oxy receipt export --format slsa: SLSA provenance cosign can check a39754d02c58

//! DSSE envelopes, the signature wrapper in-toto, SLSA and cosign read, and

//! the PEM public key cosign's `--key` takes: how Oxygen's attestations

//! reach tools outside it (spec §14.6, oxygenhub#239). Only the Ed25519 half

//! of a composite key signs here, since DSSE verifiers know Ed25519 and not

//! ML-DSA-65; DSSE's own pre-authentication encoding separates the domain

//! from Oxygen's signatures (which begin `oxy1 sig`).

use crate::identity::{Identity, SecretKey, VerifyError};

/// DSSE's payload type for in-toto statements.

pub const IN_TOTO: &str = "application/vnd.in-toto+json";

/// DSSE's pre-authentication encoding: what the signature covers.

pub fn pae(payload_type: &str, payload: &[u8]) -> Vec<u8> {

    let mut out = format!(

        "DSSEv1 {} {} {} ",

        payload_type.len(),

        payload_type,

        payload.len()

    )

    .into_bytes();

    out.extend_from_slice(payload);

    out

}

/// A DSSE envelope over `payload`, signed by `sk`, as JSON. `keyid` names

/// the key to a reader; DSSE gives it no meaning.

pub fn envelope(payload_type: &str, payload: &[u8], keyid: &str, sk: &SecretKey) -> String {

    let sig = sk.sign_ed25519(&pae(payload_type, payload));

    format!(

        "{{\"payloadType\":{},\"payload\":\"{}\",\"signatures\":[{{\"keyid\":{},\"sig\":\"{}\"}}]}}",

        crate::repo::json_str(payload_type),

        base64(payload),

        crate::repo::json_str(keyid),

        base64(&sig)

    )

}

/// Check one envelope signature, its parts already decoded.

pub fn verify(

    identity: &Identity,

    payload_type: &str,

    payload: &[u8],

    sig: &[u8],

) -> Result<(), VerifyError> {

    identity.verify_ed25519(&pae(payload_type, payload), sig)

}

/// The identity's Ed25519 public key as a PEM SubjectPublicKeyInfo.

pub fn public_pem(identity: &Identity) -> String {

    // SEQUENCE { SEQUENCE { OID 1.3.101.112 }, BIT STRING { key } }

    let mut der = vec![

        0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x03, 0x21, 0x00,

    ];

    der.extend_from_slice(&identity.ed25519_pk);

    format!(

        "-----BEGIN PUBLIC KEY-----\n{}\n-----END PUBLIC KEY-----\n",

        base64(&der)

    )

}

const ALPHABET: &[u8; 64] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";

/// Standard base64 with padding, as DSSE and PEM use.

pub fn base64(bytes: &[u8]) -> String {

    let mut out = String::with_capacity(bytes.len().div_ceil(3) * 4);

    for chunk in bytes.chunks(3) {

        let n = chunk.iter().fold(0u32, |acc, b| (acc << 8) | *b as u32) << (8 * (3 - chunk.len()));

        for i in 0..4 {

            if i <= chunk.len() {

                out.push(ALPHABET[((n >> (18 - 6 * i)) & 63) as usize] as char);

            } else {

                out.push('=');

            }

        }

    }

    out

}

/// [`base64`] back to bytes; `None` for anything that is not.

pub fn base64_decode(text: &str) -> Option<Vec<u8>> {

    let text = text.trim_end_matches('=');

    let mut out = Vec::with_capacity(text.len() * 3 / 4);

    let (mut acc, mut bits) = (0u32, 0);

    for c in text.bytes() {

        let v = ALPHABET.iter().position(|a| *a == c)? as u32;

        acc = (acc << 6) | v;

        bits += 6;

        if bits >= 8 {

            bits -= 8;

            out.push((acc >> bits) as u8);

            acc &= (1 << bits) - 1;

        }

    }

    Some(out)

}

#[cfg(test)]

mod tests {

    use super::*;

    #[test]

    fn pae_and_base64_are_the_specs() {

        // DSSE's own example: PAE("http://example.com/HelloWorld", "hello world").

        assert_eq!(

            pae("http://example.com/HelloWorld", b"hello world"),

            b"DSSEv1 29 http://example.com/HelloWorld 11 hello world".to_vec()

        );

        for (plain, coded) in [

            ("", ""),

            ("f", "Zg=="),

            ("fo", "Zm8="),

            ("foo", "Zm9v"),

            ("foobar", "Zm9vYmFy"),

        ] {

            assert_eq!(base64(plain.as_bytes()), coded);

            assert_eq!(base64_decode(coded).unwrap(), plain.as_bytes());

        }

        assert!(base64_decode("Zm9v!").is_none());

    }

    #[test]

    fn an_envelope_verifies_with_its_key_and_nothing_else() {

        let sk = SecretKey::generate();

        let id = sk.identity("Ada", "[email protected]", 1);

        let other = SecretKey::generate().identity("Eve", "[email protected]", 1);

        let payload = br#"{"_type":"https://in-toto.io/Statement/v1"}"#;

        let env = envelope(IN_TOTO, payload, "k", &sk);

        let sig_b64 = env

            .rsplit("\"sig\":\"")

            .next()

            .unwrap()

            .trim_end_matches("\"}]}");

        let sig = base64_decode(sig_b64).unwrap();

        assert!(env.contains(&format!("\"payload\":\"{}\"", base64(payload))));

        assert!(verify(&id, IN_TOTO, payload, &sig).is_ok());

        assert!(verify(&other, IN_TOTO, payload, &sig).is_err());

        assert!(verify(&id, IN_TOTO, b"{}", &sig).is_err());

        assert!(verify(&id, "text/plain", payload, &sig).is_err());

    }

    #[test]

    fn the_pem_holds_the_ed25519_key() {

        let id = SecretKey::generate().identity("Ada", "[email protected]", 1);

        let pem = public_pem(&id);

        let body: String = pem.lines().filter(|l| !l.starts_with("-----")).collect();

        let der = base64_decode(&body).unwrap();

        assert_eq!(der.len(), 44);

        assert_eq!(&der[12..], &id.ed25519_pk);

    }

}

    /// Check a [`SecretKey::sign_ed25519`] signature by this identity.

    pub fn verify_ed25519(&self, msg: &[u8], sig: &[u8]) -> Result<(), VerifyError> {

        let sig = EdSignature::from_slice(sig).map_err(|_| VerifyError::Ed25519)?;

        self.ed_key()?

            .verify_strict(msg, &sig)

            .map_err(|_| VerifyError::Ed25519)

    }

    }

    /// Ed25519 alone over `msg`, for a format that separates its own

    /// domain and whose verifiers know only Ed25519 (DSSE: see

    /// [`crate::dsse`]). Oxygen's own objects are signed with [`Self::sign`].

    pub fn sign_ed25519(&self, msg: &[u8]) -> [u8; 64] {

        self.ed().sign(msg).to_bytes()

pub mod dsse;

oxy receipt export 3f2a9c prov.json --format slsa   # SLSA provenance, signed with your key

oxy identity export --pem me.pem         # the key cosign checks it with

The SLSA form is for tools outside Oxygen: in-toto and SLSA verifiers, and

`cosign verify-blob-attestation --key me.pem --type slsaprovenance1

--check-claims=false --signature prov.json`. Its subjects are named by

Oxygen hashes, which cosign cannot compute from a file, hence

`--check-claims=false`.

**SLSA provenance.** For tools outside Oxygen, `oxy receipt export --format slsa` writes what a valid receipt says as an in-toto Statement v1 with an SLSA provenance v1 predicate (`buildType` `https://oxygenhub.io/oxygenflow/job/v1`), in a DSSE envelope (payload type `application/vnd.in-toto+json`). Its subjects are the job's outputs, with the digest `oxygen-blob` (their ObjectRefs); a job with none has the state as its subject (`oxygen-state`). Resolved dependencies are the state, the scope (`oxygen-scope`) and the inputs; the builder is `urn:oxygen:runner:<runner KeyId>`; `startedOn` is the attestation's wall time less `duration_ms`, `finishedOn` that time. The signed receipt itself is a byproduct (`oxygen-receipt`, media type `application/vnd.oxygen.receipt+cbor`, base64 `content`), so an Oxygen verifier can still check the runner's signature. The envelope is signed by the **exporter**, with the Ed25519 half of its signing key over DSSE's pre-authentication encoding (which cannot be mistaken for an Oxygen signature message, §14.3); `keyid` is the KeyId in hex. DSSE verifiers know no ML-DSA, so this signature is classical: it vouches that the exporter checked the receipt, and the receipt inside keeps the runner's composite signature. `oxy identity export --pem` writes the signing key's Ed25519 public key as a PEM SubjectPublicKeyInfo, as cosign's `--key` takes it. A host does the same with its own key for the artifacts it keeps (hub spec).

pub fn export(path: Option<PathBuf>, pem: bool) -> Result<i32> {

    // The PEM is for checking what this home signs, so it is the signing

    // key's: a delegate's when `author.signer` names one.

    let key = if pem {

        repo.signing_key()

    } else {

        repo.config.author_key

    };

    let Some(key) = key else {

    let ext = if pem { "pem" } else { "identity" };

    let path = path.unwrap_or_else(|| PathBuf::from(format!("{}.{ext}", key.short(16))));

    if pem {

        std::fs::write(&path, oxy_core::dsse::public_pem(&id))?;

    } else {

        std::fs::write(&path, id.encode())?;

    }

        "{} {} {} <{}> ({}) to {}",

        if pem { "the public key of" } else { "identity" },

        /// `oxygen`: the runner's signed receipt, as `verify` and `import`

        /// read it. `slsa`: SLSA provenance in a DSSE envelope, signed with

        /// your key, for in-toto and cosign (`oxy identity export --pem`

        /// gives the key they check it with)

        #[arg(long, default_value = "oxygen", value_parser = ["oxygen", "slsa"])]

        format: String,

        /// File to write (default: <key>.identity, or <key>.pem with --pem, in the current directory)

        /// Write the Ed25519 public key as PEM instead, as cosign's --key and

        /// other DSSE verifiers take it

        #[arg(long)]

        pem: bool,

                format,

            } => receipt::export(&r, &file, rev.as_deref(), &format),

            IdentityCmd::Export { path, pem } => identity::export(path, pem),

/// `oxy receipt export HASH FILE [--format slsa]`: the signed receipt, to

/// hand to anyone, or SLSA provenance of it for tools outside Oxygen.

pub fn export(prefix: &str, file: &str, rev: Option<&str>, format: &str) -> Result<i32> {

    if format == "slsa" {

        return export_slsa(&repo, &i, file);

    }

    );

    Ok(0)

}

/// What SLSA calls the build type of a Flow job.

pub const BUILD_TYPE: &str = "https://oxygenhub.io/oxygenflow/job/v1";

/// The in-toto Statement v1, with an SLSA provenance v1 predicate, of what

/// a receipt says (spec §14.6). Its subjects are the job's outputs (the

/// state it ran on when it made none), named by their Oxygen object hashes;

/// the signed receipt itself rides along as a byproduct, so an Oxygen

/// verifier can still check the runner's own signature.

pub fn statement(sr: &SignedReceipt) -> serde_json::Value {

    use serde_json::json;

    let r = &sr.receipt;

    let subject: Vec<_> = if r.outputs.is_empty() {

        vec![json!({ "name": "state", "digest": { "oxygen-state": sr.state().to_hex() } })]

    } else {

        r.outputs

            .iter()

            .map(|o| json!({ "name": o.to_hex(), "digest": { "oxygen-blob": o.to_hex() } }))

            .collect()

    };

    let rfc3339 = |ms: u64| super::format::when(ms).replacen(' ', "T", 1);

    let made = sr.attest.hlc.wall_ms;

    let mut deps = vec![

        json!({ "name": "state", "digest": { "oxygen-state": sr.state().to_hex() } }),

        json!({ "name": "scope", "digest": { "oxygen-scope": r.scope_tree_hash.to_hex() } }),

    ];

    deps.extend(

        r.inputs

            .iter()

            .map(|h| json!({ "name": h.to_hex(), "digest": { "oxygen-blob": h.to_hex() } })),

    );

    json!({

        "_type": "https://in-toto.io/Statement/v1",

        "subject": subject,

        "predicateType": "https://slsa.dev/provenance/v1",

        "predicate": {

            "buildDefinition": {

                "buildType": BUILD_TYPE,

                "externalParameters": {

                    "job": r.job_name,

                    "pipeline": r.pipeline_hash.to_hex(),

                },

                "internalParameters": {

                    "environment": r.environment.to_hex(),

                },

                "resolvedDependencies": deps,

            },

            "runDetails": {

                "builder": {

                    "id": format!("urn:oxygen:runner:{}", sr.runner.hash().to_hex()),

                    "version": { "name": sr.runner.name },

                },

                "metadata": {

                    "invocationId": sr.run(),

                    "startedOn": rfc3339(made.saturating_sub(r.duration_ms)),

                    "finishedOn": rfc3339(made),

                },

                "byproducts": [{

                    "name": "oxygen-receipt",

                    "mediaType": "application/vnd.oxygen.receipt+cbor",

                    "content": oxy_core::dsse::base64(&sr.encode()),

                    "annotations": {

                        "exitCode": r.exit_code,

                        "durationMs": r.duration_ms,

                        "runner": sr.runner.name,

                    },

                }],

            },

        },

    })

}

fn export_slsa(repo: &oxy_core::repo::Repo, i: &ReceiptInfo, file: &str) -> Result<i32> {

    if let Some(p) = &i.problem {

        bail!(

            "receipt #{} does not verify ({p}); provenance is only made of a valid one",

            i.attest.short(12)

        );

    }

    let Some((key, sk)) = repo.secret_key()? else {

        bail!("SLSA provenance is signed with your key, and none is set up here; run `oxy identity create`");

    };

    let payload = serde_json::to_vec(&statement(&i.signed))?;

    std::fs::write(

        file,

        oxy_core::dsse::envelope(oxy_core::dsse::IN_TOTO, &payload, &key.to_hex(), &sk),

    )?;

    println!(

        "{} {} {} {}",

        ui::done("Exported SLSA provenance of receipt"),

        ui::hash(format!("#{}", i.attest.short(12))),

        ui::path(file),

        ui::dim(format!("signed by {}", key.short(12)))

    );

    println!(

        "{}",

        ui::dim(format!(

            "  check it: oxy identity export --pem key.pem, then cosign verify-blob-attestation --key key.pem --type slsaprovenance1 --check-claims=false --signature {file}"

        ))

    // SLSA provenance is signed with the exporter's key: none yet, so it is

    // refused and says what to do.

    let prov = tmp.path().join("prov.json");

    let p = prov.to_str().unwrap();

    let slsa = ["receipt", "export", &attest[..10], p, "--format", "slsa"];

    let (code, _, err) = oxy(&r, &home, &slsa);

    assert_ne!(code, 0);

    assert!(err.contains("oxy identity create"), "{err}");

    let ident = [

        "identity",

        "create",

        "--name",

        "Ada",

        "--email",

        "[email protected]",

    ];

    assert_eq!(oxy(&r, &home, &ident).0, 0);

    assert_eq!(oxy(&r, &home, &slsa).0, 0);

    let env: serde_json::Value = serde_json::from_slice(&std::fs::read(&prov).unwrap()).unwrap();

    assert_eq!(env["payloadType"], oxy_core::dsse::IN_TOTO);

    let payload = oxy_core::dsse::base64_decode(env["payload"].as_str().unwrap()).unwrap();

    let st: serde_json::Value = serde_json::from_slice(&payload).unwrap();

    assert_eq!(st["predicateType"], "https://slsa.dev/provenance/v1");

    assert_eq!(st["subject"][0]["digest"]["oxygen-state"], state.to_hex());

    let run = &st["predicate"]["runDetails"];

    assert_eq!(run["metadata"]["invocationId"], "demo#7");

    let kept = oxy_core::dsse::base64_decode(run["byproducts"][0]["content"].as_str().unwrap());

    assert_eq!(

        kept.unwrap(),

        sr.encode(),

        "the runner's receipt rides along"

    );

    // It verifies with the exporter's key and its PEM holds that key.

    let repo = oxy_core::repo::Repo::open(&r)

        .unwrap()

        .with_home(home.clone());

    let key = repo.signing_key().unwrap();

    assert_eq!(env["signatures"][0]["keyid"], key.to_hex());

    let me = repo.identity(&key).unwrap();

    let sig = oxy_core::dsse::base64_decode(env["signatures"][0]["sig"].as_str().unwrap()).unwrap();

    assert!(oxy_core::dsse::verify(&me, oxy_core::dsse::IN_TOTO, &payload, &sig).is_ok());

    assert!(oxy_core::dsse::verify(&runner, oxy_core::dsse::IN_TOTO, &payload, &sig).is_err());

    let pem = tmp.path().join("key.pem");

    let pem_args = ["identity", "export", "--pem", pem.to_str().unwrap()];

    assert_eq!(oxy(&r, &home, &pem_args).0, 0);

    assert_eq!(

        std::fs::read_to_string(&pem).unwrap(),

        oxy_core::dsse::public_pem(&me)

    );