Release trust counts receipts by keys this hub certified 244724133fed

    /// The runner's key is one a runner token on this hub signs with, or a

    /// short-lived key this hub certified for the repository (#241).

    /// The subject this hub certified the short-lived key that signed the

    /// receipt for, when it was one.

    pub certified_for: Option<String>,

    receipts: HashMap<String, KeptReceipt>,

/// A kept receipt as the report sees it: its signer, why it does not

/// verify (if it does not), whether the key was revoked, the signed

/// receipt in hex, and the issuer and subject of a short-lived key's

/// certificate.

type KeptReceipt = (KeyInfo, Option<String>, bool, String, Option<(String, String)>);

                    // A short-lived key's certificate: its issuer and subject.

                    let certified = i.signed.certificate.as_ref().map(|c| (c.cert.cert.issuer.to_hex(), c.cert.cert.subject.clone()));

                    receipts.insert(a.clone(), (runner, i.problem.clone(), i.revoked, hex::encode(i.signed.encode()), certified));

            // Certified by this hub's key for this repository: as good as

            // a runner key of this hub (the certificate itself was checked

            // with the receipt).

            let certified_for = kept

                .as_ref()

                .and_then(|(.., c)| c.clone())

                .filter(|(issuer, subject)| *issuer == app.hub_key.key.to_hex() && subject.starts_with(&format!("repo:{}:", row.slug())));

            let certified_for = certified_for.map(|(_, subject)| subject);

                runner_known: kept.as_ref().is_some_and(|(k, ..)| known_runner_keys.contains(&k.key)) || certified_for.is_some(),

                certified_for,

                runner_revoked: kept.as_ref().is_some_and(|(_, _, rv, ..)| *rv),

                signed_receipt: kept.map(|(_, _, _, hex, _)| hex),

                            match (&b.certified_for, known) {

                                (Some(s), _) => format!(", a short-lived key this hub certified for {s}"),

                                (None, true) => ", a runner key of this hub".to_string(),

                                (None, false) => "; that key is not one this hub's runners use".to_string(),

                            }

/// oxygenhub#241: a release asset whose receipt a short-lived key signed,

/// certified by this hub for the job, is an attested build of a known

/// signer on the release's trust report (it was "not one this hub's

/// runners use" with 0.4.5).

#[tokio::test(flavor = "multi_thread")]

async fn a_release_built_by_a_certified_key_is_attested() {

    use oxy_core::cert::{certify_challenge, SignedCertificate};

    use oxy_core::hash::{hash_object, ChangeHash, ObjectType};

    use oxy_core::identity::SecretKey;

    use oxy_core::objects::StateObject;

    use oxy_core::receipt::SignedReceipt;

    let h = hub().await;

    create(&h.app, "andy", "demo").await;

    let url = format!("{}/andy/demo", h.base);

    let work = tempfile::tempdir().unwrap();

    let mut c = client(&url, work.path());

    c.create_identity("Andy", "[email protected]", oxy_core::repo::IdentityScope::Repo).unwrap();

    write(

        work.path(),

        ".flow/pipeline.kdl",

        &format!(

            "schema-version 1\nsandbox \"alpine\" {{\n    rootfs \"cas://blob/{ROOTFS}\"\n}}\njob \"build\" {{\n    sandbox \"alpine\"\n    exec \"make\"\n    output {{\n        artifact \"tool\" {{\n            path \"/src/out/tool\"\n        }}\n    }}\n}}\n"

        ),

    );

    c.snapshot("test").unwrap();

    c.commit("Build a tool", &[]).unwrap();

    let heads = c.bookmark_heads().unwrap();

    c.tag_create("v1", &heads, "first").unwrap();

    assert!(c.push("origin", false).unwrap().iter().all(|r| r.ok));

    let run = runs_of(&h.app, "andy", "demo").await.remove(0);

    let a = claim(&h.app).await.unwrap();

    let id = a["job_id"].as_i64().unwrap();

    let token = a["token"].as_str().unwrap().to_string();

    let body: Vec<u8> = b"#!/bin/sh\necho tool\n".to_vec();

    let (_, text) = upload(&h.app, id, "tool", &body).await;

    let blob = serde_json::from_str::<serde_json::Value>(&text).unwrap()["blob"].as_str().unwrap().to_string();

    let mut r = receipt("build", a["pipeline_hash"].as_str().unwrap(), 0);

    r["outputs"] = serde_json::json!([blob]);

    let heads_run: Vec<ChangeHash> = run.head_list().into_iter().filter_map(ChangeHash::from_hex).collect();

    let state = hash_object(ObjectType::State, &StateObject::new(heads_run).encode());

    let repo_id = h.app.repos.open(&RepoName::parse("andy/demo").unwrap()).unwrap().id().unwrap();

    // The job's fresh key, certified with its token.

    let sk = SecretKey::generate();

    let key = sk.identity("test-1 job", "", 1);

    let proof = sk.sign_challenge(&key.hash(), &certify_challenge(&token)).unwrap();

    let ask = serde_json::json!({

        "identity": oxy_core::dsse::base64(&key.encode()),

        "proof": oxy_core::dsse::base64(&oxy_core::cbor::encode(&proof.to_value())),

        "scope": "seal",

    });

    let (st, answer) = call(&h.app, "POST", "/api/v1/keyless/certify", Some(&token), Some(ask.to_string())).await;

    assert_eq!(st, StatusCode::OK, "{answer}");

    let v: serde_json::Value = serde_json::from_str(&answer).unwrap();

    let cert = SignedCertificate::decode(&oxy_core::dsse::base64_decode(v["certificate"].as_str().unwrap()).unwrap()).unwrap();

    let fr: flow_core::Receipt = serde_json::from_value(r.clone()).unwrap();

    let signed = hex::encode(

        SignedReceipt::sign(fr.to_oxy(), repo_id, state, &format!("{url}/flow/{}", run.number), &key, &sk)

            .with_certificate(cert, h.app.hub_key.identity.clone())

            .encode(),

    );

    let done = serde_json::json!({ "exit_code": 0, "duration_ms": 900, "receipt": r, "signed_receipt": signed });

    assert_eq!(finish(&h.app, id, done).await, StatusCode::NO_CONTENT);

    let row = db::repos::get(&h.app.db, "andy", "demo").await.unwrap().unwrap();

    let rel = db::releases::create(&h.app.db, row.id, "v1", "One", "", false, None).await.unwrap();

    oxygenhub::web::releases::store_asset(&h.app, rel.id, "tool", "", &body).await.unwrap();

    let (st, page) = call(&h.app, "GET", "/andy/demo/releases/trust/v1", None, None).await;

    assert_eq!(st, StatusCode::OK);

    for want in [

        "tool: signed receipt from run #1 build",

        "a short-lived key this hub certified for repo:andy/demo:bookmark:main",

        "1 of 1 assets built and attested by OxygenFlow",

    ] {

        assert!(page.contains(want), "missing {want:?}");

    }

    assert!(!page.contains("not one this hub"), "not an unknown key");

}