构建产物溯源与SLSA证明治理（Attestation-来源-签名）最佳实践

核心要点证明包含构建器ID、材料清单与主语摘要；哈希使用 `SHA-256`。时间窗口与 `kid` 校验；仅在有效期内接受证明。产物与证明双向绑定以支持回溯与审计。实现示例type Digest = { alg: 'SHA-256'; hex: string }

type Material = { uri: string; digest: Digest }

type Subject = { name: string; digest: Digest }

type Attestation = { builderId: string; materials: Material[]; subject: Subject; created: number; expires: number }

function hex64(h: string): boolean {

return /^[A-Fa-f0-9]{64}$/.test(h)

}

function validAtt(a: Attestation): boolean {

return !!a.builderId && a.materials.length > 0 && hex64(a.subject.digest.hex) && a.materials.every(m => hex64(m.digest.hex))

}

function within(created: number, expires: number, now: number, leewaySec: number): boolean {

if (expires <= created) return false

return now + leewaySec * 1000 >= created && now - leewaySec * 1000 <= expires

}

async function signAtt(a: Attestation, jwk: JsonWebKey, kid: string): Promise<{ kid: string; alg: string; sig: string }> {

const data = Buffer.from(JSON.stringify(a))

const key = await crypto.subtle.importKey('jwk', jwk, { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, false, ['sign'])

const sig = await crypto.subtle.sign({ name: 'RSASSA-PKCS1-v1_5' }, key, data)

return { kid, alg: 'RS256', sig: Buffer.from(sig).toString('base64') }

}

async function verifyAtt(a: Attestation, signed: { kid: string; alg: string; sig: string }, jwk: JsonWebKey, now: number): Promise<boolean> {

if (!validAtt(a) || signed.alg !== 'RS256') return false

if (!within(a.created, a.expires, now, 60)) return false

const data = Buffer.from(JSON.stringify(a))

const key = await crypto.subtle.importKey('jwk', jwk, { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, false, ['verify'])

return crypto.subtle.verify({ name: 'RSASSA-PKCS1-v1_5' }, key, Buffer.from(signed.sig, 'base64'), data)

}

审计与发布治理发布存档包含证明与签名指纹；不合规或过期证明阻断部署。证明与产物摘要对齐，支持离线验证与快速回溯。