122 lines
3.3 KiB
TypeScript
122 lines
3.3 KiB
TypeScript
import { spawnSync } from "node:child_process";
|
|
import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
|
|
import path from "node:path";
|
|
|
|
type Document = Record<string, unknown>;
|
|
|
|
function isRecord(value: unknown): value is Document {
|
|
return Boolean(value) && typeof value === "object" && !Array.isArray(value);
|
|
}
|
|
|
|
async function readDocument(file: string): Promise<Document> {
|
|
const parsed: unknown = JSON.parse(await readFile(file, "utf8"));
|
|
if (!isRecord(parsed)) throw new Error(`${file} must be a JSON object`);
|
|
return parsed;
|
|
}
|
|
|
|
const fixtureDirectory = path.resolve(".tmp/supply-chain-provider-fixture");
|
|
await rm(fixtureDirectory, { recursive: true, force: true });
|
|
await mkdir(fixtureDirectory, { recursive: true });
|
|
const inventory = await readDocument(
|
|
"artifacts/release/dependency-inventory.json",
|
|
);
|
|
const verification = await readDocument(
|
|
"artifacts/security/supply-chain-verification.json",
|
|
);
|
|
const vulnerabilityPath = path.join(
|
|
fixtureDirectory,
|
|
"vulnerability-report.json",
|
|
);
|
|
const attestationPath = path.join(fixtureDirectory, "attestation.json");
|
|
await writeFile(
|
|
vulnerabilityPath,
|
|
`${JSON.stringify(
|
|
{
|
|
schemaVersion: 1,
|
|
provider: "fixture-scanner",
|
|
scannedLockfileSha256: inventory.lockfileSha256,
|
|
generatedAt: "2026-07-26T00:00:00.000Z",
|
|
findings: [],
|
|
},
|
|
null,
|
|
2,
|
|
)}\n`,
|
|
);
|
|
await writeFile(
|
|
attestationPath,
|
|
`${JSON.stringify(
|
|
{
|
|
schemaVersion: 1,
|
|
provider: "fixture-attestor",
|
|
signer: "fixture-workload-identity",
|
|
subject: {
|
|
name: "dist",
|
|
digest: { sha256: verification.distSha256 },
|
|
},
|
|
},
|
|
null,
|
|
2,
|
|
)}\n`,
|
|
);
|
|
const providerRun = spawnSync(
|
|
"node",
|
|
["scripts/generate-supply-chain.ts"],
|
|
{
|
|
env: {
|
|
...process.env,
|
|
VULNERABILITY_REPORT_PATH: vulnerabilityPath,
|
|
PROVENANCE_ATTESTATION_PATH: attestationPath,
|
|
},
|
|
encoding: "utf8",
|
|
},
|
|
);
|
|
let promotionStatus = "MISSING";
|
|
if (providerRun.status === 0) {
|
|
const providerVerification = await readDocument(
|
|
"artifacts/security/supply-chain-verification.json",
|
|
);
|
|
promotionStatus =
|
|
typeof providerVerification.promotionStatus === "string"
|
|
? providerVerification.promotionStatus
|
|
: "MISSING";
|
|
}
|
|
const restore = spawnSync(
|
|
"node",
|
|
["scripts/generate-supply-chain.ts"],
|
|
{ encoding: "utf8" },
|
|
);
|
|
await rm(fixtureDirectory, { recursive: true, force: true });
|
|
const passed =
|
|
providerRun.status === 0 &&
|
|
promotionStatus === "PASS" &&
|
|
restore.status === 0;
|
|
await writeFile(
|
|
"artifacts/security/supply-chain-provider-fixtures.json",
|
|
`${JSON.stringify(
|
|
{
|
|
schemaVersion: 1,
|
|
providerAccepted: providerRun.status === 0,
|
|
promotionStatus,
|
|
unverifiedDefaultRestored: restore.status === 0,
|
|
status: passed ? "PASS" : "FAIL",
|
|
},
|
|
null,
|
|
2,
|
|
)}\n`,
|
|
);
|
|
if (!passed) {
|
|
const detail =
|
|
providerRun.stderr ||
|
|
restore.stderr ||
|
|
providerRun.stdout ||
|
|
restore.stdout ||
|
|
`providerStatus=${String(providerRun.status)}, promotionStatus=${promotionStatus}, restoreStatus=${String(restore.status)}`;
|
|
process.stderr.write(
|
|
`Supply-chain provider fixture failed: ${detail}\n`,
|
|
);
|
|
process.exit(1);
|
|
}
|
|
process.stdout.write(
|
|
"Supply-chain provider fixture: verified PASS and unconfigured default restored\n",
|
|
);
|