mirror of
https://github.com/whyour/qinglong.git
synced 2026-09-20 16:07:11 +08:00
feat(ql3): verify release catalog consumption
This commit is contained in:
whyour
@@ -0,0 +1,536 @@
|
||||
'use strict';
|
||||
|
||||
const assert = require('node:assert/strict');
|
||||
const crypto = require('node:crypto');
|
||||
const { spawnSync } = require('node:child_process');
|
||||
const fs = require('node:fs');
|
||||
const os = require('node:os');
|
||||
const path = require('node:path');
|
||||
const test = require('node:test');
|
||||
|
||||
const {
|
||||
ARTIFACT_TYPE,
|
||||
FILE_MEDIA_TYPE,
|
||||
OCI_EMPTY_CONFIG_DIGEST,
|
||||
OCI_EMPTY_CONFIG_MEDIA_TYPE,
|
||||
OCI_MANIFEST_MEDIA_TYPE,
|
||||
createCatalogPlan,
|
||||
} = require('../../scripts/ql3-release-catalog-contract.cjs');
|
||||
const {
|
||||
auditClusterImageCiWorkflow,
|
||||
} = require('../../scripts/ql3-cluster-image-release-audit.cjs');
|
||||
|
||||
const ROOT = path.resolve(__dirname, '../..');
|
||||
const SCRIPT = path.join(
|
||||
ROOT,
|
||||
'scripts/ql3-release-catalog-consumption-ceremony.cjs',
|
||||
);
|
||||
const VERSION = '3.0.0-alpha.0';
|
||||
const REVISION = 'a'.repeat(40);
|
||||
const SOURCE_REF = `refs/tags/v${VERSION}`;
|
||||
const OWNER = 'example';
|
||||
const SOURCE_REPOSITORY = `${OWNER}/qinglong`;
|
||||
const TOKEN = 'github_pat_catalog_consumption_fixture';
|
||||
|
||||
function sha256(value) {
|
||||
return `sha256:${crypto.createHash('sha256').update(value).digest('hex')}`;
|
||||
}
|
||||
|
||||
function selectedImages(scope) {
|
||||
const cluster = [
|
||||
['control', 'qinglong3-cluster-control'],
|
||||
['control-ai', 'qinglong3-cluster-control-ai'],
|
||||
['admin', 'qinglong3-cluster-admin'],
|
||||
['worker', 'qinglong3-worker'],
|
||||
];
|
||||
const local = [['local', 'qinglong3-local-application']];
|
||||
return scope === 'local'
|
||||
? local
|
||||
: scope === 'cluster'
|
||||
? cluster
|
||||
: [...cluster, ...local];
|
||||
}
|
||||
|
||||
function releaseSet(scope) {
|
||||
const selected = selectedImages(scope);
|
||||
const images = selected.map(([name, repository], index) => {
|
||||
const digest = `sha256:${(index + 1).toString(16).repeat(64)}`;
|
||||
const reference = `ghcr.io/${OWNER}/${repository}`;
|
||||
return {
|
||||
name,
|
||||
repository,
|
||||
digest,
|
||||
reference: `${reference}@${digest}`,
|
||||
versionTag: `${reference}:${VERSION}`,
|
||||
sourceTag: `${reference}:sha-${REVISION}`,
|
||||
platforms: ['linux/amd64', 'linux/arm64'],
|
||||
imageRecordDigest: `sha256:${(index + 6).toString(16).repeat(64)}`,
|
||||
};
|
||||
});
|
||||
const names = images.map((entry) => entry.name);
|
||||
const unsigned = {
|
||||
schemaVersion: 1,
|
||||
schema: 'qinglong/release-set@v1',
|
||||
release: {
|
||||
version: VERSION,
|
||||
sourceRevision: REVISION,
|
||||
sourceRef: SOURCE_REF,
|
||||
scope,
|
||||
},
|
||||
candidate: {
|
||||
schema: 'qinglong/release-candidate-contract@v1',
|
||||
contractDigest: `sha256:${'b'.repeat(64)}`,
|
||||
},
|
||||
repositoryOwner: OWNER,
|
||||
platforms: ['linux/amd64', 'linux/arm64'],
|
||||
deploymentFamilies: {
|
||||
local: {
|
||||
selected: ['local', 'all'].includes(scope),
|
||||
profiles: ['edge', 'standalone'],
|
||||
images: names.filter((name) => name === 'local'),
|
||||
},
|
||||
cluster: {
|
||||
selected: ['cluster', 'all'].includes(scope),
|
||||
profiles: ['cluster', 'worker-edge', 'worker-node'],
|
||||
images: names.filter((name) => name !== 'local'),
|
||||
},
|
||||
},
|
||||
images,
|
||||
promotion: {
|
||||
authority: 'complete_verified_release_set',
|
||||
versionTags: 'promote_after_complete_set_audit',
|
||||
sourceTags: 'promote_after_complete_set_audit',
|
||||
crossRepositoryAtomicity: false,
|
||||
recovery: 'verify_exact_digest_then_continue',
|
||||
},
|
||||
requiredVerification: {
|
||||
imageKeylessSignature: true,
|
||||
imageAttestations: [
|
||||
'github-provenance',
|
||||
'cyclonedx-sbom',
|
||||
'os-vulnerability',
|
||||
'release-candidate-contract',
|
||||
],
|
||||
releaseSetBuildProvenance: true,
|
||||
},
|
||||
};
|
||||
return { ...unsigned, releaseSetDigest: sha256(JSON.stringify(unsigned)) };
|
||||
}
|
||||
|
||||
function catalogManifest(value, scope) {
|
||||
const identity = {
|
||||
version: VERSION,
|
||||
sourceRevision: REVISION,
|
||||
sourceRef: SOURCE_REF,
|
||||
releaseScope: scope,
|
||||
repositoryOwner: OWNER,
|
||||
sourceRepository: SOURCE_REPOSITORY,
|
||||
};
|
||||
const plan = createCatalogPlan(value, identity);
|
||||
return {
|
||||
schemaVersion: 2,
|
||||
mediaType: OCI_MANIFEST_MEDIA_TYPE,
|
||||
artifactType: ARTIFACT_TYPE,
|
||||
config: {
|
||||
mediaType: OCI_EMPTY_CONFIG_MEDIA_TYPE,
|
||||
digest: OCI_EMPTY_CONFIG_DIGEST,
|
||||
size: 2,
|
||||
},
|
||||
layers: [
|
||||
{
|
||||
mediaType: FILE_MEDIA_TYPE,
|
||||
digest: plan.releaseSet.contentDigest,
|
||||
size: plan.releaseSet.bytes,
|
||||
annotations: {
|
||||
'org.opencontainers.image.title': plan.releaseSet.fileName,
|
||||
},
|
||||
},
|
||||
],
|
||||
annotations: { ...plan.catalog.annotations },
|
||||
};
|
||||
}
|
||||
|
||||
function fixture(t, options = {}) {
|
||||
const directory = fs.realpathSync(
|
||||
fs.mkdtempSync(path.join(os.tmpdir(), 'ql3-catalog-consumption-')),
|
||||
);
|
||||
fs.chmodSync(directory, 0o700);
|
||||
t.after(() => fs.rmSync(directory, { recursive: true, force: true }));
|
||||
const scope = options.scope || 'local';
|
||||
const release = releaseSet(scope);
|
||||
const releaseText = options.nonCanonicalRelease
|
||||
? `${JSON.stringify(release, null, 2)}\n`
|
||||
: `${JSON.stringify(release)}\n`;
|
||||
const manifest = catalogManifest(release, scope);
|
||||
const manifestText = JSON.stringify(manifest);
|
||||
const manifestDigest = sha256(Buffer.from(manifestText, 'utf8'));
|
||||
const changedDigest = `sha256:${'f'.repeat(64)}`;
|
||||
const capture = path.join(directory, 'calls.jsonl');
|
||||
const state = path.join(directory, 'state');
|
||||
const tokenFile = path.join(directory, 'github-token');
|
||||
const outputDirectory = path.join(directory, 'bundle');
|
||||
fs.writeFileSync(tokenFile, TOKEN, { mode: 0o600 });
|
||||
const tools = {};
|
||||
for (const name of ['regctl', 'cosign', 'gh']) {
|
||||
const tool = path.join(directory, name);
|
||||
let behavior = '';
|
||||
if (name === 'regctl') {
|
||||
behavior = `
|
||||
if (args[0] === 'image' && args[1] === 'digest') {
|
||||
const count = fs.existsSync(${JSON.stringify(
|
||||
state,
|
||||
)}) ? Number(fs.readFileSync(${JSON.stringify(state)}, 'utf8')) : 0;
|
||||
fs.writeFileSync(${JSON.stringify(state)}, String(count + 1));
|
||||
const digest = count > 0 && ${JSON.stringify(
|
||||
Boolean(options.changeDiscovery),
|
||||
)} ? ${JSON.stringify(changedDigest)} : ${JSON.stringify(manifestDigest)};
|
||||
process.stdout.write(digest + '\\n');
|
||||
if (count === 0 && ${JSON.stringify(Boolean(options.mutateCosign))}) {
|
||||
fs.appendFileSync(${JSON.stringify(path.join(directory, 'cosign'))}, '\\n');
|
||||
}
|
||||
} else if (args[0] === 'artifact' && args[1] === 'get') {
|
||||
process.stdout.write(${JSON.stringify(releaseText)});
|
||||
} else if (args[0] === 'manifest' && args[1] === 'get') {
|
||||
process.stdout.write(${JSON.stringify(
|
||||
options.manifestDrift ? `${manifestText} ` : manifestText,
|
||||
)});
|
||||
} else {
|
||||
process.exitCode = 7;
|
||||
}
|
||||
`;
|
||||
} else {
|
||||
behavior = `
|
||||
process.stdout.write(JSON.stringify({ verified: true, tool: name }) + '\\n');
|
||||
if (name === 'cosign' && ${JSON.stringify(Boolean(options.cosignFailure))}) {
|
||||
process.exitCode = 9;
|
||||
}
|
||||
`;
|
||||
}
|
||||
const source = `#!${process.execPath}
|
||||
'use strict';
|
||||
const fs = require('node:fs');
|
||||
const path = require('node:path');
|
||||
const name = path.basename(process.argv[1]);
|
||||
const args = process.argv.slice(2);
|
||||
fs.appendFileSync(${JSON.stringify(
|
||||
capture,
|
||||
)}, JSON.stringify({ name, args, tokenPresent: process.env.GH_TOKEN === ${JSON.stringify(
|
||||
TOKEN,
|
||||
)} }) + '\\n');
|
||||
${behavior}
|
||||
`;
|
||||
fs.writeFileSync(tool, source, { mode: 0o700 });
|
||||
tools[name] = tool;
|
||||
}
|
||||
return {
|
||||
capture,
|
||||
directory,
|
||||
manifestDigest,
|
||||
outputDirectory,
|
||||
release,
|
||||
scope,
|
||||
tokenFile,
|
||||
tools,
|
||||
};
|
||||
}
|
||||
|
||||
function createArguments(value) {
|
||||
return [
|
||||
'--mode=create',
|
||||
`--version=${VERSION}`,
|
||||
`--source-revision=${REVISION}`,
|
||||
`--source-ref=${SOURCE_REF}`,
|
||||
`--release-scope=${value.scope}`,
|
||||
`--repository-owner=${OWNER}`,
|
||||
`--source-repository=${SOURCE_REPOSITORY}`,
|
||||
`--regctl=${value.tools.regctl}`,
|
||||
`--cosign=${value.tools.cosign}`,
|
||||
`--gh=${value.tools.gh}`,
|
||||
`--github-token-file=${value.tokenFile}`,
|
||||
`--output-directory=${value.outputDirectory}`,
|
||||
];
|
||||
}
|
||||
|
||||
function auditArguments(value) {
|
||||
return [
|
||||
'--mode=audit',
|
||||
`--version=${VERSION}`,
|
||||
`--source-revision=${REVISION}`,
|
||||
`--source-ref=${SOURCE_REF}`,
|
||||
`--release-scope=${value.scope}`,
|
||||
`--repository-owner=${OWNER}`,
|
||||
`--source-repository=${SOURCE_REPOSITORY}`,
|
||||
`--output-directory=${value.outputDirectory}`,
|
||||
];
|
||||
}
|
||||
|
||||
function invoke(arguments_) {
|
||||
return spawnSync(process.execPath, [SCRIPT, ...arguments_], {
|
||||
cwd: ROOT,
|
||||
encoding: 'utf8',
|
||||
env: {},
|
||||
});
|
||||
}
|
||||
|
||||
function createAndAudit(value) {
|
||||
const created = invoke(createArguments(value));
|
||||
assert.equal(created.status, 0, created.stderr);
|
||||
assert.equal(created.stderr, '');
|
||||
const audited = invoke(auditArguments(value));
|
||||
assert.equal(audited.status, 0, audited.stderr);
|
||||
assert.equal(audited.stderr, '');
|
||||
return {
|
||||
created: JSON.parse(created.stdout),
|
||||
audited: JSON.parse(audited.stdout),
|
||||
};
|
||||
}
|
||||
|
||||
test('consumes one immutable catalog into an auditable no-replace bundle', (t) => {
|
||||
const value = fixture(t);
|
||||
const result = createAndAudit(value);
|
||||
assert.equal(result.created.compatible, true);
|
||||
assert.equal(result.audited.compatible, true);
|
||||
assert.equal(result.audited.releaseScope, 'local');
|
||||
assert.equal(
|
||||
result.created.immutableReference,
|
||||
`ghcr.io/${OWNER}/qinglong3-release-catalog@${value.manifestDigest}`,
|
||||
);
|
||||
|
||||
assert.equal(fs.statSync(value.outputDirectory).mode & 0o777, 0o700);
|
||||
const names = fs.readdirSync(value.outputDirectory).sort();
|
||||
assert.deepEqual(names, [
|
||||
`qinglong3-release-catalog-consumption-${VERSION}-local.json`,
|
||||
`qinglong3-release-catalog-manifest-${VERSION}-local.json`,
|
||||
`qinglong3-release-set-${VERSION}-local.json`,
|
||||
]);
|
||||
for (const name of names) {
|
||||
assert.equal(
|
||||
fs.statSync(path.join(value.outputDirectory, name)).mode & 0o777,
|
||||
0o600,
|
||||
);
|
||||
}
|
||||
const report = fs.readFileSync(
|
||||
path.join(
|
||||
value.outputDirectory,
|
||||
`qinglong3-release-catalog-consumption-${VERSION}-local.json`,
|
||||
),
|
||||
'utf8',
|
||||
);
|
||||
assert.equal(report.includes(TOKEN), false);
|
||||
const parsed = JSON.parse(report);
|
||||
assert.equal(
|
||||
parsed.schema,
|
||||
'qinglong/release-catalog-consumption-ceremony@v1',
|
||||
);
|
||||
assert.equal(parsed.verification.discoveryResolvedTwice, true);
|
||||
assert.equal(parsed.verification.catalogReceiptReconstructed, true);
|
||||
assert.equal(parsed.claims.deploymentMutation, false);
|
||||
assert.equal(
|
||||
parsed.claims.workstationFileWrites,
|
||||
'private_temporary_only_plus_final_bundle',
|
||||
);
|
||||
assert.equal(parsed.steps.length, 6);
|
||||
assert.equal(
|
||||
fs
|
||||
.readdirSync(value.directory)
|
||||
.some((name) => name.startsWith('.ql3-release-catalog-consumption-')),
|
||||
false,
|
||||
);
|
||||
|
||||
const calls = fs
|
||||
.readFileSync(value.capture, 'utf8')
|
||||
.trim()
|
||||
.split('\n')
|
||||
.map((line) => JSON.parse(line));
|
||||
assert.deepEqual(
|
||||
calls.map((entry) => entry.name),
|
||||
['regctl', 'cosign', 'gh', 'regctl', 'regctl', 'regctl'],
|
||||
);
|
||||
assert.deepEqual(
|
||||
calls.map((entry) => entry.tokenPresent),
|
||||
[false, false, true, false, false, false],
|
||||
);
|
||||
assert.deepEqual(calls[0].args, [
|
||||
'image',
|
||||
'digest',
|
||||
`ghcr.io/${OWNER}/qinglong3-release-catalog:v${VERSION}-local`,
|
||||
]);
|
||||
assert.ok(calls[1].args.includes(parsed.workflowIdentity));
|
||||
assert.ok(calls[2].args.includes('--deny-self-hosted-runners'));
|
||||
assert.deepEqual(calls[3].args.slice(0, 4), [
|
||||
'artifact',
|
||||
'get',
|
||||
'--file',
|
||||
`qinglong3-release-set-${VERSION}-local.json`,
|
||||
]);
|
||||
});
|
||||
|
||||
test('supports the complete all-scope image family without runtime coupling', (t) => {
|
||||
const value = fixture(t, { scope: 'all' });
|
||||
createAndAudit(value);
|
||||
const report = JSON.parse(
|
||||
fs.readFileSync(
|
||||
path.join(
|
||||
value.outputDirectory,
|
||||
`qinglong3-release-catalog-consumption-${VERSION}-all.json`,
|
||||
),
|
||||
'utf8',
|
||||
),
|
||||
);
|
||||
assert.deepEqual(report.releaseSet.images, [
|
||||
'control',
|
||||
'control-ai',
|
||||
'admin',
|
||||
'worker',
|
||||
'local',
|
||||
]);
|
||||
assert.equal(report.releaseSet.imageCount, 5);
|
||||
assert.equal(report.claims.deploymentMutation, false);
|
||||
});
|
||||
|
||||
test('fails before publication when discovery changes during verification', (t) => {
|
||||
const value = fixture(t, { changeDiscovery: true });
|
||||
const result = invoke(createArguments(value));
|
||||
assert.notEqual(result.status, 0);
|
||||
assert.match(result.stderr, /catalog discovery changed/);
|
||||
assert.equal(fs.existsSync(value.outputDirectory), false);
|
||||
});
|
||||
|
||||
test('rejects non-canonical release sets and mismatched raw manifests', async (t) => {
|
||||
await t.test('release set', () => {
|
||||
const value = fixture(t, { nonCanonicalRelease: true });
|
||||
const result = invoke(createArguments(value));
|
||||
assert.notEqual(result.status, 0);
|
||||
assert.match(result.stderr, /canonical JSON/);
|
||||
assert.equal(fs.existsSync(value.outputDirectory), false);
|
||||
});
|
||||
await t.test('manifest', () => {
|
||||
const value = fixture(t, { manifestDrift: true });
|
||||
const result = invoke(createArguments(value));
|
||||
assert.notEqual(result.status, 0);
|
||||
assert.match(result.stderr, /catalog manifest digest/);
|
||||
assert.equal(fs.existsSync(value.outputDirectory), false);
|
||||
});
|
||||
});
|
||||
|
||||
test('rejects external verification failure and executable mutation', async (t) => {
|
||||
await t.test('cosign failure', () => {
|
||||
const value = fixture(t, { cosignFailure: true });
|
||||
const result = invoke(createArguments(value));
|
||||
assert.notEqual(result.status, 0);
|
||||
assert.match(result.stderr, /keyless_signature/);
|
||||
assert.equal(fs.existsSync(value.outputDirectory), false);
|
||||
});
|
||||
await t.test('tool mutation', () => {
|
||||
const value = fixture(t, { mutateCosign: true });
|
||||
const result = invoke(createArguments(value));
|
||||
assert.notEqual(result.status, 0);
|
||||
assert.match(result.stderr, /executable changed/);
|
||||
assert.equal(fs.existsSync(value.outputDirectory), false);
|
||||
});
|
||||
});
|
||||
|
||||
test('offline audit detects every durable bundle drift surface', async (t) => {
|
||||
for (const [name, mutate] of [
|
||||
[
|
||||
'release set',
|
||||
(value) => {
|
||||
const file = path.join(
|
||||
value.outputDirectory,
|
||||
`qinglong3-release-set-${VERSION}-local.json`,
|
||||
);
|
||||
const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
|
||||
parsed.images[0].digest = `sha256:${'e'.repeat(64)}`;
|
||||
fs.writeFileSync(file, `${JSON.stringify(parsed)}\n`);
|
||||
},
|
||||
],
|
||||
[
|
||||
'manifest',
|
||||
(value) => {
|
||||
fs.appendFileSync(
|
||||
path.join(
|
||||
value.outputDirectory,
|
||||
`qinglong3-release-catalog-manifest-${VERSION}-local.json`,
|
||||
),
|
||||
' ',
|
||||
);
|
||||
},
|
||||
],
|
||||
[
|
||||
'report',
|
||||
(value) => {
|
||||
const file = path.join(
|
||||
value.outputDirectory,
|
||||
`qinglong3-release-catalog-consumption-${VERSION}-local.json`,
|
||||
);
|
||||
const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
|
||||
parsed.claims.deploymentMutation = true;
|
||||
fs.writeFileSync(file, `${JSON.stringify(parsed)}\n`);
|
||||
},
|
||||
],
|
||||
[
|
||||
'extra file',
|
||||
(value) => {
|
||||
fs.writeFileSync(path.join(value.outputDirectory, 'unexpected'), 'x', {
|
||||
mode: 0o600,
|
||||
});
|
||||
},
|
||||
],
|
||||
]) {
|
||||
await t.test(name, () => {
|
||||
const value = fixture(t);
|
||||
createAndAudit(value);
|
||||
mutate(value);
|
||||
const audited = invoke(auditArguments(value));
|
||||
assert.notEqual(audited.status, 0);
|
||||
});
|
||||
}
|
||||
});
|
||||
|
||||
test('rejects output reuse, public credentials, symlinks and open CLI shapes', async (t) => {
|
||||
await t.test('no replace', () => {
|
||||
const value = fixture(t);
|
||||
createAndAudit(value);
|
||||
const result = invoke(createArguments(value));
|
||||
assert.notEqual(result.status, 0);
|
||||
assert.match(result.stderr, /must not already exist/);
|
||||
});
|
||||
await t.test('public token', () => {
|
||||
const value = fixture(t);
|
||||
fs.chmodSync(value.tokenFile, 0o644);
|
||||
const result = invoke(createArguments(value));
|
||||
assert.notEqual(result.status, 0);
|
||||
assert.match(result.stderr, /owner-private/);
|
||||
});
|
||||
await t.test('symlink tool', () => {
|
||||
const value = fixture(t);
|
||||
const link = path.join(value.directory, 'linked');
|
||||
fs.symlinkSync(value.tools.regctl, link);
|
||||
const arguments_ = createArguments(value).map((argument) =>
|
||||
argument.startsWith('--regctl=') ? `--regctl=${link}` : argument,
|
||||
);
|
||||
const result = invoke(arguments_);
|
||||
assert.notEqual(result.status, 0);
|
||||
});
|
||||
await t.test('open arguments', () => {
|
||||
const value = fixture(t);
|
||||
const result = invoke([...createArguments(value), '--unknown=true']);
|
||||
assert.notEqual(result.status, 0);
|
||||
assert.match(result.stderr, /arguments are invalid/);
|
||||
});
|
||||
});
|
||||
|
||||
test('supply-chain CI cannot silently remove the consumption ceremony tests', () => {
|
||||
const source = fs.readFileSync(
|
||||
path.join(ROOT, '.github/workflows/ql3-ci.yml'),
|
||||
'utf8',
|
||||
);
|
||||
const mutated = source.replace(
|
||||
'test/back/ql3ReleaseCatalogConsumptionCeremony.test.cjs',
|
||||
'test/back/release-catalog-consumption-removed.test.cjs',
|
||||
);
|
||||
assert.throws(
|
||||
() => auditClusterImageCiWorkflow(mutated),
|
||||
/catalog consumption ceremony/,
|
||||
);
|
||||
});
|
||||
Reference in New Issue
Block a user