oxy tlog verify: audit a hub's whole transparency log e59512f2f075

//! `oxy tlog verify` (spec §14.8, oxygenhub#238): audit a hub's whole

//! transparency log and list the entries that concern you.

use super::json;

use super::open;

use super::ui;

use anyhow::{anyhow, Result};

use oxy_core::hash::KeyId;

use std::path::Path;

pub fn verify(hub: Option<&str>, key: Option<&str>, all: bool, as_json: bool) -> Result<i32> {

    let repo = open()?;

    let remote = repo.default_remote();

    let url = match hub {

        Some(h) if h.contains("://") => h.to_string(),

        Some(h) => format!("https://{h}"),

        None => repo.config.remotes.get(&remote).cloned().ok_or_else(|| {

            anyhow!("name the hub to check (this checkout has no remote {remote})")

        })?,

    };

    let ca = repo

        .config

        .remote_cas

        .get(&remote)

        .map(Path::new)

        .filter(|_| hub.is_none());

    let audit = repo.audit_log(&url, ca).map_err(|e| anyhow!("{e}"))?;

    let key = match key {

        Some(k) => Some(

            KeyId::from_hex(k)

                .ok_or_else(|| anyhow!("--key takes a full KeyId (64 hex digits)"))?,

        ),

        None => None,

    };

    let rid = repo.id().ok();

    let listed: Vec<(usize, &oxy_core::tlog::Entry)> = audit

        .entries

        .iter()

        .enumerate()

        .filter(|(_, e)| match (&key, all) {

            (_, true) => true,

            (Some(k), _) => e.signers.contains(k),

            (None, _) => Some(e.repo) == rid,

        })

        .collect();

    let what = match (&key, all) {

        (_, true) => "every entry".to_string(),

        (Some(k), _) => format!("entries signed by {}", k.short(12)),

        (None, _) => "this repository's entries".to_string(),

    };

    if as_json {

        println!(

            "{}",

            json::obj([

                ("hub", json::s(&audit.hub)),

                ("origin", json::s(&audit.checkpoint.origin)),

                ("size", json::n(audit.checkpoint.size)),

                (

                    "root",

                    json::s(&oxy_core::hash::ObjectRef(audit.checkpoint.root).to_hex())

                ),

                (

                    "entries",

                    json::arr(listed.iter().map(|(i, e)| {

                        json::obj([

                            ("index", json::n(*i)),

                            ("kind", json::s(&e.kind)),

                            (

                                "repo",

                                json::s(

                                    &e.repo

                                        .iter()

                                        .map(|b| format!("{b:02x}"))

                                        .collect::<String>(),

                                ),

                            ),

                            ("object", json::s(&e.object.to_hex())),

                            (

                                "signers",

                                json::arr(e.signers.iter().map(|k| json::s(&k.to_hex()))),

                            ),

                            ("received_ms", json::n(e.received)),

                        ])

                    })),

                ),

            ])

        );

        return Ok(0);

    }

    println!(

        "{} {}: {} entries make the root its log key signed, and extend what you saw before",

        ui::done("Verified"),

        ui::path(&audit.checkpoint.origin),

        audit.checkpoint.size

    );

    if listed.is_empty() {

        println!("  {} {}", ui::note(), ui::dim(format!("no {what} in it")));

        return Ok(0);

    }

    println!(

        "  {} {}",

        ui::note(),

        ui::dim(format!("{} of {what}:", listed.len()))

    );

    for (i, e) in listed {

        let signers: Vec<String> = e.signers.iter().map(|k| k.short(12)).collect();

        println!(

            "  #{i:<6} {:<11} {} {} {}",

            e.kind,

            ui::hash(e.object.short(12)),

            ui::dim(if signers.is_empty() {

                "unsigned".to_string()

            } else {

                format!("by {}", signers.join(", "))

            }),

            ui::dim(ui::ago(e.received))

        );

    }

    Ok(0)

}

pub use transparency::LogAudit;

    /// Take a checkpoint note `text` from `hub` as the newest seen, once it

    /// verifies with the hub's pinned log key and extends the last one

    /// seen. `Err` when the hub showed two histories; `Ok(Err(why))` when

    /// it could not be checked (the last one seen is kept).

    pub(crate) fn accept_checkpoint(

        hub: &str,

        text: &str,

        options: &RemoteOptions,

    ) -> Result<std::result::Result<Checkpoint, String>> {

        let unchecked = |why: String| Ok(Err(why));

        let seen = self.seen_log(hub);

            None => match http_get(&format!("{hub}/.well-known/oxyhub-key"), options)

                self.tlog_file(hub).display()

                    hub,

                    options,

        self.remember_log(hub, &identity, &note)?;

        Ok(Ok(cp))

    }

    /// Check what a refs answer from `url` says about its host's log.

    /// Fails only when the host showed two histories (or a log key other

    /// than the one it showed before); everything else is a note.

    pub(crate) fn check_log(

        &self,

        url: &str,

        ca: Option<&Path>,

        resp: &RefsResponse,

    ) -> Result<Vec<String>> {

        let (Some(text), Some(hub)) = (&resp.log, hub_of(url)) else {

            return Ok(vec![]);

        };

        let options = RemoteOptions {

            ca: ca.map(Path::to_path_buf),

            ..RemoteOptions::default()

        };

        let cp = match self.accept_checkpoint(&hub, text, &options)? {

            Ok(cp) => cp,

            Err(why) => {

                return Ok(vec![format!(

                    "{hub}'s transparency log was not checked: {why}"

                )])

            }

        };

        let mut notes = Vec::new();

    }

}

/// A hub's whole log, checked (`oxy tlog verify`).

#[derive(Clone, Debug)]

pub struct LogAudit {

    pub hub: String,

    pub checkpoint: Checkpoint,

    /// Every entry, numbered from 0.

    pub entries: Vec<Entry>,

}

impl Repo {

    /// Fetch the log of `url`'s hub whole: its checkpoint, accepted as a

    /// fetch accepts one, and every entry bundle, whose entries must make

    /// the root the checkpoint signs.

    pub fn audit_log(&self, url: &str, ca: Option<&Path>) -> Result<LogAudit> {

        let hub =

            hub_of(url).ok_or_else(|| RepoError::Msg(format!("{url} is not a hub's address")))?;

        let options = RemoteOptions {

            ca: ca.map(Path::to_path_buf),

            ..RemoteOptions::default()

        };

        let tl = |e: TlogError| RepoError::Msg(e.to_string());

        let text = String::from_utf8(http_get(&format!("{hub}/log/checkpoint"), &options)?)

            .map_err(|_| RepoError::Msg(format!("{hub}'s checkpoint is not text")))?;

        let cp = match self.accept_checkpoint(&hub, &text, &options)? {

            Ok(c) => c,

            Err(why) => return fail(format!("{hub}'s log could not be checked: {why}")),

        };

        let mut entries = Vec::with_capacity(cp.size as usize);

        let mut stored: Vec<Hash> = Vec::new();

        let mut n = 0u64;

        while n < cp.size {

            let t = Tile {

                level: 0,

                n: n >> tlog::TILE_HEIGHT,

                width: (cp.size - n).min(tlog::TILE_WIDTH) as u32,

            };

            let bytes = http_get(&format!("{hub}/log/{}", t.entries_path()), &options)?;

            let bundle = tlog::decode_bundle(&bytes).map_err(tl)?;

            if bundle.len() != t.width as usize {

                return fail(format!(

                    "{hub}'s entry bundle {} holds {} entries, not {}",

                    t.entries_path(),

                    bundle.len(),

                    t.width

                ));

            }

            for b in bundle {

                let add =

                    tlog::stored_hashes_for_leaf(n, tlog::leaf_hash(&b), &stored).map_err(tl)?;

                stored.extend(add);

                entries.push(Entry::decode(&b).map_err(tl)?);

                n += 1;

            }

        }

        if tlog::tree_hash(cp.size, &stored).map_err(tl)? != cp.root {

            return fail(format!(

                "{hub} serves entries that do not make the root it signed for {} entries: its log is not the one it attests",

                cp.size

            ));

        }

        Ok(LogAudit {

            hub,

            checkpoint: cp,

            entries,

        })

## Transparency logs

A hub that keeps a transparency log (OxygenHub does, at `/log`) logs every signed object it accepts. `oxy fetch` and `oxy pull` check it as they go. They remember the log's key and its last checkpoint, and fail if the hub ever shows a log that does not extend what you saw before. That is the sign of a hub showing different histories to different people. To audit a hub's whole log and see what it holds for this repository:

```

oxy tlog verify                         # this checkout's hub

oxy tlog verify https://oxygenhub.io --all

oxy tlog verify --key <KeyId>           # what a key signed

```

**`oxy tlog verify [HUB]`** audits a whole log: it accepts the checkpoint as a fetch does, downloads every entry bundle, and requires the entries to make the root the checkpoint signs. It then lists this repository's entries (`--key KEYID` for a key's, `--all` for every one, `--json` for machines).

mod tlog;

    /// Hubs' transparency logs: check that a hub shows everyone the same

    /// history (spec §14.8)

    Tlog {

        #[command(subcommand)]

        cmd: TlogCmd,

    },

    },

}

#[derive(Subcommand)]

enum TlogCmd {

    /// Check a hub's whole log: its checkpoint against the log key and the

    /// last checkpoint seen, and every entry against the root it signed;

    /// then list this repository's entries (or a key's, or all)

    Verify {

        /// The hub, as https://oxygenhub.io (default: this checkout's remote)

        hub: Option<String>,

        /// List the entries a key signed (a KeyId) instead

        #[arg(long, conflicts_with = "all")]

        key: Option<String>,

        /// List every entry

        #[arg(long)]

        all: bool,

        /// Machine-readable output

        #[arg(long)]

        json: bool,

        },

        Cmd::Tlog { cmd } => match cmd {

            TlogCmd::Verify {

                hub,

                key,

                all,

                json,

            } => tlog::verify(hub.as_deref(), key.as_deref(), all, json),