transparency.rs 3.7%

9 of 241 lines run, 2 of 38 functions · run #345 on proposal/125 · run missed

//! Checking a host's transparency log on fetch (spec §14.8, oxygenhub#238).
//!
//! A host that keeps a log sends its latest checkpoint with the refs, and
//! for each bookmark's attestation its entry and an inclusion proof. This
//! user remembers, per hub, the log's key and the last checkpoint seen
//! (`<oxy home>/tlog/<hub>`): the key on first sight, then never another.
//! Each new checkpoint must extend the last one, which oxy proves from the
//! hub's public tiles (C2SP tlog-tiles); one that does not means the hub
//! showed two histories, and the fetch fails. An attestation that is not
//! in the log yet, or whose proof does not verify, is only reported while
//! the log is new (oxygenhub docs/transparency.md, decision 3).

use super::*;
use crate::credentials::hub_of;
use crate::protocol::http_get;
use crate::tlog::{self, Checkpoint, Entry, Hash, HashReader, Note, Tile, TlogError};
use std::cell::RefCell;

/// Tiles fetched, by level and number, with the width fetched.
type TileCache = RefCell<HashMap<(u32, u64), (Tile, Vec<u8>)>>;

/// A hub's log as its tiles serve it, for a tree of `size` entries.
struct Tiles<'a> {
    hub: &'a str,
    size: u64,
    options: &'a RemoteOptions,
    cache: TileCache,
}

impl HashReader for Tiles<'_> {
    fn read_hashes(&self, indexes: &[u64]) -> std::result::Result<Vec<Hash>, TlogError> {
        let mut out = Vec::with_capacity(indexes.len());
        for &i in indexes {
            let (t, ..) = Tile::for_index(i);
            let key = (t.level, t.n);
            if !self.cache.borrow().contains_key(&key) {
                let held =
                    (self.size >> (tlog::TILE_HEIGHT * t.level)) - (t.n << tlog::TILE_HEIGHT);
                let tile = Tile {
                    width: held.min(tlog::TILE_WIDTH) as u32,
                    ..t
                };
                let data = http_get(&format!("{}/log/{}", self.hub, tile.path()), self.options)
                    .map_err(|e| TlogError::Read(e.to_string()))?;
                self.cache.borrow_mut().insert(key, (tile, data));
            }
            let cache = self.cache.borrow();
            let (tile, data) = &cache[&key];
            out.push(tile.hash_at(data, i)?);
        }
        Ok(out)
    }
}

/// What this user last saw of a hub's log.
struct Seen {
    identity: Identity,
    checkpoint: Checkpoint,
}

fn file_name(hub: &str) -> String {
    hub.chars()
        .map(|c| {
            if c.is_ascii_alphanumeric() || c == '.' || c == '-' {
                c
            } else {
                '_'
            }
        })
        .collect()
}

impl Repo {
    fn tlog_file(&self, hub: &str) -> PathBuf {
        self.user_config
            .parent()
            .map(Path::to_path_buf)
            .unwrap_or_else(default_home)
            .join("tlog")
            .join(file_name(hub))
    }

    fn seen_log(&self, hub: &str) -> Option<Seen> {
        let text = fs::read_to_string(self.tlog_file(hub)).ok()?;
        let (key, note) = text.split_once('\n')?;
        let identity = Identity::decode(&crate::dsse::base64_decode(key)?).ok()?;
        let note = Note::parse(note).ok()?;
        Some(Seen {
            checkpoint: Checkpoint::parse(&note.text).ok()?,
            identity,
        })
    }

    fn remember_log(&self, hub: &str, identity: &Identity, note: &Note) -> Result<()> {
        let path = self.tlog_file(hub);
        if let Some(dir) = path.parent() {
            fs::create_dir_all(dir)?;
        }
        let text = format!(
            "{}\n{}",
            crate::dsse::base64(&identity.encode()),
            note.encode()
        );
        crate::durable::write_atomic(&path, text.as_bytes())?;
        Ok(())
    }

    /// Take a checkpoint note `text` from `hub` as the newest seen, once it
    /// verifies with the hub's pinned log key and extends the last one
    /// seen. `Err` when the hub showed two histories; `Ok(Err(why))` when
    /// it could not be checked (the last one seen is kept).
    pub(crate) fn accept_checkpoint(
        &self,
        hub: &str,
        text: &str,
        options: &RemoteOptions,
    ) -> Result<std::result::Result<(Checkpoint, Vec<String>), String>> {
        let unchecked = |why: String| Ok(Err(why));
        let note = match Note::parse(text) {
            Ok(n) => n,
            Err(e) => return unchecked(e.to_string()),
        };
        let cp = match Checkpoint::parse(&note.text) {
            Ok(c) => c,
            Err(e) => return unchecked(e.to_string()),
        };
        let fetch_key = || {
            http_get(&format!("{hub}/.well-known/oxyhub-key"), options)
                .and_then(|b| Ok(Identity::decode(&b)?))
        };
        let mut notes = Vec::new();
        let mut seen = self.seen_log(hub);
        let mut identity = match &seen {
            Some(s) => s.identity.clone(),
            None => match fetch_key() {
                Ok(i) => i,
                Err(e) => return unchecked(format!("its key could not be fetched ({e})")),
            },
        };
        if let Err(e) = note.verify(&cp.origin, &identity) {
            // Signed by another key than the one pinned: a hub given a new
            // key, or one starting another log. Not proof of a fork, so a
            // loud note while logs are new (decision 3), and the new key is
            // pinned; a fork under one key is what fails.
            let Some(old) = &seen else {
                return unchecked(e.to_string());
            };
            match fetch_key() {
                Ok(new) if note.verify(&cp.origin, &new).is_ok() => {
                    notes.push(format!(
                        "{hub}'s log is signed by another key than before ({} now, {} then): if its operator did not announce a new key, it may be showing others a different log",
                        new.hash().short(12),
                        old.identity.hash().short(12)
                    ));
                    identity = new;
                    seen = None;
                }
                _ => return unchecked(format!("its checkpoint does not verify ({e})")),
            }
        }
        let two = |why: String| {
            fail(format!(
                "{hub} showed two histories: {why}. Do not trust what it serves; tell its operator. \
                 (What this user saw of its log is in {}.)",
                self.tlog_file(hub).display()
            ))
        };
        if let Some(s) = &seen {
            let old = &s.checkpoint;
            if old.origin != cp.origin {
                // A hub moved to another name keeps its key: a new log as
                // far as this user can tell, said so.
                notes.push(format!(
                    "{hub}'s log is now {}, not {}: checking it afresh",
                    cp.origin, old.origin
                ));
            } else if cp.size < old.size {
                return two(format!(
                    "its log has {} entries, fewer than the {} it showed before",
                    cp.size, old.size
                ));
            } else if cp.size == old.size && cp.root != old.root {
                return two(format!("two different logs of {} entries", cp.size));
            } else if cp.size > old.size && old.size > 0 {
                let tiles = Tiles {
                    hub,
                    size: cp.size,
                    options,
                    cache: RefCell::new(HashMap::new()),
                };
                match tlog::prove_consistency(cp.size, old.size, &tiles).and_then(|p| {
                    tlog::check_consistency(&p, cp.size, &cp.root, old.size, &old.root)
                }) {
                    Ok(()) => {}
                    Err(TlogError::ProofFailed) | Err(TlogError::BadIndex(_)) => {
                        return two(format!(
                            "its log of {} entries does not extend the one of {} it showed before",
                            cp.size, old.size
                        ))
                    }
                    // Keep the older checkpoint: the next fetch tries again.
                    Err(e) => return unchecked(format!("its tiles could not be read ({e})")),
                }
            }
        }
        self.remember_log(hub, &identity, &note)?;
        Ok(Ok((cp, notes)))
    }

    /// Check what a refs answer from `url` says about its host's log.
    /// Fails only when the host showed two histories under one key;
    /// everything else is a note.
    pub(crate) fn check_log(
        &self,
        url: &str,
        ca: Option<&Path>,
        resp: &RefsResponse,
    ) -> Result<Vec<String>> {
        let (Some(text), Some(hub)) = (&resp.log, hub_of(url)) else {
            return Ok(vec![]);
        };
        let options = RemoteOptions {
            ca: ca.map(Path::to_path_buf),
            ..RemoteOptions::default()
        };
        let (cp, mut notes) = match self.accept_checkpoint(&hub, text, &options)? {
            Ok(c) => c,
            Err(why) => {
                return Ok(vec![format!(
                    "{hub}'s transparency log was not checked: {why}"
                )])
            }
        };
        let mut missing = 0;
        for r in &resp.refs {
            let Some(a) = &r.attestation else { continue };
            let Some(l) = &r.logged else {
                missing += 1;
                continue;
            };
            let fits = Entry::decode(&l.entry).is_ok_and(|e| {
                e.kind == "ref" && e.object == a.attest.hash() && e.repo == a.attest.repo
            });
            let included = fits
                && tlog::check_inclusion(
                    &l.proof,
                    cp.size,
                    &cp.root,
                    l.index,
                    &tlog::leaf_hash(&l.entry),
                )
                .is_ok();
            if !included {
                notes.push(format!(
                    "{hub}'s log entry {} for {} does not prove its attestation is in the log",
                    l.index, r.name
                ));
            }
        }
        if missing > 0 {
            notes.push(format!(
                "{} of {hub}'s attestations {} not in its transparency log yet (logged within seconds of a push; checked on a later fetch)",
                missing,
                if missing == 1 { "is" } else { "are" }
            ));
        }
        Ok(notes)
    }
}

/// A hub's whole log, checked (`oxy tlog verify`).
#[derive(Clone, Debug)]
pub struct LogAudit {
    pub hub: String,
    pub checkpoint: Checkpoint,
    /// Every entry, numbered from 0.
    pub entries: Vec<Entry>,
    /// What accepting the checkpoint noted (a new log key, a new name).
    pub notes: Vec<String>,
}

impl Repo {
    /// Fetch the log of `url`'s hub whole: its checkpoint, accepted as a
    /// fetch accepts one, and every entry bundle, whose entries must make
    /// the root the checkpoint signs.
    pub fn audit_log(&self, url: &str, ca: Option<&Path>) -> Result<LogAudit> {
        let hub =
            hub_of(url).ok_or_else(|| RepoError::Msg(format!("{url} is not a hub's address")))?;
        let options = RemoteOptions {
            ca: ca.map(Path::to_path_buf),
            ..RemoteOptions::default()
        };
        let tl = |e: TlogError| RepoError::Msg(e.to_string());
        let text = String::from_utf8(http_get(&format!("{hub}/log/checkpoint"), &options)?)
            .map_err(|_| RepoError::Msg(format!("{hub}'s checkpoint is not text")))?;
        let (cp, notes) = match self.accept_checkpoint(&hub, &text, &options)? {
            Ok(c) => c,
            Err(why) => return fail(format!("{hub}'s log could not be checked: {why}")),
        };
        let mut entries = Vec::with_capacity(cp.size as usize);
        let mut stored: Vec<Hash> = Vec::new();
        let mut n = 0u64;
        while n < cp.size {
            let t = Tile {
                level: 0,
                n: n >> tlog::TILE_HEIGHT,
                width: (cp.size - n).min(tlog::TILE_WIDTH) as u32,
            };
            let bytes = http_get(&format!("{hub}/log/{}", t.entries_path()), &options)?;
            let bundle = tlog::decode_bundle(&bytes).map_err(tl)?;
            if bundle.len() != t.width as usize {
                return fail(format!(
                    "{hub}'s entry bundle {} holds {} entries, not {}",
                    t.entries_path(),
                    bundle.len(),
                    t.width
                ));
            }
            for b in bundle {
                let add =
                    tlog::stored_hashes_for_leaf(n, tlog::leaf_hash(&b), &stored).map_err(tl)?;
                stored.extend(add);
                entries.push(Entry::decode(&b).map_err(tl)?);
                n += 1;
            }
        }
        if tlog::tree_hash(cp.size, &stored).map_err(tl)? != cp.root {
            return fail(format!(
                "{hub} serves entries that do not make the root it signed for {} entries: its log is not the one it attests",
                cp.size
            ));
        }
        Ok(LogAudit {
            hub,
            checkpoint: cp,
            entries,
            notes,
        })
    }
}

`/`	Search
`g` `c`	Code
`g` `h`	History
`g` `b`	Bookmarks
`g` `t`	Trust
`y`	Permalink to this state (files and trees)
`?`	This sheet

1		//! Checking a host's transparency log on fetch (spec §14.8, oxygenhub#238).
2		//!
3		//! A host that keeps a log sends its latest checkpoint with the refs, and
4		//! for each bookmark's attestation its entry and an inclusion proof. This
5		//! user remembers, per hub, the log's key and the last checkpoint seen
6		//! (`<oxy home>/tlog/<hub>`): the key on first sight, then never another.
7		//! Each new checkpoint must extend the last one, which oxy proves from the
8		//! hub's public tiles (C2SP tlog-tiles); one that does not means the hub
9		//! showed two histories, and the fetch fails. An attestation that is not
10		//! in the log yet, or whose proof does not verify, is only reported while
11		//! the log is new (oxygenhub docs/transparency.md, decision 3).
12
13		use super::*;
14		use crate::credentials::hub_of;
15		use crate::protocol::http_get;
16		use crate::tlog::{self, Checkpoint, Entry, Hash, HashReader, Note, Tile, TlogError};
17		use std::cell::RefCell;
18
19		/// Tiles fetched, by level and number, with the width fetched.
20		type TileCache = RefCell<HashMap<(u32, u64), (Tile, Vec<u8>)>>;
21
22		/// A hub's log as its tiles serve it, for a tree of `size` entries.
23		struct Tiles<'a> {
24		hub: &'a str,
25		size: u64,
26		options: &'a RemoteOptions,
27		cache: TileCache,
28		}
29
30		impl HashReader for Tiles<'_> {
31	0×	fn read_hashes(&self, indexes: &[u64]) -> std::result::Result<Vec<Hash>, TlogError> {
32	0×	let mut out = Vec::with_capacity(indexes.len());
33	0×	for &i in indexes {
34	0×	let (t, ..) = Tile::for_index(i);
35	0×	let key = (t.level, t.n);
36	0×	if !self.cache.borrow().contains_key(&key) {
37	0×	let held =
38	0×	(self.size >> (tlog::TILE_HEIGHT * t.level)) - (t.n << tlog::TILE_HEIGHT);
39	0×	let tile = Tile {
40	0×	width: held.min(tlog::TILE_WIDTH) as u32,
41	0×	..t
42	0×	};
43	0×	let data = http_get(&format!("{}/log/{}", self.hub, tile.path()), self.options)
44	0×	.map_err(\|e\| TlogError::Read(e.to_string()))?;
45	0×	self.cache.borrow_mut().insert(key, (tile, data));
46	0×	}
47	0×	let cache = self.cache.borrow();
48	0×	let (tile, data) = &cache[&key];
49	0×	out.push(tile.hash_at(data, i)?);
50		}
51	0×	Ok(out)
52	0×	}
53		}
54
55		/// What this user last saw of a hub's log.
56		struct Seen {
57		identity: Identity,
58		checkpoint: Checkpoint,
59		}
60
61	0×	fn file_name(hub: &str) -> String {
62	0×	hub.chars()
63	0×	.map(\|c\| {
64	0×	if c.is_ascii_alphanumeric() \|\| c == '.' \|\| c == '-' {
65	0×	c
66		} else {
67	0×	'_'
68		}
69	0×	})
70	0×	.collect()
71	0×	}
72
73		impl Repo {
74	0×	fn tlog_file(&self, hub: &str) -> PathBuf {
75	0×	self.user_config
76	0×	.parent()
77	0×	.map(Path::to_path_buf)
78	0×	.unwrap_or_else(default_home)
79	0×	.join("tlog")
80	0×	.join(file_name(hub))
81	0×	}
82
83	0×	fn seen_log(&self, hub: &str) -> Option<Seen> {
84	0×	let text = fs::read_to_string(self.tlog_file(hub)).ok()?;
85	0×	let (key, note) = text.split_once('\n')?;
86	0×	let identity = Identity::decode(&crate::dsse::base64_decode(key)?).ok()?;
87	0×	let note = Note::parse(note).ok()?;
88		Some(Seen {
89	0×	checkpoint: Checkpoint::parse(&note.text).ok()?,
90	0×	identity,
91		})
92	0×	}
93
94	0×	fn remember_log(&self, hub: &str, identity: &Identity, note: &Note) -> Result<()> {
95	0×	let path = self.tlog_file(hub);
96	0×	if let Some(dir) = path.parent() {
97	0×	fs::create_dir_all(dir)?;
98	0×	}
99	0×	let text = format!(
100		"{}\n{}",
101	0×	crate::dsse::base64(&identity.encode()),
102	0×	note.encode()
103		);
104	0×	crate::durable::write_atomic(&path, text.as_bytes())?;
105	0×	Ok(())
106	0×	}
107
108		/// Take a checkpoint note `text` from `hub` as the newest seen, once it
109		/// verifies with the hub's pinned log key and extends the last one
110		/// seen. `Err` when the hub showed two histories; `Ok(Err(why))` when
111		/// it could not be checked (the last one seen is kept).
112	0×	pub(crate) fn accept_checkpoint(
113	0×	&self,
114	0×	hub: &str,
115	0×	text: &str,
116	0×	options: &RemoteOptions,
117	0×	) -> Result<std::result::Result<(Checkpoint, Vec<String>), String>> {
118	0×	let unchecked = \|why: String\| Ok(Err(why));
119	0×	let note = match Note::parse(text) {
120	0×	Ok(n) => n,
121	0×	Err(e) => return unchecked(e.to_string()),
122		};
123	0×	let cp = match Checkpoint::parse(&note.text) {
124	0×	Ok(c) => c,
125	0×	Err(e) => return unchecked(e.to_string()),
126		};
127	0×	let fetch_key = \|\| {
128	0×	http_get(&format!("{hub}/.well-known/oxyhub-key"), options)
129	0×	.and_then(\|b\| Ok(Identity::decode(&b)?))
130	0×	};
131	0×	let mut notes = Vec::new();
132	0×	let mut seen = self.seen_log(hub);
133	0×	let mut identity = match &seen {
134	0×	Some(s) => s.identity.clone(),
135	0×	None => match fetch_key() {
136	0×	Ok(i) => i,
137	0×	Err(e) => return unchecked(format!("its key could not be fetched ({e})")),
138		},
139		};
140	0×	if let Err(e) = note.verify(&cp.origin, &identity) {
141		// Signed by another key than the one pinned: a hub given a new
142		// key, or one starting another log. Not proof of a fork, so a
143		// loud note while logs are new (decision 3), and the new key is
144		// pinned; a fork under one key is what fails.
145	0×	let Some(old) = &seen else {
146	0×	return unchecked(e.to_string());
147		};
148	0×	match fetch_key() {
149	0×	Ok(new) if note.verify(&cp.origin, &new).is_ok() => {
150	0×	notes.push(format!(
151	0×	"{hub}'s log is signed by another key than before ({} now, {} then): if its operator did not announce a new key, it may be showing others a different log",
152	0×	new.hash().short(12),
153	0×	old.identity.hash().short(12)
154	0×	));
155	0×	identity = new;
156	0×	seen = None;
157	0×	}
158	0×	_ => return unchecked(format!("its checkpoint does not verify ({e})")),
159		}
160	0×	}
161	0×	let two = \|why: String\| {
162	0×	fail(format!(
163		"{hub} showed two histories: {why}. Do not trust what it serves; tell its operator. \
164		(What this user saw of its log is in {}.)",
165	0×	self.tlog_file(hub).display()
166		))
167	0×	};
168	0×	if let Some(s) = &seen {
169	0×	let old = &s.checkpoint;
170	0×	if old.origin != cp.origin {
171	0×	// A hub moved to another name keeps its key: a new log as
172	0×	// far as this user can tell, said so.
173	0×	notes.push(format!(
174	0×	"{hub}'s log is now {}, not {}: checking it afresh",
175	0×	cp.origin, old.origin
176	0×	));
177	0×	} else if cp.size < old.size {
178	0×	return two(format!(
179	0×	"its log has {} entries, fewer than the {} it showed before",
180	0×	cp.size, old.size
181	0×	));
182	0×	} else if cp.size == old.size && cp.root != old.root {
183	0×	return two(format!("two different logs of {} entries", cp.size));
184	0×	} else if cp.size > old.size && old.size > 0 {
185	0×	let tiles = Tiles {
186	0×	hub,
187	0×	size: cp.size,
188	0×	options,
189	0×	cache: RefCell::new(HashMap::new()),
190	0×	};
191	0×	match tlog::prove_consistency(cp.size, old.size, &tiles).and_then(\|p\| {
192	0×	tlog::check_consistency(&p, cp.size, &cp.root, old.size, &old.root)
193	0×	}) {
194	0×	Ok(()) => {}
195		Err(TlogError::ProofFailed) \| Err(TlogError::BadIndex(_)) => {
196	0×	return two(format!(
197	0×	"its log of {} entries does not extend the one of {} it showed before",
198	0×	cp.size, old.size
199	0×	))
200		}
201		// Keep the older checkpoint: the next fetch tries again.
202	0×	Err(e) => return unchecked(format!("its tiles could not be read ({e})")),
203		}
204	0×	}
205	0×	}
206	0×	self.remember_log(hub, &identity, &note)?;
207	0×	Ok(Ok((cp, notes)))
208	0×	}
209
210		/// Check what a refs answer from `url` says about its host's log.
211		/// Fails only when the host showed two histories under one key;
212		/// everything else is a note.
213	377×	pub(crate) fn check_log(
214	377×	&self,
215	377×	url: &str,
216	377×	ca: Option<&Path>,
217	377×	resp: &RefsResponse,
218	377×	) -> Result<Vec<String>> {
219	377×	let (Some(text), Some(hub)) = (&resp.log, hub_of(url)) else {
220	377×	return Ok(vec![]);
221		};
222	0×	let options = RemoteOptions {
223	0×	ca: ca.map(Path::to_path_buf),
224	0×	..RemoteOptions::default()
225	0×	};
226	0×	let (cp, mut notes) = match self.accept_checkpoint(&hub, text, &options)? {
227	0×	Ok(c) => c,
228	0×	Err(why) => {
229	0×	return Ok(vec![format!(
230	0×	"{hub}'s transparency log was not checked: {why}"
231	0×	)])
232		}
233		};
234	0×	let mut missing = 0;
235	0×	for r in &resp.refs {
236	0×	let Some(a) = &r.attestation else { continue };
237	0×	let Some(l) = &r.logged else {
238	0×	missing += 1;
239	0×	continue;
240		};
241	0×	let fits = Entry::decode(&l.entry).is_ok_and(\|e\| {
242	0×	e.kind == "ref" && e.object == a.attest.hash() && e.repo == a.attest.repo
243	0×	});
244	0×	let included = fits
245	0×	&& tlog::check_inclusion(
246	0×	&l.proof,
247	0×	cp.size,
248	0×	&cp.root,
249	0×	l.index,
250	0×	&tlog::leaf_hash(&l.entry),
251	0×	)
252	0×	.is_ok();
253	0×	if !included {
254	0×	notes.push(format!(
255	0×	"{hub}'s log entry {} for {} does not prove its attestation is in the log",
256	0×	l.index, r.name
257	0×	));
258	0×	}
259		}
260	0×	if missing > 0 {
261	0×	notes.push(format!(
262		"{} of {hub}'s attestations {} not in its transparency log yet (logged within seconds of a push; checked on a later fetch)",
263		missing,
264	0×	if missing == 1 { "is" } else { "are" }
265		));
266	0×	}
267	0×	Ok(notes)
268	377×	}
269		}
270
271		/// A hub's whole log, checked (`oxy tlog verify`).
272		#[derive(Clone, Debug)]
273		pub struct LogAudit {
274		pub hub: String,
275		pub checkpoint: Checkpoint,
276		/// Every entry, numbered from 0.
277		pub entries: Vec<Entry>,
278		/// What accepting the checkpoint noted (a new log key, a new name).
279		pub notes: Vec<String>,
280		}
281
282		impl Repo {
283		/// Fetch the log of `url`'s hub whole: its checkpoint, accepted as a
284		/// fetch accepts one, and every entry bundle, whose entries must make
285		/// the root the checkpoint signs.
286	0×	pub fn audit_log(&self, url: &str, ca: Option<&Path>) -> Result<LogAudit> {
287	0×	let hub =
288	0×	hub_of(url).ok_or_else(\|\| RepoError::Msg(format!("{url} is not a hub's address")))?;
289	0×	let options = RemoteOptions {
290	0×	ca: ca.map(Path::to_path_buf),
291	0×	..RemoteOptions::default()
292	0×	};
293	0×	let tl = \|e: TlogError\| RepoError::Msg(e.to_string());
294	0×	let text = String::from_utf8(http_get(&format!("{hub}/log/checkpoint"), &options)?)
295	0×	.map_err(\|_\| RepoError::Msg(format!("{hub}'s checkpoint is not text")))?;
296	0×	let (cp, notes) = match self.accept_checkpoint(&hub, &text, &options)? {
297	0×	Ok(c) => c,
298	0×	Err(why) => return fail(format!("{hub}'s log could not be checked: {why}")),
299		};
300	0×	let mut entries = Vec::with_capacity(cp.size as usize);
301	0×	let mut stored: Vec<Hash> = Vec::new();
302	0×	let mut n = 0u64;
303	0×	while n < cp.size {
304	0×	let t = Tile {
305	0×	level: 0,
306	0×	n: n >> tlog::TILE_HEIGHT,
307	0×	width: (cp.size - n).min(tlog::TILE_WIDTH) as u32,
308	0×	};
309	0×	let bytes = http_get(&format!("{hub}/log/{}", t.entries_path()), &options)?;
310	0×	let bundle = tlog::decode_bundle(&bytes).map_err(tl)?;
311	0×	if bundle.len() != t.width as usize {
312	0×	return fail(format!(
313		"{hub}'s entry bundle {} holds {} entries, not {}",
314	0×	t.entries_path(),
315	0×	bundle.len(),
316		t.width
317		));
318	0×	}
319	0×	for b in bundle {
320	0×	let add =
321	0×	tlog::stored_hashes_for_leaf(n, tlog::leaf_hash(&b), &stored).map_err(tl)?;
322	0×	stored.extend(add);
323	0×	entries.push(Entry::decode(&b).map_err(tl)?);
324	0×	n += 1;
325		}
326		}
327	0×	if tlog::tree_hash(cp.size, &stored).map_err(tl)? != cp.root {
328	0×	return fail(format!(
329		"{hub} serves entries that do not make the root it signed for {} entries: its log is not the one it attests",
330		cp.size
331		));
332	0×	}
333	0×	Ok(LogAudit {
334	0×	hub,
335	0×	checkpoint: cp,
336	0×	entries,
337	0×	notes,
338	0×	})
339	0×	}
340		}

Coverage / crates/oxy-core/src/repo/transparency.rs 3.7%

Keyboard