Skip to content

fix: require own download provenance #41

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
0thernet merged 1 commit into from
Sep 5, 2026
Merged

fix: require own download provenance #41

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 27 additions & 15 deletions dist/tooling/bombadil.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2230,10 +2230,17 @@ function requireNoCrossRunLiveChromeDownloadIdentity(completionRunId, completion
}
function observePendingLiveChromeDownloadCompletion(context, runId, observation) {
const pending = context.pendingCompletions.get(runId);
if (pending !== undefined && !sameLiveChromeDownloadCompletionObservation(pending, observation)) {
throw new BombadilArtifactPolicyError(`Bombadil Chrome download completion downloads/${runId} changed before provenance was proven`);
}
const previous = context.previous.get(runId);
if (previous === undefined || previous.phase !== "partial") {
throw new BombadilArtifactPolicyError(`Bombadil Chrome download completion downloads/${runId} lacks live partial provenance`);
}
if (!sameLiveChromeDownloadIdentity(previous, observation)) {
throw new BombadilArtifactPolicyError(`Bombadil Chrome download completion downloads/${runId} changed inode identity`);
}
if (pending !== undefined) {
if (!sameLiveChromeDownloadCompletionObservation(pending, observation)) {
throw new BombadilArtifactPolicyError(`Bombadil Chrome download completion downloads/${runId} changed before provenance was proven`);
}
if (pending.successfulScans === 1) {
context.nextPendingCompletions.delete(runId);
return "proven";
Expand Down Expand Up @@ -2268,10 +2275,9 @@ function requireMatchingLiveChromeDownloadIdentity(existing, completion, relativ
return;
throw new BombadilArtifactPolicyError(`Bombadil Chrome download completion ${relativePath} changed inode identity`);
}
function mayAdmitUnobservedChromeDownloadCompletion(context, runId) {
if (!context.cleanBaselineEstablished || context.previousHasPartial) {
function mayInspectUnobservedChromeDownloadCompletion(context, runId) {
if (!context.cleanBaselineEstablished)
return false;
}
context.currentUnobservedCompletions.add(runId);
return true;
}
Expand Down Expand Up @@ -2488,7 +2494,7 @@ async function scanBombadilArtifactTree(options) {
if (!Number.isSafeInteger(completionSize) || completionSize > options.policy.maxFileBytes) {
throw new BombadilArtifactPolicyError(`Bombadil artifact ${completionRelativePath} exceeds the per-file byte quota`);
}
if (previous === undefined && !mayAdmitUnobservedChromeDownloadCompletion(options.liveChromeDownloadScan, partialRunId)) {
if (previous === undefined && !mayInspectUnobservedChromeDownloadCompletion(options.liveChromeDownloadScan, partialRunId)) {
throw new BombadilArtifactPolicyError(`Bombadil Chrome download completion ${completionRelativePath} lacks live partial provenance`);
}
if (previous !== undefined && previous.phase !== "partial") {
Expand Down Expand Up @@ -2552,12 +2558,12 @@ async function scanBombadilArtifactTree(options) {
}
const completionObservation = liveChromeDownloadCompletionObservation(metadata, completionSize);
liveChromeDownloadScan.currentCompletionObservations.set(liveChromeDownloadCompletion, completionObservation);
if (previous === undefined && liveChromeDownloadScan.pendingCompletions.has(liveChromeDownloadCompletion)) {
recordLiveIdentity = observePendingLiveChromeDownloadCompletion(liveChromeDownloadScan, liveChromeDownloadCompletion, completionObservation) === "proven";
} else if (previous === undefined && !mayAdmitUnobservedChromeDownloadCompletion(liveChromeDownloadScan, liveChromeDownloadCompletion)) {
if (!liveChromeDownloadScan.cleanBaselineEstablished || !liveChromeDownloadScan.previousHasPartial) {
if (previous === undefined) {
if (!mayInspectUnobservedChromeDownloadCompletion(liveChromeDownloadScan, liveChromeDownloadCompletion)) {
throw new BombadilArtifactPolicyError(`Bombadil Chrome download completion ${relativePath} lacks live partial provenance`);
}
recordLiveIdentity = false;
} else if (previous.phase === "partial") {
recordLiveIdentity = observePendingLiveChromeDownloadCompletion(liveChromeDownloadScan, liveChromeDownloadCompletion, completionObservation) === "proven";
}
if (previous !== undefined && !sameLiveChromeDownloadIdentity(previous, liveIdentity)) {
Expand Down Expand Up @@ -2632,6 +2638,9 @@ async function scanBombadilArtifactTree(options) {
requireNoCrossRunLiveChromeDownloadIdentity(runId, observation, liveChromeDownloadScan.currentPartials);
requireNoCrossRunLiveChromeDownloadIdentity(runId, observation, liveChromeDownloadScan.currentCompletionObservations);
}
if (liveChromeDownloadScan.currentUnobservedCompletions.size > 0) {
throw new BombadilArtifactPolicyError("Bombadil Chrome download completion lacks live partial provenance");
}
for (const runId of liveChromeDownloadScan.pendingCompletions.keys()) {
if (!liveChromeDownloadScan.currentCompletionObservations.has(runId)) {
throw new BombadilArtifactPolicyError(`Bombadil Chrome download completion downloads/${runId} disappeared before provenance was proven`);
Expand Down Expand Up @@ -2708,8 +2717,7 @@ async function scanLiveBombadilArtifactTree(options) {
next,
nextPendingCompletions,
pendingCompletions,
previous,
previousHasPartial: [...previous.values()].some((identity) => identity.phase === "partial")
previous
},
policy: options.policy,
root: options.outputPath,
Expand All @@ -2728,7 +2736,7 @@ async function scanLiveBombadilArtifactTree(options) {
}
pendingCompletions = failedScanPendingCompletions;
const observedOtherUnprovenCompletion = [...currentUnobservedCompletions].some((runId) => runId !== error.completion.runId);
if (error.completion.unobserved && currentPartials.size > 0 || observedOtherUnprovenCompletion) {
if (error.completion.unobserved || observedOtherUnprovenCompletion) {
throw new BombadilArtifactPolicyError("Bombadil Chrome download completion lacks live partial provenance across the current scan");
}
for (const directory of currentDirectories)
Expand Down Expand Up @@ -2823,7 +2831,11 @@ async function scanLiveBombadilArtifactTree(options) {
successfulScans: 1
});
}
if (next.size + nextPendingCompletions.size > options.policy.maxFiles) {
const liveRunIds = new Set([
...next.keys(),
...nextPendingCompletions.keys()
]);
if (liveRunIds.size > options.policy.maxFiles) {
throw new BombadilArtifactPolicyError("Bombadil live download provenance quota was exceeded");
}
return {
Expand Down
Loading