feat: enforce live supply chain provenance gates

2026-07-10 16:47:45 +09:00
parent aa284e9bd4
commit 040af64191
8 changed files with 351 additions and 0 deletions
@@ -135,6 +135,8 @@ run "phase-sec23-registry-crypt" bash "$TESTS/phase-sec23-registry-crypt-tests.s
 # Plan-16 SEC-24/25 supply-chain (offline slice)
 run "phase-sec24-supplychain"    bash "$TESTS/phase-sec24-tests.sh"
 run "phase-sec25-attestation"    bash "$TESTS/phase-sec25-tests.sh"
+run "phase-production-handoff"   bash "$TESTS/phase-production-preflight-tests.sh"
+run "phase-release-provenance"    bash "$TESTS/phase-release-provenance-tests.sh"

 # Plan-17 loop engineering (Agentic Loop Governance) — each primitive fail-closed.
 run "phase-loop-governor"        bash "$TESTS/phase-loop-governor-tests.sh"
@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Live CI supply-chain gate. Unlike the deterministic local denylist gate, this
+# obtains current advisory data and scans the built images. Missing scanners are
+# an error in strict CI; no "scanner unavailable => green" path exists.
+#
+# Usage: live-supply-chain-scan.sh <report-dir> [image-ref ...]
+# Required tools: npm, osv-scanner, trivy (when CASAN_REQUIRE_LIVE_SCANNERS=1)
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/casan-paths.sh"
+ROOT="$CASAN_APP_ROOT"
+OUT="${1:-}"; shift || true
+[[ -n "$OUT" ]] || { echo "LIVE_SCAN_USAGE report-dir [image-ref ...]" >&2; exit 64; }
+mkdir -p "$OUT"
+
+fail() { echo "LIVE_SUPPLY_CHAIN_FAIL $*" >&2; exit 1; }
+require() { command -v "$1" >/dev/null 2>&1 || fail "tool_missing name=$1"; }
+require npm
+if [[ "${CASAN_REQUIRE_LIVE_SCANNERS:-1}" == "1" ]]; then
+  require osv-scanner
+  require trivy
+fi
+
+[[ -f "$ROOT/package-lock.json" ]] || fail "package_lock_missing"
+cd "$ROOT"
+
+# npm audit exits non-zero for findings at/above the requested level. Preserve
+# JSON evidence even on failure without converting a failed scan into success.
+set +e
+npm audit --omit=dev --audit-level=high --json > "$OUT/npm-audit.json" 2> "$OUT/npm-audit.stderr"
+audit_rc=$?
+set -e
+[[ "$audit_rc" -eq 0 ]] || fail "npm_audit_high_or_critical rc=$audit_rc report=$OUT/npm-audit.json"
+
+npm sbom --sbom-format cyclonedx --package-lock-only --omit=dev > "$OUT/npm.cyclonedx.json" \
+  || fail "npm_sbom_failed"
+python3 - "$OUT/npm.cyclonedx.json" <<'PY' || exit 1
+import json, sys
+d = json.load(open(sys.argv[1]))
+assert d.get("bomFormat") == "CycloneDX", d
+PY
+
+if command -v osv-scanner >/dev/null 2>&1; then
+  osv-scanner scan source --recursive --format json --output-file "$OUT/osv-source.json" "$ROOT" \
+    || fail "osv_source_findings_or_scan_error report=$OUT/osv-source.json"
+fi
+if command -v trivy >/dev/null 2>&1; then
+  trivy fs --scanners vuln,secret,misconfig --severity HIGH,CRITICAL --exit-code 1 --format json --output "$OUT/trivy-source.json" "$ROOT" \
+    || fail "trivy_source_findings_or_scan_error report=$OUT/trivy-source.json"
+fi
+
+for image in "$@"; do
+  safe="$(printf '%s' "$image" | tr '/:@' '___')"
+  if command -v osv-scanner >/dev/null 2>&1; then
+    osv-scanner scan image --format json --output-file "$OUT/osv-image-${safe}.json" "$image" \
+      || fail "osv_image_findings_or_scan_error image=$image"
+  fi
+  if command -v trivy >/dev/null 2>&1; then
+    trivy image --severity HIGH,CRITICAL --exit-code 1 --format json --output "$OUT/trivy-image-${safe}.json" "$image" \
+      || fail "trivy_image_findings_or_scan_error image=$image"
+  fi
+done
+
+echo "LIVE_SUPPLY_CHAIN_PASS sbom=$OUT/npm.cyclonedx.json images=$#"
@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Create/verify a signed release provenance statement. The statement binds the
+# exact commit, SBOM, test evidence and immutable image digests. The signing key
+# is injected by CI from the secret manager and never lives in the repository.
+#
+# release-provenance.sh create <statement.json> <private.pem> <sbom.json> <test-evidence> <image@sha256...>...
+# release-provenance.sh verify <statement.json> <public.pem> [expected-commit]
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/casan-paths.sh"
+ROOT="$CASAN_APP_ROOT"
+
+hash_of() { openssl dgst -sha256 "$1" | awk '{print $NF}'; }
+fail() { echo "RELEASE_PROVENANCE_FAIL $*" >&2; exit 1; }
+cmd="${1:-}"; shift || true
+
+case "$cmd" in
+  create)
+    statement="${1:-}"; key="${2:-}"; sbom="${3:-}"; evidence="${4:-}"; shift 4 || true
+    [[ -n "$statement" && -f "$key" && -s "$sbom" && -s "$evidence" && "$#" -ge 1 ]] || fail "create_usage_or_missing_input"
+    for image in "$@"; do [[ "$image" =~ @sha256:[a-f0-9]{64}$ ]] || fail "image_not_digest_pinned image=$image"; done
+    commit="$(git -C "$ROOT" rev-parse HEAD)"
+    python3 - "$statement" "$commit" "$sbom" "$evidence" "$@" <<'PY'
+import hashlib, json, sys
+out, commit, sbom, evidence, *images = sys.argv[1:]
+def sha(path):
+    h=hashlib.sha256()
+    with open(path,'rb') as f:
+        for c in iter(lambda:f.read(65536), b''): h.update(c)
+    return h.hexdigest()
+payload = {
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [{"name": image, "digest": {"sha256": image.rsplit("@sha256:",1)[1]}} for image in images],
+  "predicate": {"buildDefinition": {"resolvedDependencies": [{"uri": "git+casan", "digest": {"sha1": commit}}]},
+                "runDetails": {"builder": {"id": "casan-gitea-ci"},
+                "byproducts": [{"name": "npm.cyclonedx.json", "sha256": sha(sbom)}, {"name": "test-evidence", "sha256": sha(evidence)}]}}
+}
+with open(out, 'w', encoding='utf-8') as f: json.dump(payload, f, sort_keys=True, separators=(',', ':'))
+PY
+    openssl dgst -sha256 -sign "$key" -out "$statement.sig" "$statement" || fail "sign_failed"
+    echo "RELEASE_PROVENANCE_CREATED statement=$statement commit=$commit images=$# sbom_sha256=$(hash_of "$sbom")"
+    ;;
+  verify)
+    statement="${1:-}"; key="${2:-}"; expected="${3:-$(git -C "$ROOT" rev-parse HEAD)}"
+    [[ -s "$statement" && -s "$statement.sig" && -f "$key" ]] || fail "verify_missing_statement_signature_or_key"
+    openssl dgst -sha256 -verify "$key" -signature "$statement.sig" "$statement" >/dev/null || fail "signature_invalid"
+    python3 - "$statement" "$expected" <<'PY' || exit 1
+import json, re, sys
+d=json.load(open(sys.argv[1])); expected=sys.argv[2]
+assert d.get('_type') == 'https://in-toto.io/Statement/v1'
+assert d.get('predicateType') == 'https://slsa.dev/provenance/v1'
+deps=d.get('predicate',{}).get('buildDefinition',{}).get('resolvedDependencies',[])
+assert deps and deps[0].get('digest',{}).get('sha1') == expected
+subjects=d.get('subject',[]); assert subjects
+for s in subjects:
+    digest=s.get('digest',{}).get('sha256','')
+    assert re.fullmatch(r'[a-f0-9]{64}', digest), digest
+PY
+    echo "RELEASE_PROVENANCE_VERIFIED statement=$statement commit=$expected"
+    ;;
+  *) fail "usage create|verify" ;;
+esac
@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Verify every commit in a release range has a cryptographically good Git
+# signature. This is deliberately strict for release/main enforcement: unsigned
+# or merely unknown signatures cannot become production provenance.
+# Usage: verify-signed-commits.sh [range]  (default: HEAD)
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/casan-paths.sh"
+ROOT="$CASAN_APP_ROOT"; RANGE="${1:-HEAD}"
+commits=()
+while IFS= read -r commit; do [[ -n "$commit" ]] && commits+=("$commit"); done < <(git -C "$ROOT" rev-list --reverse "$RANGE")
+[[ "${#commits[@]}" -gt 0 ]] || { echo "SIGNED_COMMITS_FAIL empty_range=$RANGE" >&2; exit 1; }
+for commit in "${commits[@]}"; do
+  status="$(git -C "$ROOT" log -1 --format='%G?' "$commit")"
+  [[ "$status" == G ]] || { echo "SIGNED_COMMITS_FAIL commit=$commit signature_status=$status" >&2; exit 1; }
+done
+echo "SIGNED_COMMITS_VERIFIED range=$RANGE count=${#commits[@]}"