275 lines
9.4 KiB
TypeScript
275 lines
9.4 KiB
TypeScript
import { spawn } from "node:child_process";
|
|
import { constants } from "node:fs";
|
|
import { access, appendFile, lstat, mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
|
|
import { tmpdir } from "node:os";
|
|
import path from "node:path";
|
|
|
|
import {
|
|
provenanceProviderAttestationSchema,
|
|
vulnerabilityProviderReportSchema,
|
|
} from "./lib/provider-evidence.ts";
|
|
import { readBoundedRegularFile } from "./lib/ci-artifact-validator.ts";
|
|
import { readProviderTrust } from "./lib/promotion-verifier.ts";
|
|
import { superviseProviderEvidence } from "./lib/provider-supervisor.ts";
|
|
import { writeValidatedJsonArtifact } from "./lib/validated-json-artifact.ts";
|
|
import {
|
|
assertSafePublishLeaf,
|
|
ensureSafePublishDirectory,
|
|
} from "./lib/ci-gate-log.ts";
|
|
|
|
const kind = process.argv[process.argv.indexOf("--kind") + 1];
|
|
if (kind !== "vulnerability" && kind !== "provenance") {
|
|
process.stderr.write("Usage: run-and-validate-provider --kind vulnerability|provenance\n");
|
|
process.exit(2);
|
|
}
|
|
const command =
|
|
kind === "vulnerability"
|
|
? process.env.VULNERABILITY_PROVIDER_COMMAND
|
|
: process.env.PROVENANCE_PROVIDER_COMMAND;
|
|
const reportPath =
|
|
kind === "vulnerability"
|
|
? process.env.VULNERABILITY_REPORT_PATH
|
|
: process.env.PROVENANCE_ATTESTATION_PATH;
|
|
const sealedPath = process.env.VALIDATED_PROVIDER_REPORT_PATH;
|
|
const archivePath = process.env.CANDIDATE_ARCHIVE_PATH;
|
|
const archiveSha256 = process.env.CANDIDATE_ARCHIVE_SHA256;
|
|
const publicKeyPath = kind === "vulnerability"
|
|
? process.env.VULNERABILITY_PUBLIC_KEY_PATH
|
|
: process.env.PROVENANCE_PUBLIC_KEY_PATH;
|
|
const keyId = kind === "vulnerability"
|
|
? process.env.VULNERABILITY_KEY_ID
|
|
: process.env.PROVENANCE_KEY_ID;
|
|
const runId = process.env.GITEA_RUN_ID ?? process.env.GITHUB_RUN_ID ?? process.env.CI_RUN_ID;
|
|
const runAttemptSource = process.env.GITEA_RUN_ATTEMPT ??
|
|
process.env.GITHUB_RUN_ATTEMPT ?? process.env.CI_RUN_ATTEMPT;
|
|
const sourceRevision = process.env.EXPECTED_SOURCE_REVISION ?? process.env.VITE_COMMIT_SHA;
|
|
if (
|
|
!command ||
|
|
!reportPath ||
|
|
!sealedPath ||
|
|
!archivePath ||
|
|
!archiveSha256 ||
|
|
!publicKeyPath ||
|
|
!keyId ||
|
|
!runId ||
|
|
!runAttemptSource ||
|
|
!sourceRevision
|
|
) {
|
|
process.stderr.write("Provider supervisor environment is incomplete\n");
|
|
process.exit(2);
|
|
}
|
|
const runAttempt = Number(runAttemptSource);
|
|
if (!Number.isInteger(runAttempt) || runAttempt < 1 || runAttempt > 1_000) {
|
|
throw new TypeError("provider supervisor run attempt is invalid");
|
|
}
|
|
|
|
const workspaceRoot = process.cwd();
|
|
const reportAbsolute = path.resolve(reportPath);
|
|
const rawDirectory = path.dirname(reportAbsolute);
|
|
const sealedAbsolute = path.resolve(sealedPath);
|
|
if (
|
|
path.basename(rawDirectory) !== "untrusted" ||
|
|
path.dirname(rawDirectory) !== path.dirname(sealedAbsolute) ||
|
|
reportAbsolute === sealedAbsolute
|
|
) {
|
|
throw new TypeError("provider raw and sealed evidence paths are not isolated");
|
|
}
|
|
await prepareMissingProviderOutput(workspaceRoot, reportAbsolute, reportPath, "raw provider report");
|
|
await prepareMissingProviderOutput(workspaceRoot, sealedAbsolute, sealedPath, "sealed provider report");
|
|
await access("/usr/bin/bwrap", constants.X_OK).catch(() => {
|
|
throw new Error("provider sandbox unavailable: /usr/bin/bwrap is required");
|
|
});
|
|
const trust = await readProviderTrust(workspaceRoot, publicKeyPath, keyId);
|
|
if (!trust) throw new TypeError("provider supervisor trust key is invalid");
|
|
const supervised = await superviseProviderEvidence({
|
|
kind,
|
|
archivePath,
|
|
expectedArchiveSha256: archiveSha256,
|
|
expectedRun: { id: runId, attempt: runAttempt, sourceRevision },
|
|
trust,
|
|
executeProvider: async ({ candidateRoot, environment }) => {
|
|
const childEnvironment = createProviderEnvironment(kind, reportPath, environment);
|
|
await runProviderInSandbox(
|
|
command,
|
|
childEnvironment,
|
|
rawDirectory,
|
|
workspaceRoot,
|
|
candidateRoot,
|
|
);
|
|
},
|
|
captureReport: () =>
|
|
readBoundedRegularFile({
|
|
root: workspaceRoot,
|
|
relativePath: path.relative(workspaceRoot, reportAbsolute).replaceAll(path.sep, "/"),
|
|
maxBytes: 8_388_608,
|
|
}),
|
|
});
|
|
await assertSafePublishLeaf(sealedAbsolute, sealedPath);
|
|
await writeValidatedJsonArtifact({
|
|
path: sealedPath,
|
|
schema:
|
|
kind === "vulnerability"
|
|
? vulnerabilityProviderReportSchema
|
|
: provenanceProviderAttestationSchema,
|
|
value: supervised.evidence,
|
|
});
|
|
if (process.env.GITHUB_OUTPUT) {
|
|
await appendFile(
|
|
process.env.GITHUB_OUTPUT,
|
|
`invocation_nonce=${supervised.invocationNonce}\n`,
|
|
"utf8",
|
|
);
|
|
}
|
|
process.stdout.write(`${kind} provider supervised validation: PASS\n`);
|
|
|
|
function createProviderEnvironment(
|
|
providerKind: "vulnerability" | "provenance",
|
|
rawReportPath: string,
|
|
bindings: Readonly<Record<string, string>>,
|
|
): NodeJS.ProcessEnv {
|
|
const environment: NodeJS.ProcessEnv = {
|
|
PATH: process.env.PATH ?? "/usr/local/bin:/usr/bin:/bin",
|
|
HOME: "/tmp/provider-home",
|
|
TMPDIR: "/tmp",
|
|
CI: "true",
|
|
GITHUB_ENV: "/tmp/github-env",
|
|
GITHUB_PATH: "/tmp/github-path",
|
|
...bindings,
|
|
...(providerKind === "vulnerability"
|
|
? { VULNERABILITY_REPORT_PATH: rawReportPath }
|
|
: { PROVENANCE_ATTESTATION_PATH: rawReportPath }),
|
|
};
|
|
for (const name of ["LANG", "LC_ALL", "HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY"] as const) {
|
|
if (process.env[name]) environment[name] = process.env[name];
|
|
}
|
|
const credentialPrefix = `${providerKind.toUpperCase()}_PROVIDER_`;
|
|
for (const [name, value] of Object.entries(process.env)) {
|
|
if (name.startsWith(credentialPrefix) && !name.endsWith("_COMMAND") && value) {
|
|
environment[name] = value;
|
|
}
|
|
}
|
|
return environment;
|
|
}
|
|
|
|
async function runProviderInSandbox(
|
|
command: string,
|
|
environment: NodeJS.ProcessEnv,
|
|
rawDirectory: string,
|
|
workspaceRoot: string,
|
|
candidateRoot: string,
|
|
): Promise<void> {
|
|
const scratch = await mkdtemp(path.join(tmpdir(), "ci-provider-sandbox-"));
|
|
try {
|
|
await mkdir(path.join(scratch, "provider-home"));
|
|
await writeFile(path.join(scratch, "node"), "", { mode: 0o500 });
|
|
const arguments_ = [
|
|
"--die-with-parent",
|
|
"--new-session",
|
|
"--as-pid-1",
|
|
"--unshare-pid",
|
|
"--unshare-ipc",
|
|
"--unshare-uts",
|
|
"--dev", "/dev",
|
|
"--proc", "/proc",
|
|
"--bind", scratch, "/tmp",
|
|
"--dir", "/etc",
|
|
];
|
|
for (const source of ["/usr", "/bin", "/lib", "/lib64"]) {
|
|
if (await exists(source)) arguments_.push("--ro-bind", source, source);
|
|
}
|
|
// setup-node commonly installs outside /usr. Expose only the exact trusted
|
|
// runtime binary, never its credential-bearing user/toolcache directory.
|
|
arguments_.push("--ro-bind", process.execPath, "/tmp/node");
|
|
for (const source of [
|
|
"/etc/ca-certificates",
|
|
"/etc/ssl",
|
|
"/etc/resolv.conf",
|
|
"/etc/hosts",
|
|
"/etc/nsswitch.conf",
|
|
"/etc/passwd",
|
|
"/etc/group",
|
|
]) {
|
|
if (await exists(source)) arguments_.push("--ro-bind", source, source);
|
|
}
|
|
for (const directory of missingDestinationAncestors(workspaceRoot)) {
|
|
arguments_.push("--dir", directory);
|
|
}
|
|
arguments_.push(
|
|
"--ro-bind", workspaceRoot, workspaceRoot,
|
|
);
|
|
if (await exists(path.join(workspaceRoot, ".git"))) {
|
|
arguments_.push("--tmpfs", path.join(workspaceRoot, ".git"));
|
|
}
|
|
arguments_.push(
|
|
"--bind", rawDirectory, rawDirectory,
|
|
"--ro-bind", candidateRoot, "/candidate",
|
|
"--chdir", workspaceRoot,
|
|
"/bin/sh", "-eu", "-c", command,
|
|
);
|
|
await new Promise<void>((resolve, reject) => {
|
|
const child = spawn("/usr/bin/bwrap", arguments_, {
|
|
env: { ...environment, PATH: `/tmp:${environment.PATH ?? ""}` },
|
|
stdio: "inherit",
|
|
});
|
|
let settled = false;
|
|
const finish = (error?: Error): void => {
|
|
if (settled) return;
|
|
settled = true;
|
|
clearTimeout(timeout);
|
|
error ? reject(error) : resolve();
|
|
};
|
|
const timeout = setTimeout(() => {
|
|
child.kill("SIGKILL");
|
|
finish(new Error("sandboxed external provider command timed out"));
|
|
}, 30 * 60 * 1_000);
|
|
child.once("error", (error) => finish(error));
|
|
child.once("close", (code, signal) => {
|
|
if (code === 0 && signal === null) finish();
|
|
else finish(new Error(`sandboxed external provider failed: exit=${code ?? "none"}, signal=${signal ?? "none"}`));
|
|
});
|
|
});
|
|
} finally {
|
|
await rm(scratch, { recursive: true, force: true });
|
|
}
|
|
}
|
|
|
|
function missingDestinationAncestors(target: string): string[] {
|
|
const ancestors: string[] = [];
|
|
let current = path.dirname(path.resolve(target));
|
|
while (current !== path.parse(current).root && !["/usr", "/bin", "/lib", "/lib64", "/tmp"].includes(current)) {
|
|
ancestors.push(current);
|
|
current = path.dirname(current);
|
|
}
|
|
return ancestors.reverse();
|
|
}
|
|
|
|
async function exists(target: string): Promise<boolean> {
|
|
try {
|
|
await lstat(target);
|
|
return true;
|
|
} catch (error) {
|
|
if (hasErrorCode(error, "ENOENT")) return false;
|
|
throw error;
|
|
}
|
|
}
|
|
|
|
async function prepareMissingProviderOutput(
|
|
root: string,
|
|
absolutePath: string,
|
|
configuredPath: string,
|
|
label: string,
|
|
): Promise<void> {
|
|
await ensureSafePublishDirectory(root, path.dirname(absolutePath));
|
|
await assertSafePublishLeaf(absolutePath, configuredPath);
|
|
try {
|
|
await lstat(absolutePath);
|
|
throw new Error(`${label} already exists: ${configuredPath}`);
|
|
} catch (error) {
|
|
if (!hasErrorCode(error, "ENOENT")) throw error;
|
|
}
|
|
}
|
|
|
|
function hasErrorCode(error: unknown, code: string): boolean {
|
|
return Boolean(error && typeof error === "object" && "code" in error && error.code === code);
|
|
}
|