keyless.rs 36.8%

64 of 174 lines run, 7 of 38 functions · run #382 on main · run missed

//! Signing with short-lived keys (spec §14.7, oxygenhub#241): with
//! `author.signer = keyless`, oxy asks the hub to certify a fresh key
//! whenever it must sign, with the agent's grant token as the credential,
//! and keeps the key in memory for its certificate's minutes. Nothing that
//! signs is ever written to disk: the home holds only the grant token,
//! which its owner revokes on the hub. The certificate carries the owner's
//! grant, so what the key signs counts in the owner's name.

use super::*;
use crate::cert::{certify_challenge, SignedCertificate};
use crate::credentials::{hub_of, Credentials};
use crate::protocol::{http_get, http_json, RemoteOptions};

/// A certified key is used until this long before its certificate ends,
/// so a push started near the end does not outlive it.
const MARGIN_MS: u64 = 2 * 60 * 1000;

impl Repo {
    /// The hub that certifies keys: `keyless.hub`, else the default
    /// remote's.
    fn keyless_hub(&self) -> Result<String> {
        let url = match &self.config.keyless_hub {
            Some(h) => h.clone(),
            None => self
                .config
                .remotes
                .get(&self.default_remote())
                .cloned()
                .ok_or_else(|| {
                    RepoError::Msg(
                        "author.signer is keyless, but neither keyless.hub nor a default remote names the hub that certifies keys"
                            .into(),
                    )
                })?,
        };
        hub_of(&url).ok_or_else(|| RepoError::Msg(format!("{url} is not a hub URL")))
    }

    /// The key to sign with now: the one certified last while it has more
    /// than a couple of minutes left, else a fresh one the hub certifies.
    pub(crate) fn keyless_secret(&self) -> Result<(KeyId, SecretKey)> {
        let now = Hlc::now().wall_ms;
        if let Some((k, sk, until)) = self.keyless_key.borrow().as_ref() {
            if now + MARGIN_MS < *until {
                return Ok((*k, sk.clone()));
            }
        }
        let hub = self.keyless_hub()?;
        let home = self
            .user_config
            .parent()
            .map(Path::to_path_buf)
            .unwrap_or_else(default_home);
        let creds = Credentials::at(home.clone());
        let token = creds.grant(&hub).map_err(RepoError::Msg)?.ok_or_else(|| {
            RepoError::Msg(format!(
                "author.signer is keyless, but there is no agent grant for {hub}: its owner makes one with `oh agent grant NAME`, and `oxy auth grant TOKEN` keeps it"
            ))
        })?;
        let options = RemoteOptions {
            token: Some(token.clone()),
            ca: creds.get(&hub).map_err(RepoError::Msg)?.and_then(|e| e.ca),
            ..RemoteOptions::default()
        };
        let sk = SecretKey::generate();
        let id = sk.identity(&self.config.author_name, &self.config.author_email, now);
        let key = id.hash();
        let proof = sk
            .sign_challenge(&key, &certify_challenge(&token))
            .map_err(|e| RepoError::Msg(e.to_string()))?;
        let body = serde_json::json!({
            "identity": crate::dsse::base64(&id.encode()),
            "proof": crate::dsse::base64(&crate::cbor::encode(&proof.to_value())),
            "scope": "changes,refs,seal",
        });
        let (code, answer) = http_json(
            "POST",
            &format!("{hub}/api/v1/keyless/certify"),
            Some(&body.to_string()),
            &options,
        )?;
        let reply: serde_json::Value = serde_json::from_str(&answer).unwrap_or_default();
        if !(200..300).contains(&code) {
            let why = reply["error"].as_str().unwrap_or(answer.trim());
            return fail(format!(
                "{hub} would not certify a key (HTTP {code}): {why}"
            ));
        }
        let cert = reply["certificate"]
            .as_str()
            .and_then(crate::dsse::base64_decode)
            .ok_or_else(|| RepoError::Msg(format!("{hub} answered with no certificate")))?;
        let cert = SignedCertificate::decode(&cert)
            .map_err(|e| RepoError::Msg(format!("{hub}'s certificate: {e}")))?;
        if cert.cert.key_id() != key {
            return fail(format!(
                "{hub} certified another key than the one it was asked for"
            ));
        }
        // The issuer's identity, so this repository (and whoever it pushes
        // to) can check the certificate: the hub's own, as it publishes it.
        let issuer = match self.store.get_identity(&cert.cert.issuer) {
            Ok(i) => i,
            Err(_) => {
                let bytes = http_get(
                    &format!("{hub}/.well-known/oxyhub-key"),
                    &RemoteOptions {
                        token: None,
                        ..options.clone()
                    },
                )?;
                let i = Identity::decode(&bytes)?;
                if i.hash() != cert.cert.issuer {
                    return fail(format!(
                        "{hub}'s published key is not the one that signed its certificate"
                    ));
                }
                i
            }
        };
        cert.verify(&issuer)
            .map_err(|e| RepoError::Msg(format!("{hub}'s certificate: {e}")))?;
        // The grant's author, so the grant can be checked here and wherever
        // this pushes (oxygen#134): from the hub's answer, else this home's
        // copy of it. Without it, a repository that never saw the owner's
        // current identity reads the change as signed by an unknown author.
        if let Some(g) = &cert.cert.grant {
            let grantor = g.grant.grantor;
            if self.store.get_identity(&grantor).is_err() {
                let sent = reply["grantor_identity"]
                    .as_str()
                    .and_then(crate::dsse::base64_decode)
                    .and_then(|b| Identity::decode(&b).ok());
                let kept = || {
                    std::fs::read(
                        home.join("keys")
                            .join(format!("{}.identity", grantor.to_hex())),
                    )
                    .ok()
                    .and_then(|b| Identity::decode(&b).ok())
                };
                match sent.filter(|i| i.hash() == grantor).or_else(|| kept().filter(|i| i.hash() == grantor)) {
                    Some(i) => {
                        self.store.put_identity(&i)?;
                    }
                    None => {
                        return fail(format!(
                            "the grant is signed by {}, whose identity neither {hub} nor this home has: export it there (oxy identity export) into this home's keys/",
                            grantor.short(12)
                        ))
                    }
                }
            }
        }
        self.store.put_identity(&issuer)?;
        self.store.put_identity(&id)?;
        self.store.put_certificate(&cert)?;
        *self.keyless_key.borrow_mut() = Some((key, sk.clone(), cert.cert.expires));
        Ok((key, sk))
    }
}

/// The key a home names as its author (`author.key` in its
/// `config.toml`), with its secret from the home's `keys/`: what signs
/// outside any repository, such as a grant to an agent (`oh agent grant`).
/// `None` when the home names no key or does not hold its secret.
pub fn home_key(home: &Path) -> Result<Option<(Identity, SecretKey)>> {
    let config = read_config_file(&home.join("config.toml"))?;
    let Some(hex) = config.get("author.key").filter(|v| !v.is_empty()) else {
        return Ok(None);
    };
    let key = KeyId::from_hex(hex)
        .ok_or_else(|| RepoError::Msg("author.key must be a 64-character hex KeyId".into()))?;
    let keys = home.join("keys");
    let secret = match fs::read(keys.join(format!("{hex}.secret"))) {
        Ok(b) => b,
        Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(None),
        Err(e) => return Err(e.into()),
    };
    let (k, sk) = SecretKey::decode(&secret)?;
    let id = Identity::decode(&fs::read(keys.join(format!("{hex}.identity")))?)?;
    if k != key || id.hash() != key {
        return fail(format!(
            "{} holds another key than author.key",
            keys.display()
        ));
    }
    Ok(Some((id, sk)))
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn a_home_s_key_signs_outside_any_repository() {
        static HOME: std::sync::OnceLock<tempfile::TempDir> = std::sync::OnceLock::new();
        HOME.get_or_init(|| {
            let d = tempfile::tempdir().unwrap();
            std::env::set_var("OXY_HOME", d.path());
            d
        });
        let dir = tempfile::tempdir().unwrap();
        let home = dir.path().join("home");
        assert!(home_key(&home).unwrap().is_none(), "no config, no key");
        let mut r = Repo::init(&dir.path().join("work"))
            .unwrap()
            .with_home(home.clone());
        let (key, id) = r
            .create_identity("Andy", "[email protected]", IdentityScope::User)
            .unwrap();
        let (got, sk) = home_key(&home).unwrap().expect("the home's author key");
        assert_eq!(got, id);
        let sig = sk.sign(Domain::Grant, &key, &ObjectRef([1; 32]));
        assert!(verify_signature(&id, &sig, Domain::Grant, &ObjectRef([1; 32])).is_ok());
        // An agent whose signer is keyless signs nothing until it asks.
        r.set_user_config("author.signer", "keyless").unwrap();
        assert!(r.config.signer_keyless && r.config.signer_key.is_none());
        assert_eq!(r.signing_key(), None);
        let err = r.secret_key().unwrap_err().to_string();
        assert!(err.contains("keyless.hub nor a default remote"), "{err}");
    }
}

`/`	Search
`g` `c`	Code
`g` `h`	History
`g` `b`	Bookmarks
`g` `t`	Trust
`y`	Permalink to this state (files and trees)
`?`	This sheet

1		//! Signing with short-lived keys (spec §14.7, oxygenhub#241): with
2		//! `author.signer = keyless`, oxy asks the hub to certify a fresh key
3		//! whenever it must sign, with the agent's grant token as the credential,
4		//! and keeps the key in memory for its certificate's minutes. Nothing that
5		//! signs is ever written to disk: the home holds only the grant token,
6		//! which its owner revokes on the hub. The certificate carries the owner's
7		//! grant, so what the key signs counts in the owner's name.
8
9		use super::*;
10		use crate::cert::{certify_challenge, SignedCertificate};
11		use crate::credentials::{hub_of, Credentials};
12		use crate::protocol::{http_get, http_json, RemoteOptions};
13
14		/// A certified key is used until this long before its certificate ends,
15		/// so a push started near the end does not outlive it.
16		const MARGIN_MS: u64 = 2 * 60 * 1000;
17
18		impl Repo {
19		/// The hub that certifies keys: `keyless.hub`, else the default
20		/// remote's.
21	1×	fn keyless_hub(&self) -> Result<String> {
22	1×	let url = match &self.config.keyless_hub {
23	0×	Some(h) => h.clone(),
24	1×	None => self
25	1×	.config
26	1×	.remotes
27	1×	.get(&self.default_remote())
28	1×	.cloned()
29	1×	.ok_or_else(\|\| {
30	1×	RepoError::Msg(
31	1×	"author.signer is keyless, but neither keyless.hub nor a default remote names the hub that certifies keys"
32	1×	.into(),
33	1×	)
34	1×	})?,
35		};
36	0×	hub_of(&url).ok_or_else(\|\| RepoError::Msg(format!("{url} is not a hub URL")))
37	1×	}
38
39		/// The key to sign with now: the one certified last while it has more
40		/// than a couple of minutes left, else a fresh one the hub certifies.
41	1×	pub(crate) fn keyless_secret(&self) -> Result<(KeyId, SecretKey)> {
42	1×	let now = Hlc::now().wall_ms;
43	1×	if let Some((k, sk, until)) = self.keyless_key.borrow().as_ref() {
44	0×	if now + MARGIN_MS < *until {
45	0×	return Ok((*k, sk.clone()));
46	0×	}
47	1×	}
48	1×	let hub = self.keyless_hub()?;
49	0×	let home = self
50	0×	.user_config
51	0×	.parent()
52	0×	.map(Path::to_path_buf)
53	0×	.unwrap_or_else(default_home);
54	0×	let creds = Credentials::at(home.clone());
55	0×	let token = creds.grant(&hub).map_err(RepoError::Msg)?.ok_or_else(\|\| {
56	0×	RepoError::Msg(format!(
57	0×	"author.signer is keyless, but there is no agent grant for {hub}: its owner makes one with `oh agent grant NAME`, and `oxy auth grant TOKEN` keeps it"
58	0×	))
59	0×	})?;
60	0×	let options = RemoteOptions {
61	0×	token: Some(token.clone()),
62	0×	ca: creds.get(&hub).map_err(RepoError::Msg)?.and_then(\|e\| e.ca),
63	0×	..RemoteOptions::default()
64		};
65	0×	let sk = SecretKey::generate();
66	0×	let id = sk.identity(&self.config.author_name, &self.config.author_email, now);
67	0×	let key = id.hash();
68	0×	let proof = sk
69	0×	.sign_challenge(&key, &certify_challenge(&token))
70	0×	.map_err(\|e\| RepoError::Msg(e.to_string()))?;
71	0×	let body = serde_json::json!({
72	0×	"identity": crate::dsse::base64(&id.encode()),
73	0×	"proof": crate::dsse::base64(&crate::cbor::encode(&proof.to_value())),
74	0×	"scope": "changes,refs,seal",
75		});
76	0×	let (code, answer) = http_json(
77	0×	"POST",
78	0×	&format!("{hub}/api/v1/keyless/certify"),
79	0×	Some(&body.to_string()),
80	0×	&options,
81	0×	)?;
82	0×	let reply: serde_json::Value = serde_json::from_str(&answer).unwrap_or_default();
83	0×	if !(200..300).contains(&code) {
84	0×	let why = reply["error"].as_str().unwrap_or(answer.trim());
85	0×	return fail(format!(
86		"{hub} would not certify a key (HTTP {code}): {why}"
87		));
88	0×	}
89	0×	let cert = reply["certificate"]
90	0×	.as_str()
91	0×	.and_then(crate::dsse::base64_decode)
92	0×	.ok_or_else(\|\| RepoError::Msg(format!("{hub} answered with no certificate")))?;
93	0×	let cert = SignedCertificate::decode(&cert)
94	0×	.map_err(\|e\| RepoError::Msg(format!("{hub}'s certificate: {e}")))?;
95	0×	if cert.cert.key_id() != key {
96	0×	return fail(format!(
97		"{hub} certified another key than the one it was asked for"
98		));
99	0×	}
100		// The issuer's identity, so this repository (and whoever it pushes
101		// to) can check the certificate: the hub's own, as it publishes it.
102	0×	let issuer = match self.store.get_identity(&cert.cert.issuer) {
103	0×	Ok(i) => i,
104		Err(_) => {
105	0×	let bytes = http_get(
106	0×	&format!("{hub}/.well-known/oxyhub-key"),
107	0×	&RemoteOptions {
108	0×	token: None,
109	0×	..options.clone()
110	0×	},
111	0×	)?;
112	0×	let i = Identity::decode(&bytes)?;
113	0×	if i.hash() != cert.cert.issuer {
114	0×	return fail(format!(
115		"{hub}'s published key is not the one that signed its certificate"
116		));
117	0×	}
118	0×	i
119		}
120		};
121	0×	cert.verify(&issuer)
122	0×	.map_err(\|e\| RepoError::Msg(format!("{hub}'s certificate: {e}")))?;
123		// The grant's author, so the grant can be checked here and wherever
124		// this pushes (oxygen#134): from the hub's answer, else this home's
125		// copy of it. Without it, a repository that never saw the owner's
126		// current identity reads the change as signed by an unknown author.
127	0×	if let Some(g) = &cert.cert.grant {
128	0×	let grantor = g.grant.grantor;
129	0×	if self.store.get_identity(&grantor).is_err() {
130	0×	let sent = reply["grantor_identity"]
131	0×	.as_str()
132	0×	.and_then(crate::dsse::base64_decode)
133	0×	.and_then(\|b\| Identity::decode(&b).ok());
134	0×	let kept = \|\| {
135	0×	std::fs::read(
136	0×	home.join("keys")
137	0×	.join(format!("{}.identity", grantor.to_hex())),
138		)
139	0×	.ok()
140	0×	.and_then(\|b\| Identity::decode(&b).ok())
141	0×	};
142	0×	match sent.filter(\|i\| i.hash() == grantor).or_else(\|\| kept().filter(\|i\| i.hash() == grantor)) {
143	0×	Some(i) => {
144	0×	self.store.put_identity(&i)?;
145		}
146		None => {
147	0×	return fail(format!(
148		"the grant is signed by {}, whose identity neither {hub} nor this home has: export it there (oxy identity export) into this home's keys/",
149	0×	grantor.short(12)
150		))
151		}
152		}
153	0×	}
154	0×	}
155	0×	self.store.put_identity(&issuer)?;
156	0×	self.store.put_identity(&id)?;
157	0×	self.store.put_certificate(&cert)?;
158	0×	*self.keyless_key.borrow_mut() = Some((key, sk.clone(), cert.cert.expires));
159	0×	Ok((key, sk))
160	1×	}
161		}
162
163		/// The key a home names as its author (`author.key` in its
164		/// `config.toml`), with its secret from the home's `keys/`: what signs
165		/// outside any repository, such as a grant to an agent (`oh agent grant`).
166		/// `None` when the home names no key or does not hold its secret.
167	2×	pub fn home_key(home: &Path) -> Result<Option<(Identity, SecretKey)>> {
168	2×	let config = read_config_file(&home.join("config.toml"))?;
169	2×	let Some(hex) = config.get("author.key").filter(\|v\| !v.is_empty()) else {
170	1×	return Ok(None);
171		};
172	1×	let key = KeyId::from_hex(hex)
173	1×	.ok_or_else(\|\| RepoError::Msg("author.key must be a 64-character hex KeyId".into()))?;
174	1×	let keys = home.join("keys");
175	1×	let secret = match fs::read(keys.join(format!("{hex}.secret"))) {
176	1×	Ok(b) => b,
177	0×	Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(None),
178	0×	Err(e) => return Err(e.into()),
179		};
180	1×	let (k, sk) = SecretKey::decode(&secret)?;
181	1×	let id = Identity::decode(&fs::read(keys.join(format!("{hex}.identity")))?)?;
182	1×	if k != key \|\| id.hash() != key {
183	0×	return fail(format!(
184		"{} holds another key than author.key",
185	0×	keys.display()
186		));
187	1×	}
188	1×	Ok(Some((id, sk)))
189	2×	}
190
191		#[cfg(test)]
192		mod tests {
193		use super::*;
194
195		#[test]
196	1×	fn a_home_s_key_signs_outside_any_repository() {
197		static HOME: std::sync::OnceLock<tempfile::TempDir> = std::sync::OnceLock::new();
198	1×	HOME.get_or_init(\|\| {
199	1×	let d = tempfile::tempdir().unwrap();
200	1×	std::env::set_var("OXY_HOME", d.path());
201	1×	d
202	1×	});
203	1×	let dir = tempfile::tempdir().unwrap();
204	1×	let home = dir.path().join("home");
205	1×	assert!(home_key(&home).unwrap().is_none(), "no config, no key");
206	1×	let mut r = Repo::init(&dir.path().join("work"))
207	1×	.unwrap()
208	1×	.with_home(home.clone());
209	1×	let (key, id) = r
210	1×	.create_identity("Andy", "[email protected]", IdentityScope::User)
211	1×	.unwrap();
212	1×	let (got, sk) = home_key(&home).unwrap().expect("the home's author key");
213	1×	assert_eq!(got, id);
214	1×	let sig = sk.sign(Domain::Grant, &key, &ObjectRef([1; 32]));
215	1×	assert!(verify_signature(&id, &sig, Domain::Grant, &ObjectRef([1; 32])).is_ok());
216		// An agent whose signer is keyless signs nothing until it asks.
217	1×	r.set_user_config("author.signer", "keyless").unwrap();
218	1×	assert!(r.config.signer_keyless && r.config.signer_key.is_none());
219	1×	assert_eq!(r.signing_key(), None);
220	1×	let err = r.secret_key().unwrap_err().to_string();
221	1×	assert!(err.contains("keyless.hub nor a default remote"), "{err}");
222	1×	}
223		}

Coverage / crates/oxy-core/src/repo/keyless.rs 36.8%

Keyboard