feat(ql3): bind private release evidence receipts

2026-09-20 16:07:11 +08:00 · 2026-08-18 01:48:27 +08:00
parent fd433c41cd
commit 3e7bfa8087
17 changed files with 1452 additions and 66 deletions
@@ -0,0 +1,75 @@
+'use strict';
+
+const crypto = require('node:crypto');
+
+const RECEIPT_SCHEMA = 'qinglong/private-release-evidence-receipt@v1';
+const FIXTURES = Object.freeze({
+  'worker-management': 'qinglong/worker-credential-management-release-gate@v1',
+  'cloudnativepg-disaster-recovery':
+    'qinglong/cloudnativepg-disaster-recovery@v1',
+});
+const STATIC_AUDITS = Object.freeze([
+  'cloudnativepg-backup',
+  'barman-cloud-supply-chain',
+  'cert-manager-selection',
+]);
+
+function sha256(value) {
+  return `sha256:${crypto.createHash('sha256').update(value).digest('hex')}`;
+}
+
+function privateReleaseEvidenceReceipt(release, evidenceKind) {
+  const staticAudits =
+    evidenceKind === 'cloudnativepg-disaster-recovery'
+      ? STATIC_AUDITS.map((name, index) => ({
+          name,
+          auditDigest: `sha256:${String(index + 7).repeat(64)}`,
+          compatible: true,
+        }))
+      : [];
+  const unsigned = {
+    schemaVersion: 1,
+    schema: RECEIPT_SCHEMA,
+    release: { ...release },
+    evidenceKind,
+    evidence: {
+      fixture: FIXTURES[evidenceKind],
+      observedAt: '2026-08-18T00:00:00.000Z',
+      validatedAt: '2026-08-18T00:05:00.000Z',
+      maximumAgeSeconds: 86_400,
+      reportDigest: `sha256:${
+        evidenceKind === 'worker-management' ? '5' : '6'
+      }`.padEnd(71, evidenceKind === 'worker-management' ? '5' : '6'),
+      sourceReportsUploaded: false,
+    },
+    staticAudits,
+    verification: {
+      sourceAwareAudit: true,
+      privateEvidenceReplayed: true,
+      publicConsumerReplay: 'not_possible_without_private_reports',
+      privateReportContentPublished: false,
+      compatible: true,
+    },
+  };
+  return Object.freeze({
+    ...unsigned,
+    receiptDigest: sha256(JSON.stringify(unsigned)),
+  });
+}
+
+function privateReleaseEvidenceReceipts(release) {
+  return release.scope === 'local'
+    ? []
+    : [
+        privateReleaseEvidenceReceipt(release, 'worker-management'),
+        privateReleaseEvidenceReceipt(
+          release,
+          'cloudnativepg-disaster-recovery',
+        ),
+      ];
+}
+
+module.exports = Object.freeze({
+  privateReleaseEvidenceReceipt,
+  privateReleaseEvidenceReceipts,
+});