OXYGENHUB
# ff6987682725 oxygen / src / cli / tlog.rs
5.1 KiB · Rust · last changed Trusted time: judge a fetched attestation at its integrated time 17 days ago source blame history raw
e59512f2 Andy McCall ↶ 1 
//! `oxy tlog verify` (spec §14.8, oxygenhub#238): audit a hub's whole
2 
//! transparency log and list the entries that concern you.
3
4 
use super::json;
5 
use super::open;
6 
use super::ui;
7 
use anyhow::{anyhow, Result};
8 
use oxy_core::hash::KeyId;
9 
use std::path::Path;
10
11 
pub fn verify(hub: Option<&str>, key: Option<&str>, all: bool, as_json: bool) -> Result<i32> {
12 
    let repo = open()?;
13 
    let remote = repo.default_remote();
14 
    let url = match hub {
15 
        Some(h) if h.contains("://") => h.to_string(),
16 
        Some(h) => format!("https://{h}"),
17 
        None => repo.config.remotes.get(&remote).cloned().ok_or_else(|| {
18 
            anyhow!("name the hub to check (this checkout has no remote {remote})")
19 
        })?,
20 
    };
21 
    let ca = repo
22 
        .config
23 
        .remote_cas
24 
        .get(&remote)
25 
        .map(Path::new)
26 
        .filter(|_| hub.is_none());
27 
    let audit = repo.audit_log(&url, ca).map_err(|e| anyhow!("{e}"))?;
28 
    let key = match key {
29 
        Some(k) => Some(
30 
            KeyId::from_hex(k)
31 
                .ok_or_else(|| anyhow!("--key takes a full KeyId (64 hex digits)"))?,
32 
        ),
33 
        None => None,
34 
    };
35 
    let rid = repo.id().ok();
36 
    let listed: Vec<(usize, &oxy_core::tlog::Entry)> = audit
37 
        .entries
38 
        .iter()
39 
        .enumerate()
40 
        .filter(|(_, e)| match (&key, all) {
41 
            (_, true) => true,
42 
            (Some(k), _) => e.signers.contains(k),
43 
            (None, _) => Some(e.repo) == rid,
44 
        })
45 
        .collect();
46 
    let what = match (&key, all) {
47 
        (_, true) => "every entry".to_string(),
48 
        (Some(k), _) => format!("entries signed by {}", k.short(12)),
49 
        (None, _) => "this repository's entries".to_string(),
50 
    };
51 
    if as_json {
52 
        println!(
53 
            "{}",
54 
            json::obj([
55 
                ("hub", json::s(&audit.hub)),
56 
                ("origin", json::s(&audit.checkpoint.origin)),
57 
                ("size", json::n(audit.checkpoint.size)),
58 
                (
59 
                    "root",
60 
                    json::s(&oxy_core::hash::ObjectRef(audit.checkpoint.root).to_hex())
61 
                ),
62 
                (
028545df Andy McCall ↶ 63 
                    "witnesses",
64 
                    json::arr(audit.witnessed.iter().map(|(name, t)| {
65 
                        json::obj([
66 
                            ("name", json::s(name)),
67 
                            ("time_ms", json::n(t.saturating_mul(1000))),
68 
                        ])
69 
                    })),
70 
                ),
71 
                (
e59512f2 Andy McCall ↶ 72 
                    "entries",
73 
                    json::arr(listed.iter().map(|(i, e)| {
74 
                        json::obj([
75 
                            ("index", json::n(*i)),
76 
                            ("kind", json::s(&e.kind)),
77 
                            (
78 
                                "repo",
79 
                                json::s(
80 
                                    &e.repo
81 
                                        .iter()
82 
                                        .map(|b| format!("{b:02x}"))
83 
                                        .collect::<String>(),
84 
                                ),
85 
                            ),
86 
                            ("object", json::s(&e.object.to_hex())),
87 
                            (
88 
                                "signers",
89 
                                json::arr(e.signers.iter().map(|k| json::s(&k.to_hex()))),
90 
                            ),
91 
                            ("received_ms", json::n(e.received)),
92 
                        ])
93 
                    })),
94 
                ),
95 
            ])
96 
        );
97 
        return Ok(0);
98 
    }
b333a199 Andy McCall ↶ 99 
    for n in &audit.notes {
100 
        eprintln!("{} {n}", ui::caution());
101 
    }
e59512f2 Andy McCall ↶ 102 
    println!(
103 
        "{} {}: {} entries make the root its log key signed, and extend what you saw before",
104 
        ui::done("Verified"),
105 
        ui::path(&audit.checkpoint.origin),
106 
        audit.checkpoint.size
107 
    );
028545df Andy McCall ↶ 108 
    // Its cosignatures: an upper bound on when every entry in it was made
109 
    // (spec §14.8, *Integrated time*).
110 
    if audit.witnessed.is_empty() {
111 
        println!(
112 
            "  {} {}",
113 
            ui::note(),
114 
            ui::dim("cosigned by no witness you trust")
115 
        );
116 
    } else {
117 
        let by: Vec<String> = audit
118 
            .witnessed
119 
            .iter()
120 
            .map(|(name, t)| format!("{name} {}", ui::ago(t.saturating_mul(1000))))
121 
            .collect();
122 
        println!(
123 
            "  {} {}",
124 
            ui::note(),
125 
            ui::dim(format!("cosigned by {}", by.join(", ")))
126 
        );
127 
    }
e59512f2 Andy McCall ↶ 128 
    if listed.is_empty() {
129 
        println!("  {} {}", ui::note(), ui::dim(format!("no {what} in it")));
130 
        return Ok(0);
131 
    }
132 
    println!(
133 
        "  {} {}",
134 
        ui::note(),
135 
        ui::dim(format!("{} of {what}:", listed.len()))
136 
    );
137 
    for (i, e) in listed {
138 
        let signers: Vec<String> = e.signers.iter().map(|k| k.short(12)).collect();
139 
        println!(
140 
            "  #{i:<6} {:<11} {} {} {}",
141 
            e.kind,
142 
            ui::hash(e.object.short(12)),
143 
            ui::dim(if signers.is_empty() {
144 
                "unsigned".to_string()
145 
            } else {
146 
                format!("by {}", signers.join(", "))
147 
            }),
148 
            ui::dim(ui::ago(e.received))
149 
        );
150 
    }
151 
    Ok(0)
152 
}