Challenge signatures and a push report for hosts 7aa2dc9369e3

    /// A server-issued challenge, proving possession of a key to a host

    /// (hub spec §5.3, §5.4). Never a stored object.

    Challenge,

            Domain::Challenge => "challenge",

    #[error("a challenge is at least 16 bytes")]

    ShortChallenge,

/// The signing target of a challenge: `BLAKE3-256("oxy1 challenge " || bytes)`,

/// so a challenge can never collide with a stored object's reference.

pub fn challenge_target(challenge: &[u8]) -> ObjectRef {

    let mut h = blake3::Hasher::new();

    h.update(b"oxy1 challenge ");

    h.update(challenge);

    ObjectRef(*h.finalize().as_bytes())

}

impl SecretKey {

    /// Sign a host's challenge (at least 16 bytes) with this key.

    pub fn sign_challenge(&self, key: &KeyId, challenge: &[u8]) -> Result<Signature, VerifyError> {

        if challenge.len() < 16 {

            return Err(VerifyError::ShortChallenge);

        }

        Ok(self.sign(Domain::Challenge, key, &challenge_target(challenge)))

    }

}

/// Check a challenge signature against the identity that claims it.

pub fn verify_challenge(identity: &Identity, sig: &Signature, challenge: &[u8]) -> Result<(), VerifyError> {

    if challenge.len() < 16 {

        return Err(VerifyError::ShortChallenge);

    }

    if sig.key != identity.hash() {

        return Err(VerifyError::KeyMismatch);

    }

    verify(identity, sig, Domain::Challenge, &challenge_target(challenge))

}

#[cfg(test)]

mod challenge_tests {

    use super::*;

    #[test]

    fn a_challenge_signature_binds_key_and_bytes() {

        let sk = SecretKey::generate();

        let id = sk.identity("A", "a@example", 1);

        let key = id.hash();

        let challenge = [7u8; 32];

        let sig = sk.sign_challenge(&key, &challenge).unwrap();

        assert!(verify_challenge(&id, &sig, &challenge).is_ok());

        assert!(verify_challenge(&id, &sig, &[8u8; 32]).is_err(), "other bytes");

        let other = SecretKey::generate().identity("B", "b@example", 1);

        assert!(verify_challenge(&other, &sig, &challenge).is_err(), "other identity");

        assert!(sk.sign_challenge(&key, b"short").is_err());

        // A challenge target never equals a change signature's target for the same bytes.

        assert_ne!(challenge_target(&challenge), ObjectRef(challenge));

    }

}

pub use sync::{FetchReport, PullReport, PushReport, RefUpdated};

/// What a push did, for hosts (hub spec §6.12).

#[derive(Clone, Debug, Default)]

pub struct PushReport {

    pub results: Vec<RefResult>,

    /// Accepted reference updates, in request order.

    pub updated: Vec<RefUpdated>,

    /// Changes this push stored that were not already present.

    pub imported: Vec<ChangeHash>,

}

#[derive(Clone, Debug)]

pub struct RefUpdated {

    pub name: String,

    pub old_state: ObjectRef,

    pub new_state: ObjectRef,

    pub heads: Vec<ChangeHash>,

}

        Ok(self.receive_push_report(bundle, updates, policy, tags)?.results)

    }

    /// `receive_push` with what a host wants to log: each accepted

    /// reference's old and new state and heads, and the changes this push

    /// stored (hub spec §6.12).

    pub fn receive_push_report(

        &self,

        bundle: Bundle,

        updates: Vec<RefUpdate>,

        policy: Option<SignedPolicy>,

        tags: Vec<crate::protocol::TagRef>,

    ) -> Result<PushReport> {

        let mut report = PushReport::default();

        let results = &mut report.results;

                    return Ok(report);

        match self.import_bundle(&bundle, policy.is_some()) {

            Ok(imported) => report.imported = imported,

            Err(e) => {

                for u in updates {

                    results.push(RefResult {

                        name: u.name,

                        ok: false,

                        reason: e.to_string(),

                    });

                }

                return Ok(report);

                let heads = self.store.get_state(&u.new_state).map(|s| s.heads).unwrap_or_default();

                report.updated.push(RefUpdated { name: u.name.clone(), old_state: u.old_state, new_state: u.new_state, heads });

        Ok(report)

    /// (accepted or refused), the states each accepted reference moved

    /// between, and the changes stored, for logs and cache invalidation.

    fn after_push(&self, _name: &str, _report: &oxy_core::repo::PushReport) {}

                let report = r.receive_push_report(bundle, updates, policy, tags)?;

                self.backend.after_push(name, &report);

                ok(wire::encode_push_response(&report.results))

        fn after_push(&self, name: &str, report: &oxy_core::repo::PushReport) {

                "{name}: {} ok, {} updated to {} head(s), {} imported",

                report.results.iter().filter(|r| r.ok).count(),

                report.updated.len(),

                report.updated.first().map(|u| u.heads.len()).unwrap_or(0),

                report.imported.len()

    assert_eq!(pushes.lock().unwrap().as_slice(), ["andy/app: 1 ok, 1 updated to 1 head(s), 1 imported"]);

- [x] `oxy identity sign-challenge` and `identity::{sign_challenge, verify_challenge, challenge_target}` (hub 0.2).

- [x] `receive_push_report` with `PushReport { results, updated: [RefUpdated { name, old_state, new_state, heads }], imported }`; `Backend::after_push` receives it.

| **Status** | Draft 0.8f |

**Challenges.** A host that must know a client holds a key (linking a key to an account, signing in to a server) sends at least 16 random bytes; the client returns a composite signature in domain `challenge` over `BLAKE3-256("oxy1 challenge " || bytes)`, which can never equal a stored object's reference, so a challenge signature authenticates nothing but the challenge. `oxy identity sign-challenge HEX` prints it.

oxy identity create|show|export|rotate|renew|revoke|delegate|sign-challenge

*Changelog.* Draft 0.8f (2026-09-27): challenge signatures (§14.3) for hosts. Draft 0.8e (2026-09-27): anonymous changes (zero author) are authenticated by a seal from any key, so imported and pre-identity history can be pushed under a policy (§14.4). Draft 0.8d (2026-09-27): unbound hosted repositories adopt the first pusher's id (§16.1). Draft 0.8c (2026-09-27): bare repositories (`oxy init --bare`, §12.2: no workspace, no working copy; hosting) and the reference server as an embeddable library (§15.1). Draft 0.8b (2026-09-27): the machine interface for editors (§24): `root`, `cat`, `version`, `hunks`, `discard`, and `--json` on the reporting commands.

/// `oxy identity sign-challenge HEX`: the composite signature over a

/// host's challenge, as hex of the CBOR signature (hub spec §5.3).

pub fn sign_challenge(challenge_hex: &str, as_json: bool) -> Result<i32> {

    let repo = open()?;

    let Some((key, sk)) = repo.secret_key()? else {

        anyhow::bail!("no secret key: run `oxy identity create` first");

    };

    let challenge = hex_bytes(challenge_hex.trim()).ok_or_else(|| anyhow::anyhow!("the challenge must be hex"))?;

    let sig = sk.sign_challenge(&key, &challenge).map_err(|e| anyhow::anyhow!("{e}"))?;

    let encoded = hex_string(&oxy_core::identity::Signature::encode_list(&[sig]));

    if as_json {

        println!("{{\"key\":\"{}\",\"signature\":\"{}\"}}", key.to_hex(), encoded);

    } else {

        println!("{encoded}");

    }

    Ok(0)

}

fn hex_bytes(s: &str) -> Option<Vec<u8>> {

    if !s.len().is_multiple_of(2) {

        return None;

    }

    (0..s.len()).step_by(2).map(|i| u8::from_str_radix(&s[i..i + 2], 16).ok()).collect()

}

fn hex_string(b: &[u8]) -> String {

    b.iter().map(|x| format!("{x:02x}")).collect()

}

    /// Sign a host's challenge (hex, at least 16 bytes) to prove you hold your key; prints the signature as hex

    SignChallenge {

        challenge: String,

        #[arg(long)]

        json: bool,

    },

            IdentityCmd::SignChallenge { challenge, json } => identity::sign_challenge(&challenge, json),