receipts.rs 84.6%

110 of 130 lines run, 17 of 26 functions · run #421 on main · run missed

//! Execution receipts in a repository (spec §14.6): kept beside the state
//! they were made on, with the runner's identity and signature.

use super::*;
use crate::receipt::SignedReceipt;

/// A stored receipt and what verifying it found.
#[derive(Clone, Debug)]
pub struct ReceiptInfo {
    /// The receipt attestation's ObjectRef, which names it.
    pub attest: ObjectRef,
    pub signed: SignedReceipt,
    /// Why it does not verify, if it does not.
    pub problem: Option<String>,
    /// The runner's key was revoked (spec §14.2).
    pub revoked: bool,
}

impl Repo {
    /// Verify `sr` and keep it: the receipt, the attestation with its
    /// signatures, and the runner's identity. Returns the attestation's
    /// ObjectRef. Receipts for another repository are refused.
    pub fn add_receipt(&self, sr: &SignedReceipt) -> Result<ObjectRef> {
        sr.verify()
            .map_err(|e| RepoError::Msg(format!("receipt does not verify: {e}")))?;
        if sr.attest.repo != self.id()? {
            return fail("that receipt is for another repository");
        }
        self.store.put_identity(&sr.runner)?;
        if let Some(c) = &sr.certificate {
            self.store.put_identity(&c.issuer)?;
            self.store.put_certificate(&c.cert)?;
        }
        self.store.put_receipt(&sr.receipt)?;
        let r = self.store.put_attest(&sr.attest)?;
        for sig in &sr.sigs {
            self.store.put_signature(&r, sig)?;
        }
        self.store.index_receipt(&sr.state(), &r)?;
        Ok(r)
    }

    /// The receipt named by attestation `r`, verified again from the store.
    pub fn receipt(&self, r: &ObjectRef) -> Result<ReceiptInfo> {
        let attest = self.store.get_attest(r)?;
        let AttestBody::Receipt { receipt, .. } = &attest.body else {
            return fail(format!("#{} is not a receipt", r.short(12)));
        };
        let receipt = self.store.get_receipt(receipt)?;
        let sigs = self.store.signatures(r)?;
        let Some(key) = sigs.first().map(|s| s.key) else {
            return fail(format!("receipt #{} has no signature", r.short(12)));
        };
        let runner = self.store.get_identity(&key)?;
        // Signed by a short-lived key: its certificate and issuer too.
        let certificate = match self.store.certificate_of(&key)? {
            Some(c) => {
                let cert = self.store.get_certificate(&c)?;
                let issuer = self.store.get_identity(&cert.cert.issuer)?;
                Some(crate::receipt::CertifiedBy { cert, issuer })
            }
            None => None,
        };
        let signed = SignedReceipt {
            receipt,
            attest,
            sigs,
            runner,
            certificate,
        };
        let problem = signed.verify().err().map(|e| e.to_string());
        Ok(ReceiptInfo {
            attest: *r,
            revoked: self.is_revoked(&key)?,
            signed,
            problem,
        })
    }

    /// Every receipt kept for the state of `heads`, oldest first.
    pub fn receipts(&self, heads: &[ChangeHash]) -> Result<Vec<ReceiptInfo>> {
        let state = hash_object(
            ObjectType::State,
            &StateObject::new(heads.to_vec()).encode(),
        );
        let mut out = self
            .store
            .receipts_for(&state)?
            .iter()
            .map(|r| self.receipt(r))
            .collect::<Result<Vec<_>>>()?;
        out.sort_by_key(|i| i.signed.attest.hlc);
        Ok(out)
    }

    /// Receipts to keep through garbage collection: those whose state's
    /// heads `keep` holds, with their receipts, runners and outputs.
    /// Keep a signed approval (oxygenhub#235): verified, for this repository,
    /// with the signer's identity and indexed by the state it approves, so
    /// garbage collection keeps it while that state lives. Who may approve is
    /// the caller's rule.
    pub fn add_approval(&self, sa: &crate::approval::SignedApproval) -> Result<ObjectRef> {
        sa.verify()
            .map_err(|e| RepoError::Msg(format!("approval does not verify: {e}")))?;
        if sa.attest.repo != self.id()? {
            return fail("that approval is for another repository");
        }
        let state = sa
            .statement()
            .map_err(|e| RepoError::Msg(e.to_string()))?
            .state;
        self.store.put_identity(&sa.signer)?;
        let r = self.store.put_attest(&sa.attest)?;
        for sig in &sa.sigs {
            self.store.put_signature(&r, sig)?;
        }
        self.store.index_approval(&state, &r)?;
        Ok(r)
    }

    /// Approvals of states garbage collection keeps are kept, with their
    /// signatures and signers.
    pub(crate) fn reachable_approvals(&self, keep: &mut HashSet<ObjectRef>) -> Result<()> {
        for state in self.store.approval_states()? {
            if !keep.contains(&state) {
                let heads = match self.store.get_state(&state) {
                    Ok(s) => s.heads,
                    Err(StoreError::NotFound(_)) => vec![],
                    Err(e) => return Err(e.into()),
                };
                if !heads.iter().all(|h| keep.contains(h)) {
                    continue;
                }
                keep.insert(state);
            }
            for a in self.store.approvals_for(&state)? {
                keep.insert(a);
                for sig in self.store.signatures(&a)? {
                    keep.insert(sig.key);
                }
            }
        }
        Ok(())
    }

    pub(crate) fn reachable_receipts(&self, keep: &mut HashSet<ObjectRef>) -> Result<()> {
        for state in self.store.receipt_states()? {
            let heads = match self.store.get_state(&state) {
                Ok(s) => s.heads,
                // A receipt may arrive before its state object; its heads
                // are unknown, so keep it.
                Err(StoreError::NotFound(_)) => vec![],
                Err(e) => return Err(e.into()),
            };
            if !heads.iter().all(|h| keep.contains(h)) {
                continue;
            }
            keep.insert(state);
            for a in self.store.receipts_for(&state)? {
                keep.insert(a);
                for sig in self.store.signatures(&a)? {
                    self.keep_signer(keep, sig.key)?;
                }
                let Ok(attest) = self.store.get_attest(&a) else {
                    continue;
                };
                let AttestBody::Receipt { receipt, .. } = attest.body else {
                    continue;
                };
                keep.insert(receipt);
                let Ok(r) = self.store.get_receipt(&receipt) else {
                    continue;
                };
                for b in r.outputs.iter().chain(&r.inputs) {
                    if keep.insert(*b) {
                        if let Ok(bytes) = self.store.get_typed(b, ObjectType::Blob) {
                            keep.extend(Blob::decode(&bytes)?.chunks);
                        }
                    }
                }
            }
        }
        Ok(())
    }
}

1		//! Execution receipts in a repository (spec §14.6): kept beside the state
2		//! they were made on, with the runner's identity and signature.
3
4		use super::*;
5		use crate::receipt::SignedReceipt;
6
7		/// A stored receipt and what verifying it found.
8		#[derive(Clone, Debug)]
9		pub struct ReceiptInfo {
10		/// The receipt attestation's ObjectRef, which names it.
11		pub attest: ObjectRef,
12		pub signed: SignedReceipt,
13		/// Why it does not verify, if it does not.
14		pub problem: Option<String>,
15		/// The runner's key was revoked (spec §14.2).
16		pub revoked: bool,
17		}
18
19		impl Repo {
20		/// Verify `sr` and keep it: the receipt, the attestation with its
21		/// signatures, and the runner's identity. Returns the attestation's
22		/// ObjectRef. Receipts for another repository are refused.
23	6×	pub fn add_receipt(&self, sr: &SignedReceipt) -> Result<ObjectRef> {
24	6×	sr.verify()
25	6×	.map_err(\|e\| RepoError::Msg(format!("receipt does not verify: {e}")))?;
26	4×	if sr.attest.repo != self.id()? {
27	1×	return fail("that receipt is for another repository");
28	3×	}
29	3×	self.store.put_identity(&sr.runner)?;
30	3×	if let Some(c) = &sr.certificate {
31	1×	self.store.put_identity(&c.issuer)?;
32	1×	self.store.put_certificate(&c.cert)?;
33	2×	}
34	3×	self.store.put_receipt(&sr.receipt)?;
35	3×	let r = self.store.put_attest(&sr.attest)?;
36	3×	for sig in &sr.sigs {
37	3×	self.store.put_signature(&r, sig)?;
38		}
39	3×	self.store.index_receipt(&sr.state(), &r)?;
40	3×	Ok(r)
41	6×	}
42
43		/// The receipt named by attestation `r`, verified again from the store.
44	10×	pub fn receipt(&self, r: &ObjectRef) -> Result<ReceiptInfo> {
45	10×	let attest = self.store.get_attest(r)?;
46	10×	let AttestBody::Receipt { receipt, .. } = &attest.body else {
47	0×	return fail(format!("#{} is not a receipt", r.short(12)));
48		};
49	10×	let receipt = self.store.get_receipt(receipt)?;
50	10×	let sigs = self.store.signatures(r)?;
51	10×	let Some(key) = sigs.first().map(\|s\| s.key) else {
52	0×	return fail(format!("receipt #{} has no signature", r.short(12)));
53		};
54	10×	let runner = self.store.get_identity(&key)?;
55		// Signed by a short-lived key: its certificate and issuer too.
56	10×	let certificate = match self.store.certificate_of(&key)? {
57	2×	Some(c) => {
58	2×	let cert = self.store.get_certificate(&c)?;
59	2×	let issuer = self.store.get_identity(&cert.cert.issuer)?;
60	2×	Some(crate::receipt::CertifiedBy { cert, issuer })
61		}
62	8×	None => None,
63		};
64	10×	let signed = SignedReceipt {
65	10×	receipt,
66	10×	attest,
67	10×	sigs,
68	10×	runner,
69	10×	certificate,
70	10×	};
71	10×	let problem = signed.verify().err().map(\|e\| e.to_string());
72		Ok(ReceiptInfo {
73	10×	attest: *r,
74	10×	revoked: self.is_revoked(&key)?,
75	10×	signed,
76	10×	problem,
77		})
78	10×	}
79
80		/// Every receipt kept for the state of `heads`, oldest first.
81	10×	pub fn receipts(&self, heads: &[ChangeHash]) -> Result<Vec<ReceiptInfo>> {
82	10×	let state = hash_object(
83	10×	ObjectType::State,
84	10×	&StateObject::new(heads.to_vec()).encode(),
85		);
86	10×	let mut out = self
87	10×	.store
88	10×	.receipts_for(&state)?
89	10×	.iter()
90	10×	.map(\|r\| self.receipt(r))
91	10×	.collect::<Result<Vec<_>>>()?;
92	10×	out.sort_by_key(\|i\| i.signed.attest.hlc);
93	10×	Ok(out)
94	10×	}
95
96		/// Receipts to keep through garbage collection: those whose state's
97		/// heads `keep` holds, with their receipts, runners and outputs.
98		/// Keep a signed approval (oxygenhub#235): verified, for this repository,
99		/// with the signer's identity and indexed by the state it approves, so
100		/// garbage collection keeps it while that state lives. Who may approve is
101		/// the caller's rule.
102	3×	pub fn add_approval(&self, sa: &crate::approval::SignedApproval) -> Result<ObjectRef> {
103	3×	sa.verify()
104	3×	.map_err(\|e\| RepoError::Msg(format!("approval does not verify: {e}")))?;
105	2×	if sa.attest.repo != self.id()? {
106	1×	return fail("that approval is for another repository");
107	1×	}
108	1×	let state = sa
109	1×	.statement()
110	1×	.map_err(\|e\| RepoError::Msg(e.to_string()))?
111		.state;
112	1×	self.store.put_identity(&sa.signer)?;
113	1×	let r = self.store.put_attest(&sa.attest)?;
114	1×	for sig in &sa.sigs {
115	1×	self.store.put_signature(&r, sig)?;
116		}
117	1×	self.store.index_approval(&state, &r)?;
118	1×	Ok(r)
119	3×	}
120
121		/// Approvals of states garbage collection keeps are kept, with their
122		/// signatures and signers.
123	26×	pub(crate) fn reachable_approvals(&self, keep: &mut HashSet<ObjectRef>) -> Result<()> {
124	26×	for state in self.store.approval_states()? {
125	1×	if !keep.contains(&state) {
126	0×	let heads = match self.store.get_state(&state) {
127	0×	Ok(s) => s.heads,
128	0×	Err(StoreError::NotFound(_)) => vec![],
129	0×	Err(e) => return Err(e.into()),
130		};
131	0×	if !heads.iter().all(\|h\| keep.contains(h)) {
132	0×	continue;
133	0×	}
134	0×	keep.insert(state);
135	1×	}
136	1×	for a in self.store.approvals_for(&state)? {
137	1×	keep.insert(a);
138	1×	for sig in self.store.signatures(&a)? {
139	1×	keep.insert(sig.key);
140	1×	}
141		}
142		}
143	26×	Ok(())
144	26×	}
145
146	26×	pub(crate) fn reachable_receipts(&self, keep: &mut HashSet<ObjectRef>) -> Result<()> {
147	26×	for state in self.store.receipt_states()? {
148	1×	let heads = match self.store.get_state(&state) {
149	1×	Ok(s) => s.heads,
150		// A receipt may arrive before its state object; its heads
151		// are unknown, so keep it.
152	0×	Err(StoreError::NotFound(_)) => vec![],
153	0×	Err(e) => return Err(e.into()),
154		};
155	1×	if !heads.iter().all(\|h\| keep.contains(h)) {
156	0×	continue;
157	1×	}
158	1×	keep.insert(state);
159	2×	for a in self.store.receipts_for(&state)? {
160	2×	keep.insert(a);
161	2×	for sig in self.store.signatures(&a)? {
162	2×	self.keep_signer(keep, sig.key)?;
163		}
164	2×	let Ok(attest) = self.store.get_attest(&a) else {
165	0×	continue;
166		};
167	2×	let AttestBody::Receipt { receipt, .. } = attest.body else {
168	0×	continue;
169		};
170	2×	keep.insert(receipt);
171	2×	let Ok(r) = self.store.get_receipt(&receipt) else {
172	0×	continue;
173		};
174	2×	for b in r.outputs.iter().chain(&r.inputs) {
175	2×	if keep.insert(*b) {
176	1×	if let Ok(bytes) = self.store.get_typed(b, ObjectType::Blob) {
177	1×	keep.extend(Blob::decode(&bytes)?.chunks);
178	0×	}
179	1×	}
180		}
181		}
182		}
183	26×	Ok(())
184	26×	}
185		}

`/`	Search
`g` `c`	Code
`g` `h`	History
`g` `b`	Bookmarks
`g` `t`	Trust
`y`	Permalink to this state (files and trees)
`?`	This sheet

Coverage / crates/oxy-core/src/repo/receipts.rs 84.6%

Keyboard