Binary attestations: phase 2 – reproducible Fastly builds

.github/workflows/format.yml

@@ -124,6 +124,12 @@ jobs:
       - name: Run host-target CLI clippy
         run: cargo clippy --package trusted-server-cli --target x86_64-unknown-linux-gnu --all-targets --all-features -- -D warnings
 
+      - name: Run host-target release producer clippy
+        run: cargo clippy --package trusted-server-release --target x86_64-unknown-linux-gnu --all-targets --all-features --locked -- -D warnings
+
+      - name: Lint native JS release build fixtures
+        run: cargo clippy --package trusted-server-js --target x86_64-unknown-linux-gnu --all-targets --all-features --locked -- -D warnings
+
       # The codegen crate is a workspace member but is not a default member and
       # is not covered by any adapter-scoped alias, so lint it explicitly.
       - name: Run host-target OpenRTB codegen clippy
@@ -247,7 +253,7 @@ jobs:
           node-version: ${{ steps.node-version.outputs.node-version }}
 
       - name: Run shellcheck
-        run: shellcheck scripts/release/phase1-build.sh
+        run: shellcheck scripts/release/phase1-build.sh scripts/release/validate-fastly-package.sh scripts/release/bootstrap.sh scripts/release/build.sh scripts/release/build-js.sh
 
       - name: Test release producer scripts
         run: node --test scripts/release/phase1.test.mjs

.github/workflows/release.yml

@@ -15,6 +15,7 @@ jobs:
     uses: ./.github/workflows/release-build.yml
     permissions:
       contents: read
+      actions: read
       id-token: write
       attestations: write
   release:

.github/workflows/test.yml

@@ -196,6 +196,23 @@ jobs:
       - name: Run host-target CLI tests
         run: ./scripts/test-cli.sh
 
+      - name: Run release producer primitive and process tests
+        run: |
+          set -euo pipefail
+          cargo test --package trusted-server-release --target x86_64-unknown-linux-gnu --locked --test commands -- --list > "$RUNNER_TEMP/ordinary-command-tests.txt"
+          grep -Fx 'ordinary_compare_mismatch_writes_no_companion: test' "$RUNNER_TEMP/ordinary-command-tests.txt"
+          cargo test --package trusted-server-release --target x86_64-unknown-linux-gnu --locked
+          cargo test --package trusted-server-release --target x86_64-unknown-linux-gnu --locked --test commands ordinary_compare_mismatch_writes_no_companion -- --exact > "$RUNNER_TEMP/ordinary-negative-result.txt"
+          cat "$RUNNER_TEMP/ordinary-negative-result.txt"
+          grep -E '^test result: ok\. 1 passed; 0 failed; 0 ignored;' "$RUNNER_TEMP/ordinary-negative-result.txt"
+
+      - name: Run checked and ordinary JS release build fixtures
+        shell: bash
+        run: |
+          cargo test --package trusted-server-js --target x86_64-unknown-linux-gnu --locked --test release_prebuilt -- --list > "$RUNNER_TEMP/js-release-tests.txt"
+          grep -Fx 'ordinary_release_without_prebuilt_builds_private_bundles: test' "$RUNNER_TEMP/js-release-tests.txt"
+          cargo test --package trusted-server-js --target x86_64-unknown-linux-gnu --locked --test release_prebuilt
+
       # The codegen crate is not a default member and no adapter alias builds it,
       # so its tests only run if invoked explicitly on the host target.
       - name: Run host-target OpenRTB codegen tests
@@ -351,6 +368,11 @@ jobs:
         run: |
           cargo clippy --manifest-path crates/trusted-server-cli/Cargo.toml --target "$(rustc -vV | sed -n 's/host: //p')" --all-targets -- -D warnings
 
+      - name: Run producer process supervision on macOS
+        if: runner.os == 'macOS'
+        run: |
+          cargo test --package trusted-server-release --target "$(rustc -vV | sed -n 's/host: //p')" --locked --bin trusted-server-release process::
+
       - name: Set up Chrome for browser fixture tests
         if: runner.os == 'macOS'
         id: setup-chrome
@@ -371,6 +393,11 @@ jobs:
           TRUSTED_SERVER__GIT_VERSION: abcdef0123456789abcdef0123456789abcdef01
         run: |
           cargo test --manifest-path crates/trusted-server-cli/Cargo.toml --target "$(rustc -vV | sed -n 's/host: //p')" --test release_build_facts
+          # The release cfg also selects resource discovery without the
+          # builder's checkout path; only a release-mode lib build reaches it.
+          cargo test --manifest-path crates/trusted-server-cli/Cargo.toml --target "$(rustc -vV | sed -n 's/host: //p')" --lib prebid_bundle::tests::actual_resource_discovery_uses_owning_release_cfg -- --exact > "$RUNNER_TEMP/release-cfg-result.txt"
+          cat "$RUNNER_TEMP/release-cfg-result.txt"
+          grep -E '^test result: ok\. 1 passed; 0 failed;' "$RUNNER_TEMP/release-cfg-result.txt"
 
       # A valid commit also passes when the release gate is bypassed, so check
       # that core's build script refuses a branch name in release mode.

AGENTS.md

@@ -377,7 +377,9 @@ Every PR must pass:
 13. CI Node pin guard: `node --test scripts/check-ci-node-pin.test.mjs && node scripts/check-ci-node-pin.mjs` with the `.tool-versions` Node (every CI job that compiles Rust sets up the `.tool-versions` Node before its first cargo step)
 14. Fastly absolute-deadline network fixtures under Viceroy (the harness builds the adapter test binary itself): `node crates/trusted-server-adapter-fastly/tests/deadline-origin.mjs "$(command -v viceroy)"`
 15. Worker auction-deadline runtime fixtures (`worker-auction-deadlines.yml`): build and lint the runtime fixture, then run it under the local runtime. For Cloudflare, `cargo build --locked -p trusted-server-adapter-cloudflare --example deadline-runtime --target wasm32-unknown-unknown --features cloudflare` and `node scripts/test-worker-auction-deadlines.mjs cloudflare --runtime "$(command -v wrangler)"` (requires wrangler and the `Cargo.lock` wasm-bindgen CLI). For Spin, `cargo build --locked -p trusted-server-adapter-spin --example deadline-runtime --target wasm32-wasip1 --features spin` and `node scripts/test-worker-auction-deadlines.mjs spin --runtime "$(command -v spin)"`. CI lints each fixture with the same `cargo clippy` arguments plus `-- -D warnings`
-16. Release producer checks: `node --test scripts/release/phase1.test.mjs && shellcheck scripts/release/phase1-build.sh`
+16. Release producer helpers: `node --test scripts/release/phase1.test.mjs && shellcheck scripts/release/phase1-build.sh scripts/release/validate-fastly-package.sh scripts/release/bootstrap.sh scripts/release/build.sh scripts/release/build-js.sh`
+17. Native release producer tests and lint: `cargo test --package trusted-server-release --target <host-triple> --locked` and `cargo clippy --package trusted-server-release --target <host-triple> --all-targets --all-features --locked -- -D warnings` (CI uses `x86_64-unknown-linux-gnu`).
+18. Native checked/ordinary JS release fixtures: `cargo test --package trusted-server-js --target <host-triple> --locked --test release_prebuilt` and `cargo clippy --package trusted-server-js --target <host-triple> --all-targets --all-features --locked -- -D warnings` (CI uses `x86_64-unknown-linux-gnu`).
 
 CI also runs these HTML EOF checks. Run them locally only when changing EOF
 finalization, publisher or HTML-processor code:

CHANGELOG.md

@@ -9,11 +9,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- Publish a reproducible, provenance- and SBOM-attested `trusted-server-fastly.tar.gz` alongside the Fastly wasm. Both ordinary builds use the same fixed service-neutral manifest and normalized archive metadata; the gate compares both complete files before signing. Operators can verify and deploy the downloaded package unchanged.
+
+- Add an ordinary Fastly release byte-equality gate and a real provenance-attested `trusted-server-fastly.wasm.rebuild-check.json`. Release CI now builds the Fastly wasm a second time on every push to `main` and every `v*` tag and requires both complete files to match byte for byte; a mismatch prevents signing and publication. The ordinary profile remains unqualified, native reproduction is not a release gate, and the four binary names and signer identity stay unchanged.
 - Add Phase 1 attested release binaries: the Fastly wasm and the `ts` CLI for Linux x86-64 and macOS (ARM64 and x86-64), with SPDX 2.3 inventories, provenance/SBOM bundles, immutable verification and a GNU glibc 2.34 startup check. Reproducibility, other adapters and the custom verifier remain later work; production publication requires maintainer settings.
 
 ### Changed
 
 - **Breaking:** Known `[integrations.*]` tables, `[tester_cookie]`, and `[tinybird]` now reject unknown fields, including in disabled integration blocks. Integration parse errors name the offending key. `ts config validate` and `ts config push` also reject unknown integration IDs and list the supported IDs; runtime startup warns and ignores unknown IDs for compatibility with stored configs. Before deploying the new binary, use the new CLI to run `ts config validate` on the current config, correct the reported fields and IDs, then push the cleaned config while the old binary is still running. On Fastly, wait for the config-store propagation window to elapse before activating the new binary; a successful push does not mean every point of presence (POP) has the new config. Stored unknown fields can otherwise prevent startup. Intentionally open payload maps remain supported. Lockr uses `app_id`; remove unsupported `organization_id` and `project_id` fields.
+- **Breaking:** The tsjs bundle build (`crates/trusted-server-js/lib/build-all.mjs`, run by Cargo builds of `trusted-server-js` and by `npm run build`) now requires a Node.js with `import.meta.main` (22.18 or later, or 24.2 or later) and fails on older versions; use the `.tool-versions` Node.
+- **Breaking:** Cargo builds of `trusted-server-js` now fail whenever `TSJS_SKIP_BUILD` is set to any value, including empty or `0`; previously only `TSJS_SKIP_BUILD=1` was rejected. Remove it from shell profiles and `.env` files, and use `TSJS_PREBUILT_DIR` to embed prebuilt bundles instead.
 - The attested Fastly wasm reports `x-ts-version` as the full 40-character source commit; deploy-pipeline builds keep the tag, branch or short-commit value described below.
 - **Breaking:** `ts --version` now prints `ts package=<version> source=<source> target=<triple> variant=default` instead of `ts <version>`. `source` is the full commit in attested release binaries, and otherwise the development ref, short commit or `unknown`. Update scripts that parse the old output.
 - **Breaking:** Creative rewrite proxy, click, CSS, `srcset`, sign-response, rebuild-response, and injected creative TSJS URLs are now absolute on `publisher.public_origin`. Review the [default authority, cookie scope, and coordinated upgrade/rollback warning for `public_origin`](docs/guide/configuration.md#publisher-configuration) before deployment. Existing root-relative signed proxy and click inputs remain accepted. TSJS bundle selection and hash calculation are unchanged.

Cargo.toml

@@ -13,6 +13,7 @@ members = [
     # Manual protobuf codegen tool — a member so it shares workspace settings,
     # but no default member or alias builds it. Run it explicitly with `-p`.
     "crates/trusted-server-openrtb-codegen",
+    "crates/trusted-server-release",
 ]
 
 # Viceroy (cargo test-fastly runner) calls `cargo run --bin trusted-server-adapter-fastly`

crates/trusted-server-adapter-spin/src/app.rs

@@ -568,8 +568,8 @@ impl TrustedServerApp {
     /// Build the full application router from explicit settings.
     ///
     /// Testing seam: cross-adapter parity tests use this to drive the router
-    /// with known-good settings instead of the baked `get_settings()` result,
-    /// whose embedded placeholder secrets fail validation by design.
+    /// with known-good settings without external runtime configuration or
+    /// secret-store bindings.
     ///
     /// # Errors
     ///

crates/trusted-server-adapter-spin/src/middleware.rs

@@ -221,9 +221,8 @@ mod tests {
     }
 
     fn settings_with_response_headers(headers: Vec<(&str, &str)>) -> Settings {
-        // Build from explicit test settings: the settings baked into the
-        // binary contain placeholder secrets that `get_settings()` rejects
-        // by design.
+        // Build explicit, deterministic test settings without external runtime
+        // configuration or secret-store bindings.
         let mut s = Settings::from_toml(
             r#"
                 [[handlers]]

crates/trusted-server-adapter-spin/tests/routes.rs

@@ -14,9 +14,9 @@ use trusted_server_core::settings::Settings;
 
 /// Build the full application router from explicit test settings.
 ///
-/// The settings baked into the binary contain placeholder secrets that
-/// `get_settings()` rejects by design, which would turn every route into a
-/// startup error page (and its route table into the fallback-only set).
+/// Explicit settings exercise the full route table without external runtime
+/// configuration or secret-store bindings. Missing runtime settings would
+/// otherwise select the startup error router.
 /// The handler regex is the production-shaped `^/_ts/admin`, matching
 /// `Settings::ADMIN_ENDPOINTS` and the default config, so the canonical
 /// `/_ts/admin/keys/*` routes are auth-gated exactly as in production.

crates/trusted-server-cli/build.rs

@@ -8,6 +8,13 @@
 
 fn main() {
     println!("cargo:rerun-if-changed=build.rs");
+    println!("cargo:rerun-if-env-changed=TRUSTED_SERVER__RELEASE_BUILD");
+    println!("cargo:rustc-check-cfg=cfg(trusted_server_release_build)");
+    // Core's build script rejects an invalid release control for every product
+    // build; this only selects release-only resource discovery.
+    if std::env::var_os("TRUSTED_SERVER__RELEASE_BUILD").is_some() {
+        println!("cargo:rustc-cfg=trusted_server_release_build");
+    }
     let target = std::env::var("TARGET").expect("should set the owning Cargo target");
     println!("cargo:rustc-env=TRUSTED_SERVER__BUILD_TARGET={target}");
 }

crates/trusted-server-cli/src/prebid_bundle.rs

@@ -627,18 +627,28 @@ fn ensure_file_exists(path: &Path, description: &str) -> CliResult<()> {
 }
 
 fn find_js_lib_dir(start: &Path) -> CliResult<PathBuf> {
+    #[cfg(not(trusted_server_release_build))]
+    let fallback = Some(
+        PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+            .join("../..")
+            .join("crates/trusted-server-js/lib"),
+    );
+    #[cfg(trusted_server_release_build)]
+    let fallback: Option<PathBuf> = None;
+    find_js_lib_dir_with_fallback(start, fallback.as_deref())
+}
+
+fn find_js_lib_dir_with_fallback(start: &Path, fallback: Option<&Path>) -> CliResult<PathBuf> {
     for ancestor in start.ancestors() {
         let candidate = ancestor.join("crates/trusted-server-js/lib");
         if is_js_lib_dir(&candidate) {
             return Ok(candidate);
         }
     }
 
-    let manifest_dir = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
-    let candidate = manifest_dir
-        .join("../..")
-        .join("crates/trusted-server-js/lib");
-    if is_js_lib_dir(&candidate) {
+    if let Some(candidate) = fallback
+        && is_js_lib_dir(candidate)
+    {
         return candidate.canonicalize().map_err(|error| {
             report_error(format!(
                 "failed to resolve JS library directory {}: {error}",
@@ -815,6 +825,71 @@ mod tests {
     #[cfg(unix)]
     use std::os::unix::fs::PermissionsExt as _;
 
+    #[test]
+    fn resource_discovery_without_fallback_requires_runtime_checkout() {
+        let directory = tempfile::tempdir().expect("should create outside checkout fixture");
+        let error = find_js_lib_dir_with_fallback(directory.path(), None)
+            .expect_err("should require runtime checkout when fallback is absent");
+        assert!(
+            error
+                .to_string()
+                .contains("run `ts prebid client` from the Trusted Server repository"),
+            "should explain the missing source prerequisites"
+        );
+        let resources = directory.path().join("crates/trusted-server-js/lib");
+        fs::create_dir_all(&resources).expect("should create runtime resources");
+        fs::write(resources.join("package.json"), "{}").expect("should create package fixture");
+        fs::write(resources.join("build-prebid-external.mjs"), "")
+            .expect("should create builder fixture");
+        let nested = directory.path().join("nested");
+        fs::create_dir(&nested).expect("should create nested current directory");
+        assert_eq!(
+            find_js_lib_dir_with_fallback(&nested, None)
+                .expect("should discover actual runtime checkout"),
+            resources,
+            "should discover runtime ancestor resources"
+        );
+    }
+
+    #[test]
+    fn resource_discovery_uses_explicit_development_fallback() {
+        let directory = tempfile::tempdir().expect("should create fixture");
+        let resources = directory.path().join("development-lib");
+        fs::create_dir(&resources).expect("should create development fallback");
+        fs::write(resources.join("package.json"), "{}").expect("should create package fixture");
+        fs::write(resources.join("build-prebid-external.mjs"), "")
+            .expect("should create builder fixture");
+        assert_eq!(
+            find_js_lib_dir_with_fallback(directory.path(), Some(&resources))
+                .expect("should use explicit development fallback"),
+            resources
+                .canonicalize()
+                .expect("should canonicalize fallback"),
+            "should preserve development fallback behavior"
+        );
+    }
+
+    #[test]
+    fn actual_resource_discovery_uses_owning_release_cfg() {
+        let directory = tempfile::tempdir().expect("should create outside checkout fixture");
+        let result = find_js_lib_dir(directory.path());
+        if cfg!(trusted_server_release_build) {
+            let error =
+                result.expect_err("should exclude the compiled developer checkout in release mode");
+            assert!(
+                error
+                    .to_string()
+                    .contains("run `ts prebid client` from the Trusted Server repository"),
+                "should identify release source prerequisites"
+            );
+        } else {
+            assert!(
+                result.is_ok(),
+                "should retain the compiled checkout fallback in development"
+            );
+        }
+    }
+
     fn managed_config(managed: &str, user_id: &str) -> String {
         format!(
             r#"

crates/trusted-server-cli/tests/release_build_facts.rs

@@ -72,11 +72,22 @@ fn cli_build_script_emits_only_its_target() {
         )
         .expect("should emit UTF-8 directives"),
     );
-    for directives in &outputs {
+    for (index, directives) in outputs.iter().enumerate() {
+        // Release-only resource discovery is selected for the two release runs.
+        let release_cfg = if index < 2 {
+            "cargo:rustc-cfg=trusted_server_release_build\n"
+        } else {
+            ""
+        };
         assert_eq!(
             directives,
-            "cargo:rerun-if-changed=build.rs\n\
-             cargo:rustc-env=TRUSTED_SERVER__BUILD_TARGET=example-target\n",
+            &format!(
+                "cargo:rerun-if-changed=build.rs\n\
+                 cargo:rerun-if-env-changed=TRUSTED_SERVER__RELEASE_BUILD\n\
+                 cargo:rustc-check-cfg=cfg(trusted_server_release_build)\n\
+                 {release_cfg}\
+                 cargo:rustc-env=TRUSTED_SERVER__BUILD_TARGET=example-target\n"
+            ),
             "should emit only the target owned by Cargo TARGET"
         );
     }