Keyless step 3, runner: sign receipts with a key the hub certifies per job 35f7a849bcc5

    /// Sign each job's receipt with a fresh key the hub certifies for that

    /// job, just before signing (keyless, oxygenhub#241), rather than with

    /// the runner's own key; off unless set. When the hub cannot certify,

    /// the runner's key signs, and the job's log says why.

    #[serde(default)]

    pub keyless: bool,

    /// A ten-minute certificate for `identity`, asked with a job's token

    /// (keyless, oxygenhub#241), and the identity of the hub's key that

    /// issued it, from `/.well-known/oxyhub-key`.

    pub fn certify(

        &self,

        job_token: &str,

        identity: &oxy_core::identity::Identity,

        proof: &oxy_core::identity::Signature,

    ) -> Result<(oxy_core::cert::SignedCertificate, oxy_core::identity::Identity)> {

        use oxy_core::dsse::{base64, base64_decode};

        let body = serde_json::json!({

            "identity": base64(&identity.encode()),

            "proof": base64(&oxy_core::cbor::encode(&proof.to_value())),

            "scope": "seal",

        });

        let url = format!("{}/api/v1/keyless/certify", self.base);

        let r = self

            .agent

            .post(&url)

            .set("Authorization", &format!("Bearer {job_token}"))

            .send_json(body)

            .map_err(|e| anyhow::anyhow!("asking the hub to certify the key: {e}"))?;

        let v: serde_json::Value = r.into_json()?;

        let cert = base64_decode(v["certificate"].as_str().unwrap_or(""))

            .context("the hub's answer has no certificate")

            .and_then(|b| oxy_core::cert::SignedCertificate::decode(&b).map_err(|e| anyhow::anyhow!("{e}")))?;

        let mut bytes = Vec::new();

        std::io::Read::read_to_end(

            &mut self.agent.get(&format!("{}/.well-known/oxyhub-key", self.base)).call()?.into_reader(),

            &mut bytes,

        )?;

        let issuer = oxy_core::identity::Identity::decode(&bytes)?;

        if issuer.hash() != cert.cert.issuer || cert.verify(&issuer).is_err() {

            bail!("the certificate is not signed by the hub's published key");

        }

        if cert.cert.key_id() != identity.hash() {

            bail!("the hub certified another key");

        }

        Ok((cert, issuer))

    }

            Some(r) => {

                let mut signed = sign_receipt(&repo, &heads, cfg, key, claim, r)?;

                if cfg.keyless {

                    match sign_keyless(&repo, &heads, cfg, hub, claim, r) {

                        Ok(k) => signed = k,

                        Err(e) => {

                            note(&mut sink, format!("receipt: signed with the runner's key; a short-lived key was not certified: {e:#}"))

                        }

                    }

                }

                Some(hex::encode(signed.encode()))

            }

/// Sign `receipt` with a fresh key the hub certifies for this job now,

/// just before signing, so the certificate covers the moment the hub

/// accepts it (keyless, oxygenhub#241). The key is dropped with the

/// receipt signed: nothing long-lived signs.

fn sign_keyless(

    repo: &Repo,

    heads: &[ChangeHash],

    cfg: &RunnerConfig,

    hub: &Hub,

    claim: &Claim,

    receipt: &Receipt,

) -> Result<oxy_core::receipt::SignedReceipt> {

    let sk = oxy_core::identity::SecretKey::generate();

    let now = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map(|d| d.as_millis() as u64).unwrap_or(0);

    let name = format!("{} job {}", cfg.name.as_deref().unwrap_or("runner"), claim.job_id);

    let id = sk.identity(&name, "", now);

    let proof = sk.sign_challenge(&id.hash(), &oxy_core::cert::certify_challenge(&claim.token)).map_err(|e| anyhow::anyhow!("{e}"))?;

    let (cert, issuer) = hub.certify(&claim.token, &id, &proof)?;

    let state = state_of(heads);

    let run = format!("{}/{}/flow/{}", cfg.hub.trim_end_matches('/'), claim.repo, claim.run_number);

    Ok(oxy_core::receipt::SignedReceipt::sign(receipt.to_oxy(), repo.id()?, state, &run, &id, &sk).with_certificate(cert, issuer))

}

    }

    /// A hub that answers certify with a certificate `sign_as` signs for

    /// `cert_key`, and publishes `published` as its key: two requests.

    fn fake_certify_hub(

        sign_as: (oxy_core::identity::Identity, oxy_core::identity::SecretKey),

        cert_key: oxy_core::identity::Identity,

        published: oxy_core::identity::Identity,

    ) -> String {

        use std::io::{Read, Write};

        let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();

        let addr = listener.local_addr().unwrap();

        std::thread::spawn(move || {

            for _ in 0..2 {

                let Ok((mut s, _)) = listener.accept() else { return };

                let mut req = Vec::new();

                let mut buf = [0u8; 65536];

                loop {

                    let n = s.read(&mut buf).unwrap_or(0);

                    if n == 0 {

                        break;

                    }

                    req.extend_from_slice(&buf[..n]);

                    let text = String::from_utf8_lossy(&req);

                    if let Some(end) = text.find("\r\n\r\n") {

                        let len = text[..end]

                            .lines()

                            .find_map(|l| {

                                l.to_ascii_lowercase().strip_prefix("content-length:").map(|v| v.trim().parse::<usize>().unwrap_or(0))

                            })

                            .unwrap_or(0);

                        if req.len() >= end + 4 + len {

                            break;

                        }

                    }

                }

                let line = String::from_utf8_lossy(&req).lines().next().unwrap_or("").to_string();

                let body: Vec<u8> = if line.contains("/keyless/certify") {

                    let cert = oxy_core::cert::SignedCertificate::sign(

                        oxy_core::cert::Certificate {

                            key: cert_key.clone(),

                            issuer: sign_as.0.hash(),

                            subject: "repo:andy/demo:bookmark:main".into(),

                            claims: vec![],

                            scope: oxy_core::identity::Scope::SEAL,

                            not_before: 1,

                            expires: 600_001,

                        },

                        &sign_as.0,

                        &sign_as.1,

                    );

                    serde_json::json!({ "certificate": oxy_core::dsse::base64(&cert.encode()) }).to_string().into_bytes()

                } else {

                    published.encode()

                };

                let _ = write!(s, "HTTP/1.1 200 OK\r\nContent-Length: {}\r\nConnection: close\r\n\r\n", body.len());

                let _ = s.write_all(&body);

            }

        });

        format!("http://{addr}")

    }

    /// keyless (oxygenhub#241): the runner takes a certificate only when it

    /// is for its fresh key and signed by the key the hub publishes.

    #[test]

    fn a_certificate_is_taken_only_for_this_key_from_the_hubs_key() {

        use oxy_core::identity::SecretKey;

        let hub_sk = SecretKey::generate();

        let hub_id = hub_sk.identity("hub", "", 1);

        let sk = SecretKey::generate();

        let id = sk.identity("earth-1 job 7", "", 1);

        let proof = sk.sign_challenge(&id.hash(), &oxy_core::cert::certify_challenge("flowjob_x")).unwrap();

        let base = fake_certify_hub((hub_id.clone(), hub_sk.clone()), id.clone(), hub_id.clone());

        let (cert, issuer) = hub_at(base).certify("flowjob_x", &id, &proof).unwrap();

        assert_eq!((cert.cert.key_id(), issuer.hash()), (id.hash(), hub_id.hash()));

        let mallory_sk = SecretKey::generate();

        let mallory = mallory_sk.identity("mallory", "", 1);

        let base = fake_certify_hub((mallory.clone(), mallory_sk), id.clone(), hub_id.clone());

        let e = hub_at(base).certify("flowjob_x", &id, &proof).unwrap_err().to_string();

        assert!(e.contains("not signed by the hub's published key"), "{e}");

        let other = SecretKey::generate().identity("other", "", 1);

        let base = fake_certify_hub((hub_id.clone(), hub_sk), other, hub_id);

        let e = hub_at(base).certify("flowjob_x", &id, &proof).unwrap_err().to_string();

        assert!(e.contains("another key"), "{e}");

**Keyless receipts** (oxygenhub#241). With `keyless = true` under

`[runner]` (or in `runner.toml`), a runner signs each job's receipt with a

fresh key instead of its own: just before signing, it asks the hub to

certify the key (`POST /api/v1/keyless/certify` with the job's token and

the key's proof of possession, scope `seal`), checks the certificate is

for that key and signed by the key the hub publishes at

`/.well-known/oxyhub-key`, signs, attaches the certificate and the hub's

identity to the receipt (Oxygen spec §14.6), and drops the key. When the

hub cannot certify, the runner's own key signs and the job's log says

why. The runner's key then only authenticates it to the hub.