Enforce immutable supply chain defaults

scripts/check-pins.sh

@@ -0,0 +1,117 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+
+fail() {
+  printf '%s\n' "$1" >&2
+  exit 1
+}
+
+awk '
+function verify() {
+  if (registry && !checksum) {
+    printf "registry package lacks checksum: %s\n", package > "/dev/stderr"
+    failed = 1
+  }
+}
+/^\[\[package\]\]$/ {
+  verify()
+  package = "unknown"
+  registry = 0
+  checksum = 0
+  next
+}
+/^name = "/ {
+  package = $0
+  sub(/^name = "/, "", package)
+  sub(/"$/, "", package)
+}
+/^source = "registry\+/ { registry = 1 }
+/^checksum = "/ {
+  value = $0
+  sub(/^checksum = "/, "", value)
+  sub(/"$/, "", value)
+  checksum = length(value) == 64 && value !~ /[^0-9a-f]/
+}
+END {
+  verify()
+  exit failed
+}
+' "$ROOT/Cargo.lock"
+
+if rg -q '^source = "git\+' "$ROOT/Cargo.lock"; then
+  fail "Cargo.lock contains a Git dependency"
+fi
+
+for lock in \
+  "$ROOT/contracts/typespec/package-lock.json" \
+  "$ROOT/contracts/typespec-rust-emitter/package-lock.json"; do
+  if ! jq -e '
+    [.packages | to_entries[] |
+      select(.key | startswith("node_modules/")) |
+      select(.value.link != true) |
+      select(.value.integrity == null)] |
+    length == 0
+  ' "$lock" >/dev/null; then
+    fail "$lock contains a registry package without integrity"
+  fi
+done
+
+read -r pnpm_packages pnpm_hashes < <(
+  awk '
+  BEGIN { packages = 0; hashes = 0; active = 0 }
+  /^packages:/ { active = 1; next }
+  /^snapshots:/ { active = 0 }
+  active && /^  [^ ].*:$/ { packages++ }
+  active && /integrity:/ { hashes++ }
+  END { print packages, hashes }
+  ' "$ROOT/web/pnpm-lock.yaml"
+)
+if [[ "$pnpm_packages" != "$pnpm_hashes" ]]; then
+  fail "web/pnpm-lock.yaml contains a package without integrity"
+fi
+
+pnpm_ref="$(jq -r .packageManager "$ROOT/web/package.json")"
+if [[ ! "$pnpm_ref" =~ ^pnpm@[0-9]+\.[0-9]+\.[0-9]+\+sha512\.[0-9a-f]{128}$ ]]; then
+  fail "web/package.json packageManager is not content-pinned"
+fi
+if ! rg -Fq "corepack install --global $pnpm_ref" "$ROOT/Dockerfile.test"; then
+  fail "Dockerfile.test does not install the pinned package manager"
+fi
+
+while IFS= read -r image; do
+  if [[ ! "$image" =~ @sha256:[0-9a-f]{64}$ ]]; then
+    fail "fixture image is not digest-pinned: $image"
+  fi
+done < <(awk -F= '/_IMAGE=/ { print $2 }' "$ROOT/tests/kind/fixture/versions.env")
+
+while IFS= read -r image; do
+  if [[ ! "$image" =~ @sha256:[0-9a-f]{64}$ ]]; then
+    fail "Docker image default is not digest-pinned: $image"
+  fi
+done < <(awk -F= '/^ARG [A-Z_]+_IMAGE=/ { print $2 }' "$ROOT/Dockerfile" "$ROOT/Dockerfile.test")
+
+while IFS= read -r command; do
+  if [[ "$command" != *--locked* ]]; then
+    fail "Cargo dependency command lacks --locked: $command"
+  fi
+done < <(
+  {
+    sed -n '/cargo \(build\|check\|clippy\|install\|nextest\|test\)/p' "$ROOT/Makefile"
+    awk '
+    {
+      line = line $0
+      if (sub(/\\$/, "", line)) {
+        next
+      }
+      print line
+      line = ""
+    }
+    ' "$ROOT/Dockerfile" "$ROOT/Dockerfile.test" |
+      sed 's/&&/\n/g' |
+      sed -n '/cargo \(build\|check\|clippy\|install\|nextest\|test\)/p'
+  } | sed '/cargo fmt/d'
+)
+
+printf 'immutable external reference checks passed\n'