${integrity}}
|
||||||
|
|
||||||
|
snapshots:
|
||||||
|
`);
|
||||||
|
expect(parsed).toEqual([
|
||||||
|
{ name: "@scope/one", version: "1.0.0", integrity },
|
||||||
|
{ name: "two", version: "2.0.0", integrity },
|
||||||
|
]);
|
||||||
|
expect(parsed.every((entry) => isValidSha512Integrity(entry.integrity))).toBe(
|
||||||
|
true,
|
||||||
|
);
|
||||||
|
});
|
||||||
|
|
||||||
|
it("keeps inventory digests stable when dependency ordering changes", () => {
|
||||||
|
const other = { ...dependency, name: "other" };
|
||||||
|
expect(supplyChainDigest([dependency, other])).toBe(
|
||||||
|
supplyChainDigest([other, dependency]),
|
||||||
|
);
|
||||||
|
});
|
||||||
|
|
||||||
|
it("calculates actual additions and requires independent high-risk review", () => {
|
||||||
|
const before = { dependencies: [] };
|
||||||
|
const after = { dependencies: [dependency] };
|
||||||
|
const diff = diffDependencyInventories(before, after);
|
||||||
|
expect(diff.added).toEqual(["fixture@1.0.0"]);
|
||||||
|
expect(
|
||||||
|
validateDependencyReview(diff, after, {
|
||||||
|
changes: [
|
||||||
|
{
|
||||||
|
changeId: "add:fixture@1.0.0",
|
||||||
|
owner: "one",
|
||||||
|
reviewer: "one",
|
||||||
|
reason: "fixture",
|
||||||
|
rollback: "remove",
|
||||||
|
},
|
||||||
|
],
|
||||||
|
}).passed,
|
||||||
|
).toBe(false);
|
||||||
|
});
|
||||||
|
|
||||||
|
it("allows explicit policy licenses and rejects denied licenses", () => {
|
||||||
|
expect(
|
||||||
|
validateLicensePolicy(
|
||||||
|
{ dependencies: [dependency] },
|
||||||
|
{ allowedLicenses: ["MIT"], deniedLicensePatterns: ["AGPL"] },
|
||||||
|
).passed,
|
||||||
|
).toBe(true);
|
||||||
|
expect(
|
||||||
|
validateLicensePolicy(
|
||||||
|
{
|
||||||
|
dependencies: [{ ...dependency, license: "AGPL-3.0" }],
|
||||||
|
},
|
||||||
|
{ allowedLicenses: ["MIT"], deniedLicensePatterns: ["AGPL"] },
|
||||||
|
).passed,
|
||||||
|
).toBe(false);
|
||||||
|
});
|
||||||
|
});
|
||||||
Reference in New Issue
Block a user