fix: close release provenance and privacy gaps

containers/privacy-worker-a/worker.mjs

@@ -1,33 +1,45 @@
 import { createHash } from "node:crypto";
 import { readFile, writeFile } from "node:fs/promises";
+import { pathToFileURL } from "node:url";
 
-const request = JSON.parse(await readFile("/input/request.json", "utf8"));
-if (
-  request.schema !== "portfolio-privacy-worker-request/v1" ||
-  request.workerId !== "worker-a" ||
-  !/^[a-f0-9]{64}$/u.test(request.inputDigest)
-)
-  throw new Error("Invalid worker request.");
-const bytes = await readFile("/input/object");
-const actual = createHash("sha256").update(bytes).digest("hex");
-if (actual !== request.inputDigest) throw new Error("Input digest mismatch.");
-const normalizedMembers = [`bytes:${actual}`];
-const normalizedOutputDigest = createHash("sha256")
-  .update(Buffer.from(JSON.stringify(normalizedMembers)))
-  .digest("hex");
-const output = {
-  schema: "portfolio-privacy-worker-report/v1",
-  workerId: "worker-a",
-  imageDigest: request.imageDigest,
-  toolchain: "bytes-js/v1",
-  inputDigest: actual,
-  checkId: request.checkId,
-  normalizedOutputDigest,
-  normalizedMembers,
-  verdict: "pass",
-  findingsDigest: "0".repeat(64),
-};
-await writeFile("/output/report.json", JSON.stringify(output), {
-  flag: "wx",
-  mode: 0o400,
-});
+export function inspectObject(request, bytes) {
+  if (
+    request?.schema !== "portfolio-privacy-worker-request/v1" ||
+    request.workerId !== "worker-a" ||
+    !/^[a-f0-9]{64}$/u.test(request.inputDigest) ||
+    !/^[a-f0-9]{64}$/u.test(request.imageDigest) ||
+    !/^[A-Za-z0-9][A-Za-z0-9._/-]{0,127}$/u.test(request.checkId)
+  )
+    throw new Error("Invalid worker request.");
+  const actual = createHash("sha256").update(bytes).digest("hex");
+  if (actual !== request.inputDigest) throw new Error("Input digest mismatch.");
+  const normalizedMembers = [`unsupported:${actual}`];
+  return {
+    schema: "portfolio-privacy-worker-report/v1",
+    workerId: "worker-a",
+    imageDigest: request.imageDigest,
+    toolchain: "scanner-unavailable-js/v1",
+    inputDigest: actual,
+    checkId: request.checkId,
+    normalizedOutputDigest: createHash("sha256")
+      .update(Buffer.from(JSON.stringify(normalizedMembers)))
+      .digest("hex"),
+    normalizedMembers,
+    verdict: "unsupported",
+    findingsDigest: createHash("sha256")
+      .update("scanner-unavailable")
+      .digest("hex"),
+  };
+}
+
+async function main() {
+  const request = JSON.parse(await readFile("/input/request.json", "utf8"));
+  const output = inspectObject(request, await readFile("/input/object"));
+  await writeFile("/output/report.json", JSON.stringify(output), {
+    flag: "wx",
+    mode: 0o400,
+  });
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
+  await main();