Flow: SLSA provenance for artifacts, in DSSE, that cosign verifies 076c7a7c86b1

//! Provenance others can verify (oxygenhub#239): a Flow artifact's in-toto

//! Statement with an SLSA provenance v1 predicate, in a DSSE envelope signed

//! with the hub's Ed25519 key, as `cosign verify-blob-attestation` and other

//! in-toto and SLSA verifiers read it. The runner signed the job's receipt

//! with a key the hub holds no secret of; the hub checked that receipt when

//! it kept it, and this envelope is the hub's statement of what the receipt

//! says, in the shape the wider tools understand. `/.well-known/oxyhub-signing.pem`

//! is the public key, as cosign's `--key` takes it.

use crate::Shared;

/// DSSE's payload type for in-toto statements.

pub const PAYLOAD_TYPE: &str = "application/vnd.in-toto+json";

/// What the statement says of one artifact.

pub struct Subject<'a> {

    /// The artifact's file name.

    pub name: &'a str,

    pub bytes: &'a [u8],

    /// `owner/name` and the hub's URL of the run.

    pub repo: &'a str,

    pub run_url: &'a str,

    pub bookmark: &'a str,

    /// The state the run built, and the heads it is.

    pub state: &'a str,

    pub heads: &'a str,

    pub pipeline_hash: &'a str,

    pub job: &'a str,

    /// The runner that ran it and signed its receipt.

    pub runner: &'a str,

    pub receipt_signer: &'a str,

    pub receipt_attest: &'a str,

    pub started_ms: Option<i64>,

    pub finished_ms: Option<i64>,

}

/// The in-toto Statement v1 with an SLSA provenance v1 predicate.

pub fn statement(base_url: &str, s: &Subject) -> serde_json::Value {

    use sha2::Digest;

    let sha256 = hex::encode(sha2::Sha256::digest(s.bytes));

    let when = |ms: Option<i64>| {

        ms.and_then(|t| time::OffsetDateTime::from_unix_timestamp_nanos(t as i128 * 1_000_000).ok())

            .and_then(|t| t.format(&time::format_description::well_known::Rfc3339).ok())

    };

    let mut metadata = serde_json::json!({ "invocationId": s.run_url });

    if let Some(t) = when(s.started_ms) {

        metadata["startedOn"] = t.into();

    }

    if let Some(t) = when(s.finished_ms) {

        metadata["finishedOn"] = t.into();

    }

    serde_json::json!({

        "_type": "https://in-toto.io/Statement/v1",

        "subject": [{ "name": s.name, "digest": { "sha256": sha256, "blake3": blake3::hash(s.bytes).to_hex().to_string() } }],

        "predicateType": "https://slsa.dev/provenance/v1",

        "predicate": {

            "buildDefinition": {

                "buildType": format!("{base_url}/oxygenflow/job/v1"),

                "externalParameters": {

                    "repository": format!("{base_url}/{}", s.repo),

                    "bookmark": s.bookmark,

                    "job": s.job,

                    "pipeline": s.pipeline_hash,

                },

                "resolvedDependencies": [{

                    "uri": format!("{base_url}/{}", s.repo),

                    "digest": { "oxygen-state": s.state },

                    "annotations": { "heads": s.heads },

                }],

            },

            "runDetails": {

                "builder": {

                    "id": format!("{base_url}/oxygenflow/runner/{}", s.runner),

                },

                "metadata": metadata,

                "byproducts": [{

                    "name": "oxygen-receipt",

                    "digest": { "oxygen-attestation": s.receipt_attest },

                    "annotations": { "signedBy": s.receipt_signer },

                }],

            },

        },

    })

}

/// DSSE's pre-authentication encoding: what the signature covers.

pub fn pae(payload_type: &str, payload: &[u8]) -> Vec<u8> {

    let mut out = format!("DSSEv1 {} {} {} ", payload_type.len(), payload_type, payload.len()).into_bytes();

    out.extend_from_slice(payload);

    out

}

/// `statement` in a DSSE envelope signed with the hub's key.

pub fn envelope(app: &Shared, statement: &serde_json::Value) -> anyhow::Result<serde_json::Value> {

    let payload = serde_json::to_vec(statement)?;

    let (key, secret) = crate::keys::load_secret(&app.config.keys_dir())?;

    let pair = ring::signature::Ed25519KeyPair::from_seed_unchecked(&secret.ed_seed)

        .map_err(|_| anyhow::anyhow!("the hub's key is not an Ed25519 seed"))?;

    let sig = pair.sign(&pae(PAYLOAD_TYPE, &payload));

    Ok(serde_json::json!({

        "payloadType": PAYLOAD_TYPE,

        "payload": base64(&payload),

        "signatures": [{ "keyid": key.to_hex(), "sig": base64(sig.as_ref()) }],

    }))

}

/// The hub's Ed25519 public key as a PEM SubjectPublicKeyInfo.

pub fn public_pem(app: &Shared) -> String {

    // SEQUENCE { SEQUENCE { OID 1.3.101.112 }, BIT STRING { key } }

    let mut der = vec![0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x03, 0x21, 0x00];

    der.extend_from_slice(&app.hub_key.identity.ed25519_pk);

    let body = base64(&der);

    format!("-----BEGIN PUBLIC KEY-----\n{body}\n-----END PUBLIC KEY-----\n")

}

/// Standard base64 with padding, as DSSE and PEM use.

pub fn base64(bytes: &[u8]) -> String {

    const T: &[u8; 64] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";

    let mut out = String::with_capacity(bytes.len().div_ceil(3) * 4);

    for chunk in bytes.chunks(3) {

        let n = chunk.iter().fold(0u32, |acc, b| (acc << 8) | *b as u32) << (8 * (3 - chunk.len()));

        for i in 0..4 {

            if i <= chunk.len() {

                out.push(T[((n >> (18 - 6 * i)) & 63) as usize] as char);

            } else {

                out.push('=');

            }

        }

    }

    out

}

#[cfg(test)]

mod tests {

    #[test]

    fn pae_and_base64_are_the_specs() {

        // DSSE's own example: PAE("http://example.com/HelloWorld", "hello world").

        assert_eq!(

            super::pae("http://example.com/HelloWorld", b"hello world"),

            b"DSSEv1 29 http://example.com/HelloWorld 11 hello world".to_vec()

        );

        assert_eq!(super::base64(b"f"), "Zg==");

        assert_eq!(super::base64(b"fo"), "Zm8=");

        assert_eq!(super::base64(b"foo"), "Zm9v");

        assert_eq!(super::base64(b"foobar"), "Zm9vYmFy");

    }

}

pub mod provenance;

/// `GET …/artifacts/{job}/{artifact}/provenance` (oxygenhub#239): the

/// artifact's SLSA provenance in a DSSE envelope signed by the hub, for

/// `cosign verify-blob-attestation --key oxyhub-signing.pem --type

/// slsaprovenance1`. Only for a job whose signed receipt the hub kept.

pub async fn provenance(

    State(app): State<Shared>,

    viewer: Viewer,

    Path((owner, name, id, job, artifact)): Path<(String, String, i64, String, String)>,

) -> Result<Response, Error> {

    let shell = Shell::new(&app, &format!("/{owner}/{name}/flow/{id}/artifacts/{job}/{artifact}/provenance"), &viewer);

    let (repo, row, _role) = lookup(&app, &shell, &viewer, &owner, &name).await?;

    let run = fdb::run(&app.db, row.id, id)

        .await

        .map_err(|e| Error::from_db(shell.clone(), e))?

        .ok_or_else(|| Error::not_found(shell.clone()))?;

    let jobs = fdb::jobs(&app.db, run.id).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    let Some(j) = jobs.iter().find(|j| j.name == job) else { return Err(Error::not_found(shell)) };

    if j.receipt_attest.is_empty() {

        return Err(Error::bad(shell, "This job has no signed receipt the hub kept, so the hub states no provenance for it.".to_string()));

    }

    let arts = fdb::artifacts(&app.db, j.id).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    let Some(a) = arts.into_iter().find(|a| a.name == artifact) else { return Err(Error::not_found(shell)) };

    let Some(blob) = oxy_core::hash::ObjectRef::from_hex(&a.blob) else { return Err(Error::not_found(shell)) };

    let bytes = app.repos.read(&repo, move |r, _| Ok(r.read_blob(&blob)?)).await.map_err(|_| Error::not_found(shell.clone()))?;

    let file = a.path.rsplit('/').next().unwrap_or(&a.name).to_string();

    let base = app.config.base_url();

    let subject = crate::provenance::Subject {

        name: &file,

        bytes: &bytes,

        repo: &format!("{owner}/{name}"),

        run_url: &format!("{base}/{owner}/{name}/flow/{id}"),

        bookmark: &run.bookmark,

        state: &run.state,

        heads: &run.heads,

        pipeline_hash: &run.pipeline_hash,

        job: &j.name,

        runner: &j.runner,

        receipt_signer: &j.receipt_signer,

        receipt_attest: &j.receipt_attest,

        started_ms: j.started_ms,

        finished_ms: j.finished_ms,

    };

    let statement = crate::provenance::statement(base, &subject);

    let envelope = crate::provenance::envelope(&app, &statement).map_err(|e| Error::bad(shell.clone(), e.to_string()))?;

    Ok((

        [

            (axum::http::header::CONTENT_TYPE, "application/json".to_string()),

            (axum::http::header::CONTENT_DISPOSITION, format!("attachment; filename=\"{}.intoto.json\"", file.replace('"', ""))),

        ],

        serde_json::to_string(&envelope).unwrap_or_default(),

    )

        .into_response())

}

/// `GET /.well-known/oxyhub-signing.pem`: the hub's Ed25519 public key, as

/// cosign and other verifiers take it (oxygenhub#239).

pub async fn signing_key(State(app): State<Shared>) -> Response {

    ([(axum::http::header::CONTENT_TYPE, "application/x-pem-file")], crate::provenance::public_pem(&app)).into_response()

}

        .route("/.well-known/oxyhub-signing.pem", get(flow::signing_key))

        .route("/{owner}/{name}/flow/{id}/artifacts/{job}/{artifact}/provenance", get(flow::provenance))

    // Provenance (#239): only for a job whose signed receipt the hub kept;

    // then an in-toto statement in a DSSE envelope the hub's key verifies.

    let prov = format!("{link}/provenance");

    assert_eq!(get_bytes(&h.app, &prov).await.0, StatusCode::BAD_REQUEST, "no kept receipt, no provenance");

    sqlx::query("UPDATE flow_jobs SET receipt_attest = 'a1b2', receipt_signer = 'test-1 runner' WHERE id = $1")

        .bind(id)

        .execute(&h.app.db)

        .await

        .unwrap();

    let (st, env) = get_bytes(&h.app, &prov).await;

    assert_eq!(st, StatusCode::OK);

    let env: serde_json::Value = serde_json::from_slice(&env).unwrap();

    assert_eq!(env["payloadType"], "application/vnd.in-toto+json");

    let unb64 = |t: &str| -> Vec<u8> {

        let val = |c: u8| match c {

            b'A'..=b'Z' => c - b'A',

            b'a'..=b'z' => c - b'a' + 26,

            b'0'..=b'9' => c - b'0' + 52,

            b'+' => 62,

            _ => 63,

        };

        let clean: Vec<u8> = t.bytes().filter(|c| *c != b'=').collect();

        let mut out = Vec::new();

        for chunk in clean.chunks(4) {

            let n = chunk.iter().enumerate().fold(0u32, |acc, (i, c)| acc | (val(*c) as u32) << (18 - 6 * i));

            for i in 0..chunk.len() - 1 {

                out.push((n >> (16 - 8 * i)) as u8);

            }

        }

        out

    };

    let payload = unb64(env["payload"].as_str().unwrap());

    let sig = unb64(env["signatures"][0]["sig"].as_str().unwrap());

    let signed = oxygenhub::provenance::pae("application/vnd.in-toto+json", &payload);

    ring::signature::UnparsedPublicKey::new(&ring::signature::ED25519, h.app.hub_key.identity.ed25519_pk)

        .verify(&signed, &sig)

        .expect("the hub's key signed the envelope");

    let statement: serde_json::Value = serde_json::from_slice(&payload).unwrap();

    use sha2::Digest;

    assert_eq!(statement["subject"][0]["digest"]["sha256"], hex::encode(sha2::Sha256::digest(&body)));

    assert_eq!(statement["predicateType"], "https://slsa.dev/provenance/v1");

    assert_eq!(statement["predicate"]["buildDefinition"]["externalParameters"]["job"], "build");

    assert_eq!(statement["predicate"]["runDetails"]["byproducts"][0]["digest"]["oxygen-attestation"], "a1b2");

    let (_, pem) = get_bytes(&h.app, "/.well-known/oxyhub-signing.pem").await;

    let pem = String::from_utf8(pem).unwrap();

    let der = unb64(pem.lines().filter(|l| !l.starts_with("-----")).collect::<String>().as_str());

    assert_eq!(&der[der.len() - 32..], &h.app.hub_key.identity.ed25519_pk[..], "the PEM holds the hub's key");

    sqlx::query("UPDATE flow_jobs SET receipt_attest = '', receipt_signer = '' WHERE id = $1").bind(id).execute(&h.app.db).await.unwrap();

- **Provenance others verify** (oxygenhub#239). For an artifact of a job whose signed receipt the hub kept, `…/flow/{run}/artifacts/{job}/{artifact}/provenance` answers an in-toto Statement v1 with an SLSA provenance v1 predicate, in a DSSE envelope signed with the hub's Ed25519 key. The subject is the artifact by SHA-256 (and BLAKE3); the build definition names the repository, bookmark, job and pipeline hash, and depends on the state built; the run details name the runner as builder, the run as invocation with its start and finish, and the kept receipt's attestation as a byproduct. The runner signed the receipt; the hub, which checked it, states what it says in the shape cosign, policy-controller, Kyverno and slsa-verifier read. `/.well-known/oxyhub-signing.pem` is the key: `cosign verify-blob-attestation --key oxyhub-signing.pem --type slsaprovenance1 --signature tool.intoto.json tool`.