59 lines
1.8 KiB
Python
59 lines
1.8 KiB
Python
from __future__ import annotations
|
|
|
|
from pathlib import Path
|
|
from typing import Any
|
|
|
|
from governed_provider_auth_adapter import (
|
|
ALL_RELEASE_EVIDENCE_KINDS,
|
|
authenticate_build_artifacts,
|
|
gate_w_authentication_status,
|
|
)
|
|
from trusted_provider_receipts import (
|
|
ProviderAuthenticationError,
|
|
TrustedProviderReceiptResolver,
|
|
)
|
|
|
|
|
|
def produce_authenticated_evidence_closure(
|
|
request: Any,
|
|
*,
|
|
provider_receipt_resolver: TrustedProviderReceiptResolver | None,
|
|
source_root: Path,
|
|
builder_policy: Path,
|
|
legacy_producer=None,
|
|
):
|
|
"""Production wrapper for the existing evidence producer.
|
|
|
|
This is the governed operation entrypoint. It refuses to call the legacy
|
|
closure assembler until *all* final-release provider receipts are resolved
|
|
from authenticated stores. For Gate-W, use `validate_gate_w_provider_auth`
|
|
instead; canary/rollback remain pending until Gate-R.
|
|
"""
|
|
if provider_receipt_resolver is None:
|
|
raise ProviderAuthenticationError("PROVIDER_AUTHENTICATION_REQUIRED")
|
|
if legacy_producer is None:
|
|
from governed_release_evidence_producer import produce_evidence_closure as legacy_producer
|
|
|
|
authenticated_request = authenticate_build_artifacts(
|
|
request,
|
|
resolver=provider_receipt_resolver,
|
|
required_kinds=ALL_RELEASE_EVIDENCE_KINDS,
|
|
)
|
|
return legacy_producer(
|
|
authenticated_request,
|
|
source_root=source_root,
|
|
builder_policy=builder_policy,
|
|
)
|
|
|
|
|
|
def validate_gate_w_provider_auth(
|
|
request: Any,
|
|
*,
|
|
provider_receipt_resolver: TrustedProviderReceiptResolver | None,
|
|
) -> dict[str, str]:
|
|
"""Gate-W authentication check without pretending Gate-R evidence exists."""
|
|
return gate_w_authentication_status(
|
|
request,
|
|
resolver=provider_receipt_resolver,
|
|
)
|