xeno/Portfolio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: require signed execution security evidence

Browse Source
This commit is contained in:
LucaP
2026-09-02 11:12:28 +03:00
parent 259f52a02b
commit 7da2b72933
5 changed files with 180 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

96
tests/deployment/headers.spec.ts
View File

@@ -1,9 +1,11 @@
import { createHash } from 'node:crypto';
import { createHash, generateKeyPairSync, sign } from 'node:crypto';
import { mkdtemp, mkdir, writeFile } from 'node:fs/promises';
import { tmpdir } from 'node:os';
import { join } from 'node:path';
import { describe, expect, it } from 'vitest';
import { canonicalValueBytes } from '../../src/security/canonical-digest.ts';
// @ts-expect-error The production release checker is an executable ESM module.
import { verifySupplyChainEvidence } from '../../scripts/supply-chain-check.mjs';
@@ -21,12 +23,56 @@ async function evidenceFixture(overrides: Record<string, unknown> = {}) {
} });
await writeFile(join(root, 'package.json'), packageJson);
await writeFile(join(root, 'package-lock.json'), packageLock);
const signingKeys = generateKeyPairSync('ed25519');
const trustPolicyPath = join(root, 'execution-trust.json');
await writeFile(trustPolicyPath, JSON.stringify({
schema: 'portfolio-execution-evidence-trust/v1',
keyId: 'supply-chain-test-key',
issuerEpoch: 1,
scope: 'portfolio-execution-security-evidence/v1',
publicKeyPem: signingKeys.publicKey.export({ type: 'spki', format: 'pem' }),
revoked: false,
expectedImageRoles: ['coordinator', 'matcher', 'worker-a', 'worker-b'],
}));
const executionPayload = overrides.executionPayload ?? {
schema: 'portfolio-execution-security-evidence/v1',
keyId: 'supply-chain-test-key',
issuerEpoch: 1,
scope: 'portfolio-execution-security-evidence/v1',
generatedAt: '2026-09-02T00:00:00Z',
expiresAt: '2026-09-03T00:00:00Z',
images: ['coordinator', 'matcher', 'worker-a', 'worker-b'].map((role, index) => ({
role,
image: `registry.invalid/portfolio-${role}@sha256:${String(index + 1).repeat(64)}`,
provenanceVerified: true,
critical: 0,
high: 0,
})),
nativeTools: [{ name: 'nginx', version: '1.29.1', sha256: 'a'.repeat(64), signatureVerified: true, critical: 0, high: 0 }],
repository: {
commitSha: 'b'.repeat(40),
secretScanPassed: true,
historyScanPassed: true,
ciActionsPinned: true,
distributionNoticesComplete: true,
},
};
const executionEnvelope = overrides.executionEnvelope ?? {
schema: 'portfolio-execution-security-evidence-envelope/v1',
payload: executionPayload,
signature: {
algorithm: 'Ed25519',
encoding: 'base64url-nopad',
value: sign(null, canonicalValueBytes(executionPayload), signingKeys.privateKey).toString('base64url'),
},
};
const reports = {
'npm-audit-production.json': JSON.stringify(overrides.productionAudit ?? { auditReportVersion: 2, vulnerabilities: {}, metadata: { vulnerabilities: { info: 0, low: 0, moderate: 0, high: 0, critical: 0, total: 0 } } }),
'npm-audit-development.json': JSON.stringify(overrides.developmentAudit ?? { auditReportVersion: 2, vulnerabilities: {}, metadata: { vulnerabilities: { info: 0, low: 0, moderate: 0, high: 0, critical: 0, total: 0 } } }),
'licenses.json': JSON.stringify(overrides.licenses ?? { 'portfolio@1.0.0': { licenses: 'ISC' } }),
'sbom.cdx.json': JSON.stringify(overrides.sbom ?? { bomFormat: 'CycloneDX', specVersion: '1.6', version: 1, metadata: { component: { type: 'application', name: 'portfolio', version: '1.0.0' } }, components: [] }),
'medium-triage.json': JSON.stringify(overrides.triage ?? { schema: 'portfolio-medium-vulnerability-triage/v1', findings: [] }),
'execution-security.json': JSON.stringify(executionEnvelope),
};
for (const [name, contents] of Object.entries(reports)) await writeFile(join(evidence, name), contents);
const manifest = {
@@ -37,40 +83,72 @@ async function evidenceFixture(overrides: Record<string, unknown> = {}) {
toolVersions: { npm: '11.0.0', cyclonedxNpm: '6.0.1', licenseChecker: '4.4.2' },
};
await writeFile(join(evidence, 'evidence-manifest.json'), JSON.stringify(manifest));
return { root, evidence };
return { root, evidence, trustPolicyPath };
}
const verifyFixture = (fixture: Awaited<ReturnType<typeof evidenceFixture>>, extra: Record<string, unknown> = {}) =>
verifySupplyChainEvidence({
projectRoot: fixture.root,
evidenceDir: fixture.evidence,
toolTrustPolicyPath: fixture.trustPolicyPath,
requireTrackedTriage: false,
...extra,
});
describe('supply-chain evidence', () => {
it('accepts a digest-bound clean audit, allowlisted licenses, and CycloneDX SBOM', async () => {
const fixture = await evidenceFixture();
await expect(verifySupplyChainEvidence({ projectRoot: fixture.root, evidenceDir: fixture.evidence, requireTrackedTriage: false })).resolves.toMatchObject({
critical: 0, high: 0, medium: 0, componentCount: 0,
await expect(verifyFixture(fixture, { now: '2026-09-02T12:00:00Z' })).resolves.toMatchObject({
critical: 0, high: 0, medium: 0, componentCount: 0, executionImages: 4,
});
});
it('fails closed on altered evidence, Critical/High findings, or forbidden licenses', async () => {
const fixture = await evidenceFixture();
await writeFile(join(fixture.evidence, 'licenses.json'), JSON.stringify({ 'portfolio@1.0.0': { licenses: 'AGPL-3.0' } }));
await expect(verifySupplyChainEvidence({ projectRoot: fixture.root, evidenceDir: fixture.evidence, requireTrackedTriage: false })).rejects.toThrow(/digest/u);
await expect(verifyFixture(fixture)).rejects.toThrow(/digest/u);
const high = await evidenceFixture({
productionAudit: { auditReportVersion: 2, vulnerabilities: { unsafe: { name: 'unsafe', severity: 'high', via: [], effects: [], range: '*', nodes: [] } }, metadata: { vulnerabilities: { info: 0, low: 0, moderate: 0, high: 1, critical: 0, total: 1 } } },
});
await expect(verifySupplyChainEvidence({ projectRoot: high.root, evidenceDir: high.evidence, requireTrackedTriage: false })).rejects.toThrow(/High|high/u);
await expect(verifyFixture(high)).rejects.toThrow(/High|high/u);
const license = await evidenceFixture({ licenses: { 'portfolio@1.0.0': { licenses: 'AGPL-3.0-only' } } });
await expect(verifySupplyChainEvidence({ projectRoot: license.root, evidenceDir: license.evidence, requireTrackedTriage: false })).rejects.toThrow(/license/u);
await expect(verifyFixture(license)).rejects.toThrow(/license/u);
});
it('requires an exact, current triage record for every Medium finding', async () => {
const audit = { auditReportVersion: 2, vulnerabilities: { packageA: { name: 'packageA', severity: 'moderate', via: [], effects: [], range: '<2', nodes: ['node_modules/packageA'] } }, metadata: { vulnerabilities: { info: 0, low: 0, moderate: 1, high: 0, critical: 0, total: 1 } } };
const missing = await evidenceFixture({ developmentAudit: audit });
await expect(verifySupplyChainEvidence({ projectRoot: missing.root, evidenceDir: missing.evidence, requireTrackedTriage: false })).rejects.toThrow(/triage/u);
await expect(verifyFixture(missing)).rejects.toThrow(/triage/u);
const accepted = await evidenceFixture({
developmentAudit: audit,
triage: { schema: 'portfolio-medium-vulnerability-triage/v1', findings: [{ scope: 'development', package: 'packageA', severity: 'moderate', range: '<2', disposition: 'accepted', rationale: 'Build-only tool; no deployed runtime exposure.', owner: 'Luca Pîslaru', reviewBy: '2027-01-01' }] },
});
await expect(verifySupplyChainEvidence({ projectRoot: accepted.root, evidenceDir: accepted.evidence, requireTrackedTriage: false, today: '2026-09-02' })).resolves.toMatchObject({ medium: 1 });
await expect(verifyFixture(accepted, { today: '2026-09-02' })).resolves.toMatchObject({ medium: 1 });
});
it('fails closed on unsigned tooling, vulnerable images, or incomplete repository security evidence', async () => {
const unsigned = await evidenceFixture({ executionEnvelope: { schema: 'portfolio-execution-security-evidence-envelope/v1', payload: {}, signature: { algorithm: 'Ed25519', encoding: 'base64url-nopad', value: '' } } });
await expect(verifyFixture(unsigned)).rejects.toThrow(/execution|signature|payload/u);
const vulnerable = await evidenceFixture({ executionPayload: {
schema: 'portfolio-execution-security-evidence/v1', keyId: 'supply-chain-test-key', issuerEpoch: 1,
scope: 'portfolio-execution-security-evidence/v1', generatedAt: '2026-09-02T00:00:00Z', expiresAt: '2026-09-03T00:00:00Z',
images: ['coordinator', 'matcher', 'worker-a', 'worker-b'].map((role, index) => ({ role, image: `registry.invalid/${role}@sha256:${String(index + 1).repeat(64)}`, provenanceVerified: true, critical: 0, high: role === 'worker-a' ? 1 : 0 })),
nativeTools: [{ name: 'nginx', version: '1.29.1', sha256: 'a'.repeat(64), signatureVerified: true, critical: 0, high: 0 }],
repository: { commitSha: 'b'.repeat(40), secretScanPassed: true, historyScanPassed: true, ciActionsPinned: true, distributionNoticesComplete: true },
} });
await expect(verifyFixture(vulnerable)).rejects.toThrow(/Critical|High|vulnerab/u);
const unscanned = await evidenceFixture({ executionPayload: {
schema: 'portfolio-execution-security-evidence/v1', keyId: 'supply-chain-test-key', issuerEpoch: 1,
scope: 'portfolio-execution-security-evidence/v1', generatedAt: '2026-09-02T00:00:00Z', expiresAt: '2026-09-03T00:00:00Z',
images: ['coordinator', 'matcher', 'worker-a', 'worker-b'].map((role, index) => ({ role, image: `registry.invalid/${role}@sha256:${String(index + 1).repeat(64)}`, provenanceVerified: true, critical: 0, high: 0 })),
nativeTools: [{ name: 'nginx', version: '1.29.1', sha256: 'a'.repeat(64), signatureVerified: true, critical: 0, high: 0 }],
repository: { commitSha: 'b'.repeat(40), secretScanPassed: false, historyScanPassed: true, ciActionsPinned: true, distributionNoticesComplete: true },
} });
await expect(verifyFixture(unscanned)).rejects.toThrow(/repository|secret/u);
});
});