attest.rs 95.3%

162 of 170 lines run, 20 of 22 functions · run #258 on main · run missed

//! Attestations (spec §14.4): signed statements about references and batches
//! of changes, and runs (receipts, §14.6).

use crate::cbor::{self, Value};
use crate::hash::{hash_object, ChangeHash, KeyId, ObjectRef, ObjectType};
use crate::objects::{
    array, bytes, check_version, field, map, oref, text, uint, Hlc, ObjectError, FORMAT_VERSION,
};

pub const MAX_SEAL_HASHES: usize = 4096;

#[derive(Clone, Debug, PartialEq, Eq)]
pub enum AttestBody {
    /// A bookmark moved from `old_state` to `new_state` (spec §10.2).
    Ref {
        name: String,
        old_state: ObjectRef,
        new_state: ObjectRef,
        serial: u64,
    },
    /// One signature covering a batch of changes (spec §14.4).
    Seal { hashes: Vec<ChangeHash> },
    /// An immutable named state (spec §10.1).
    Tag {
        name: String,
        state: ObjectRef,
        message: String,
    },
    /// The signing key's identity was replaced by `new` (spec §14.2).
    Rotate { new: KeyId },
    /// `key` must no longer be trusted (spec §14.2).
    Revoke { key: KeyId, reason: String },
    /// A runner ran the job of `receipt` on `state` (spec §14.6); `run`
    /// names the run, usually by URL.
    Receipt {
        receipt: ObjectRef,
        state: ObjectRef,
        run: String,
    },
}

#[derive(Clone, Debug, PartialEq, Eq)]
pub struct Attest {
    /// Repository ID chosen at init.
    pub repo: [u8; 16],
    pub hlc: Hlc,
    pub body: AttestBody,
}

impl Attest {
    pub fn kind(&self) -> &'static str {
        match self.body {
            AttestBody::Ref { .. } => "ref",
            AttestBody::Seal { .. } => "seal",
            AttestBody::Tag { .. } => "tag",
            AttestBody::Rotate { .. } => "rotate",
            AttestBody::Revoke { .. } => "revoke",
            AttestBody::Receipt { .. } => "receipt",
        }
    }

    pub fn seal(repo: [u8; 16], mut hashes: Vec<ChangeHash>) -> Attest {
        hashes.sort();
        hashes.dedup();
        Attest {
            repo,
            hlc: Hlc::now(),
            body: AttestBody::Seal { hashes },
        }
    }

    pub fn to_value(&self) -> Value {
        let body = match &self.body {
            AttestBody::Ref {
                name,
                old_state,
                new_state,
                serial,
            } => Value::map([
                (0, Value::Text(name.clone())),
                (1, Value::Bytes(old_state.0.to_vec())),
                (2, Value::Bytes(new_state.0.to_vec())),
                (3, Value::Uint(*serial)),
            ]),
            AttestBody::Seal { hashes } => Value::map([(
                0,
                Value::Array(hashes.iter().map(|h| Value::Bytes(h.0.to_vec())).collect()),
            )]),
            AttestBody::Tag {
                name,
                state,
                message,
            } => Value::map([
                (0, Value::Text(name.clone())),
                (1, Value::Bytes(state.0.to_vec())),
                (2, Value::Text(message.clone())),
            ]),
            AttestBody::Rotate { new } => Value::map([(0, Value::Bytes(new.0.to_vec()))]),
            AttestBody::Revoke { key, reason } => Value::map([
                (0, Value::Bytes(key.0.to_vec())),
                (1, Value::Text(reason.clone())),
            ]),
            AttestBody::Receipt {
                receipt,
                state,
                run,
            } => Value::map([
                (0, Value::Bytes(receipt.0.to_vec())),
                (1, Value::Bytes(state.0.to_vec())),
                (2, Value::Text(run.clone())),
            ]),
        };
        Value::map([
            (0, Value::Uint(FORMAT_VERSION)),
            (1, Value::Text(self.kind().into())),
            (2, Value::Bytes(self.repo.to_vec())),
            (3, self.hlc.to_value()),
            (4, body),
        ])
    }

    pub fn encode(&self) -> Vec<u8> {
        cbor::encode(&self.to_value())
    }

    pub fn hash(&self) -> ObjectRef {
        hash_object(ObjectType::Attest, &self.encode())
    }

    pub fn decode(b: &[u8]) -> Result<Attest, ObjectError> {
        let v = cbor::decode(b)?;
        let m = map(&v, "attest")?;
        check_version(m)?;
        let kind = text(field(m, 1, "kind")?, "kind")?;
        let repo: [u8; 16] = bytes(field(m, 2, "repo")?, "repo")?
            .try_into()
            .map_err(|_| ObjectError::Schema("repo: expected 16 bytes".into()))?;
        let hlc = Hlc::from_value(field(m, 3, "hlc")?)?;
        let b = map(field(m, 4, "body")?, "body")?;
        let body = match kind {
            "ref" => AttestBody::Ref {
                name: text(field(b, 0, "name")?, "name")?.to_owned(),
                old_state: oref(field(b, 1, "old_state")?, "old_state")?,
                new_state: oref(field(b, 2, "new_state")?, "new_state")?,
                serial: uint(field(b, 3, "serial")?, "serial")?,
            },
            "seal" => {
                let hashes = array(field(b, 0, "hashes")?, "hashes")?
                    .iter()
                    .map(|h| oref(h, "hash"))
                    .collect::<Result<Vec<_>, _>>()?;
                if hashes.is_empty()
                    || hashes.len() > MAX_SEAL_HASHES
                    || !hashes.windows(2).all(|w| w[0] < w[1])
                {
                    return Err(ObjectError::Schema(
                        "seal: hashes must be 1..4096, sorted and unique".into(),
                    ));
                }
                AttestBody::Seal { hashes }
            }
            "tag" => AttestBody::Tag {
                name: text(field(b, 0, "name")?, "name")?.to_owned(),
                state: oref(field(b, 1, "state")?, "state")?,
                message: text(field(b, 2, "message")?, "message")?.to_owned(),
            },
            "rotate" => AttestBody::Rotate {
                new: oref(field(b, 0, "new")?, "new")?,
            },
            "revoke" => AttestBody::Revoke {
                key: oref(field(b, 0, "key")?, "key")?,
                reason: text(field(b, 1, "reason")?, "reason")?.to_owned(),
            },
            "receipt" => AttestBody::Receipt {
                receipt: oref(field(b, 0, "receipt")?, "receipt")?,
                state: oref(field(b, 1, "state")?, "state")?,
                run: text(field(b, 2, "run")?, "run")?.to_owned(),
            },
            other => {
                return Err(ObjectError::Schema(format!(
                    "unknown attestation kind {other:?}"
                )))
            }
        };
        Ok(Attest { repo, hlc, body })
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn round_trips() {
        let r = Attest {
            repo: [1; 16],
            hlc: Hlc {
                wall_ms: 3,
                logical: 0,
            },
            body: AttestBody::Ref {
                name: "main".into(),
                old_state: ObjectRef([1; 32]),
                new_state: ObjectRef([2; 32]),
                serial: 7,
            },
        };
        assert_eq!(Attest::decode(&r.encode()).unwrap(), r);
        assert_eq!(r.kind(), "ref");
        let s = Attest::seal(
            [1; 16],
            vec![ObjectRef([9; 32]), ObjectRef([3; 32]), ObjectRef([9; 32])],
        );
        let d = Attest::decode(&s.encode()).unwrap();
        assert!(
            matches!(&d.body, AttestBody::Seal { hashes } if hashes == &vec![ObjectRef([3; 32]), ObjectRef([9; 32])])
        );
        assert_ne!(s.hash(), r.hash());
        let t = Attest {
            repo: [1; 16],
            hlc: Hlc::default(),
            body: AttestBody::Tag {
                name: "v1".into(),
                state: ObjectRef([5; 32]),
                message: "release".into(),
            },
        };
        assert_eq!(Attest::decode(&t.encode()).unwrap(), t);
        assert_eq!(t.kind(), "tag");
    }

    #[test]
    fn rejects_bad_seals() {
        let empty = Attest {
            repo: [0; 16],
            hlc: Hlc::default(),
            body: AttestBody::Seal { hashes: vec![] },
        };
        assert!(Attest::decode(&empty.encode()).is_err());
        let unsorted = Attest {
            repo: [0; 16],
            hlc: Hlc::default(),
            body: AttestBody::Seal {
                hashes: vec![ObjectRef([2; 32]), ObjectRef([1; 32])],
            },
        };
        assert!(Attest::decode(&unsorted.encode()).is_err());
    }
}

`/`	Search
`g` `c`	Code
`g` `h`	History
`g` `b`	Bookmarks
`g` `t`	Trust
`y`	Permalink to this state (files and trees)
`?`	This sheet

1		//! Attestations (spec §14.4): signed statements about references and batches
2		//! of changes, and runs (receipts, §14.6).
3
4		use crate::cbor::{self, Value};
5		use crate::hash::{hash_object, ChangeHash, KeyId, ObjectRef, ObjectType};
6		use crate::objects::{
7		array, bytes, check_version, field, map, oref, text, uint, Hlc, ObjectError, FORMAT_VERSION,
8		};
9
10		pub const MAX_SEAL_HASHES: usize = 4096;
11
12		#[derive(Clone, Debug, PartialEq, Eq)]
13		pub enum AttestBody {
14		/// A bookmark moved from `old_state` to `new_state` (spec §10.2).
15		Ref {
16		name: String,
17		old_state: ObjectRef,
18		new_state: ObjectRef,
19		serial: u64,
20		},
21		/// One signature covering a batch of changes (spec §14.4).
22		Seal { hashes: Vec<ChangeHash> },
23		/// An immutable named state (spec §10.1).
24		Tag {
25		name: String,
26		state: ObjectRef,
27		message: String,
28		},
29		/// The signing key's identity was replaced by `new` (spec §14.2).
30		Rotate { new: KeyId },
31		/// `key` must no longer be trusted (spec §14.2).
32		Revoke { key: KeyId, reason: String },
33		/// A runner ran the job of `receipt` on `state` (spec §14.6); `run`
34		/// names the run, usually by URL.
35		Receipt {
36		receipt: ObjectRef,
37		state: ObjectRef,
38		run: String,
39		},
40		}
41
42		#[derive(Clone, Debug, PartialEq, Eq)]
43		pub struct Attest {
44		/// Repository ID chosen at init.
45		pub repo: [u8; 16],
46		pub hlc: Hlc,
47		pub body: AttestBody,
48		}
49
50		impl Attest {
51	482×	pub fn kind(&self) -> &'static str {
52	482×	match self.body {
53	282×	AttestBody::Ref { .. } => "ref",
54	115×	AttestBody::Seal { .. } => "seal",
55	44×	AttestBody::Tag { .. } => "tag",
56	14×	AttestBody::Rotate { .. } => "rotate",
57	4×	AttestBody::Revoke { .. } => "revoke",
58	23×	AttestBody::Receipt { .. } => "receipt",
59		}
60	482×	}
61
62	39×	pub fn seal(repo: [u8; 16], mut hashes: Vec<ChangeHash>) -> Attest {
63	39×	hashes.sort();
64	39×	hashes.dedup();
65	39×	Attest {
66	39×	repo,
67	39×	hlc: Hlc::now(),
68	39×	body: AttestBody::Seal { hashes },
69	39×	}
70	39×	}
71
72	480×	pub fn to_value(&self) -> Value {
73	480×	let body = match &self.body {
74		AttestBody::Ref {
75	281×	name,
76	281×	old_state,
77	281×	new_state,
78	281×	serial,
79	281×	} => Value::map([
80	281×	(0, Value::Text(name.clone())),
81	281×	(1, Value::Bytes(old_state.0.to_vec())),
82	281×	(2, Value::Bytes(new_state.0.to_vec())),
83	281×	(3, Value::Uint(*serial)),
84	281×	]),
85	115×	AttestBody::Seal { hashes } => Value::map([(
86		0,
87	125×	Value::Array(hashes.iter().map(\|h\| Value::Bytes(h.0.to_vec())).collect()),
88		)]),
89		AttestBody::Tag {
90	43×	name,
91	43×	state,
92	43×	message,
93	43×	} => Value::map([
94	43×	(0, Value::Text(name.clone())),
95	43×	(1, Value::Bytes(state.0.to_vec())),
96	43×	(2, Value::Text(message.clone())),
97	43×	]),
98	14×	AttestBody::Rotate { new } => Value::map([(0, Value::Bytes(new.0.to_vec()))]),
99	4×	AttestBody::Revoke { key, reason } => Value::map([
100	4×	(0, Value::Bytes(key.0.to_vec())),
101	4×	(1, Value::Text(reason.clone())),
102	4×	]),
103		AttestBody::Receipt {
104	23×	receipt,
105	23×	state,
106	23×	run,
107	23×	} => Value::map([
108	23×	(0, Value::Bytes(receipt.0.to_vec())),
109	23×	(1, Value::Bytes(state.0.to_vec())),
110	23×	(2, Value::Text(run.clone())),
111	23×	]),
112		};
113	480×	Value::map([
114	480×	(0, Value::Uint(FORMAT_VERSION)),
115	480×	(1, Value::Text(self.kind().into())),
116	480×	(2, Value::Bytes(self.repo.to_vec())),
117	480×	(3, self.hlc.to_value()),
118	480×	(4, body),
119	480×	])
120	480×	}
121
122	480×	pub fn encode(&self) -> Vec<u8> {
123	480×	cbor::encode(&self.to_value())
124	480×	}
125
126	137×	pub fn hash(&self) -> ObjectRef {
127	137×	hash_object(ObjectType::Attest, &self.encode())
128	137×	}
129
130	787×	pub fn decode(b: &[u8]) -> Result<Attest, ObjectError> {
131	787×	let v = cbor::decode(b)?;
132	787×	let m = map(&v, "attest")?;
133	787×	check_version(m)?;
134	787×	let kind = text(field(m, 1, "kind")?, "kind")?;
135	787×	let repo: [u8; 16] = bytes(field(m, 2, "repo")?, "repo")?
136	787×	.try_into()
137	787×	.map_err(\|_\| ObjectError::Schema("repo: expected 16 bytes".into()))?;
138	787×	let hlc = Hlc::from_value(field(m, 3, "hlc")?)?;
139	787×	let b = map(field(m, 4, "body")?, "body")?;
140	787×	let body = match kind {
141	787×	"ref" => AttestBody::Ref {
142	324×	name: text(field(b, 0, "name")?, "name")?.to_owned(),
143	324×	old_state: oref(field(b, 1, "old_state")?, "old_state")?,
144	324×	new_state: oref(field(b, 2, "new_state")?, "new_state")?,
145	324×	serial: uint(field(b, 3, "serial")?, "serial")?,
146		},
147	463×	"seal" => {
148	332×	let hashes = array(field(b, 0, "hashes")?, "hashes")?
149	332×	.iter()
150	367×	.map(\|h\| oref(h, "hash"))
151	332×	.collect::<Result<Vec<_>, _>>()?;
152	332×	if hashes.is_empty()
153	331×	\|\| hashes.len() > MAX_SEAL_HASHES
154	331×	\|\| !hashes.windows(2).all(\|w\| w[0] < w[1])
155		{
156	2×	return Err(ObjectError::Schema(
157	2×	"seal: hashes must be 1..4096, sorted and unique".into(),
158	2×	));
159	330×	}
160	330×	AttestBody::Seal { hashes }
161		}
162	131×	"tag" => AttestBody::Tag {
163	119×	name: text(field(b, 0, "name")?, "name")?.to_owned(),
164	119×	state: oref(field(b, 1, "state")?, "state")?,
165	119×	message: text(field(b, 2, "message")?, "message")?.to_owned(),
166		},
167	12×	"rotate" => AttestBody::Rotate {
168	0×	new: oref(field(b, 0, "new")?, "new")?,
169		},
170	12×	"revoke" => AttestBody::Revoke {
171	0×	key: oref(field(b, 0, "key")?, "key")?,
172	0×	reason: text(field(b, 1, "reason")?, "reason")?.to_owned(),
173		},
174	12×	"receipt" => AttestBody::Receipt {
175	12×	receipt: oref(field(b, 0, "receipt")?, "receipt")?,
176	12×	state: oref(field(b, 1, "state")?, "state")?,
177	12×	run: text(field(b, 2, "run")?, "run")?.to_owned(),
178		},
179	0×	other => {
180	0×	return Err(ObjectError::Schema(format!(
181	0×	"unknown attestation kind {other:?}"
182	0×	)))
183		}
184		};
185	785×	Ok(Attest { repo, hlc, body })
186	787×	}
187		}
188
189		#[cfg(test)]
190		mod tests {
191		use super::*;
192
193		#[test]
194	1×	fn round_trips() {
195	1×	let r = Attest {
196	1×	repo: [1; 16],
197	1×	hlc: Hlc {
198	1×	wall_ms: 3,
199	1×	logical: 0,
200	1×	},
201	1×	body: AttestBody::Ref {
202	1×	name: "main".into(),
203	1×	old_state: ObjectRef([1; 32]),
204	1×	new_state: ObjectRef([2; 32]),
205	1×	serial: 7,
206	1×	},
207	1×	};
208	1×	assert_eq!(Attest::decode(&r.encode()).unwrap(), r);
209	1×	assert_eq!(r.kind(), "ref");
210	1×	let s = Attest::seal(
211	1×	[1; 16],
212	1×	vec![ObjectRef([9; 32]), ObjectRef([3; 32]), ObjectRef([9; 32])],
213		);
214	1×	let d = Attest::decode(&s.encode()).unwrap();
215	1×	assert!(
216	1×	matches!(&d.body, AttestBody::Seal { hashes } if hashes == &vec![ObjectRef([3; 32]), ObjectRef([9; 32])])
217		);
218	1×	assert_ne!(s.hash(), r.hash());
219	1×	let t = Attest {
220	1×	repo: [1; 16],
221	1×	hlc: Hlc::default(),
222	1×	body: AttestBody::Tag {
223	1×	name: "v1".into(),
224	1×	state: ObjectRef([5; 32]),
225	1×	message: "release".into(),
226	1×	},
227	1×	};
228	1×	assert_eq!(Attest::decode(&t.encode()).unwrap(), t);
229	1×	assert_eq!(t.kind(), "tag");
230	1×	}
231
232		#[test]
233	1×	fn rejects_bad_seals() {
234	1×	let empty = Attest {
235	1×	repo: [0; 16],
236	1×	hlc: Hlc::default(),
237	1×	body: AttestBody::Seal { hashes: vec![] },
238	1×	};
239	1×	assert!(Attest::decode(&empty.encode()).is_err());
240	1×	let unsorted = Attest {
241	1×	repo: [0; 16],
242	1×	hlc: Hlc::default(),
243	1×	body: AttestBody::Seal {
244	1×	hashes: vec![ObjectRef([2; 32]), ObjectRef([1; 32])],
245	1×	},
246	1×	};
247	1×	assert!(Attest::decode(&unsorted.encode()).is_err());
248	1×	}
249		}

Coverage / crates/oxy-core/src/attest.rs 95.3%

Keyboard