Harden runtime distribution acceptance

.gitea/workflows/runtime-distribution.yml

@@ -162,6 +162,21 @@ jobs:
           WEB_DIGEST="sha256:$(sha256sum runtime-output/web-index.json | cut -d' ' -f1)"
           python tools/release/resolve-oci-platforms.py --repository git.add-ideas.de/govoplan/runtime-api --index-digest "$API_DIGEST" --index runtime-output/api-index.json --output runtime-output/api-metadata.json
           python tools/release/resolve-oci-platforms.py --repository git.add-ideas.de/govoplan/runtime-web --index-digest "$WEB_DIGEST" --index runtime-output/web-index.json --output runtime-output/web-metadata.json
+      - name: Exercise amd64 and arm64 runtime images
+        working-directory: govoplan
+        env:
+          POSTGRES_IMAGE: ${{ inputs.postgres_image }}
+          REDIS_IMAGE: ${{ inputs.redis_image }}
+        run: |
+          for ARCH in amd64 arm64; do
+            .runtime-build/bin/python tools/checks/runtime-image-smoke.py \
+              --api-metadata runtime-output/api-metadata.json \
+              --web-metadata runtime-output/web-metadata.json \
+              --postgres-image "$POSTGRES_IMAGE" \
+              --redis-image "$REDIS_IMAGE" \
+              --platform "linux/$ARCH" \
+              --output "runtime-output/evidence/runtime-smoke-$ARCH.json"
+          done
       - name: Generate and sign distribution evidence
         working-directory: govoplan
         env:
@@ -209,14 +224,46 @@ jobs:
           openssl pkeyutl -sign -inkey runtime-output/signing-key.pem -rawin \
             -in runtime-output/govoplan-deploy.pyz \
             -out runtime-output/govoplan-deploy.pyz.sig
-          sha256sum runtime-output/govoplan-deploy.pyz > runtime-output/govoplan-deploy.pyz.sha256
-          sha256sum runtime-output/distribution-manifest.json > runtime-output/distribution-manifest.json.sha256
+          (cd runtime-output && sha256sum govoplan-deploy.pyz > govoplan-deploy.pyz.sha256)
+          (cd runtime-output && sha256sum distribution-manifest.json > distribution-manifest.json.sha256)
           rm runtime-output/signing-key.pem
       - name: Verify the published bundle contract with the zipapp
         working-directory: govoplan
         env:
           VERSION: ${{ inputs.version }}
+          SIGNING_KEY_ID: ${{ secrets.RUNTIME_DISTRIBUTION_SIGNING_KEY_ID }}
         run: |
+          (cd runtime-output && sha256sum --check govoplan-deploy.pyz.sha256)
+          (cd runtime-output && sha256sum --check distribution-manifest.json.sha256)
+          .runtime-build/bin/python - <<'PY'
+          import json
+          import os
+          from pathlib import Path
+
+          keyring = json.loads(
+              Path("runtime-output/distribution-keyring.json").read_text(encoding="utf-8")
+          )
+          key_id = os.environ["SIGNING_KEY_ID"]
+          matches = [item for item in keyring["keys"] if item.get("key_id") == key_id]
+          if len(matches) != 1 or matches[0].get("status") != "active":
+              raise SystemExit("runtime signing key is not uniquely active in the keyring")
+          Path("runtime-output/runtime-release-public.pem").write_text(
+              matches[0]["public_key_pem"], encoding="utf-8"
+          )
+          PY
+          openssl pkeyutl -verify -pubin \
+            -inkey runtime-output/runtime-release-public.pem -rawin \
+            -in runtime-output/govoplan-deploy.pyz \
+            -sigfile runtime-output/govoplan-deploy.pyz.sig
+          cp runtime-output/govoplan-deploy.pyz runtime-output/govoplan-deploy.tampered.pyz
+          printf '\0' >> runtime-output/govoplan-deploy.tampered.pyz
+          if openssl pkeyutl -verify -pubin \
+            -inkey runtime-output/runtime-release-public.pem -rawin \
+            -in runtime-output/govoplan-deploy.tampered.pyz \
+            -sigfile runtime-output/govoplan-deploy.pyz.sig >/dev/null 2>&1; then
+            echo "Tampered deployment bootstrap unexpectedly verified" >&2
+            exit 1
+          fi
           MANIFEST_SHA256="$(cut -d' ' -f1 runtime-output/distribution-manifest.json.sha256)"
           python runtime-output/govoplan-deploy.pyz init \
             --directory runtime-output/acceptance-install \
@@ -255,4 +302,6 @@ jobs:
             --asset runtime-output/evidence/api-sbom.cdx.json \
             --asset runtime-output/evidence/web-sbom.cdx.json \
             --asset runtime-output/evidence/api-provenance.json \
-            --asset runtime-output/evidence/web-provenance.json
+            --asset runtime-output/evidence/web-provenance.json \
+            --asset runtime-output/evidence/runtime-smoke-amd64.json \
+            --asset runtime-output/evidence/runtime-smoke-arm64.json