106 lines
2.6 KiB
JavaScript
106 lines
2.6 KiB
JavaScript
import { spawnSync } from "node:child_process";
|
|
import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
|
|
import path from "node:path";
|
|
|
|
const fixtureDirectory = path.resolve(".tmp/supply-chain-provider-fixture");
|
|
await rm(fixtureDirectory, { recursive: true, force: true });
|
|
await mkdir(fixtureDirectory, { recursive: true });
|
|
const inventory = JSON.parse(
|
|
await readFile("artifacts/release/dependency-inventory.json", "utf8"),
|
|
);
|
|
const verification = JSON.parse(
|
|
await readFile(
|
|
"artifacts/security/supply-chain-verification.json",
|
|
"utf8",
|
|
),
|
|
);
|
|
const vulnerabilityPath = path.join(
|
|
fixtureDirectory,
|
|
"vulnerability-report.json",
|
|
);
|
|
const attestationPath = path.join(fixtureDirectory, "attestation.json");
|
|
await writeFile(
|
|
vulnerabilityPath,
|
|
`${JSON.stringify(
|
|
{
|
|
schemaVersion: 1,
|
|
provider: "fixture-scanner",
|
|
scannedLockfileSha256: inventory.lockfileSha256,
|
|
generatedAt: "2026-07-26T00:00:00.000Z",
|
|
findings: [],
|
|
},
|
|
null,
|
|
2,
|
|
)}\n`,
|
|
);
|
|
await writeFile(
|
|
attestationPath,
|
|
`${JSON.stringify(
|
|
{
|
|
schemaVersion: 1,
|
|
provider: "fixture-attestor",
|
|
signer: "fixture-workload-identity",
|
|
subject: {
|
|
name: "dist",
|
|
digest: { sha256: verification.distSha256 },
|
|
},
|
|
},
|
|
null,
|
|
2,
|
|
)}\n`,
|
|
);
|
|
const providerRun = spawnSync(
|
|
"node",
|
|
["scripts/generate-supply-chain.mjs"],
|
|
{
|
|
env: {
|
|
...process.env,
|
|
VULNERABILITY_REPORT_PATH: vulnerabilityPath,
|
|
PROVENANCE_ATTESTATION_PATH: attestationPath,
|
|
},
|
|
encoding: "utf8",
|
|
},
|
|
);
|
|
let promotionStatus = "MISSING";
|
|
if (providerRun.status === 0) {
|
|
promotionStatus = JSON.parse(
|
|
await readFile(
|
|
"artifacts/security/supply-chain-verification.json",
|
|
"utf8",
|
|
),
|
|
).promotionStatus;
|
|
}
|
|
const restore = spawnSync(
|
|
"node",
|
|
["scripts/generate-supply-chain.mjs"],
|
|
{ encoding: "utf8" },
|
|
);
|
|
await rm(fixtureDirectory, { recursive: true, force: true });
|
|
const passed =
|
|
providerRun.status === 0 &&
|
|
promotionStatus === "PASS" &&
|
|
restore.status === 0;
|
|
await writeFile(
|
|
"artifacts/security/supply-chain-provider-fixtures.json",
|
|
`${JSON.stringify(
|
|
{
|
|
schemaVersion: 1,
|
|
providerAccepted: providerRun.status === 0,
|
|
promotionStatus,
|
|
unverifiedDefaultRestored: restore.status === 0,
|
|
status: passed ? "PASS" : "FAIL",
|
|
},
|
|
null,
|
|
2,
|
|
)}\n`,
|
|
);
|
|
if (!passed) {
|
|
process.stderr.write(
|
|
`Supply-chain provider fixture failed: ${providerRun.stderr || restore.stderr}\n`,
|
|
);
|
|
process.exit(1);
|
|
}
|
|
process.stdout.write(
|
|
"Supply-chain provider fixture: verified PASS and unconfigured default restored\n",
|
|
);
|