crates/oxy-core/src/policy.rs at 58dfe0e134eb · andymccall/oxygen

# 58dfe0e134eb oxygen / crates / oxy-core / src / policy.rs

15.4 KiB · Rust · last changed Unbound hosted repositories adopt the first pusher's id 1 month ago source blame history raw

//! The trust policy (spec §14.5): who may update which references, signed
//! by a threshold of root keys. A repository without a policy is unverified.
//!
//! Encoding: `{0: version, 1: repo, 2: serial, 3: {0: root keys, 1: threshold},
//! 4: [rule], 5: [identity bytes], 6: [revoked], 7: expires}`; a rule is
//! `{0: pattern, 1: keys, 2: threshold, 3: require, 4: allow_conflicts}` with
//! `require` 0 = signed, 1 = sealed, 2 = any.

use crate::cbor::{self, Value};
use crate::hash::{hash_object, KeyId, ObjectRef, ObjectType};
use crate::identity::{self, Domain, Identity, Signature};
use crate::objects::{
    array, bytes, check_version, field, map, oref, text, uint, ObjectError, FORMAT_VERSION,
};
use std::collections::BTreeMap;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum Require {
    Signed,
    Sealed,
    Any,
}

impl Require {
    fn tag(self) -> u64 {
        match self {
            Require::Signed => 0,
            Require::Sealed => 1,
            Require::Any => 2,
        }
    }
    fn from_tag(t: u64) -> Result<Require, ObjectError> {
        Ok(match t {
            0 => Require::Signed,
            1 => Require::Sealed,
            2 => Require::Any,
            _ => return Err(ObjectError::Schema(format!("unknown require {t}"))),
        })
    }
    pub fn name(self) -> &'static str {
        match self {
            Require::Signed => "signed",
            Require::Sealed => "sealed",
            Require::Any => "any",
        }
    }
}

#[derive(Clone, Debug, PartialEq, Eq)]
pub struct Rule {
    /// Glob over reference names; `*` matches any run of characters.
    pub pattern: String,
    pub keys: Vec<KeyId>,
    pub threshold: u32,
    pub require: Require,
    pub allow_conflicts: bool,
}

#[derive(Clone, Debug, PartialEq, Eq)]
pub struct Policy {
    pub repo: [u8; 16],
    pub serial: u64,
    pub roots: Vec<KeyId>,
    pub root_threshold: u32,
    pub rules: Vec<Rule>,
    /// Embedded so verification needs no fetch.
    pub identities: Vec<Identity>,
    pub revoked: Vec<KeyId>,
    pub expires: u64,
}

/// `*` matches any run of characters (including `/`); everything else is literal.
pub fn glob_matches(pattern: &str, name: &str) -> bool {
    fn rec(p: &[u8], n: &[u8]) -> bool {
        match p.first() {
            None => n.is_empty(),
            Some(b'*') => (0..=n.len()).any(|i| rec(&p[1..], &n[i..])),
            Some(c) => n.first() == Some(c) && rec(&p[1..], &n[1..]),
        }
    }
    rec(pattern.as_bytes(), name.as_bytes())
}

impl Policy {
    fn keys_value(keys: &[KeyId]) -> Value {
        Value::Array(keys.iter().map(|k| Value::Bytes(k.0.to_vec())).collect())
    }
    fn keys_from(v: &Value, what: &str) -> Result<Vec<KeyId>, ObjectError> {
        let mut ks = array(v, what)?
            .iter()
            .map(|k| oref(k, what))
            .collect::<Result<Vec<_>, _>>()?;
        ks.sort();
        ks.dedup();
        Ok(ks)
    }

    pub fn to_value(&self) -> Value {
        Value::map([
            (0, Value::Uint(FORMAT_VERSION)),
            (1, Value::Bytes(self.repo.to_vec())),
            (2, Value::Uint(self.serial)),
                3,
                Value::map([
                    (0, Self::keys_value(&self.roots)),
                    (1, Value::Uint(self.root_threshold as u64)),
                ]),
            ),
            (
            (
                4,
                Value::Array(
                    self.rules
                        .iter()
                        .map(|r| {
                            Value::map([
                                (0, Value::Text(r.pattern.clone())),
                                (1, Self::keys_value(&r.keys)),
                                (2, Value::Uint(r.threshold as u64)),
                                (3, Value::Uint(r.require.tag())),
                                (4, Value::Bool(r.allow_conflicts)),
                            ])
                        })
                        .collect(),
                ),
            ),
            (
                5,
                Value::Array(
                    self.identities
                        .iter()
                        .map(|i| Value::Bytes(i.encode()))
                        .collect(),
                ),
            ),
            (6, Self::keys_value(&self.revoked)),
            (7, Value::Uint(self.expires)),
        ])
    }

    pub fn encode(&self) -> Vec<u8> {
        cbor::encode(&self.to_value())
    }

    pub fn hash(&self) -> ObjectRef {
        hash_object(ObjectType::Policy, &self.encode())
    }

    pub fn decode(b: &[u8]) -> Result<Policy, ObjectError> {
        let v = cbor::decode(b)?;
        let m = map(&v, "policy")?;
        check_version(m)?;
        let roots = map(field(m, 3, "roots")?, "roots")?;
        let mut rules = Vec::new();
        for r in array(field(m, 4, "rules")?, "rules")? {
            let rm = map(r, "rule")?;
            rules.push(Rule {
                pattern: text(field(rm, 0, "pattern")?, "pattern")?.to_owned(),
                keys: Self::keys_from(field(rm, 1, "rule keys")?, "rule keys")?,
                threshold: uint(field(rm, 2, "threshold")?, "threshold")? as u32,
                require: Require::from_tag(uint(field(rm, 3, "require")?, "require")?)?,
                allow_conflicts: field(rm, 4, "allow_conflicts")?
                    .as_bool()
                    .ok_or_else(|| ObjectError::Schema("allow_conflicts: expected bool".into()))?,
            });
        }
        let identities = array(field(m, 5, "identities")?, "identities")?
            .iter()
            .map(|i| Identity::decode(bytes(i, "identity")?))
            .collect::<Result<Vec<_>, _>>()?;
        let p = Policy {
            repo: bytes(field(m, 1, "repo")?, "repo")?
                .try_into()
                .map_err(|_| ObjectError::Schema("repo: expected 16 bytes".into()))?,
            serial: uint(field(m, 2, "serial")?, "serial")?,
            roots: Self::keys_from(field(roots, 0, "root keys")?, "root keys")?,
            root_threshold: uint(field(roots, 1, "root threshold")?, "root threshold")? as u32,
            rules,
            identities,
            revoked: Self::keys_from(field(m, 6, "revoked")?, "revoked")?,
            expires: uint(field(m, 7, "expires")?, "expires")?,
        };
        if p.root_threshold == 0 || p.root_threshold as usize > p.roots.len() {
            return Err(ObjectError::Schema(
                "root threshold must be between 1 and the number of root keys".into(),
            ));
        }
        for r in &p.rules {
            if r.threshold == 0 || r.threshold as usize > r.keys.len() {
                return Err(ObjectError::Schema(format!(
                    "rule {:?}: threshold must be between 1 and the number of keys",
                    r.pattern
                )));
            }
        }
        Ok(p)
    }

    pub fn identity(&self, key: &KeyId) -> Option<&Identity> {
        self.identities.iter().find(|i| i.hash() == *key)
    }

    pub fn is_revoked(&self, key: &KeyId) -> bool {
        self.revoked.contains(key)
    }

    pub fn is_expired(&self, now_ms: u64) -> bool {
        now_ms > self.expires
    }

    /// The first rule whose pattern matches `reference`.
    pub fn rule_for(&self, reference: &str) -> Option<&Rule> {
        self.rules
            .iter()
            .find(|r| glob_matches(&r.pattern, reference))
    }

    /// Whether `key` may update `reference`: listed in the matching rule and not revoked.
    pub fn authorizes(&self, key: &KeyId, reference: &str) -> bool {
        !self.is_revoked(key)
            && self
                .rule_for(reference)
                .is_some_and(|r| r.keys.contains(key))
    }

    /// Verify that `sigs` over this policy's hash meet `trusted`'s root
    /// threshold (`trusted` is the previous policy, or this one when
    /// bootstrapping). Returns the signing root keys.
    pub fn verify_signatures(
        &self,
        sigs: &[Signature],
        trusted: &Policy,
    ) -> Result<Vec<KeyId>, String> {
        let target = self.hash();
        let mut signers = Vec::new();
        for sig in sigs {
            if !trusted.roots.contains(&sig.key) || trusted.is_revoked(&sig.key) {
                continue;
            }
            let Some(id) = trusted
                .identity(&sig.key)
                .or_else(|| self.identity(&sig.key))
            else {
                continue;
            };
            if identity::verify(id, sig, Domain::Policy, &target).is_ok()
                && !signers.contains(&sig.key)
            {
                signers.push(sig.key);
            }
        }
        if (signers.len() as u32) < trusted.root_threshold {
            return Err(format!(
                "policy needs {} root signature(s), has {}",
                trusted.root_threshold,
                signers.len()
            ));
        }
        Ok(signers)
    }

    /// Bootstrap check for the first policy a repository sees (trust on
    /// first use): at least one valid signature by one of its own roots.
    /// The full threshold applies only to updates from a trusted policy,
    /// whose signers are the previous roots and need not be the new ones.
    pub fn verify_bootstrap(&self, sigs: &[Signature]) -> Result<KeyId, String> {
        let target = self.hash();
        for sig in sigs {
            if !self.roots.contains(&sig.key) || self.is_revoked(&sig.key) {
                continue;
            }
            if let Some(id) = self.identity(&sig.key) {
                if identity::verify(id, sig, Domain::Policy, &target).is_ok() {
                    return Ok(sig.key);
                }
            }
        }
        Err("policy carries no valid signature by one of its own root keys".into())
    }

    /// A single-root policy letting `root` do everything on every reference.
    pub fn single_root(repo: [u8; 16], root: Identity, expires: u64) -> Policy {
        let key = root.hash();
        Policy {
            repo,
            serial: 1,
            roots: vec![key],
            root_threshold: 1,
            rules: vec![Rule {
                pattern: "*".into(),
                keys: vec![key],
                threshold: 1,
                require: Require::Any,
                allow_conflicts: true,
            }],
            identities: vec![root],
            revoked: vec![],
            expires,
        }
    }

    /// Whether `key` appears anywhere in the policy (roots, rules, identities).
    pub fn mentions(&self, key: &KeyId) -> bool {
        self.roots.contains(key)
            || self.rules.iter().any(|r| r.keys.contains(key))
            || self.identity(key).is_some()
    }

    /// Whether `key` is `rule_key` or one of its predecessors in the
    /// rotation chain (`previous` links, spec §14.2), so that changes signed
    /// before a rotation remain authorized. Revoked keys never qualify.
    pub fn succeeds(&self, rule_key: &KeyId, key: &KeyId) -> bool {
        if self.is_revoked(key) {
            return false;
        }
        let mut cur = Some(*rule_key);
        for _ in 0..32 {
            match cur {
                Some(k) if k == *key => return true,
                Some(k) => cur = self.identity(&k).and_then(|i| i.previous),
                None => return false,
            }
        }
        false
    }

    /// Replace `old` by `new` in the roots and every rule and embed `new`'s
    /// identity (a rotation, spec §14.2). The old identity stays embedded so
    /// signatures made before the rotation still verify; it is superseded,
    /// not revoked.
    pub fn substitute_key(&mut self, old: &KeyId, new: Identity) {
        let nk = new.hash();
        for k in self
            .roots
            .iter_mut()
            .chain(self.rules.iter_mut().flat_map(|r| r.keys.iter_mut()))
        {
            if k == old {
                *k = nk;
            }
        }
        for r in &mut self.rules {
            r.keys.sort();
            r.keys.dedup();
        }
        self.roots.sort();
        self.roots.dedup();
        if self.identity(&nk).is_none() {
            self.identities.push(new);
        }
    }

    /// Identities keyed by KeyId.
    pub fn identity_map(&self) -> BTreeMap<KeyId, &Identity> {
        self.identities.iter().map(|i| (i.hash(), i)).collect()
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::identity::SecretKey;

    fn sk(n: u8) -> SecretKey {
        SecretKey {
            ed_seed: [n; 32],
            ml_seed: [n + 100; 32],
        }
    }

    #[test]
    fn globs() {
        assert!(glob_matches("*", "main"));
        assert!(glob_matches("release/*", "release/1.0"));
        assert!(!glob_matches("release/*", "main"));
        assert!(glob_matches("main", "main"));
        assert!(!glob_matches("main", "main2"));
        assert!(glob_matches("*-rc*", "1.0-rc2"));
        assert!(glob_matches("", ""));
    }

    #[test]
    fn round_trip_and_rules() {
        let root = sk(1).identity("Root", "r@x", 0);
        let dev = sk(2).identity("Dev", "d@x", 0);
        let mut p = Policy::single_root([9; 16], root.clone(), 10);
        p.rules.insert(
            0,
            Rule {
                pattern: "release/*".into(),
                keys: vec![root.hash()],
                threshold: 1,
                require: Require::Signed,
                allow_conflicts: false,
            },
        );
        p.rules[1].keys.push(dev.hash());
        p.identities.push(dev.clone());
        p.revoked.push(ObjectRef([7; 32]));
        let d = Policy::decode(&p.encode()).unwrap();
        assert_eq!(d.rules.len(), 2);
        assert_eq!(d.rules[0].require, Require::Signed);
        assert_eq!(d.identity(&dev.hash()), Some(&dev));
        assert!(d.authorizes(&dev.hash(), "main"));
        assert!(!d.authorizes(&dev.hash(), "release/1"));
        assert!(d.authorizes(&root.hash(), "release/1"));
        assert!(d.is_expired(11) && !d.is_expired(10));
        assert_eq!(d.hash(), p.hash());

        let mut bad = p.clone();
        bad.root_threshold = 5;
        assert!(Policy::decode(&bad.encode()).is_err());
    }

    #[test]
    fn signatures_need_root_threshold() {
        let r1 = sk(1);
        let r2 = sk(2);
        let i1 = r1.identity("a", "a", 0);
        let i2 = r2.identity("b", "b", 0);
        let mut p = Policy::single_root([1; 16], i1.clone(), 100);
        p.roots.push(i2.hash());
        p.roots.sort();
        p.root_threshold = 2;
        p.identities.push(i2.clone());
        let h = p.hash();
        let s1 = r1.sign(Domain::Policy, &i1.hash(), &h);
        let s2 = r2.sign(Domain::Policy, &i2.hash(), &h);
        assert!(p.verify_signatures(std::slice::from_ref(&s1), &p).is_err());
        assert_eq!(
            p.verify_signatures(&[s1.clone(), s2.clone()], &p)
                .unwrap()
                .len(),
            2
        );
        // Duplicates do not count twice; a non-root signer does not count.
        assert!(p.verify_signatures(&[s1.clone(), s1.clone()], &p).is_err());
        let stranger = sk(3);
        let si = stranger.identity("s", "s", 0);
        let s3 = stranger.sign(Domain::Policy, &si.hash(), &h);
        assert!(p.verify_signatures(&[s1.clone(), s3], &p).is_err());
        // A successor policy is verified against the previous roots.
        let mut next = p.clone();
        next.serial = 2;
        next.revoked.push(i2.hash());
        let nh = next.hash();
        let n1 = r1.sign(Domain::Policy, &i1.hash(), &nh);
        let n2 = r2.sign(Domain::Policy, &i2.hash(), &nh);
        assert_eq!(next.verify_signatures(&[n1, n2], &p).unwrap().len(), 2);
    }
}

`/`	Search
`g` `c`	Code
`g` `h`	History
`g` `b`	Bookmarks
`g` `t`	Trust
`y`	Permalink to this state (files and trees)
`?`	This sheet

83e0677b Andy McCall 1 month ago ↶	1	//! The trust policy (spec §14.5): who may update which references, signed
	2	//! by a threshold of root keys. A repository without a policy is unverified.
	3	//!
	4	//! Encoding: `{0: version, 1: repo, 2: serial, 3: {0: root keys, 1: threshold},
	5	//! 4: [rule], 5: [identity bytes], 6: [revoked], 7: expires}`; a rule is
	6	//! `{0: pattern, 1: keys, 2: threshold, 3: require, 4: allow_conflicts}` with
	7	//! `require` 0 = signed, 1 = sealed, 2 = any.
	8
	9	use crate::cbor::{self, Value};
	10	use crate::hash::{hash_object, KeyId, ObjectRef, ObjectType};
	11	use crate::identity::{self, Domain, Identity, Signature};
75167672 Andy McCall 1 month ago	12	use crate::objects::{
	13	array, bytes, check_version, field, map, oref, text, uint, ObjectError, FORMAT_VERSION,
	14	};
83e0677b Andy McCall 1 month ago ↶	15	use std::collections::BTreeMap;
	16
	17	#[derive(Clone, Copy, Debug, PartialEq, Eq)]
	18	pub enum Require {
	19	Signed,
	20	Sealed,
	21	Any,
	22	}
	23
	24	impl Require {
	25	fn tag(self) -> u64 {
	26	match self {
	27	Require::Signed => 0,
	28	Require::Sealed => 1,
	29	Require::Any => 2,
	30	}
	31	}
	32	fn from_tag(t: u64) -> Result<Require, ObjectError> {
	33	Ok(match t {
	34	0 => Require::Signed,
	35	1 => Require::Sealed,
	36	2 => Require::Any,
	37	_ => return Err(ObjectError::Schema(format!("unknown require {t}"))),
	38	})
	39	}
	40	pub fn name(self) -> &'static str {
	41	match self {
	42	Require::Signed => "signed",
	43	Require::Sealed => "sealed",
	44	Require::Any => "any",
	45	}
	46	}
	47	}
	48
	49	#[derive(Clone, Debug, PartialEq, Eq)]
	50	pub struct Rule {
	51	/// Glob over reference names; `*` matches any run of characters.
	52	pub pattern: String,
	53	pub keys: Vec<KeyId>,
	54	pub threshold: u32,
	55	pub require: Require,
	56	pub allow_conflicts: bool,
	57	}
	58
	59	#[derive(Clone, Debug, PartialEq, Eq)]
	60	pub struct Policy {
	61	pub repo: [u8; 16],
	62	pub serial: u64,
	63	pub roots: Vec<KeyId>,
	64	pub root_threshold: u32,
	65	pub rules: Vec<Rule>,
	66	/// Embedded so verification needs no fetch.
	67	pub identities: Vec<Identity>,
	68	pub revoked: Vec<KeyId>,
	69	pub expires: u64,
	70	}
	71
	72	/// `*` matches any run of characters (including `/`); everything else is literal.
	73	pub fn glob_matches(pattern: &str, name: &str) -> bool {
	74	fn rec(p: &[u8], n: &[u8]) -> bool {
	75	match p.first() {
	76	None => n.is_empty(),
	77	Some(b'*') => (0..=n.len()).any(\|i\| rec(&p[1..], &n[i..])),
	78	Some(c) => n.first() == Some(c) && rec(&p[1..], &n[1..]),
79	}
80	}
81	rec(pattern.as_bytes(), name.as_bytes())
82	}
83
84	impl Policy {
85	fn keys_value(keys: &[KeyId]) -> Value {
86	Value::Array(keys.iter().map(\|k\| Value::Bytes(k.0.to_vec())).collect())
87	}
88	fn keys_from(v: &Value, what: &str) -> Result<Vec<KeyId>, ObjectError> {
75167672 Andy McCall 1 month ago	89	let mut ks = array(v, what)?
	90	.iter()
	91	.map(\|k\| oref(k, what))
	92	.collect::<Result<Vec<_>, _>>()?;
83e0677b Andy McCall 1 month ago ↶	93	ks.sort();
	94	ks.dedup();
	95	Ok(ks)
	96	}
	97
	98	pub fn to_value(&self) -> Value {
	99	Value::map([
	100	(0, Value::Uint(FORMAT_VERSION)),
	101	(1, Value::Bytes(self.repo.to_vec())),
	102	(2, Value::Uint(self.serial)),
75167672 Andy McCall 1 month ago	103	3,
	104	Value::map([
	105	(0, Self::keys_value(&self.roots)),
	106	(1, Value::Uint(self.root_threshold as u64)),
	107	]),
	108	),
	109	(
83e0677b Andy McCall 1 month ago ↶	110	(
	111	4,
	112	Value::Array(
	113	self.rules
	114	.iter()
	115	.map(\|r\| {
	116	Value::map([
	117	(0, Value::Text(r.pattern.clone())),
	118	(1, Self::keys_value(&r.keys)),
	119	(2, Value::Uint(r.threshold as u64)),
	120	(3, Value::Uint(r.require.tag())),
	121	(4, Value::Bool(r.allow_conflicts)),
	122	])
	123	})
	124	.collect(),
	125	),
	126	),
75167672 Andy McCall 1 month ago	127	(
	128	5,
	129	Value::Array(
	130	self.identities
	131	.iter()
	132	.map(\|i\| Value::Bytes(i.encode()))
	133	.collect(),
	134	),
	135	),
83e0677b Andy McCall 1 month ago ↶	136	(6, Self::keys_value(&self.revoked)),
	137	(7, Value::Uint(self.expires)),
	138	])
	139	}
	140
	141	pub fn encode(&self) -> Vec<u8> {
	142	cbor::encode(&self.to_value())
	143	}
	144
	145	pub fn hash(&self) -> ObjectRef {
	146	hash_object(ObjectType::Policy, &self.encode())
	147	}
	148
	149	pub fn decode(b: &[u8]) -> Result<Policy, ObjectError> {
	150	let v = cbor::decode(b)?;
	151	let m = map(&v, "policy")?;
	152	check_version(m)?;
	153	let roots = map(field(m, 3, "roots")?, "roots")?;
	154	let mut rules = Vec::new();
	155	for r in array(field(m, 4, "rules")?, "rules")? {
	156	let rm = map(r, "rule")?;
	157	rules.push(Rule {
	158	pattern: text(field(rm, 0, "pattern")?, "pattern")?.to_owned(),
	159	keys: Self::keys_from(field(rm, 1, "rule keys")?, "rule keys")?,
	160	threshold: uint(field(rm, 2, "threshold")?, "threshold")? as u32,
	161	require: Require::from_tag(uint(field(rm, 3, "require")?, "require")?)?,
75167672 Andy McCall 1 month ago	162	allow_conflicts: field(rm, 4, "allow_conflicts")?
	163	.as_bool()
	164	.ok_or_else(\|\| ObjectError::Schema("allow_conflicts: expected bool".into()))?,
83e0677b Andy McCall 1 month ago ↶	165	});
	166	}
	167	let identities = array(field(m, 5, "identities")?, "identities")?
	168	.iter()
	169	.map(\|i\| Identity::decode(bytes(i, "identity")?))
	170	.collect::<Result<Vec<_>, _>>()?;
	171	let p = Policy {
75167672 Andy McCall 1 month ago	172	repo: bytes(field(m, 1, "repo")?, "repo")?
	173	.try_into()
	174	.map_err(\|_\| ObjectError::Schema("repo: expected 16 bytes".into()))?,
83e0677b Andy McCall 1 month ago ↶	175	serial: uint(field(m, 2, "serial")?, "serial")?,
	176	roots: Self::keys_from(field(roots, 0, "root keys")?, "root keys")?,
	177	root_threshold: uint(field(roots, 1, "root threshold")?, "root threshold")? as u32,
	178	rules,
	179	identities,
	180	revoked: Self::keys_from(field(m, 6, "revoked")?, "revoked")?,
	181	expires: uint(field(m, 7, "expires")?, "expires")?,
	182	};
	183	if p.root_threshold == 0 \|\| p.root_threshold as usize > p.roots.len() {
75167672 Andy McCall 1 month ago	184	return Err(ObjectError::Schema(
	185	"root threshold must be between 1 and the number of root keys".into(),
	186	));
83e0677b Andy McCall 1 month ago ↶	187	}
	188	for r in &p.rules {
	189	if r.threshold == 0 \|\| r.threshold as usize > r.keys.len() {
75167672 Andy McCall 1 month ago	190	return Err(ObjectError::Schema(format!(
	191	"rule {:?}: threshold must be between 1 and the number of keys",
	192	r.pattern
	193	)));
83e0677b Andy McCall 1 month ago ↶	194	}
	195	}
	196	Ok(p)
	197	}
	198
	199	pub fn identity(&self, key: &KeyId) -> Option<&Identity> {
	200	self.identities.iter().find(\|i\| i.hash() == *key)
	201	}
	202
	203	pub fn is_revoked(&self, key: &KeyId) -> bool {
	204	self.revoked.contains(key)
	205	}
	206
	207	pub fn is_expired(&self, now_ms: u64) -> bool {
	208	now_ms > self.expires
	209	}
	210
	211	/// The first rule whose pattern matches `reference`.
	212	pub fn rule_for(&self, reference: &str) -> Option<&Rule> {
75167672 Andy McCall 1 month ago	213	self.rules
	214	.iter()
	215	.find(\|r\| glob_matches(&r.pattern, reference))
83e0677b Andy McCall 1 month ago ↶	216	}
	217
	218	/// Whether `key` may update `reference`: listed in the matching rule and not revoked.
	219	pub fn authorizes(&self, key: &KeyId, reference: &str) -> bool {
75167672 Andy McCall 1 month ago	220	!self.is_revoked(key)
	221	&& self
	222	.rule_for(reference)
	223	.is_some_and(\|r\| r.keys.contains(key))
83e0677b Andy McCall 1 month ago ↶	224	}
	225
	226	/// Verify that `sigs` over this policy's hash meet `trusted`'s root
	227	/// threshold (`trusted` is the previous policy, or this one when
	228	/// bootstrapping). Returns the signing root keys.
75167672 Andy McCall 1 month ago	229	pub fn verify_signatures(
	230	&self,
	231	sigs: &[Signature],
	232	trusted: &Policy,
	233	) -> Result<Vec<KeyId>, String> {
83e0677b Andy McCall 1 month ago ↶	234	let target = self.hash();
	235	let mut signers = Vec::new();
	236	for sig in sigs {
	237	if !trusted.roots.contains(&sig.key) \|\| trusted.is_revoked(&sig.key) {
	238	continue;
	239	}
75167672 Andy McCall 1 month ago	240	let Some(id) = trusted
	241	.identity(&sig.key)
	242	.or_else(\|\| self.identity(&sig.key))
	243	else {
	244	continue;
	245	};
	246	if identity::verify(id, sig, Domain::Policy, &target).is_ok()
	247	&& !signers.contains(&sig.key)
	248	{
83e0677b Andy McCall 1 month ago ↶	249	signers.push(sig.key);
	250	}
	251	}
	252	if (signers.len() as u32) < trusted.root_threshold {
75167672 Andy McCall 1 month ago	253	return Err(format!(
	254	"policy needs {} root signature(s), has {}",
	255	trusted.root_threshold,
	256	signers.len()
	257	));
83e0677b Andy McCall 1 month ago ↶	258	}
	259	Ok(signers)
	260	}
	261
28fc23d7 Andy McCall 1 month ago ↶	262	/// Bootstrap check for the first policy a repository sees (trust on
	263	/// first use): at least one valid signature by one of its own roots.
	264	/// The full threshold applies only to updates from a trusted policy,
	265	/// whose signers are the previous roots and need not be the new ones.
	266	pub fn verify_bootstrap(&self, sigs: &[Signature]) -> Result<KeyId, String> {
	267	let target = self.hash();
	268	for sig in sigs {
	269	if !self.roots.contains(&sig.key) \|\| self.is_revoked(&sig.key) {
	270	continue;
	271	}
	272	if let Some(id) = self.identity(&sig.key) {
	273	if identity::verify(id, sig, Domain::Policy, &target).is_ok() {
	274	return Ok(sig.key);
	275	}
	276	}
	277	}
	278	Err("policy carries no valid signature by one of its own root keys".into())
	279	}
	280
83e0677b Andy McCall 1 month ago ↶	281	/// A single-root policy letting `root` do everything on every reference.
	282	pub fn single_root(repo: [u8; 16], root: Identity, expires: u64) -> Policy {
	283	let key = root.hash();
	284	Policy {
	285	repo,
	286	serial: 1,
	287	roots: vec![key],
	288	root_threshold: 1,
75167672 Andy McCall 1 month ago	289	rules: vec![Rule {
	290	pattern: "*".into(),
	291	keys: vec![key],
	292	threshold: 1,
	293	require: Require::Any,
	294	allow_conflicts: true,
	295	}],
83e0677b Andy McCall 1 month ago ↶	296	identities: vec![root],
	297	revoked: vec![],
	298	expires,
	299	}
	300	}
	301
28fc23d7 Andy McCall 1 month ago ↶	302	/// Whether `key` appears anywhere in the policy (roots, rules, identities).
28fc23d7 Andy McCall 1 month ago ↶	303	pub fn mentions(&self, key: &KeyId) -> bool {
75167672 Andy McCall 1 month ago	304	self.roots.contains(key)
	305	\|\| self.rules.iter().any(\|r\| r.keys.contains(key))
	306	\|\| self.identity(key).is_some()
28fc23d7 Andy McCall 1 month ago ↶	307	}
	308
	309	/// Whether `key` is `rule_key` or one of its predecessors in the
	310	/// rotation chain (`previous` links, spec §14.2), so that changes signed
	311	/// before a rotation remain authorized. Revoked keys never qualify.
	312	pub fn succeeds(&self, rule_key: &KeyId, key: &KeyId) -> bool {
	313	if self.is_revoked(key) {
	314	return false;
	315	}
	316	let mut cur = Some(*rule_key);
	317	for _ in 0..32 {
	318	match cur {
	319	Some(k) if k == *key => return true,
	320	Some(k) => cur = self.identity(&k).and_then(\|i\| i.previous),
	321	None => return false,
	322	}
	323	}
	324	false
	325	}
	326
	327	/// Replace `old` by `new` in the roots and every rule and embed `new`'s
	328	/// identity (a rotation, spec §14.2). The old identity stays embedded so
	329	/// signatures made before the rotation still verify; it is superseded,
	330	/// not revoked.
	331	pub fn substitute_key(&mut self, old: &KeyId, new: Identity) {
	332	let nk = new.hash();
75167672 Andy McCall 1 month ago	333	for k in self
	334	.roots
	335	.iter_mut()
	336	.chain(self.rules.iter_mut().flat_map(\|r\| r.keys.iter_mut()))
	337	{
28fc23d7 Andy McCall 1 month ago ↶	338	if k == old {
	339	*k = nk;
	340	}
	341	}
	342	for r in &mut self.rules {
	343	r.keys.sort();
	344	r.keys.dedup();
	345	}
	346	self.roots.sort();
	347	self.roots.dedup();
	348	if self.identity(&nk).is_none() {
	349	self.identities.push(new);
	350	}
	351	}
	352
83e0677b Andy McCall 1 month ago ↶	353	/// Identities keyed by KeyId.
	354	pub fn identity_map(&self) -> BTreeMap<KeyId, &Identity> {
	355	self.identities.iter().map(\|i\| (i.hash(), i)).collect()
	356	}
	357	}
	358
	359	#[cfg(test)]
	360	mod tests {
	361	use super::*;
	362	use crate::identity::SecretKey;
	363
	364	fn sk(n: u8) -> SecretKey {
75167672 Andy McCall 1 month ago	365	SecretKey {
	366	ed_seed: [n; 32],
	367	ml_seed: [n + 100; 32],
	368	}
83e0677b Andy McCall 1 month ago ↶	369	}
	370
	371	#[test]
	372	fn globs() {
	373	assert!(glob_matches("*", "main"));
	374	assert!(glob_matches("release/*", "release/1.0"));
	375	assert!(!glob_matches("release/*", "main"));
	376	assert!(glob_matches("main", "main"));
	377	assert!(!glob_matches("main", "main2"));
	378	assert!(glob_matches("-rc", "1.0-rc2"));
	379	assert!(glob_matches("", ""));
	380	}
	381
	382	#[test]
	383	fn round_trip_and_rules() {
	384	let root = sk(1).identity("Root", "r@x", 0);
	385	let dev = sk(2).identity("Dev", "d@x", 0);
	386	let mut p = Policy::single_root([9; 16], root.clone(), 10);
75167672 Andy McCall 1 month ago	387	p.rules.insert(
	388	0,
	389	Rule {
	390	pattern: "release/*".into(),
	391	keys: vec![root.hash()],
	392	threshold: 1,
	393	require: Require::Signed,
	394	allow_conflicts: false,
	395	},
	396	);
83e0677b Andy McCall 1 month ago ↶	397	p.rules[1].keys.push(dev.hash());
	398	p.identities.push(dev.clone());
	399	p.revoked.push(ObjectRef([7; 32]));
	400	let d = Policy::decode(&p.encode()).unwrap();
	401	assert_eq!(d.rules.len(), 2);
	402	assert_eq!(d.rules[0].require, Require::Signed);
	403	assert_eq!(d.identity(&dev.hash()), Some(&dev));
	404	assert!(d.authorizes(&dev.hash(), "main"));
	405	assert!(!d.authorizes(&dev.hash(), "release/1"));
	406	assert!(d.authorizes(&root.hash(), "release/1"));
	407	assert!(d.is_expired(11) && !d.is_expired(10));
	408	assert_eq!(d.hash(), p.hash());
	409
	410	let mut bad = p.clone();
	411	bad.root_threshold = 5;
	412	assert!(Policy::decode(&bad.encode()).is_err());
	413	}
	414
	415	#[test]
	416	fn signatures_need_root_threshold() {
	417	let r1 = sk(1);
	418	let r2 = sk(2);
	419	let i1 = r1.identity("a", "a", 0);
	420	let i2 = r2.identity("b", "b", 0);
	421	let mut p = Policy::single_root([1; 16], i1.clone(), 100);
	422	p.roots.push(i2.hash());
	423	p.roots.sort();
	424	p.root_threshold = 2;
	425	p.identities.push(i2.clone());
	426	let h = p.hash();
	427	let s1 = r1.sign(Domain::Policy, &i1.hash(), &h);
	428	let s2 = r2.sign(Domain::Policy, &i2.hash(), &h);
a269bee1 Andy McCall 1 month ago ↶	429	assert!(p.verify_signatures(std::slice::from_ref(&s1), &p).is_err());
75167672 Andy McCall 1 month ago	430	assert_eq!(
	431	p.verify_signatures(&[s1.clone(), s2.clone()], &p)
	432	.unwrap()
	433	.len(),
	434	2
	435	);
83e0677b Andy McCall 1 month ago ↶	436	// Duplicates do not count twice; a non-root signer does not count.
	437	assert!(p.verify_signatures(&[s1.clone(), s1.clone()], &p).is_err());
	438	let stranger = sk(3);
	439	let si = stranger.identity("s", "s", 0);
	440	let s3 = stranger.sign(Domain::Policy, &si.hash(), &h);
	441	assert!(p.verify_signatures(&[s1.clone(), s3], &p).is_err());
	442	// A successor policy is verified against the previous roots.
	443	let mut next = p.clone();
	444	next.serial = 2;
	445	next.revoked.push(i2.hash());
	446	let nh = next.hash();
	447	let n1 = r1.sign(Domain::Policy, &i1.hash(), &nh);
	448	let n2 = r2.sign(Domain::Policy, &i2.hash(), &nh);
	449	assert_eq!(next.verify_signatures(&[n1, n2], &p).unwrap().len(), 2);
	450	}
	451	}

Keyboard