| 1 | #!/usr/bin/env node |
| 2 | /** Local source, release, pinned-key parity and public-fixture gate. */ |
| 3 | import { dirname, resolve } from "node:path"; |
| 4 | import { fileURLToPath } from "node:url"; |
| 5 | import { validateSource, verifyEnvelope, parseTsKeys, validateTrustedKeys, readBoundedFile } from "./facts-publish.mjs"; |
| 6 | |
| 7 | const WEB_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), ".."); |
| 8 | const REPO_ROOT = resolve(WEB_ROOT, ".."); |
| 9 | export { parseTsKeys }; |
| 10 | |
| 11 | export function parseRustKeys(text) { |
| 12 | const source = text.replace(/\/\*[\s\S]*?\*\//g, "").replace(/^\s*\/\/.*$/gm, ""); |
| 13 | const tables = [...source.matchAll(/^\s*pub\s+const\s+TRUSTED_KEYS\s*:\s*&\s*\[TrustedKey\]\s*=\s*&\s*\[([\s\S]*?)\]\s*;/gm)]; |
| 14 | if (tables.length !== 1) throw new Error("cannot parse exactly one Rust TRUSTED_KEYS table"); |
| 15 | const table = tables[0]; |
| 16 | const body = table[1].replace(/^\s*\/\/.*$/gm, ""); |
| 17 | const keys = []; |
| 18 | const remainder = body.replace(/TrustedKey\s*\{\s*key_id:\s*"([^"]+)",\s*public_key:\s*\[([^\]]*)\],\s*status:\s*KeyStatus::(Active|Retired)\s*,?\s*\}/g, (_, keyId, encoded, status) => { |
| 19 | const pieces = encoded.split(",").map((piece) => piece.trim()).filter(Boolean); |
| 20 | if (pieces.length !== 32 || pieces.some((piece) => !/^(?:\d+|0x[0-9a-fA-F]+)$/.test(piece))) throw new Error("Rust public key must contain 32 literal bytes"); |
| 21 | const bytes = pieces.map(Number); |
| 22 | if (bytes.some((byte) => !Number.isInteger(byte) || byte < 0 || byte > 255)) throw new Error("Rust public key byte out of range"); |
| 23 | keys.push({ keyId, publicKey: Buffer.from(bytes).toString("base64"), status: status.toLowerCase() }); |
| 24 | return ""; |
| 25 | }); |
| 26 | if (remainder.replace(/[\s,]/g, "")) throw new Error("unparsed Rust TRUSTED_KEYS entry"); |
| 27 | return validateTrustedKeys(keys); |
| 28 | } |
| 29 | |
| 30 | function text(path) { return readBoundedFile(path).toString("utf8"); } |
| 31 | function json(path) { return JSON.parse(text(path)); } |
| 32 | |
| 33 | export function checkCloudFacts() { |
| 34 | const failures = []; |
| 35 | const source = json(resolve(REPO_ROOT, "docs/cloud-facts/stable.json")); |
| 36 | for (const error of validateSource(source)) failures.push(`stable.json: ${error}`); |
| 37 | if (source.channel !== "stable") failures.push("stable.json: channel must be stable"); |
| 38 | const latest = json(resolve(WEB_ROOT, "data/latest-published-release.json")); |
| 39 | if (source.release?.latest !== latest.version) failures.push("stable.json release.latest differs from latest-published-release.json"); |
| 40 | if (source.release?.release_url && source.release.release_url !== latest.url) failures.push("stable.json release.release_url differs from latest-published-release.json"); |
| 41 | // An explicit empty table is valid and inert; parse failures are never empty. |
| 42 | const rustKeys = parseRustKeys(text(resolve(REPO_ROOT, "crates/config/src/cloud_facts/keys.rs"))); |
| 43 | const tsKeys = parseTsKeys(text(resolve(WEB_ROOT, "lib/cloud-facts/keys.ts"))); |
| 44 | if (JSON.stringify(rustKeys) !== JSON.stringify(tsKeys)) failures.push("Rust and web pinned key tables diverge"); |
| 45 | const testOnlyPub = text(resolve(REPO_ROOT, "docs/cloud-facts/fixtures/test-only.pub")).trim(); |
| 46 | for (const name of ["envelope-stable-v7.json", "envelope-future-only-v8.json"]) { |
| 47 | const result = verifyEnvelope(json(resolve(REPO_ROOT, "docs/cloud-facts/fixtures", name)), testOnlyPub); |
| 48 | if (!result.ok) failures.push(`fixture ${name}: ${result.errors.join("; ")}`); |
| 49 | } |
| 50 | if ([...rustKeys, ...tsKeys].some((key) => key.publicKey === testOnlyPub || key.keyId === "cwf-test-only")) failures.push("TEST-ONLY keys must never be production trust anchors"); |
| 51 | return { failures, factsVersion: source.facts_version, activeKeys: tsKeys.filter((key) => key.status === "active").length }; |
| 52 | } |
| 53 | |
| 54 | if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) { |
| 55 | try { |
| 56 | const result = checkCloudFacts(); |
| 57 | if (result.failures.length) throw new Error(result.failures.join("\n - ")); |
| 58 | console.log(`check-cloud-facts: OK (facts_version=${result.factsVersion}, ${result.activeKeys} active production keys)`); |
| 59 | } catch (error) { |
| 60 | console.error(`check-cloud-facts: FAIL\n - ${error.message}`); |
| 61 | process.exitCode = 1; |
| 62 | } |
| 63 | } |
| 64 |