Exercise federated directories and browser-local signing

.github/workflows/ci.yml

@@ -22,14 +22,14 @@ jobs:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           repository: HTMLTrust/htmltrust-canonicalization
-          ref: 5e51040dcaaf50935e245702bdefbc18a1d542ce
+          ref: 760593d4a02e9fffa56dc4d002eb52ab2ade1b49
           path: htmltrust-canonicalization
           persist-credentials: false
 
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           repository: HTMLTrust/htmltrust-browser-client
-          ref: f21504e170c6b29e91eda3bb491bf4580e5f5a86
+          ref: 70c5ddb6ed23c06c0b1c46d5284618fb99a28aac
           path: htmltrust-browser-client
           persist-credentials: false
 
@@ -55,8 +55,13 @@ jobs:
         working-directory: htmltrust-e2e
         run: |
           npm test
+          npm run test:analysis
           npm run build
 
+      - name: Browser lifecycle engines
+        working-directory: htmltrust-e2e
+        run: npm run test:browser:engines
+
       - name: Audit dependencies
         working-directory: htmltrust-e2e
         run: npm audit --audit-level=low

.gitignore

@@ -1,5 +1,8 @@
 node_modules/
 dist/
+.env
+.env.*
+!.env.example
 results/
 output/
 hugo-sites/

Dockerfile.nginx

@@ -1,4 +1,4 @@
-FROM nginx:1.29.1-alpine
+FROM nginx:1.29.1-alpine@sha256:42a516af16b852e33b7682d5ef8acbd5d13fe08fecadc7ed98605ba5e3b26ab8
 
 # Test-only wildcard certificate for the isolated htmltrust Docker network.
 # Browsers in the harness explicitly allow this self-signed certificate.

Dockerfile.trust-server

@@ -1,4 +1,4 @@
-FROM node:22-slim
+FROM node:22-slim@sha256:83f487e0a63425e5b4d146fb5e5be574bcbe1b7b843d3ebafdd95eaf7767a7e5
 WORKDIR /app
 
 # Copy the local canonicalization package first

Dockerfile.trust-server.dockerignore

@@ -0,0 +1,10 @@
+**
+!htmltrust-canonicalization/
+!htmltrust-canonicalization/javascript/
+!htmltrust-canonicalization/javascript/**
+htmltrust-canonicalization/javascript/node_modules/
+!htmltrust-server-reference/
+!htmltrust-server-reference/package.json
+!htmltrust-server-reference/package-lock.json
+!htmltrust-server-reference/src/
+!htmltrust-server-reference/src/**

Dockerfile.wordpress

@@ -1,4 +1,28 @@
-FROM wordpress:6-php8.2-apache
+FROM composer:2.8.11@sha256:68e926a477000f12e8645e82a020b84904d49071c895c4951551fe80eed5d103 AS composer
+
+FROM wordpress:6-php8.5-apache@sha256:d0503978e17bd0724f9b06b1ef6e5f7af80e83c98fa6f3eaea92780927d702cf
+
+COPY --from=composer /usr/bin/composer /usr/local/bin/composer
+
+RUN apt-get update \
+    && apt-get install --no-install-recommends --yes git libicu-dev libonig-dev unzip \
+    && docker-php-ext-install intl mbstring \
+    && rm -rf /var/lib/apt/lists/*
+
+# Build a self-contained plugin from the sibling checkout. The custom
+# entrypoint refreshes this exact directory in the test WordPress volume on
+# every container start, including when a previous run left the volume up.
+COPY htmltrust-cms-reference/wordpress /opt/htmltrust-content-signing
+RUN composer install \
+      --working-dir=/opt/htmltrust-content-signing \
+      --no-dev \
+      --prefer-dist \
+      --no-interaction \
+      --no-progress \
+      --optimize-autoloader
+
+COPY htmltrust-e2e/scripts/wordpress-entrypoint.sh /usr/local/bin/htmltrust-wordpress-entrypoint
+RUN chmod 0755 /usr/local/bin/htmltrust-wordpress-entrypoint
 
 # Install wp-cli from a pinned release, verified against the sha512 published
 # with that release. The previous source (the wp-cli/builds gh-pages branch)
@@ -43,3 +67,6 @@ RUN printf '%s\n' \
       '  remove_filter("the_excerpt", "wpautop");' \
       '}, 99);' \
     > /usr/src/wordpress/wp-content/mu-plugins/disable-content-filters.php
+
+ENTRYPOINT ["/usr/local/bin/htmltrust-wordpress-entrypoint"]
+CMD ["apache2-foreground"]

Dockerfile.wordpress.dockerignore

@@ -0,0 +1,9 @@
+**
+!htmltrust-cms-reference/
+!htmltrust-cms-reference/wordpress/
+!htmltrust-cms-reference/wordpress/**
+htmltrust-cms-reference/wordpress/vendor/
+htmltrust-cms-reference/wordpress/.phpunit.result.cache
+!htmltrust-e2e/
+!htmltrust-e2e/scripts/
+!htmltrust-e2e/scripts/wordpress-entrypoint.sh