scripts/asf-source-release.test.mjs

/*
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements.  See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership.  The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License.  You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on an
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 * KIND, either express or implied.  See the License for the
 * specific language governing permissions and limitations
 * under the License.
 */

import assert from 'node:assert/strict';
import { execFileSync } from 'node:child_process';
import { createHash } from 'node:crypto';
import {
  chmodSync,
  copyFileSync,
  existsSync,
  mkdtempSync,
  mkdirSync,
  readFileSync,
  rmSync,
  writeFileSync,
} from 'node:fs';
import { tmpdir } from 'node:os';
import { basename, dirname, join } from 'node:path';
import { describe, test } from 'node:test';
import {
  createSourceCandidate,
  controlledProcessEnvironment,
  parseSha512File,
  reproduceSourceCandidate,
  signSourceCandidate,
  sourceCandidateIdentity,
  validateArchiveEntries,
  validateGpgVerificationStatus,
  validatePackageVersions,
  verifySourceCandidate,
} from './asf-source-release.mjs';

describe('ASF source release identity', () => {
  test('uses the incubating source distribution name for plain versions only', () => {
    assert.deepEqual(sourceCandidateIdentity('0.1.12'), {
      archiveName: 'apache-maka-0.1.12-incubating-src.tar.gz',
      rootDirectory: 'apache-maka-0.1.12-incubating',
      version: '0.1.12',
    });
    assert.throws(() => sourceCandidateIdentity('0.1.12-incubating'), /Invalid release version/);
  });
});

describe('ASF source release verification', () => {
  test('validates checksum identity and archive boundaries', () => {
    const name = 'apache-maka-0.1.12-incubating-src.tar.gz';
    assert.equal(parseSha512File(`${'a'.repeat(128)}  ${name}\n`, name), 'a'.repeat(128));
    assert.throws(() => parseSha512File(`${'a'.repeat(128)}  another.tar.gz\n`, name), /expected/);

    const root = 'apache-maka-0.1.12-incubating';
    assert.doesNotThrow(() =>
      validateArchiveEntries(
        [
          `${root}/`,
          `${root}/DISCLAIMER-WIP`,
          `${root}/LICENSE`,
          `${root}/NOTICE`,
          `${root}/package-lock.json`,
          `${root}/package.json`,
          `${root}/src/index.ts`,
        ],
        root,
      ),
    );
    assert.throws(
      () =>
        validateArchiveEntries(
          [
            `${root}/DISCLAIMER-WIP`,
            `${root}/LICENSE`,
            `${root}/NOTICE`,
            `${root}/package-lock.json`,
            `${root}/package.json`,
            `${root}/.maka-shots/review.png`,
            `${root}/node_modules/dependency/index.js`,
          ],
          root,
        ),
      /Forbidden archive entry/,
    );
    assert.throws(
      () =>
        validateArchiveEntries(
          [
            `${root}/DISCLAIMER-WIP`,
            `${root}/LICENSE`,
            `${root}/NOTICE`,
            `${root}/package-lock.json`,
            `${root}/package.json`,
            `${root}/fixtures/evil.bin`,
            `${root}/fixtures/EVIL.BIN`,
          ],
          root,
        ),
      /Cross-platform archive entry collision/,
    );
  });

  test('requires one current valid GPG signature status', () => {
    const fingerprint = 'A'.repeat(40);
    assert.deepEqual(
      validateGpgVerificationStatus(
        `[GNUPG:] GOODSIG ABCDEF0123456789 Release Test\n[GNUPG:] VALIDSIG ${fingerprint} 2026-08-20 1787193600 0 4 0 1 10 00 ${fingerprint}\n`,
      ),
      { fingerprint, hashAlgorithm: 10 },
    );
    for (const status of ['EXPKEYSIG', 'EXPSIG', 'KEYEXPIRED', 'KEYREVOKED', 'REVKEYSIG']) {
      assert.throws(
        () =>
          validateGpgVerificationStatus(
            `[GNUPG:] ${status} ABCDEF0123456789 Release Test\n[GNUPG:] GOODSIG ABCDEF0123456789 Release Test\n[GNUPG:] VALIDSIG ${fingerprint} 2026-08-20 1787193600 0 4 0 1 10 00 ${fingerprint}\n`,
          ),
        new RegExp(status),
      );
    }
  });

  test('requires package and lockfile versions to share one identity', () => {
    const packageJson = { version: '0.1.12' };
    const packageLock = { packages: { '': { version: '0.1.12' } }, version: '0.1.12' };
    assert.doesNotThrow(() =>
      validatePackageVersions({ packageJson, packageLock, source: 'fixture', version: '0.1.12' }),
    );
    assert.throws(
      () =>
        validatePackageVersions({
          packageJson,
          packageLock: { ...packageLock, version: '9.9.9' },
          source: 'fixture',
          version: '0.1.12',
        }),
      /package-lock\.json.*9\.9\.9/,
    );
  });

  test('rejects Category X dependencies from a nested package lockfile', async () => {
    const fixture = createFixtureCandidate({
      'tools/runtime/package.json': `${JSON.stringify({ name: 'runtime', private: true, license: 'Apache-2.0' })}\n`,
      'tools/runtime/package-lock.json': `${JSON.stringify({
        lockfileVersion: 3,
        name: 'runtime',
        packages: {
          '': { name: 'runtime', license: 'Apache-2.0' },
          'node_modules/category-x-runtime': {
            version: '1.0.0',
            license: 'LGPL-3.0-or-later',
          },
        },
      })}\n`,
    });
    try {
      await assert.rejects(
        () => verifySourceCandidate({ archivePath: fixture.archivePath }),
        /Category X.*category-x-runtime.*LGPL-3\.0-or-later/,
      );
    } finally {
      fixture.cleanup();
    }
  });

  test('accepts a classified dependency from a nested package lockfile', async () => {
    const fixture = createFixtureCandidate({
      'tools/source/package.json': `${JSON.stringify({
        dependencies: { 'source-helper': '1.0.0' },
        name: 'source',
        private: true,
      })}\n`,
      'tools/source/package-lock.json': `${JSON.stringify({
        lockfileVersion: 3,
        name: 'source',
        packages: {
          '': { name: 'source', license: 'Apache-2.0' },
          'node_modules/source-helper': { version: '1.0.0', license: 'MIT' },
        },
      })}\n`,
    });
    try {
      await assert.doesNotReject(() => verifySourceCandidate({ archivePath: fixture.archivePath }));
    } finally {
      fixture.cleanup();
    }
  });

  test('rejects an unclassified dependency from a nested package lockfile', async () => {
    const fixture = createFixtureCandidate({
      'tools/unknown/package.json': `${JSON.stringify({ name: 'unknown', private: true, license: 'Apache-2.0' })}\n`,
      'tools/unknown/package-lock.json': `${JSON.stringify({
        lockfileVersion: 3,
        name: 'unknown',
        packages: {
          '': { name: 'unknown', license: 'Apache-2.0' },
          'node_modules/unknown-runtime': { version: '1.0.0' },
        },
      })}\n`,
    });
    try {
      await assert.rejects(
        () => verifySourceCandidate({ archivePath: fixture.archivePath }),
        /Cannot safely classify unknown-runtime@1\.0\.0.*tools\/unknown\/package-lock\.json/,
      );
    } finally {
      fixture.cleanup();
    }
  });

  test('accepts an unlicensed private manifest without dependencies', async () => {
    const fixture = createFixtureCandidate({
      'tools/profile/package.json': `${JSON.stringify({ name: 'profile', private: true })}\n`,
    });
    try {
      await assert.doesNotReject(() => verifySourceCandidate({ archivePath: fixture.archivePath }));
    } finally {
      fixture.cleanup();
    }
  });

  test('rejects unlicensed private manifests whose dependencies lack lock provenance', async () => {
    const dependencyDeclarations = {
      bundleDependencies: ['runtime-helper'],
      bundledDependencies: ['runtime-helper'],
      dependencies: { 'runtime-helper': '1.0.0' },
      devDependencies: { 'runtime-helper': '1.0.0' },
      optionalDependencies: { 'runtime-helper': '1.0.0' },
      peerDependencies: { 'runtime-helper': '1.0.0' },
    };
    for (const [field, declaration] of Object.entries(dependencyDeclarations)) {
      const fixture = createFixtureCandidate({
        [`tools/${field}/package.json`]: `${JSON.stringify({
          [field]: declaration,
          name: field,
          private: true,
        })}\n`,
      });
      try {
        await assert.rejects(
          () => verifySourceCandidate({ archivePath: fixture.archivePath }),
          new RegExp(
            `Cannot safely classify.*${field}.*without (?:matching )?lock provenance`,
            'u',
          ),
        );
      } finally {
        fixture.cleanup();
      }
    }
  });

  test('does not accept arbitrary notice files as dependency license authority', async () => {
    const fixture = createFixtureCandidate({
      'tools/runtime/THIRD_PARTY_NOTICES.txt':
        'Package: unknown-runtime@1.0.0\nSelected license: MIT\n',
      'tools/runtime/package-lock.json': `${JSON.stringify({
        lockfileVersion: 3,
        packages: {
          '': { name: 'runtime' },
          'node_modules/unknown-runtime': { version: '1.0.0' },
        },
      })}\n`,
      'tools/runtime/package.json': `${JSON.stringify({
        dependencies: { 'unknown-runtime': '1.0.0' },
        license: 'Apache-2.0',
        name: 'runtime',
        private: true,
      })}\n`,
    });
    try {
      await assert.rejects(
        () => verifySourceCandidate({ archivePath: fixture.archivePath }),
        /Cannot safely classify unknown-runtime@1\.0\.0/,
      );
    } finally {
      fixture.cleanup();
    }
  });

  test('uses the generated npm notice as the dependency license authority', async () => {
    const fixture = createFixtureCandidate({
      'apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt':
        'Package: source-helper@1.0.0\nSelected license: MIT\n',
      'tools/source/package-lock.json': `${JSON.stringify({
        lockfileVersion: 3,
        packages: {
          '': { name: 'source' },
          'node_modules/source-helper': { version: '1.0.0' },
        },
      })}\n`,
      'tools/source/package.json': `${JSON.stringify({
        dependencies: { 'source-helper': '1.0.0' },
        name: 'source',
        private: true,
      })}\n`,
    });
    try {
      await assert.doesNotReject(() => verifySourceCandidate({ archivePath: fixture.archivePath }));
    } finally {
      fixture.cleanup();
    }
  });

  test('does not let lock metadata override a Category X generated notice', async () => {
    const fixture = createFixtureCandidate({
      'apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt':
        'Package: disguised-runtime@1.0.0\nSelected license: GPL-3.0-only\n',
      'tools/runtime/package-lock.json': `${JSON.stringify({
        lockfileVersion: 3,
        packages: {
          '': { name: 'runtime' },
          'node_modules/disguised-runtime': { license: 'MIT', version: '1.0.0' },
        },
      })}\n`,
      'tools/runtime/package.json': `${JSON.stringify({
        dependencies: { 'disguised-runtime': '1.0.0' },
        license: 'Apache-2.0',
        name: 'runtime',
        private: true,
      })}\n`,
    });
    try {
      await assert.rejects(
        () => verifySourceCandidate({ archivePath: fixture.archivePath }),
        /Category X.*disguised-runtime.*GPL-3\.0-only/,
      );
    } finally {
      fixture.cleanup();
    }
  });

  test('rejects lock links without a candidate-owned workspace target', async () => {
    const fixture = createFixtureCandidate({
      'tools/runtime/package-lock.json': `${JSON.stringify({
        lockfileVersion: 3,
        packages: {
          '': { name: 'runtime' },
          'node_modules/evil-runtime': { link: true, resolved: '../../evil-runtime' },
        },
      })}\n`,
      'tools/runtime/package.json': `${JSON.stringify({ license: 'Apache-2.0', name: 'runtime' })}\n`,
    });
    try {
      await assert.rejects(
        () => verifySourceCandidate({ archivePath: fixture.archivePath }),
        /Cannot safely classify workspace link.*evil-runtime/,
      );
    } finally {
      fixture.cleanup();
    }
  });

  test('rejects Category X metadata on workspace package lock entries', async () => {
    const fixture = createFixtureCandidate({
      'packages/evil/package.json': `${JSON.stringify({
        license: 'Apache-2.0',
        name: 'evil',
        version: '1.0.0',
      })}\n`,
      'package-lock.json': `${JSON.stringify({
        lockfileVersion: 3,
        name: 'maka',
        packages: {
          '': { name: 'maka', version: '0.1.12' },
          'packages/evil': { license: 'GPL-3.0-only', name: 'evil', version: '1.0.0' },
        },
        version: '0.1.12',
      })}\n`,
    });
    try {
      await assert.rejects(
        () => verifySourceCandidate({ archivePath: fixture.archivePath }),
        /Category X.*packages\/evil.*GPL-3\.0-only/,
      );
    } finally {
      fixture.cleanup();
    }
  });

  test('binds licensed manifest dependencies to a package lock closure', async () => {
    const fixture = createFixtureCandidate({
      'tools/runtime/package.json': `${JSON.stringify({
        dependencies: { 'unlocked-runtime': '1.0.0' },
        license: 'Apache-2.0',
        name: 'runtime',
        private: true,
      })}\n`,
    });
    try {
      await assert.rejects(
        () => verifySourceCandidate({ archivePath: fixture.archivePath }),
        /Cannot safely classify.*tools\/runtime\/package\.json.*without (?:matching )?lock provenance/,
      );
    } finally {
      fixture.cleanup();
    }
  });

  test('rejects unsupported npm lockfile versions', async () => {
    const fixture = createFixtureCandidate({
      'tools/runtime/package-lock.json': `${JSON.stringify({
        lockfileVersion: 99,
        packages: { '': { name: 'runtime' } },
      })}\n`,
      'tools/runtime/package.json': `${JSON.stringify({ license: 'Apache-2.0', name: 'runtime' })}\n`,
    });
    try {
      await assert.rejects(
        () => verifySourceCandidate({ archivePath: fixture.archivePath }),
        /Unsupported npm lockfile version 99/,
      );
    } finally {
      fixture.cleanup();
    }
  });

  test('classifies dependencies from a nested npm shrinkwrap', async () => {
    const fixture = createFixtureCandidate({
      'tools/source/npm-shrinkwrap.json': `${JSON.stringify({
        lockfileVersion: 3,
        packages: {
          '': { name: 'source' },
          'node_modules/source-helper': { license: 'MIT', version: '1.0.0' },
        },
      })}\n`,
      'tools/source/package.json': `${JSON.stringify({
        dependencies: { 'source-helper': '1.0.0' },
        name: 'source',
        private: true,
      })}\n`,
    });
    try {
      await assert.doesNotReject(() => verifySourceCandidate({ archivePath: fixture.archivePath }));
    } finally {
      fixture.cleanup();
    }
  });

  test('rejects unsupported nested package manager lockfiles', async () => {
    for (const [name, contents] of [
      ['pnpm-lock.yaml', 'lockfileVersion: 9\n'],
      ['yarn.lock', '# yarn lockfile v1\n'],
    ]) {
      const fixture = createFixtureCandidate({ [`tools/source/${name}`]: contents });
      try {
        await assert.rejects(
          () => verifySourceCandidate({ archivePath: fixture.archivePath }),
          /Cannot safely classify unsupported package lockfile/,
        );
      } finally {
        fixture.cleanup();
      }
    }
  });

  test('rejects Category X and unknown nested package manifest licenses', async () => {
    for (const [license, expected] of [
      ['AGPL-3.0-only', /Category X/],
      ['LicenseRef-Unknown', /Cannot safely classify license/],
    ]) {
      const fixture = createFixtureCandidate({
        'tools/source/package.json': `${JSON.stringify({ license, name: 'source' })}\n`,
      });
      try {
        await assert.rejects(
          () => verifySourceCandidate({ archivePath: fixture.archivePath }),
          expected,
        );
      } finally {
        fixture.cleanup();
      }
    }
  });

  test('rejects compiled artifacts regardless of their file extension', async () => {
    const formats = new Map([
      ['ELF', Buffer.from([0x7f, 0x45, 0x4c, 0x46])],
      ['Mach-O', Buffer.from([0xfe, 0xed, 0xfa, 0xcf])],
      ['Mach-O fat little-endian', Buffer.from([0xbe, 0xba, 0xfe, 0xca])],
      ['Mach-O fat64 little-endian', Buffer.from([0xbf, 0xba, 0xfe, 0xca])],
      ['PE', Buffer.from('MZ')],
      ['WASM', Buffer.from([0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00])],
      ['ZIP/JAR', Buffer.from([0x50, 0x4b, 0x03, 0x04])],
      ['thin ar archive', Buffer.from('!<thin>\n')],
    ]);
    for (const [format, bytes] of formats) {
      const fixture = createFixtureCandidate({
        'docs/code-origin-audit.md':
          '### Source archive non-text inventory\n\n- `fixtures/runtime.dat`: a claimed fixture.\n',
        'fixtures/runtime.dat': bytes,
      });
      try {
        await assert.rejects(
          () => verifySourceCandidate({ archivePath: fixture.archivePath }),
          new RegExp(`Compiled artifact.*fixtures/runtime\\.dat.*${format.replace('/', '\\/')}`),
        );
      } finally {
        fixture.cleanup();
      }
    }
  });

  test('rejects ZIP payloads hidden behind an allowed source prefix', async () => {
    for (const bytes of [
      Buffer.concat([Buffer.from('source preface\n'), Buffer.from([0x50, 0x4b, 0x03, 0x04])]),
      Buffer.concat([
        Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]),
        Buffer.from([0x50, 0x4b, 0x03, 0x04]),
      ]),
    ]) {
      const fixture = createFixtureCandidate({
        'docs/code-origin-audit.md':
          '### Source archive non-text inventory\n\n- `fixtures/runtime.dat`: a claimed fixture.\n',
        'fixtures/runtime.dat': bytes,
      });
      try {
        await assert.rejects(
          () => verifySourceCandidate({ archivePath: fixture.archivePath }),
          /forbidden ZIP\/JAR content/,
        );
      } finally {
        fixture.cleanup();
      }
    }
  });

  test('accepts an inventoried source image', async () => {
    const fixture = createFixtureCandidate({
      'docs/code-origin-audit.md':
        '### Source archive non-text inventory\n\n- `fixtures/*.png`: test-generated source images.\n',
      'fixtures/source.png': Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]),
    });
    try {
      await assert.doesNotReject(() => verifySourceCandidate({ archivePath: fixture.archivePath }));
    } finally {
      fixture.cleanup();
    }
  });

  test('accepts an inventoried non-text source fixture', async () => {
    const fixture = createFixtureCandidate({
      'docs/code-origin-audit.md':
        '### Source archive non-text inventory\n\n- `fixtures/control.ts`: a raw control-character fixture.\n',
      'fixtures/control.ts': Buffer.from([0x63, 0x6f, 0x6e, 0x73, 0x74, 0x20, 0x78, 0x00]),
    });
    try {
      await assert.doesNotReject(() => verifySourceCandidate({ archivePath: fixture.archivePath }));
    } finally {
      fixture.cleanup();
    }
  });

  test('rejects unknown non-text release inputs', async () => {
    const fixture = createFixtureCandidate({ 'fixtures/unknown.bin': Buffer.from([0x01, 0x02]) });
    try {
      await assert.rejects(
        () => verifySourceCandidate({ archivePath: fixture.archivePath }),
        /Cannot safely classify non-text release input.*fixtures\/unknown\.bin/,
      );
    } finally {
      fixture.cleanup();
    }
  });

  test('rejects unknown binary paths even when their bytes are valid UTF-8', async () => {
    const fixture = createFixtureCandidate({
      'fixtures/unknown.bin': Buffer.from('printable but still an unknown binary input'),
    });
    try {
      await assert.rejects(
        () => verifySourceCandidate({ archivePath: fixture.archivePath }),
        /Cannot safely classify non-text release input.*fixtures\/unknown\.bin/,
      );
    } finally {
      fixture.cleanup();
    }
  });

  test('keeps provenance inventory entries inside their Markdown section', async () => {
    const fixture = createFixtureCandidate({
      'docs/code-origin-audit.md':
        '### Source archive non-text inventory\n\n## Another section\n\n- `fixtures/unknown.bin`: outside the inventory.\n',
      'fixtures/unknown.bin': Buffer.from([0x01, 0x02]),
    });
    try {
      await assert.rejects(
        () => verifySourceCandidate({ archivePath: fixture.archivePath }),
        /Cannot safely classify non-text release input.*fixtures\/unknown\.bin/,
      );
    } finally {
      fixture.cleanup();
    }
  });

  test('rejects provenance patterns without a fixed path prefix', async () => {
    const fixture = createFixtureCandidate({
      'docs/code-origin-audit.md':
        '### Source archive non-text inventory\n\n- `**`: overbroad inventory.\n',
      'fixtures/unknown.bin': Buffer.from([0x01, 0x02]),
    });
    try {
      await assert.rejects(
        () => verifySourceCandidate({ archivePath: fixture.archivePath }),
        /Unsafe source archive inventory pattern/,
      );
    } finally {
      fixture.cleanup();
    }
  });

  test('allows a double-star inventory to match zero nested directories', async () => {
    const fixture = createFixtureCandidate({
      'docs/code-origin-audit.md':
        '### Source archive non-text inventory\n\n- `docs/images/**/*.png`: reviewed screenshots.\n',
      'docs/images/root.png': Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]),
    });
    try {
      await assert.doesNotReject(() => verifySourceCandidate({ archivePath: fixture.archivePath }));
    } finally {
      fixture.cleanup();
    }
  });

  test('filters controlled environment names case-insensitively', async () => {
    await withEnvironmentVariables(
      { gIt_Prefix_Probe: 'prefix', mAkA_Exact_Probe: 'exact' },
      () => {
        const environment = controlledProcessEnvironment({
          excludedNames: ['MAKA_EXACT_PROBE'],
          excludedPrefixes: ['GIT_'],
          overrides: { GIT_CONFIG_NOSYSTEM: '1' },
        });
        const names = Object.keys(environment).map((name) => name.toUpperCase());
        assert.equal(names.includes('MAKA_EXACT_PROBE'), false);
        assert.equal(names.includes('GIT_PREFIX_PROBE'), false);
        assert.equal(environment.GIT_CONFIG_NOSYSTEM, '1');
      },
    );
  });

  test('requires a signature before reading unauthenticated candidate metadata', async () => {
    const temporaryRoot = mkdtempSync(join(tmpdir(), 'maka-asf-auth-order-test-'));
    const identity = sourceCandidateIdentity('0.1.12');
    const archivePath = join(temporaryRoot, identity.archiveName);
    try {
      writeFileSync(archivePath, 'not a tar archive\n');
      const keysPath = join(temporaryRoot, 'KEYS');
      writeFileSync(keysPath, '');

      await assert.rejects(
        () => verifySourceCandidate({ archivePath, keysPath }),
        /Detached signature does not exist/,
      );
    } finally {
      rmSync(temporaryRoot, { force: true, recursive: true });
    }
  });

  test('documents the checkout-only DeepSeek Harness toolchain build in the candidate', async () => {
    const temporaryRoot = mkdtempSync(join(tmpdir(), 'maka-asf-dsh-contract-test-'));
    const repositoryRoot = join(temporaryRoot, 'repository');
    const outputDirectory = join(temporaryRoot, 'release');
    const identity = sourceCandidateIdentity('0.1.12');
    try {
      writeReleaseContents(repositoryRoot, { includeAttributes: true });
      mkdirSync(join(repositoryRoot, 'packages/eval/harbor/deepseek-harness-toolchain'), {
        recursive: true,
      });
      mkdirSync(join(repositoryRoot, 'packages/eval/harbor/deepseek-harness-profile'), {
        recursive: true,
      });
      mkdirSync(join(repositoryRoot, 'scripts'), { recursive: true });
      copyFileSync(
        join(import.meta.dirname, '../packages/eval/README.md'),
        join(repositoryRoot, 'packages/eval/README.md'),
      );
      writeFileSync(
        join(repositoryRoot, 'packages/eval/harbor/deepseek-harness-toolchain/package.json'),
        '{}\n',
      );
      writeFileSync(
        join(repositoryRoot, 'packages/eval/harbor/deepseek-harness-toolchain/package-lock.json'),
        '{}\n',
      );
      writeFileSync(
        join(repositoryRoot, 'scripts/prepare-deepseek-harness-toolchain.mjs'),
        'export {};\n',
      );
      for (const name of ['package.json', 'cordis.patch.yml']) {
        copyFileSync(
          join(import.meta.dirname, `../packages/eval/harbor/deepseek-harness-profile/${name}`),
          join(repositoryRoot, `packages/eval/harbor/deepseek-harness-profile/${name}`),
        );
      }

      git(repositoryRoot, ['init']);
      git(repositoryRoot, ['add', '.']);
      commitFixture(repositoryRoot, 'test DSH source archive contract');

      const candidate = await createSourceCandidate({
        outputDirectory,
        repositoryRoot,
        version: '0.1.12',
      });
      const entries = execFileSync('tar', ['-tzf', candidate.archivePath], { encoding: 'utf8' });
      const archivedReadme = execFileSync(
        'tar',
        ['-xOzf', candidate.archivePath, `${identity.rootDirectory}/packages/eval/README.md`],
        { encoding: 'utf8' },
      );

      assert.doesNotMatch(entries, /deepseek-harness-toolchain\/package(?:-lock)?\.json/);
      assert.match(entries, /scripts\/prepare-deepseek-harness-toolchain\.mjs/);
      for (const name of ['package.json', 'cordis.patch.yml']) {
        const relativePath = `packages/eval/harbor/deepseek-harness-profile/${name}`;
        assert.deepEqual(
          execFileSync('tar', [
            '-xOzf',
            candidate.archivePath,
            `${identity.rootDirectory}/${relativePath}`,
          ]),
          readFileSync(join(repositoryRoot, relativePath)),
        );
      }
      assert.match(archivedReadme, /only from a complete Git checkout/u);
      assert.match(archivedReadme, /intentionally excluded from ASF source archives/u);
    } finally {
      rmSync(temporaryRoot, { force: true, recursive: true });
    }
  });

  test('creates reproducible candidates from committed files only', async () => {
    const temporaryRoot = mkdtempSync(join(tmpdir(), 'maka-asf-source-test-'));
    const repositoryRoot = join(temporaryRoot, 'repository');
    const firstOutput = join(temporaryRoot, 'first');
    const hostileOutput = join(temporaryRoot, 'hostile');
    mkdirSync(repositoryRoot, { recursive: true });
    try {
      writeReleaseContents(repositoryRoot, { includeAttributes: true });
      writeFileSync(join(repositoryRoot, '.gitignore'), 'untracked.txt\n');
      writeFileSync(join(repositoryRoot, 'README.md'), 'release fixture\n'.repeat(4096));
      writeFileSync(join(repositoryRoot, 'untracked.txt'), 'must not be released\n');
      mkdirSync(join(repositoryRoot, '.claude'));
      mkdirSync(join(repositoryRoot, '.maka-shots'));
      writeFileSync(join(repositoryRoot, '.claude/launch.json'), '{}\n');
      writeFileSync(join(repositoryRoot, '.maka-shots/review.png'), 'review evidence\n');
      writeFileSync(join(repositoryRoot, 'maka-proposal-zh-review.txt'), 'working notes\n');
      mkdirSync(join(repositoryRoot, 'packages/eval/harbor/deepseek-harness-toolchain'), {
        recursive: true,
      });
      mkdirSync(join(repositoryRoot, 'packages/eval/harbor/deepseek-harness-profile'), {
        recursive: true,
      });
      writeFileSync(
        join(repositoryRoot, 'packages/eval/harbor/deepseek-harness-toolchain/package-lock.json'),
        '{}\n',
      );
      writeFileSync(
        join(repositoryRoot, 'packages/eval/harbor/deepseek-harness-toolchain/package.json'),
        '{}\n',
      );
      writeFileSync(
        join(
          repositoryRoot,
          'packages/eval/harbor/deepseek-harness-toolchain/patch-subprocess-local.mjs',
        ),
        'export {};\n',
      );
      writeFileSync(
        join(repositoryRoot, 'packages/eval/harbor/deepseek-harness-profile/cordis.yml'),
        'profile: maka-eval\n',
      );

      git(repositoryRoot, ['init']);
      git(repositoryRoot, [
        'add',
        'package.json',
        'package-lock.json',
        'DISCLAIMER-WIP',
        'LICENSE',
        'NOTICE',
        '.gitignore',
        '.gitattributes',
        'README.md',
        '.claude/launch.json',
        '.maka-shots/review.png',
        'maka-proposal-zh-review.txt',
        'packages/eval/harbor/deepseek-harness-toolchain/package-lock.json',
        'packages/eval/harbor/deepseek-harness-toolchain/package.json',
        'packages/eval/harbor/deepseek-harness-toolchain/patch-subprocess-local.mjs',
        'packages/eval/harbor/deepseek-harness-profile/cordis.yml',
      ]);
      git(repositoryRoot, [
        '-c',
        'user.name=ASF Release Test',
        '-c',
        'user.email=release-test@example.invalid',
        'commit',
        '-m',
        'test fixture',
      ]);

      const first = await createSourceCandidate({
        outputDirectory: firstOutput,
        repositoryRoot,
        version: '0.1.12',
      });
      await assert.rejects(
        () =>
          createSourceCandidate({
            outputDirectory: firstOutput,
            repositoryRoot,
            version: '0.1.12',
          }),
        /Refusing to overwrite existing release output/,
      );
      git(repositoryRoot, ['config', 'tar.umask', '0077']);
      writeFileSync(join(repositoryRoot, '.git/info/attributes'), 'README.md export-ignore\n');

      const ambientTemplate = join(temporaryRoot, 'ambient-template');
      mkdirSync(join(ambientTemplate, 'info'), { recursive: true });
      writeFileSync(join(ambientTemplate, 'info/attributes'), 'README.md export-ignore\n');

      const ambientRepository = join(temporaryRoot, 'ambient-repository');
      git(temporaryRoot, ['clone', '--quiet', repositoryRoot, ambientRepository]);
      writeFileSync(join(ambientRepository, 'README.md'), 'ambient repository\n');
      git(ambientRepository, ['add', 'README.md']);
      git(ambientRepository, [
        '-c',
        'user.name=ASF Release Test',
        '-c',
        'user.email=release-test@example.invalid',
        'commit',
        '-m',
        'change ambient repository',
      ]);
      const hostile = await withEnvironmentVariables(
        {
          GIT_DIR: join(ambientRepository, '.git'),
          GIT_TEMPLATE_DIR: ambientTemplate,
          GZIP: '-l',
        },
        () =>
          createSourceCandidate({
            outputDirectory: hostileOutput,
            repositoryRoot,
            version: '0.1.12',
          }),
      );
      assert.deepEqual(readFileSync(first.archivePath), readFileSync(hostile.archivePath));
      assert.equal(hostile.commit, first.commit);
      assert.deepEqual(
        readFileSync(`${first.archivePath}.sha512`),
        readFileSync(`${hostile.archivePath}.sha512`),
      );
      await assert.doesNotReject(() => verifySourceCandidate({ archivePath: first.archivePath }));

      const entries = execFileSync('tar', ['-tzf', basename(first.archivePath)], {
        cwd: dirname(first.archivePath),
        encoding: 'utf8',
      });
      assert.doesNotMatch(entries, /untracked\.txt/);
      assert.doesNotMatch(entries, /\.claude|\.maka-shots|maka-proposal-zh-review/);
      assert.doesNotMatch(entries, /deepseek-harness-toolchain\/package(?:-lock)?\.json/);
      assert.match(entries, /deepseek-harness-toolchain\/patch-subprocess-local\.mjs/);
      assert.match(entries, /deepseek-harness-profile\/cordis\.yml/);
      assert.match(entries, /README\.md/);

      const originalCompressedBytes = readFileSync(first.archivePath);
      rewriteArchiveCompression(first.archivePath, 1);
      assert.notDeepEqual(readFileSync(first.archivePath), originalCompressedBytes);
      await assert.doesNotReject(() =>
        reproduceSourceCandidate({
          archivePath: first.archivePath,
          repositoryRoot,
          revision: first.commit,
        }),
      );
      writeFileSync(join(repositoryRoot, 'README.md'), 'different committed payload\n');
      git(repositoryRoot, ['add', 'README.md']);
      commitFixture(repositoryRoot, 'change candidate payload');
      await assert.rejects(
        () =>
          reproduceSourceCandidate({
            archivePath: first.archivePath,
            repositoryRoot,
            revision: 'HEAD',
          }),
        /Candidate source payload does not match/,
      );

      const gpgHome = join(temporaryRoot, 'gnupg');
      const keysPath = join(temporaryRoot, 'KEYS');
      const fingerprint = generateSigningKey({
        algorithm: 'rsa2048',
        gpgHome,
        identity: 'ASF Release Test <release-test@example.invalid>',
        signingSubkeyAlgorithm: 'rsa2048',
        usage: 'cert',
      });
      writeFileSync(join(gpgHome, 'gpg.conf'), 'digest-algo SHA1\n');
      await assert.doesNotReject(() =>
        signSourceCandidate({
          archivePath: first.archivePath,
          gpgHome,
          keyFingerprint: fingerprint,
          repositoryRoot,
          revision: first.commit,
        }),
      );
      exportPublicKey({ fingerprint, gpgHome, keysPath });
      await assert.doesNotReject(() =>
        verifySourceCandidate({ archivePath: first.archivePath, keysPath }),
      );

      rmSync(`${first.archivePath}.asc`);
      execFileSync(
        'gpg',
        [
          '--batch',
          '--homedir',
          gpgHome,
          '--digest-algo',
          'SHA512',
          '--detach-sign',
          '--output',
          `${first.archivePath}.asc`,
          first.archivePath,
        ],
        { stdio: 'ignore' },
      );
      const checksum = readFileSync(`${first.archivePath}.sha512`);
      writeFileSync(`${first.archivePath}.sha512`, 'not a checksum\n');
      await assert.rejects(
        () => verifySourceCandidate({ archivePath: first.archivePath, keysPath }),
        /ASCII-armored/,
      );
      writeFileSync(`${first.archivePath}.sha512`, checksum);

      rmSync(`${first.archivePath}.asc`);
      execFileSync(
        'gpg',
        [
          '--batch',
          '--homedir',
          gpgHome,
          '--armor',
          '--digest-algo',
          'SHA1',
          '--detach-sign',
          '--output',
          `${first.archivePath}.asc`,
          first.archivePath,
        ],
        { stdio: 'ignore' },
      );
      await assert.rejects(
        () => verifySourceCandidate({ archivePath: first.archivePath, keysPath }),
        /must use SHA-256, SHA-384, or SHA-512/,
      );

      rmSync(`${first.archivePath}.asc`);
      // Keep the homedir short enough for GPG agent socket paths on macOS.
      const ed25519Home = join(temporaryRoot, 'ed');
      const ed25519Fingerprint = generateSigningKey({
        algorithm: 'ed25519',
        gpgHome: ed25519Home,
        identity: 'ASF Ed25519 Release Test <release-test@example.invalid>',
      });
      await assert.rejects(
        () =>
          signSourceCandidate({
            archivePath: first.archivePath,
            gpgHome: ed25519Home,
            keyFingerprint: ed25519Fingerprint,
            repositoryRoot,
            revision: first.commit,
          }),
        /must be RSA with at least 2048 bits/,
      );
      assert.equal(existsSync(`${first.archivePath}.asc`), false);

      const rsa1024Home = join(temporaryRoot, 'r');
      const rsa1024Fingerprint = generateSigningKey({
        algorithm: 'rsa2048',
        gpgHome: rsa1024Home,
        identity: 'ASF RSA-1024 Subkey Test <release-test@example.invalid>',
        signingSubkeyAlgorithm: 'rsa1024',
        usage: 'cert',
      });
      await assert.rejects(
        () =>
          signSourceCandidate({
            archivePath: first.archivePath,
            gpgHome: rsa1024Home,
            keyFingerprint: rsa1024Fingerprint,
            repositoryRoot,
            revision: first.commit,
          }),
        /must be RSA with at least 2048 bits/,
      );
      assert.equal(existsSync(`${first.archivePath}.asc`), false);
    } finally {
      rmSync(temporaryRoot, { force: true, recursive: true });
    }
  });

  test('does not let ambient tar options control archive verification', async () => {
    const temporaryRoot = mkdtempSync(join(tmpdir(), 'maka-asf-tar-options-test-'));
    const identity = sourceCandidateIdentity('0.1.12');
    const sourceRoot = join(temporaryRoot, identity.rootDirectory);
    const archivePath = join(temporaryRoot, identity.archiveName);
    try {
      writeReleaseContents(sourceRoot);
      mkdirSync(join(sourceRoot, '.agents'), { recursive: true });
      writeFileSync(join(sourceRoot, '.agents/secret.txt'), 'must not be released\n');
      execFileSync('tar', ['-czf', archivePath, identity.rootDirectory], {
        cwd: temporaryRoot,
        stdio: 'ignore',
      });
      const digest = createHash('sha512').update(readFileSync(archivePath)).digest('hex');
      writeFileSync(`${archivePath}.sha512`, `${digest}  ${identity.archiveName}\n`);

      for (const [name, value] of Object.entries({
        GZIP: '-l',
        TAR_OPTIONS: `--exclude=${identity.rootDirectory}/.agents`,
        TAR_READER_OPTIONS: 'tar:hdrcharset=BOGUS',
      })) {
        await withEnvironmentVariables({ [name]: value }, () =>
          assert.rejects(() => verifySourceCandidate({ archivePath }), /Forbidden archive entry/),
        );
      }
    } finally {
      rmSync(temporaryRoot, { force: true, recursive: true });
    }
  });
});

function git(repositoryRoot, arguments_) {
  execFileSync('git', arguments_, { cwd: repositoryRoot, stdio: 'ignore' });
}

function writeReleaseContents(root, { includeAttributes = false } = {}) {
  mkdirSync(root, { recursive: true });
  writeFileSync(
    join(root, 'package.json'),
    `${JSON.stringify({ license: 'Apache-2.0', name: 'maka', private: true, version: '0.1.12' }, null, 2)}\n`,
  );
  writeFileSync(
    join(root, 'package-lock.json'),
    `${JSON.stringify({ lockfileVersion: 3, name: 'maka', packages: { '': { name: 'maka', version: '0.1.12' } }, version: '0.1.12' }, null, 2)}\n`,
  );
  writeFileSync(
    join(root, 'DISCLAIMER-WIP'),
    'Apache Maka is undergoing incubation at The Apache Software Foundation.\n',
  );
  writeFileSync(join(root, 'LICENSE'), 'Apache License, Version 2.0\n');
  writeFileSync(join(root, 'NOTICE'), 'Apache Maka\n');
  if (includeAttributes) {
    copyFileSync(join(import.meta.dirname, '../.gitattributes'), join(root, '.gitattributes'));
  }
}

function createFixtureCandidate(files = {}) {
  const temporaryRoot = mkdtempSync(join(tmpdir(), 'maka-asf-candidate-test-'));
  const identity = sourceCandidateIdentity('0.1.12');
  const sourceRoot = join(temporaryRoot, identity.rootDirectory);
  const archivePath = join(temporaryRoot, identity.archiveName);
  writeReleaseContents(sourceRoot);
  for (const [relativePath, contents] of Object.entries(files)) {
    const path = join(sourceRoot, relativePath);
    mkdirSync(dirname(path), { recursive: true });
    writeFileSync(path, contents);
  }
  execFileSync('tar', ['-czf', archivePath, identity.rootDirectory], {
    cwd: temporaryRoot,
    stdio: 'ignore',
  });
  const digest = createHash('sha512').update(readFileSync(archivePath)).digest('hex');
  writeFileSync(`${archivePath}.sha512`, `${digest}  ${identity.archiveName}\n`);
  return {
    archivePath,
    cleanup: () => rmSync(temporaryRoot, { force: true, recursive: true }),
  };
}

function commitFixture(repositoryRoot, message) {
  git(repositoryRoot, [
    '-c',
    'user.name=ASF Release Test',
    '-c',
    'user.email=release-test@example.invalid',
    'commit',
    '-m',
    message,
  ]);
}

async function withEnvironmentVariables(values, callback) {
  const previous = new Map(Object.keys(values).map((name) => [name, process.env[name]]));
  Object.assign(process.env, values);
  try {
    return await callback();
  } finally {
    for (const [name, value] of previous) {
      if (value === undefined) delete process.env[name];
      else process.env[name] = value;
    }
  }
}

function rewriteArchiveCompression(archivePath, level) {
  const tarPath = archivePath.slice(0, -3);
  execFileSync('gzip', ['-d', archivePath], { stdio: 'ignore' });
  execFileSync('gzip', ['-n', `-${level}`, tarPath], { stdio: 'ignore' });
  const digest = createHash('sha512').update(readFileSync(archivePath)).digest('hex');
  writeFileSync(`${archivePath}.sha512`, `${digest}  ${basename(archivePath)}\n`);
}

function generateSigningKey({
  algorithm,
  gpgHome,
  identity,
  signingSubkeyAlgorithm,
  usage = 'sign',
}) {
  mkdirSync(gpgHome, { mode: 0o700 });
  chmodSync(gpgHome, 0o700);
  execFileSync(
    'gpg',
    [
      '--batch',
      '--homedir',
      gpgHome,
      '--pinentry-mode',
      'loopback',
      '--passphrase',
      '',
      '--quick-generate-key',
      identity,
      algorithm,
      usage,
      '1d',
    ],
    { stdio: 'ignore' },
  );
  const fingerprint = execFileSync(
    'gpg',
    ['--batch', '--homedir', gpgHome, '--with-colons', '--fingerprint', '--list-secret-keys'],
    { encoding: 'utf8' },
  )
    .split(/\r?\n/)
    .find((line) => line.startsWith('fpr:'))
    ?.split(':')[9];
  assert.match(fingerprint, /^[0-9A-F]{40}$/);
  if (signingSubkeyAlgorithm) {
    execFileSync(
      'gpg',
      [
        '--batch',
        '--homedir',
        gpgHome,
        '--pinentry-mode',
        'loopback',
        '--passphrase',
        '',
        '--quick-add-key',
        fingerprint,
        signingSubkeyAlgorithm,
        'sign',
        '1d',
      ],
      { stdio: 'ignore' },
    );
  }
  return fingerprint;
}

function exportPublicKey({ fingerprint, gpgHome, keysPath }) {
  execFileSync(
    'gpg',
    ['--batch', '--homedir', gpgHome, '--armor', '--output', keysPath, '--export', fingerprint],
    { stdio: 'ignore' },
  );
}