Receipts signed by a certified short-lived key carry the certificate c63fed2e0465

    #[error("its certificate does not hold: {0}")]

    Certificate(String),

/// the runner's identity, so it verifies with nothing else. A runner that

/// signs with a short-lived key (keyless, oxygenhub#241) adds that key's

/// certificate and its issuer's identity.

    pub certificate: Option<CertifiedBy>,

/// A short-lived signing key's certificate, with the identity of the key

/// that issued it (spec §14.7).

#[derive(Clone, Debug, PartialEq, Eq)]

pub struct CertifiedBy {

    pub cert: crate::cert::SignedCertificate,

    pub issuer: Identity,

}

            certificate: None,

    /// The same, signed by a short-lived key whose certificate `cert`

    /// `issuer` issued: the certificate rides along.

    pub fn with_certificate(

        mut self,

        cert: crate::cert::SignedCertificate,

        issuer: Identity,

    ) -> SignedReceipt {

        self.certificate = Some(CertifiedBy { cert, issuer });

        self

    }

            .map_err(|e| ReceiptError::BadSignature(e.to_string()))?;

        if let Some(c) = &self.certificate {

            c.cert

                .verify(&c.issuer)

                .map_err(|e| ReceiptError::Certificate(e.to_string()))?;

            if c.cert.cert.key_id() != key {

                return Err(ReceiptError::Certificate(

                    "it certifies another key than the one that signed".into(),

                ));

            }

            // The attestation's own time is the signer's claim: a host

            // checks the time it accepted the receipt as well.

            if !c

                .cert

                .cert

                .covers(crate::identity::Scope::SEAL, self.attest.hlc.wall_ms)

            {

                return Err(ReceiptError::Certificate(

                    "the receipt was signed outside the certificate's window, or it gives no seal scope".into(),

                ));

            }

        }

        Ok(())

    /// `[receipt, attest, [Signature], identity]`, and

    /// `[certificate, issuer identity]` after them when a short-lived key

    /// signed.

        let mut parts = vec![

        ];

        if let Some(c) = &self.certificate {

            parts.push(Value::Array(vec![

                Value::Bytes(c.cert.encode()),

                Value::Bytes(c.issuer.encode()),

            ]));

        }

        cbor::encode(&Value::Array(parts))

        if a.len() != 4 && a.len() != 5 {

                "signed receipt: expected [receipt, attest, sigs, identity, (certificate, issuer)]"

                    .into(),

        let certificate = match a.get(4) {

            None => None,

            Some(c) => {

                let c = array(c, "certificate")?;

                if c.len() != 2 {

                    return Err(ReceiptError::Schema(

                        "signed receipt: expected [certificate, issuer identity]".into(),

                    ));

                }

                Some(CertifiedBy {

                    cert: crate::cert::SignedCertificate::decode(bytes(&c[0], "certificate")?)

                        .map_err(|e| ReceiptError::Certificate(e.to_string()))?,

                    issuer: Identity::decode(bytes(&c[1], "issuer")?)?,

                })

            }

        };

            certificate,

    }

    /// A receipt signed with a short-lived key carries its certificate

    /// (oxygenhub#241): it verifies, round-trips, and is refused when the

    /// certificate is another key's, gives no seal scope, or does not cover

    /// when it was signed.

    #[test]

    fn a_receipt_by_a_certified_key_carries_and_checks_its_certificate() {

        use crate::cert::{Certificate, SignedCertificate};

        use crate::identity::Scope;

        let hub_sk = SecretKey::generate();

        let hub = hub_sk.identity("oxygenhub.io", "[email protected]", 1);

        let job_sk = SecretKey::generate();

        let job = job_sk.identity("job 7 test", "[email protected]", 1);

        let certify = |key: &Identity, scope: Scope, from: u64, to: u64| {

            SignedCertificate::sign(

                Certificate {

                    key: key.clone(),

                    issuer: hub.hash(),

                    subject: "repo:andy/demo:bookmark:main".into(),

                    claims: vec![("job".into(), "test".into())],

                    scope,

                    not_before: from,

                    expires: to,

                },

                &hub,

                &hub_sk,

            )

        };

        let sr = SignedReceipt::sign(

            sample(),

            [7; 16],

            ObjectRef([9; 32]),

            "andy/demo#7",

            &job,

            &job_sk,

        );

        let now = sr.attest.hlc.wall_ms;

        let good = sr.clone().with_certificate(

            certify(&job, Scope::SEAL, now - 1000, now + 600_000),

            hub.clone(),

        );

        good.verify().unwrap();

        let back = SignedReceipt::decode(&good.encode()).unwrap();

        assert_eq!(back, good);

        assert_eq!(

            SignedReceipt::decode(&sr.encode()).unwrap().certificate,

            None,

            "a plain receipt reads as before"

        );

        let other = SecretKey::generate().identity("other", "o@x", 1);

        let wrong_key = sr.clone().with_certificate(

            certify(&other, Scope::SEAL, now - 1000, now + 600_000),

            hub.clone(),

        );

        assert!(

            matches!(wrong_key.verify(), Err(ReceiptError::Certificate(m)) if m.contains("another key"))

        );

        let no_seal = sr.clone().with_certificate(

            certify(&job, Scope::CHANGES, now - 1000, now + 600_000),

            hub.clone(),

        );

        assert!(matches!(

            no_seal.verify(),

            Err(ReceiptError::Certificate(_))

        ));

        let too_late = sr.clone().with_certificate(

            certify(&job, Scope::SEAL, now - 700_000, now - 100_000),

            hub.clone(),

        );

        assert!(

            matches!(too_late.verify(), Err(ReceiptError::Certificate(m)) if m.contains("window"))

        );

        let wrong_issuer = sr

            .clone()

            .with_certificate(certify(&job, Scope::SEAL, now - 1000, now + 600_000), other);

        assert!(matches!(

            wrong_issuer.verify(),

            Err(ReceiptError::Certificate(_))

        ));

        if let Some(c) = &sr.certificate {

            self.store.put_identity(&c.issuer)?;

            self.store.put_certificate(&c.cert)?;

        }

        // Signed by a short-lived key: its certificate and issuer too.

        let certificate = match self.store.certificate_of(&key)? {

            Some(c) => {

                let cert = self.store.get_certificate(&c)?;

                let issuer = self.store.get_identity(&cert.cert.issuer)?;

                Some(crate::receipt::CertifiedBy { cert, issuer })

            }

            None => None,

        };

            certificate,

                    // A short-lived key's certificate and its issuer.

                    if let Some(c) = self.store.certificate_of(&sig.key)? {

                        keep.insert(c);

                        if let Ok(cert) = self.store.get_certificate(&c) {

                            keep.insert(cert.cert.issuer);

                        }

                    }

    // A receipt signed by a short-lived key keeps its certificate and the

    // issuer's identity, and reads back with them (oxygenhub#241).

    let hub_sk = SecretKey::generate();

    let hub = hub_sk.identity("oxygenhub.io", "[email protected]", 1);

    let job_sk = SecretKey::generate();

    let job = job_sk.identity("job 2 test", "[email protected]", 1);

    let mut test_receipt = receipt.clone();

    test_receipt.job_name = "test".into();

    let plain = SignedReceipt::sign(

        test_receipt,

        repo.id().unwrap(),

        state,

        "demo#2",

        &job,

        &job_sk,

    );

    let now = plain.attest.hlc.wall_ms;

    let cert = crate::cert::SignedCertificate::sign(

        crate::cert::Certificate {

            key: job.clone(),

            issuer: hub.hash(),

            subject: "repo:andy/demo:bookmark:main".into(),

            claims: vec![],

            scope: crate::identity::Scope::SEAL,

            not_before: now - 1_000,

            expires: now + 600_000,

        },

        &hub,

        &hub_sk,

    );

    let certified = plain.with_certificate(cert, hub.clone());

    repo.add_receipt(&certified).unwrap();

    let found = repo.receipts(&heads).unwrap();

    let got = found

        .iter()

        .find(|i| i.signed.receipt.job_name == "test")

        .unwrap();

    assert_eq!(got.signed, certified);

    assert!(got.problem.is_none(), "{:?}", got.problem);

    // gc keeps the receipts, their runners, the certificate and its issuer,

    // and the output while the state lives.

    let found = repo.receipts(&heads).unwrap();

    assert_eq!(found.len(), 2);

    let got = found

        .iter()

        .find(|i| i.signed.receipt.job_name == "test")

        .unwrap();

    assert_eq!(got.signed, certified, "the certificate survives gc");

    assert!(got.problem.is_none());

    /// Keep a short-lived key's certificate (spec §14.7), with its issuer's

    /// signature, indexed by the key it certifies.

    pub fn put_certificate(&self, c: &crate::cert::SignedCertificate) -> Result<ObjectRef> {

        let r = self.put(ObjectType::Certificate, &c.cert.encode())?;

        self.put_signature(&r, &c.sig)?;

        self.index_add("cert", &c.cert.key_id(), &r)?;

        Ok(r)

    }

    /// A kept certificate with its issuer's signature.

    pub fn get_certificate(&self, r: &ObjectRef) -> Result<crate::cert::SignedCertificate> {

        let cert = crate::cert::Certificate::decode(&self.get_typed(r, ObjectType::Certificate)?)?;

        let sig = self

            .signatures(r)?

            .into_iter()

            .find(|s| s.key == cert.issuer)

            .ok_or(StoreError::NotFound(*r))?;

        Ok(crate::cert::SignedCertificate { cert, sig })

    }

    /// The certificate kept for short-lived key `key`, if any.

    pub fn certificate_of(&self, key: &ObjectRef) -> Result<Option<ObjectRef>> {

        Ok(self

            .index_get("cert", "certs", key)?

            .into_iter()

            .find(|r| self.has(r)))

    }

**Signed receipt.** A runner hands a receipt over as `[receipt bytes, attest bytes, [Signature], identity bytes]`, so it verifies with nothing else: the attestation's `receipt` is the receipt's ObjectRef, and a signature by the included identity verifies over the attestation. Whether a runner is trusted is the reader's decision (a host lists its runners' keys); a revoked runner key is reported. A runner that signs with a short-lived key (§14.7) adds a fifth element, `[certificate bytes, issuer identity bytes]`: the receipt then verifies only if the certificate does (signed by the identity given, which its `issuer` names), certifies the key that signed, gives the `seal` scope and covers the attestation's time; a host checks the time it accepted the receipt as well, since the attestation's is the signer's claim. A repository keeps the certificate (type `certificate`, with its issuer's signature, indexed by the key it certifies) and the issuer's identity beside the receipt, and gc keeps them with it.