Advance N-023 through N-026 audited parity

tools/web/collect-release-evidence.mjs

@@ -0,0 +1,52 @@
+import assert from "node:assert/strict";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
+const ledgerPath = path.join(root, "docs/status/parity-ledger.json");
+const outputPath = path.join(root, "docs/status/release-evidence.json");
+const sha256 = (file) => crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex");
+const evidence = {
+  browser: { chromium: false },
+  runtime: { offline: false, workerRestart: false, opfsRecovery: false },
+  performance: { geometry1M: false, geometry10M: false, texture4K: false, texture8K: false, longMedia: false, simulationCache: false },
+  faults: { oom: false, deviceLoss: false, networkInterrupt: false, malformedBlend: false, zipBomb: false },
+  provenance: { license: false, sbom: false, sourceOffer: false, deterministicPackage: false },
+  records: [],
+};
+
+function run(id, fields, command, artifacts = []) {
+  const started = Date.now();
+  const result = spawnSync("bash", ["-lc", command], { cwd: root, encoding: "utf8", env: { ...process.env, WEB_TEST_PORT: process.env.WEB_TEST_PORT ?? "5326" }, maxBuffer: 16 * 1024 * 1024 });
+  const combined = `${result.stdout ?? ""}\n${result.stderr ?? ""}`.trim();
+  if (result.status !== 0) {
+    process.stderr.write(`${combined}\n`);
+    throw new Error(`${id} failed with exit code ${result.status}`);
+  }
+  for (const field of fields) {
+    const [group, key] = field.split(".");
+    evidence[group][key] = true;
+  }
+  evidence.records.push({ id, fields, command, exitCode: 0, durationMs: Date.now() - started, output: combined.slice(-4096) || `${id} passed`, artifactSha256: artifacts.filter((file) => fs.existsSync(path.join(root, file))).map((file) => sha256(path.join(root, file))) });
+  process.stdout.write(`${id}-ok durationMs=${Date.now() - started}\n`);
+}
+
+run("sbom", ["provenance.license", "provenance.sbom"], "npm --prefix web run release:sbom", ["docs/web/sbom.spdx.json", "docs/web/third-party-notices.json", "web/package-lock.json"]);
+run("chromium", ["browser.chromium", "runtime.offline", "runtime.workerRestart", "runtime.opfsRecovery"], "npm --prefix web run test:e2e -- --workers=1 && npm --prefix web run test:browser", ["web/app/src/vendor/blender/web_engine.wasm"]);
+run("geometry-1m", ["performance.geometry1M"], "npm --prefix web run test:release-performance", ["web/app/src/vendor/blender/web_engine.wasm"]);
+run("malformed-blend", ["faults.malformedBlend"], "npm --prefix web run test:malicious-blends", ["tests/files/web/basic_scene.blend"]);
+run("zip-bomb", ["faults.zipBomb"], "WEB_TEST_PORT=5323 npm --prefix web run test:asset-library", ["web/protocol/asset-library-io.ts"]);
+run("release-package", [], "npm --prefix web run test:release-package", ["docs/web/sbom.spdx.json", "web/app/src/vendor/blender/web_engine.wasm"]);
+run("offline-reproducibility", ["provenance.sourceOffer", "provenance.deterministicPackage"], "npm --prefix web run release:offline", ["release/blender-web-offline.tar.gz", "release/blender-web-corresponding-source.tar.gz", "release/SHA256SUMS.txt"]);
+
+const ledgerBytes = fs.readFileSync(ledgerPath);
+const ledger = JSON.parse(ledgerBytes);
+const manifest = { schemaVersion: 3, source: "docs/status/parity-ledger.json", sourceSha256: crypto.createHash("sha256").update(ledgerBytes).digest("hex"), generatedAt: new Date().toISOString(), families: ledger.families, evidence };
+assert.ok(manifest.families.some((family) => family.status === "BLOCKED"));
+assert.equal(manifest.evidence.performance.geometry10M, false);
+assert.equal(manifest.evidence.faults.deviceLoss, false);
+fs.writeFileSync(outputPath, `${JSON.stringify(manifest, null, 2)}\n`);
+process.stdout.write(`release-evidence-ok records=${evidence.records.length} status=BLOCKED sha256=${sha256(outputPath)}\n`);