feat(registryctl): add registry-backed Notary tutorial

crates/registryctl/Cargo.toml

@@ -17,10 +17,12 @@ anyhow = "1"
 base64 = "0.22"
 clap = { version = "4.5", features = ["derive"] }
 crc32fast = "1.4"
+ed25519-dalek.workspace = true
 getrandom = "0.4"
 hex.workspace = true
 include_dir = "0.7"
 ipnet.workspace = true
+rcgen.workspace = true
 registry-config-report = { workspace = true }
 registry-notary-core.workspace = true
 registry-notary-server = { workspace = true, features = ["registry-notary-cel"] }

crates/registryctl/src/main.rs

@@ -61,6 +61,15 @@ fn main() -> Result<()> {
                 OutputFormat::Json => print_json(&report)?,
             }
         }
+        Commands::Add { command } => match command {
+            AddCommand::Notary => {
+                let image_lock = registryctl::load_registryctl_image_lock()?;
+                print_json(&registryctl::add_notary_to_project(
+                    &std::env::current_dir()?,
+                    &image_lock,
+                )?)?;
+            }
+        },
         Commands::Test {
             project_dir,
             environment,
@@ -819,6 +828,11 @@ enum Commands {
         #[command(subcommand)]
         command: Option<Box<InitCommand>>,
     },
+    /// Add another local Registry Stack product to the current project.
+    Add {
+        #[command(subcommand)]
+        command: AddCommand,
+    },
     /// Run every project integration fixture offline.
     Test {
         /// Project workspace root.
@@ -924,6 +938,12 @@ enum Commands {
     },
 }
 
+#[derive(Debug, Subcommand)]
+enum AddCommand {
+    /// Add a local Notary and private consultation Relay over the benefits workbook.
+    Notary,
+}
+
 impl Commands {
     fn should_check_for_updates(&self) -> bool {
         !matches!(
@@ -1433,6 +1453,18 @@ deployment:
         assert!(matches!(cli.command, Commands::Restart));
     }
 
+    #[test]
+    fn add_notary_cli_parses() {
+        let cli = Cli::try_parse_from(["registryctl", "add", "notary"]).unwrap();
+
+        assert!(matches!(
+            cli.command,
+            Commands::Add {
+                command: AddCommand::Notary
+            }
+        ));
+    }
+
     #[test]
     fn legacy_notary_authoring_commands_are_removed() {
         assert!(Cli::try_parse_from(["registryctl", "init", "notary", "project"]).is_err());

crates/registryctl/src/project_authoring/commands.rs

@@ -753,6 +753,28 @@ pub fn check_registry_project(options: &ProjectCheckOptions) -> Result<ProjectCo
 }
 
 pub fn build_registry_project(options: &ProjectBuildOptions) -> Result<ProjectCommandReport> {
+    build_registry_project_inner(options, false, None)
+}
+
+/// Build the closed local tutorial runtime in one atomic publication.
+///
+/// These overrides are fixed in reviewed `registryctl` code, are not authored
+/// extension input, and are revalidated with the production product models
+/// before publication. Applying them before `write_compiled_project` prevents
+/// containers from observing the compiler's PostgreSQL defaults between the
+/// generated build and the tutorial's in-memory runtime configuration.
+pub(crate) fn build_registry_project_for_local_tutorial(
+    options: &ProjectBuildOptions,
+    runtime_identity: Option<crate::RuntimeIdentity>,
+) -> Result<ProjectCommandReport> {
+    build_registry_project_inner(options, true, runtime_identity)
+}
+
+fn build_registry_project_inner(
+    options: &ProjectBuildOptions,
+    local_tutorial_runtime: bool,
+    runtime_identity: Option<crate::RuntimeIdentity>,
+) -> Result<ProjectCommandReport> {
     validate_baseline_pair(options.against.as_deref(), options.anchor.as_deref())?;
     let loaded = load_registry_project(
         &options.project_directory,
@@ -764,15 +786,18 @@ pub fn build_registry_project(options: &ProjectBuildOptions) -> Result<ProjectCo
         options.anchor.as_deref(),
         &loaded,
     )?;
-    let compiled = compile_project(&loaded, baseline.as_ref())?;
+    let mut compiled = compile_project(&loaded, baseline.as_ref())?;
+    if local_tutorial_runtime {
+        apply_local_tutorial_runtime_overrides(&mut compiled)?;
+    }
     validate_generated_product_configs(&compiled)?;
     let fixtures = execute_all_fixtures(&loaded, &compiled, None, None, false)?;
     require_passing_fixtures(&fixtures)?;
     let output = loaded
         .root
         .join(BUILD_ROOT)
         .join(options.environment.as_str());
-    write_compiled_project(&loaded.root, &output, &compiled)?;
+    write_compiled_project(&loaded.root, &output, &compiled, runtime_identity)?;
     Ok(ProjectCommandReport {
         status: "built",
         project: loaded.project.registry.id.clone(),
@@ -789,6 +814,45 @@ pub fn build_registry_project(options: &ProjectBuildOptions) -> Result<ProjectCo
     })
 }
 
+fn apply_local_tutorial_runtime_overrides(compiled: &mut CompiledProject) -> Result<()> {
+    let notary = compiled
+        .notary_private
+        .get_mut(Path::new("config/notary.yaml"))
+        .ok_or_else(|| anyhow!("generated local Notary config is absent"))?;
+    let mut notary_config: serde_yaml::Value = serde_yaml::from_slice(notary)
+        .context("generated local Notary config did not parse")?;
+    notary_config["server"]["bind"] =
+        serde_yaml::Value::String("0.0.0.0:8081".to_string());
+    notary_config["state"] = serde_yaml::from_str("storage: in_memory\n")?;
+    notary_config["evidence"]["signing_keys"] = serde_yaml::from_str(&format!(
+        "relay-workload:\n  provider: local_jwk_env\n  private_jwk_env: {}\n  alg: EdDSA\n  kid: {}\n  status: active\n",
+        super::NOTARY_RELAY_WORKLOAD_JWK_ENV,
+        super::NOTARY_RELAY_WORKLOAD_KID,
+    ))?;
+    *notary = serde_yaml::to_string(&notary_config)
+        .context("failed to render local Notary config")?
+        .into_bytes()
+        .into_boxed_slice();
+
+    let relay = compiled
+        .relay_private
+        .get_mut(Path::new("config/relay.yaml"))
+        .ok_or_else(|| anyhow!("generated local consultation Relay config is absent"))?;
+    let mut relay_config: serde_yaml::Value = serde_yaml::from_slice(relay)
+        .context("generated local consultation Relay config did not parse")?;
+    relay_config["server"]["bind"] =
+        serde_yaml::Value::String("0.0.0.0:8082".to_string());
+    relay_config["auth"]["oidc"]["allow_dev_insecure_fetch_urls"] =
+        serde_yaml::Value::Bool(true);
+    relay_config["consultation"]["state_plane"]["root_certificate_path"] =
+        serde_yaml::Value::String("/run/registry-tls/state-plane-ca.pem".to_string());
+    *relay = serde_yaml::to_string(&relay_config)
+        .context("failed to render local consultation Relay config")?
+        .into_bytes()
+        .into_boxed_slice();
+    Ok(())
+}
+
 fn require_passing_fixtures(fixtures: &[FixtureReport]) -> Result<()> {
     let failing = fixtures
         .iter()

crates/registryctl/src/project_authoring/output.rs

@@ -265,7 +265,12 @@ fn generated_evidence(
         .collect()
 }
 
-fn write_compiled_project(root: &Path, output: &Path, compiled: &CompiledProject) -> Result<()> {
+fn write_compiled_project(
+    root: &Path,
+    output: &Path,
+    compiled: &CompiledProject,
+    runtime_identity: Option<crate::RuntimeIdentity>,
+) -> Result<()> {
     let expected_parent = root.join(BUILD_ROOT);
     let parent = output
         .parent()
@@ -313,6 +318,15 @@ fn write_compiled_project(root: &Path, output: &Path, compiled: &CompiledProject
             &approval_state_bytes,
         )?;
     }
+    if let Some(identity) = runtime_identity {
+        // The temporary build root is freshly created owner-only state and is
+        // not published until the rename below. Privileged ownership changes
+        // are confined to the two config trees mounted into containers, so a
+        // failure leaves the prior published build untouched.
+        for relative in ["private/relay/config", "private/notary/config"] {
+            assign_unpublished_runtime_input_owner(&temporary.join(relative), identity)?;
+        }
+    }
 
     let backup = expected_parent.join(format!(".{name}.previous-{}", std::process::id()));
     if backup.exists() {
@@ -337,6 +351,52 @@ fn write_compiled_project(root: &Path, output: &Path, compiled: &CompiledProject
     Ok(())
 }
 
+#[cfg(unix)]
+fn assign_unpublished_runtime_input_owner(
+    path: &Path,
+    identity: crate::RuntimeIdentity,
+) -> Result<()> {
+    use std::os::unix::fs::{lchown, MetadataExt};
+
+    let metadata = fs::symlink_metadata(path)
+        .with_context(|| format!("failed to inspect unpublished runtime input {}", path.display()))?;
+    if metadata.file_type().is_symlink() || (!metadata.is_dir() && !metadata.is_file()) {
+        bail!(
+            "unpublished runtime input contains an unsupported file type: {}",
+            path.display()
+        );
+    }
+    if metadata.is_dir() {
+        for entry in fs::read_dir(path)
+            .with_context(|| format!("failed to read unpublished runtime input {}", path.display()))?
+        {
+            let child = entry
+                .with_context(|| {
+                    format!("failed to read an entry under unpublished runtime input {}", path.display())
+                })?
+                .path();
+            assign_unpublished_runtime_input_owner(&child, identity)?;
+        }
+    }
+    if metadata.uid() != identity.uid || metadata.gid() != identity.gid {
+        lchown(path, Some(identity.uid), Some(identity.gid)).with_context(|| {
+            format!(
+                "failed to assign unpublished runtime input {} to {}:{}; the prior generated build remains active",
+                path.display(), identity.uid, identity.gid
+            )
+        })?;
+    }
+    Ok(())
+}
+
+#[cfg(not(unix))]
+fn assign_unpublished_runtime_input_owner(
+    _path: &Path,
+    _identity: crate::RuntimeIdentity,
+) -> Result<()> {
+    Ok(())
+}
+
 fn write_file_map(root: &Path, files: &BTreeMap<PathBuf, Box<[u8]>>) -> Result<()> {
     for (relative, bytes) in files {
         validate_relative_authored_path(relative)?;