Identities and composite Ed25519 + ML-DSA-65 signatures; oxy identity, verify, config 1983686fb7a7

//! Identities and composite Ed25519 + ML-DSA-65 signatures (spec §14.2, §14.3).

//!

//! Both halves sign the same message, which binds the composite `KeyId`, and

//! verification requires both. A signature with either half missing, wrong,

//! or made for a different KeyId is invalid.

use crate::cbor::{self, Value};

use crate::hash::{hash_object, KeyId, ObjectRef, ObjectType};

use crate::objects::{array, bytes, check_version, field, oref, text, uint, ObjectError, FORMAT_VERSION};

use ed25519_dalek::ed25519::signature::Signer as _;

use ed25519_dalek::{Signature as EdSignature, SigningKey as EdSigningKey, VerifyingKey as EdVerifyingKey};

use ml_dsa::{EncodedSignature, EncodedVerifyingKey, MlDsa65, Seed, Signature as MlSignature, SigningKey as MlSigningKey, VerifyingKey as MlVerifyingKey};

use rand::RngCore;

pub const ED25519_PK_LEN: usize = 32;

pub const MLDSA65_PK_LEN: usize = 1952;

pub const ED25519_SIG_LEN: usize = 64;

pub const MLDSA65_SIG_LEN: usize = 3309;

/// `alg` value for Ed25519 + ML-DSA-65.

pub const ALG_COMPOSITE: u64 = 1;

#[derive(Clone, Debug, PartialEq, Eq)]

pub struct Identity {

    pub ed25519_pk: [u8; ED25519_PK_LEN],

    pub mldsa65_pk: Vec<u8>,

    pub name: String,

    pub email: String,

    pub created: u64,

    pub expires: Option<u64>,

    pub previous: Option<KeyId>,

    pub delegates: Vec<KeyId>,

}

impl Identity {

    pub fn to_value(&self) -> Value {

        Value::map([

            (0, Value::Uint(FORMAT_VERSION)),

            (1, Value::Bytes(self.ed25519_pk.to_vec())),

            (2, Value::Bytes(self.mldsa65_pk.clone())),

            (3, Value::Text(self.name.clone())),

            (4, Value::Text(self.email.clone())),

            (5, Value::Uint(self.created)),

            (6, self.expires.map(Value::Uint).unwrap_or(Value::Null)),

            (7, self.previous.map(|p| Value::Bytes(p.0.to_vec())).unwrap_or(Value::Null)),

            (8, Value::Array(self.delegates.iter().map(|d| Value::Bytes(d.0.to_vec())).collect())),

        ])

    }

    pub fn encode(&self) -> Vec<u8> {

        cbor::encode(&self.to_value())

    }

    pub fn hash(&self) -> KeyId {

        hash_object(ObjectType::Identity, &self.encode())

    }

    pub fn decode(b: &[u8]) -> Result<Identity, ObjectError> {

        let v = cbor::decode(b)?;

        let m = v.as_map().ok_or_else(|| ObjectError::Schema("identity: expected map".into()))?;

        check_version(m)?;

        let ed = bytes(field(m, 1, "ed25519_pk")?, "ed25519_pk")?;

        let ml = bytes(field(m, 2, "mldsa65_pk")?, "mldsa65_pk")?;

        if ed.len() != ED25519_PK_LEN || ml.len() != MLDSA65_PK_LEN {

            return Err(ObjectError::Schema("identity: wrong public key length".into()));

        }

        let opt_u = |v: &Value| -> Result<Option<u64>, ObjectError> { if v.is_null() { Ok(None) } else { uint(v, "expires").map(Some) } };

        let opt_r = |v: &Value| -> Result<Option<KeyId>, ObjectError> { if v.is_null() { Ok(None) } else { oref(v, "previous").map(Some) } };

        let mut delegates = array(field(m, 8, "delegates")?, "delegates")?.iter().map(|d| oref(d, "delegate")).collect::<Result<Vec<_>, _>>()?;

        delegates.sort();

        delegates.dedup();

        Ok(Identity {

            ed25519_pk: ed.try_into().unwrap(),

            mldsa65_pk: ml.to_vec(),

            name: text(field(m, 3, "name")?, "name")?.to_owned(),

            email: text(field(m, 4, "email")?, "email")?.to_owned(),

            created: uint(field(m, 5, "created")?, "created")?,

            expires: opt_u(field(m, 6, "expires")?)?,

            previous: opt_r(field(m, 7, "previous")?)?,

            delegates,

        })

    }

    fn ed_key(&self) -> Result<EdVerifyingKey, VerifyError> {

        EdVerifyingKey::from_bytes(&self.ed25519_pk).map_err(|_| VerifyError::BadKey)

    }

    fn ml_key(&self) -> Result<MlVerifyingKey<MlDsa65>, VerifyError> {

        let enc = EncodedVerifyingKey::<MlDsa65>::try_from(self.mldsa65_pk.as_slice()).map_err(|_| VerifyError::BadKey)?;

        Ok(MlVerifyingKey::decode(&enc))

    }

}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]

pub enum Domain {

    Change,

    Attest,

}

impl Domain {

    pub fn name(self) -> &'static str {

        match self {

            Domain::Change => "change",

            Domain::Attest => "attest",

        }

    }

}

/// `"oxy1 sig " || domain || 0x00 || KeyId || target` (spec §14.3).

pub fn signing_message(domain: Domain, key: &KeyId, target: &ObjectRef) -> Vec<u8> {

    let mut m = Vec::with_capacity(80);

    m.extend_from_slice(b"oxy1 sig ");

    m.extend_from_slice(domain.name().as_bytes());

    m.push(0);

    m.extend_from_slice(&key.0);

    m.extend_from_slice(&target.0);

    m

}

#[derive(Clone, PartialEq, Eq)]

pub struct Signature {

    pub key: KeyId,

    pub ed: [u8; ED25519_SIG_LEN],

    pub ml: Vec<u8>,

}

impl std::fmt::Debug for Signature {

    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {

        write!(f, "Signature(key {:?})", self.key)

    }

}

impl Signature {

    pub fn to_value(&self) -> Value {

        Value::map([

            (0, Value::Bytes(self.key.0.to_vec())),

            (1, Value::Uint(ALG_COMPOSITE)),

            (2, Value::Bytes(self.ed.to_vec())),

            (3, Value::Bytes(self.ml.clone())),

        ])

    }

    pub fn from_value(v: &Value) -> Result<Signature, ObjectError> {

        let m = v.as_map().ok_or_else(|| ObjectError::Schema("signature: expected map".into()))?;

        let alg = uint(field(m, 1, "alg")?, "alg")?;

        if alg != ALG_COMPOSITE {

            return Err(ObjectError::Schema(format!("unknown signature algorithm {alg}")));

        }

        let ed = bytes(field(m, 2, "ed")?, "ed")?;

        let ml = bytes(field(m, 3, "ml")?, "ml")?;

        if ed.len() != ED25519_SIG_LEN || ml.len() != MLDSA65_SIG_LEN {

            return Err(ObjectError::Schema("signature: wrong length".into()));

        }

        Ok(Signature { key: oref(field(m, 0, "key")?, "key")?, ed: ed.try_into().unwrap(), ml: ml.to_vec() })

    }

    pub fn encode_list(sigs: &[Signature]) -> Vec<u8> {

        cbor::encode(&Value::Array(sigs.iter().map(|s| s.to_value()).collect()))

    }

    pub fn decode_list(b: &[u8]) -> Result<Vec<Signature>, ObjectError> {

        let v = cbor::decode(b)?;

        array(&v, "signatures")?.iter().map(Signature::from_value).collect()

    }

}

#[derive(Clone, Copy, Debug, PartialEq, Eq, thiserror::Error)]

pub enum VerifyError {

    #[error("signature names a different key than the identity")]

    KeyMismatch,

    #[error("identity holds a malformed public key")]

    BadKey,

    #[error("Ed25519 signature invalid")]

    Ed25519,

    #[error("ML-DSA-65 signature invalid")]

    MlDsa,

}

/// Verify a composite signature by `identity` over `target` (spec §14.3).

pub fn verify(identity: &Identity, sig: &Signature, domain: Domain, target: &ObjectRef) -> Result<(), VerifyError> {

    let key = identity.hash();

    if sig.key != key {

        return Err(VerifyError::KeyMismatch);

    }

    let msg = signing_message(domain, &key, target);

    let ed_sig = EdSignature::from_bytes(&sig.ed);

    identity.ed_key()?.verify_strict(&msg, &ed_sig).map_err(|_| VerifyError::Ed25519)?;

    let enc = EncodedSignature::<MlDsa65>::try_from(sig.ml.as_slice()).map_err(|_| VerifyError::MlDsa)?;

    let ml_sig = MlSignature::<MlDsa65>::decode(&enc).ok_or(VerifyError::MlDsa)?;

    if !identity.ml_key()?.verify_with_context(&msg, b"", &ml_sig) {

        return Err(VerifyError::MlDsa);

    }

    Ok(())

}

/// The seeds of a composite key pair. Stored only in the user's key directory.

#[derive(Clone)]

pub struct SecretKey {

    pub ed_seed: [u8; 32],

    pub ml_seed: [u8; 32],

}

impl std::fmt::Debug for SecretKey {

    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {

        f.write_str("SecretKey(..)")

    }

}

impl SecretKey {

    pub fn generate() -> SecretKey {

        let mut ed_seed = [0u8; 32];

        let mut ml_seed = [0u8; 32];

        rand::rngs::OsRng.fill_bytes(&mut ed_seed);

        rand::rngs::OsRng.fill_bytes(&mut ml_seed);

        SecretKey { ed_seed, ml_seed }

    }

    fn ed(&self) -> EdSigningKey {

        EdSigningKey::from_bytes(&self.ed_seed)

    }

    fn ml(&self) -> MlSigningKey<MlDsa65> {

        MlSigningKey::from_seed(&Seed::from(self.ml_seed))

    }

    /// The identity object for these keys.

    pub fn identity(&self, name: &str, email: &str, created: u64) -> Identity {

        Identity {

            ed25519_pk: self.ed().verifying_key().to_bytes(),

            mldsa65_pk: self.ml().expanded_key().verifying_key().encode().as_slice().to_vec(),

            name: name.into(),

            email: email.into(),

            created,

            expires: None,

            previous: None,

            delegates: vec![],

        }

    }

    pub fn sign(&self, domain: Domain, key: &KeyId, target: &ObjectRef) -> Signature {

        let msg = signing_message(domain, key, target);

        let ed = self.ed().sign(&msg).to_bytes();

        let ml = self.ml().expanded_key().sign_deterministic(&msg, b"").expect("empty context is valid").encode().as_slice().to_vec();

        Signature { key: *key, ed, ml }

    }

    pub fn encode(&self, key: &KeyId) -> Vec<u8> {

        cbor::encode(&Value::map([

            (0, Value::Uint(FORMAT_VERSION)),

            (1, Value::Bytes(key.0.to_vec())),

            (2, Value::Bytes(self.ed_seed.to_vec())),

            (3, Value::Bytes(self.ml_seed.to_vec())),

        ]))

    }

    pub fn decode(b: &[u8]) -> Result<(KeyId, SecretKey), ObjectError> {

        let v = cbor::decode(b)?;

        let m = v.as_map().ok_or_else(|| ObjectError::Schema("secret key: expected map".into()))?;

        check_version(m)?;

        let seed = |k: u64| -> Result<[u8; 32], ObjectError> {

            bytes(field(m, k, "seed")?, "seed")?.try_into().map_err(|_| ObjectError::Schema("seed: expected 32 bytes".into()))

        };

        Ok((oref(field(m, 1, "key")?, "key")?, SecretKey { ed_seed: seed(2)?, ml_seed: seed(3)? }))

    }

}

#[cfg(test)]

mod tests {

    use super::*;

    fn fixed_key() -> SecretKey {

        SecretKey { ed_seed: [1; 32], ml_seed: [2; 32] }

    }

    #[test]

    fn identity_round_trip_and_sizes() {

        let sk = fixed_key();

        let id = sk.identity("Ada", "[email protected]", 1_700_000_000_000);

        assert_eq!(id.mldsa65_pk.len(), MLDSA65_PK_LEN);

        let d = Identity::decode(&id.encode()).unwrap();

        assert_eq!(d, id);

        assert_eq!(d.hash(), id.hash());

        // Deterministic from seeds.

        assert_eq!(fixed_key().identity("Ada", "[email protected]", 1_700_000_000_000).hash(), id.hash());

        let mut other = id.clone();

        other.delegates.push(ObjectRef([9; 32]));

        assert_ne!(other.hash(), id.hash());

    }

    #[test]

    fn sign_and_verify() {

        let sk = fixed_key();

        let id = sk.identity("Ada", "[email protected]", 1);

        let key = id.hash();

        let target = ObjectRef([7; 32]);

        let sig = sk.sign(Domain::Change, &key, &target);

        assert_eq!(sig.ml.len(), MLDSA65_SIG_LEN);

        assert_eq!(verify(&id, &sig, Domain::Change, &target), Ok(()));

        // Different target, different domain: invalid.

        assert_eq!(verify(&id, &sig, Domain::Change, &ObjectRef([8; 32])), Err(VerifyError::Ed25519));

        assert_eq!(verify(&id, &sig, Domain::Attest, &target), Err(VerifyError::Ed25519));

        // Deterministic signatures.

        assert_eq!(sk.sign(Domain::Change, &key, &target), sig);

        // Signature list round trip.

        let l = Signature::decode_list(&Signature::encode_list(&[sig.clone()])).unwrap();

        assert_eq!(l, vec![sig]);

    }

    #[test]

    fn stripping_or_forging_either_half_fails() {

        let sk = fixed_key();

        let id = sk.identity("Ada", "a@b", 1);

        let key = id.hash();

        let target = ObjectRef([7; 32]);

        let good = sk.sign(Domain::Change, &key, &target);

        let mut no_ml = good.clone();

        no_ml.ml = vec![0; MLDSA65_SIG_LEN];

        assert_eq!(verify(&id, &no_ml, Domain::Change, &target), Err(VerifyError::MlDsa));

        let mut bad_ed = good.clone();

        bad_ed.ed[10] ^= 1;

        assert_eq!(verify(&id, &bad_ed, Domain::Change, &target), Err(VerifyError::Ed25519));

        // A signature made for another KeyId over the same target does not transfer.

        let other = SecretKey { ed_seed: [3; 32], ml_seed: [4; 32] };

        let other_id = other.identity("Bob", "b@b", 1);

        let theirs = other.sign(Domain::Change, &other_id.hash(), &target);

        assert_eq!(verify(&id, &theirs, Domain::Change, &target), Err(VerifyError::KeyMismatch));

        let mut relabelled = theirs.clone();

        relabelled.key = key;

        assert_eq!(verify(&id, &relabelled, Domain::Change, &target), Err(VerifyError::Ed25519));

        // Wrong length is rejected at decode time.

        let mut short = good.to_value();

        if let Value::Map(m) = &mut short {

            m.insert(3, Value::Bytes(vec![0; 10]));

        }

        assert!(Signature::from_value(&short).is_err());

    }

    #[test]

    fn secret_key_round_trip() {

        let sk = fixed_key();

        let key = sk.identity("x", "y", 0).hash();

        let (k, d) = SecretKey::decode(&sk.encode(&key)).unwrap();

        assert_eq!(k, key);

        assert_eq!(d.ed_seed, sk.ed_seed);

        assert_eq!(d.ml_seed, sk.ml_seed);

        assert_ne!(SecretKey::generate().ed_seed, SecretKey::generate().ed_seed);

    }

}

pub mod identity;

//! Not yet implemented from the spec: seals, attestations and trust policy,

//! packs, checkpoints, multiple workspaces, remotes, and resolving conflicts

//! by editing markers. Changes are signed individually when `core.sign` is

//! `change`; the default `seal` leaves them unsigned until push exists.

use crate::hash::{hash_object, ChangeHash, KeyId, ObjectRef, ObjectType};

use crate::identity::{self, Domain, Identity, SecretKey, Signature};

    /// The KeyId of the author's identity, once `create_identity` has run.

    pub author_key: Option<KeyId>,

    /// `core.sign`: sign every change at commit (`true`) or leave signing to

    /// push-time seals (`false`, the spec default).

    pub sign_changes: bool,

            author_key: None,

            sign_changes: false,

    /// Set a key as `oxy config` does; returns false for unknown keys.

    pub fn set(&mut self, key: &str, value: &str) -> Result<()> {

        match key {

            "author.name" => self.author_name = value.into(),

            "author.email" => self.author_email = value.into(),

            "author.key" => {

                self.author_key = if value.is_empty() {

                    None

                } else {

                    Some(KeyId::from_hex(value).ok_or_else(|| RepoError::Msg("author.key must be a 64-character hex KeyId".into()))?)

                }

            }

            "core.sign" => {

                self.sign_changes = match value {

                    "change" => true,

                    "seal" => false,

                    _ => return fail("core.sign must be \"change\" or \"seal\""),

                }

            }

            "workspace.bookmark" => self.bookmark = value.into(),

            _ => return fail(format!("unknown configuration key {key:?}")),

        }

        Ok(())

    }

            let _ = c.set(k.trim(), &v);

            "author.name = \"{}\"\nauthor.email = \"{}\"\nauthor.key = \"{}\"\ncore.sign = \"{}\"\nworkspace.bookmark = \"{}\"\n",

            self.author_name,

            self.author_email,

            self.author_key.map(|k| k.to_hex()).unwrap_or_default(),

            if self.sign_changes { "change" } else { "seal" },

            self.bookmark

    keys_dir: PathBuf,

/// Where secret keys live: `$OXY_HOME/keys`, else `$XDG_CONFIG_HOME/oxy/keys`,

/// else `~/.config/oxy/keys`.

pub fn default_keys_dir() -> PathBuf {

    if let Ok(h) = std::env::var("OXY_HOME") {

        return PathBuf::from(h).join("keys");

    }

    if let Ok(x) = std::env::var("XDG_CONFIG_HOME") {

        return PathBuf::from(x).join("oxy").join("keys");

    }

    let home = std::env::var("HOME").unwrap_or_else(|_| ".".into());

    PathBuf::from(home).join(".config").join("oxy").join("keys")

}

/// Outcome of verifying the signatures on a change (spec §14.3, §14.4).

#[derive(Clone, Debug, PartialEq, Eq)]

pub enum SignatureStatus {

    Unsigned,

    Valid { key: KeyId, name: String, email: String },

    Invalid(String),

}

        let repo = Repo { root, oxy, store, workspace, keys_dir: default_keys_dir(), config };

                return Ok(Repo { root: d.to_path_buf(), oxy, store, workspace, keys_dir: default_keys_dir(), config });

    /// Use a different secret key directory (tests, or `--keys-dir`).

    pub fn with_keys_dir(mut self, dir: impl Into<PathBuf>) -> Repo {

        self.keys_dir = dir.into();

        self

    }

    pub fn save_config(&self) -> Result<()> {

        self.config.save(&self.oxy.join("config"))

    }

    fn author(&self) -> KeyId {

        self.config.author_key.unwrap_or(ObjectRef::ZERO)

    }

    // ------------------------------------------------------------ identity

    /// Generate a composite key pair, store its identity object, keep the

    /// secret in the key directory, and make it this repository's author.

    pub fn create_identity(&mut self, name: &str, email: &str) -> Result<(KeyId, Identity)> {

        let sk = SecretKey::generate();

        let id = sk.identity(name, email, Hlc::now().wall_ms);

        let key = self.store.put_identity(&id)?;

        fs::create_dir_all(&self.keys_dir)?;

        let path = self.keys_dir.join(format!("{}.secret", key.to_hex()));

        write_atomic(&path, &sk.encode(&key))?;

        #[cfg(unix)]

        {

            use std::os::unix::fs::PermissionsExt;

            fs::set_permissions(&path, fs::Permissions::from_mode(0o600))?;

        }

        self.config.author_name = name.into();

        self.config.author_email = email.into();

        self.config.author_key = Some(key);

        self.save_config()?;

        Ok((key, id))

    }

    /// The secret key for `author.key`, if configured and present on disk.

    pub fn secret_key(&self) -> Result<Option<(KeyId, SecretKey)>> {

        let Some(key) = self.config.author_key else { return Ok(None) };

        let path = self.keys_dir.join(format!("{}.secret", key.to_hex()));

        match fs::read(&path) {

            Ok(b) => {

                let (k, sk) = SecretKey::decode(&b)?;

                if k != key {

                    return fail(format!("{} holds a different key than its name", path.display()));

                }

                Ok(Some((k, sk)))

            }

            Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(None),

            Err(e) => Err(e.into()),

        }

    }

    pub fn identity(&self, key: &KeyId) -> Result<Identity> {

        Ok(self.store.get_identity(key)?)

    }

    /// Sign a stored change with the configured secret key.

    pub fn sign_change(&self, hash: &ChangeHash) -> Result<Signature> {

        let Some((key, sk)) = self.secret_key()? else {

            return fail("no secret key: run `oxy identity create` first");

        };

        let sig = sk.sign(Domain::Change, &key, hash);

        self.store.put_signature(hash, &sig)?;

        Ok(sig)

    }

    /// Check the signatures on a change against the author-or-delegate rule.

    pub fn verify_change(&self, hash: &ChangeHash) -> Result<SignatureStatus> {

        let change = self.store.get_change(hash)?;

        let sigs = self.store.signatures(hash)?;

        if sigs.is_empty() {

            return Ok(SignatureStatus::Unsigned);

        }

        let mut last_err = String::new();

        for sig in &sigs {

            let id = match self.store.get_identity(&sig.key) {

                Ok(id) => id,

                Err(_) => {

                    last_err = format!("unknown key {}", sig.key.short(12));

                    continue;

                }

            };

            let authorised = sig.key == change.author

                || self.store.get_identity(&change.author).map(|a| a.delegates.contains(&sig.key)).unwrap_or(false);

            if !authorised {

                last_err = format!("key {} is neither the author nor a delegate", sig.key.short(12));

                continue;

            }

            match identity::verify(&id, sig, Domain::Change, hash) {

                Ok(()) => return Ok(SignatureStatus::Valid { key: sig.key, name: id.name, email: id.email }),

                Err(e) => last_err = e.to_string(),

            }

        }

        Ok(SignatureStatus::Invalid(last_err))

    }

            author: self.author(),

            author: self.author(),

        if self.config.sign_changes && self.secret_key()?.is_none() {

            return fail("core.sign is \"change\" but no secret key is available for author.key");

        }

            author: self.author(),

        if self.config.sign_changes {

            self.sign_change(&hash)?;

        }

        entries.sort_by(|a, b| b.is_working_copy.cmp(&a.is_working_copy).then(b.change.hlc.cmp(&a.change.hlc)).then(b.hash.cmp(&a.hash)));

    fn identities_and_signed_commits() {

        let dir = tempfile::tempdir().unwrap();

        let root = dir.path();

        let mut repo = Repo::init(root).unwrap().with_keys_dir(root.join("keys"));

        write(root, "a.txt", b"a\n");

        let h0 = repo.commit("unsigned", &[]).unwrap();

        assert_eq!(repo.verify_change(&h0).unwrap(), SignatureStatus::Unsigned);

        assert_eq!(repo.store().get_change(&h0).unwrap().author, ObjectRef::ZERO);

        let (key, id) = repo.create_identity("Ada", "[email protected]").unwrap();

        assert_eq!(id.hash(), key);

        assert_eq!(repo.config.author_key, Some(key));

        // Config survives reopen; the secret key is found again.

        let reopened = Repo::open(root).unwrap().with_keys_dir(root.join("keys"));

        assert_eq!(reopened.config.author_key, Some(key));

        assert_eq!(reopened.secret_key().unwrap().unwrap().0, key);

        // Default core.sign = seal: commits carry the author but no signature.

        write(root, "a.txt", b"a\nb\n");

        let h1 = repo.commit("authored", &[]).unwrap();

        assert_eq!(repo.store().get_change(&h1).unwrap().author, key);

        assert_eq!(repo.verify_change(&h1).unwrap(), SignatureStatus::Unsigned);

        // Signing later works too.

        repo.sign_change(&h1).unwrap();

        assert!(matches!(repo.verify_change(&h1).unwrap(), SignatureStatus::Valid { key: k, .. } if k == key));

        repo.config.set("core.sign", "change").unwrap();

        repo.save_config().unwrap();

        write(root, "a.txt", b"a\nb\nc\n");

        let h2 = repo.commit("signed", &[]).unwrap();

        assert_eq!(repo.verify_change(&h2).unwrap(), SignatureStatus::Valid { key, name: "Ada".into(), email: "[email protected]".into() });

        // A signature by a key that is not the author or a delegate is rejected.

        let other = SecretKey::generate();

        let other_id = other.identity("Mallory", "[email protected]", 0);

        let other_key = repo.store().put_identity(&other_id).unwrap();

        let forged = other.sign(Domain::Change, &other_key, &h0);

        repo.store().put_signature(&h0, &forged).unwrap();

        assert!(matches!(repo.verify_change(&h0).unwrap(), SignatureStatus::Invalid(m) if m.contains("neither the author")));

        // Tampering with the stored signature invalidates it.

        let mut sig = repo.store().signatures(&h2).unwrap().remove(0);

        sig.ed[0] ^= 1;

        repo.store().put_signature(&h2, &sig).unwrap();

        assert!(matches!(repo.verify_change(&h2).unwrap(), SignatureStatus::Invalid(_)));

        // Without the secret key, signing at commit fails cleanly.

        let no_keys = Repo::open(root).unwrap().with_keys_dir(root.join("nowhere"));

        write(root, "a.txt", b"z\n");

        assert!(no_keys.commit("cannot sign", &[]).is_err());

    }

    #[test]

use crate::identity::{Identity, Signature};

    pub fn put_identity(&self, id: &Identity) -> Result<ObjectRef> {

        self.put(ObjectType::Identity, &id.encode())

    }

    pub fn get_identity(&self, r: &ObjectRef) -> Result<Identity> {

        Ok(Identity::decode(&self.get_typed(r, ObjectType::Identity)?)?)

    }

    fn sig_path(&self, r: &ObjectRef) -> PathBuf {

        let h = r.to_hex();

        self.dir.join("sigs").join(&h[..2]).join(&h[2..])

    }

    /// Signatures stored alongside object `r` (spec §5.4). Empty if none.

    pub fn signatures(&self, r: &ObjectRef) -> Result<Vec<Signature>> {

        match fs::read(self.sig_path(r)) {

            Ok(b) => Ok(Signature::decode_list(&b)?),

            Err(e) if e.kind() == io::ErrorKind::NotFound => Ok(vec![]),

            Err(e) => Err(e.into()),

        }

    }

    /// Attach a signature to object `r`, replacing any earlier one by the same key.

    pub fn put_signature(&self, r: &ObjectRef, sig: &Signature) -> Result<()> {

        let mut sigs = self.signatures(r)?;

        sigs.retain(|s| s.key != sig.key);

        sigs.push(sig.clone());

        sigs.sort_by(|a, b| a.key.cmp(&b.key));

        let path = self.sig_path(r);

        fs::create_dir_all(path.parent().unwrap())?;

        let mut nonce = [0u8; 8];

        rand::rngs::OsRng.fill_bytes(&mut nonce);

        let tmp = self.dir.join(format!("sigs-tmp-{}", hex::encode(nonce)));

        {

            let mut f = fs::File::create(&tmp)?;

            f.write_all(&Signature::encode_list(&sigs))?;

            f.sync_all()?;

        }

        fs::rename(&tmp, &path)?;

        Ok(())

    }

    fn signatures_are_stored_beside_objects() {

        use crate::identity::{Domain, SecretKey};

        let dir = tempfile::tempdir().unwrap();

        let s = Store::open(dir.path()).unwrap();

        let r = s.put(ObjectType::Chunk, b"x").unwrap();

        assert!(s.signatures(&r).unwrap().is_empty());

        let sk = SecretKey { ed_seed: [1; 32], ml_seed: [2; 32] };

        let id = sk.identity("a", "b", 0);

        let key = s.put_identity(&id).unwrap();

        assert_eq!(s.get_identity(&key).unwrap(), id);

        let sig = sk.sign(Domain::Change, &key, &r);

        s.put_signature(&r, &sig).unwrap();

        s.put_signature(&r, &sig).unwrap();

        assert_eq!(s.signatures(&r).unwrap(), vec![sig]);

        // The object itself is untouched by its signatures.

        assert_eq!(s.get(&r).unwrap().1, b"x");

    }

    #[test]

use oxy_core::repo::{ChangeStatus, Repo, SignatureStatus};

    /// Manage the signing identity

    Identity {

        #[command(subcommand)]

        cmd: IdentityCmd,

    },

    /// Verify the signatures on a change (default: every change in the log)

    Verify { change: Option<String> },

    /// Set a repository configuration key (author.name, author.email, author.key, core.sign, workspace.bookmark)

    Config { key: String, value: String },

#[derive(Subcommand)]

enum IdentityCmd {

    /// Generate a composite Ed25519 + ML-DSA-65 key pair and make it the author

    Create {

        #[arg(long)]

        name: Option<String>,

        #[arg(long)]

        email: Option<String>,

    },

    /// Show the configured identity

    Show,

}

fn signature_line(repo: &Repo, h: &oxy_core::hash::ChangeHash) -> Result<String> {

    Ok(match repo.verify_change(h)? {

        SignatureStatus::Unsigned => "unsigned".to_string(),

        SignatureStatus::Valid { key, name, email } => format!("signed by {name} <{email}> key {}", key.short(12)),

        SignatureStatus::Invalid(why) => format!("INVALID signature: {why}"),

    })

}

            println!("sig:    {}", signature_line(&repo, &h)?);

        Cmd::Identity { cmd: IdentityCmd::Create { name, email } } => {

            let mut repo = open()?;

            let name = name.unwrap_or_else(|| repo.config.author_name.clone());

            let email = email.unwrap_or_else(|| repo.config.author_email.clone());

            let (key, _) = repo.create_identity(&name, &email)?;

            println!("Created identity {name} <{email}>");

            println!("KeyId: {key}");

            println!("Secret key stored under {}", oxy_core::repo::default_keys_dir().display());

            if !repo.config.sign_changes {

                println!("Changes will carry this author; run `oxy config core.sign change` to sign each commit.");

            }

            Ok(0)

        }

        Cmd::Identity { cmd: IdentityCmd::Show } => {

            let repo = open()?;

            match repo.config.author_key {

                None => println!("No identity configured; run `oxy identity create`."),

                Some(key) => {

                    let id = repo.identity(&key)?;

                    println!("{} <{}>", id.name, id.email);

                    println!("KeyId:   {key}");

                    println!("Created: {}", when(id.created));

                    println!("Secret:  {}", if repo.secret_key()?.is_some() { "available" } else { "NOT FOUND in key directory" });

                    println!("Signing: {}", if repo.config.sign_changes { "every change (core.sign = change)" } else { "at push via seals (core.sign = seal)" });

                }

            }

            Ok(0)

        }

        Cmd::Verify { change } => {

            let repo = open()?;

            let hashes: Vec<oxy_core::hash::ChangeHash> = match change {

                Some(c) => vec![repo.resolve_change(&c)?],

                None => repo.log()?.into_iter().filter(|e| !e.is_working_copy).map(|e| e.hash).collect(),

            };

            let mut bad = 0;

            for h in hashes {

                let c = repo.store().get_change(&h)?;

                let line = signature_line(&repo, &h)?;

                if line.starts_with("INVALID") {

                    bad += 1;

                }

                println!("{} #{}  {}", short_id(&c), h.short(12), line);

            }

            Ok(if bad > 0 { 1 } else { 0 })

        }

        Cmd::Config { key, value } => {

            let mut repo = open()?;

            repo.config.set(&key, &value)?;

            repo.save_config()?;

            println!("{key} = {value}");

            Ok(0)

        }