chore: initialize from frontend template 4dc033c

2026-08-13 18:23:26 +09:00
commit 40107eec84
897 changed files with 234824 additions and 0 deletions
@@ -0,0 +1,42 @@
+import { createPublicKey } from "node:crypto";
+import path from "node:path";
+
+import { readBoundedRegularFile } from "./ci-artifact-validator.ts";
+import {
+  providerPublicKeyFingerprint,
+  type ProviderTrust,
+} from "./provider-evidence.ts";
+
+export async function readProviderTrust(
+  configuredRoot: string,
+  publicKeyPath: string | undefined,
+  keyId: string | undefined,
+): Promise<ProviderTrust | null> {
+  if (!publicKeyPath || !keyId?.trim()) return null;
+  try {
+    const root = path.resolve(configuredRoot);
+    const absolute = path.resolve(root, publicKeyPath);
+    const relative = path.relative(root, absolute);
+    const outside =
+      relative === ".." ||
+      relative.startsWith(`..${path.sep}`) ||
+      path.isAbsolute(relative);
+    const bytes = await readBoundedRegularFile({
+      root: outside ? path.dirname(absolute) : root,
+      relativePath: outside
+        ? path.basename(absolute)
+        : relative.replaceAll(path.sep, "/"),
+      maxBytes: 1_048_576,
+    });
+    const publicKey = createPublicKey(
+      new TextDecoder("utf-8", { fatal: true }).decode(bytes),
+    );
+    return Object.freeze({
+      keyId,
+      publicKey,
+      publicKeyFingerprint: providerPublicKeyFingerprint(publicKey),
+    });
+  } catch {
+    return null;
+  }
+}