Keyless step 3, hub: receipts signed by a key the hub certified are kept 2c31915f5c89

    let signer = match &sr.certificate {

        // Signed by a short-lived key this hub certified for this job

        // (keyless, #241): the certificate stands for the runner's key.

        Some(c) => {

            let cert = &c.cert.cert;

            if cert.issuer != app.hub_key.key || c.issuer.hash() != app.hub_key.key {

                return Err("its certificate was not issued by this hub".into());

            }

            let subject = format!("repo:{}/{}:bookmark:{}", row.owner, row.name, run.bookmark);

            if cert.subject != subject {

                return Err(format!("its certificate is for {}, not {subject}", cert.subject));

            }

            if cert.claim("run") != Some(run.number.to_string().as_str()) || cert.claim("job") != Some(sr.receipt.job_name.as_str()) {

                return Err("its certificate is for another run or job".into());

            }

            // Now is when this hub accepts it: a time the runner did not choose.

            if !cert.covers(oxy_core::identity::Scope::SEAL, db::now_ms() as u64) {

                return Err("its certificate does not cover now: certify the key just before signing the receipt".into());

            }

            format!("{} (short-lived key)", runner.name)

        }

        None => {

            let key = sr.runner.hash().to_hex();

            let bound = db::runners::bind_key(&app.db, runner.id, &key, &sr.runner.name).await.map_err(|e| e.to_string())?;

            if bound != key {

                return Err(format!("signed by {}, not the key this runner signs with ({})", &key[..12], &bound[..12.min(bound.len())]));

            }

            sr.runner.name.clone()

        }

    };

/// Keyless step 3 (oxygenhub#241): a job signs its receipt with a fresh

/// key the hub certified for it, and the hub keeps the receipt without

/// binding any runner key; a certificate for another job, or from another

/// issuer, is not this job's.

#[tokio::test(flavor = "multi_thread")]

async fn a_receipt_signed_by_a_certified_key_is_kept() {

    use oxy_core::cert::{certify_challenge, SignedCertificate};

    use oxy_core::hash::{hash_object, ChangeHash, ObjectType};

    use oxy_core::identity::SecretKey;

    use oxy_core::objects::StateObject;

    use oxy_core::receipt::SignedReceipt;

    let h = hub().await;

    create(&h.app, "andy", "demo").await;

    let url = format!("{}/andy/demo", h.base);

    let work = tempfile::tempdir().unwrap();

    let c = client(&url, work.path());

    write(work.path(), ".flow/pipeline.kdl", &pipeline(""));

    c.snapshot("test").unwrap();

    c.commit("Add a pipeline", &[]).unwrap();

    assert!(c.push("origin", false).unwrap().iter().all(|r| r.ok));

    let run = runs_of(&h.app, "andy", "demo").await.remove(0);

    let heads: Vec<ChangeHash> = run.head_list().into_iter().filter_map(ChangeHash::from_hex).collect();

    let state = hash_object(ObjectType::State, &StateObject::new(heads.clone()).encode());

    let repo_id = h.app.repos.open(&RepoName::parse("andy/demo").unwrap()).unwrap().id().unwrap();

    // Certify a fresh key with a job's token, as a runner does just before

    // it signs the receipt.

    let certify = |token: String| {

        let app = h.app.clone();

        async move {

            let sk = SecretKey::generate();

            let id = sk.identity("test-1 job", "", 1);

            let proof = sk.sign_challenge(&id.hash(), &certify_challenge(&token)).unwrap();

            let body = serde_json::json!({

                "identity": oxy_core::dsse::base64(&id.encode()),

                "proof": oxy_core::dsse::base64(&oxy_core::cbor::encode(&proof.to_value())),

                "scope": "seal",

            });

            let (st, body) = call(&app, "POST", "/api/v1/keyless/certify", Some(&token), Some(body.to_string())).await;

            assert_eq!(st, StatusCode::OK, "{body}");

            let v: serde_json::Value = serde_json::from_str(&body).unwrap();

            let cert = SignedCertificate::decode(&oxy_core::dsse::base64_decode(v["certificate"].as_str().unwrap()).unwrap()).unwrap();

            (sk, id, cert)

        }

    };

    let sign = |r: &serde_json::Value,

                sk: &SecretKey,

                id: &oxy_core::identity::Identity,

                cert: SignedCertificate,

                issuer: oxy_core::identity::Identity| {

        let r: flow_core::Receipt = serde_json::from_value(r.clone()).unwrap();

        let run_url = format!("{url}/flow/{}", run.number);

        hex::encode(SignedReceipt::sign(r.to_oxy(), repo_id, state, &run_url, id, sk).with_certificate(cert, issuer).encode())

    };

    let hub_id = h.app.hub_key.identity.clone();

    let a = claim(&h.app).await.unwrap();

    let b = claim(&h.app).await.unwrap();

    let ph = a["pipeline_hash"].as_str().unwrap().to_string();

    let (a_name, b_name) = (a["job"]["name"].as_str().unwrap().to_string(), b["job"]["name"].as_str().unwrap().to_string());

    let (a_id, b_id) = (a["job_id"].as_i64().unwrap(), b["job_id"].as_i64().unwrap());

    let (sk_a, id_a, cert_a) = certify(a["token"].as_str().unwrap().to_string()).await;

    // Job b's receipt signed with job a's certified key: another job's.

    let rb = receipt(&b_name, &ph, 0);

    let body = serde_json::json!({ "exit_code": 0, "duration_ms": 300, "receipt": rb, "signed_receipt": sign(&rb, &sk_a, &id_a, cert_a.clone(), hub_id.clone()) });

    assert_eq!(finish(&h.app, b_id, body).await, StatusCode::NO_CONTENT);

    // Job a's, with its own certificate: kept.

    let ra = receipt(&a_name, &ph, 0);

    let body = serde_json::json!({ "exit_code": 0, "duration_ms": 700, "receipt": ra, "signed_receipt": sign(&ra, &sk_a, &id_a, cert_a, hub_id.clone()) });

    assert_eq!(finish(&h.app, a_id, body).await, StatusCode::NO_CONTENT);

    let jobs = db::flow::jobs(&h.app.db, run.id).await.unwrap();

    let job = |n: &str| jobs.iter().find(|j| j.name == n).unwrap().clone();

    assert_eq!(job(&a_name).receipt_attest.len(), 64, "{}", job(&a_name).receipt_note);

    assert!(job(&a_name).receipt_signer.ends_with("(short-lived key)"), "{}", job(&a_name).receipt_signer);

    assert!(job(&b_name).receipt_attest.is_empty());

    assert!(job(&b_name).receipt_note.contains("another run or job"), "{}", job(&b_name).receipt_note);

    // The kept receipt carries its certificate, and verifies on its own.

    let kept = h.app.repos.open(&RepoName::parse("andy/demo").unwrap()).unwrap().receipts(&heads).unwrap();

    assert_eq!(kept.len(), 1);

    assert!(kept[0].problem.is_none() && kept[0].signed.certificate.is_some());

    // A certificate from another issuer, for the third job: not this hub's.

    let t = claim(&h.app).await.unwrap();

    let t_name = t["job"]["name"].as_str().unwrap().to_string();

    let fake_sk = SecretKey::generate();

    let fake = fake_sk.identity("not the hub", "", 1);

    let (sk_t, id_t, mut cert_t) = certify(t["token"].as_str().unwrap().to_string()).await;

    cert_t.cert.issuer = fake.hash();

    let cert_t = SignedCertificate::sign(cert_t.cert, &fake, &fake_sk);

    let rt = receipt(&t_name, &ph, 0);

    let body =

        serde_json::json!({ "exit_code": 0, "duration_ms": 500, "receipt": rt, "signed_receipt": sign(&rt, &sk_t, &id_t, cert_t, fake) });

    assert_eq!(finish(&h.app, t["job_id"].as_i64().unwrap(), body).await, StatusCode::NO_CONTENT);

    let jobs = db::flow::jobs(&h.app.db, run.id).await.unwrap();

    let t_job = jobs.iter().find(|j| j.name == t_name).unwrap();

    assert!(t_job.receipt_note.contains("not issued by this hub"), "{}", t_job.receipt_note);

}

`POST /api/v1/keyless/certify` gives a fresh key a certificate (Oxygen spec §14.7) for ten minutes, signed with the hub's key. The bearer is the credential: a running job's token (subject `repo:OWNER/NAME:bookmark:B`, claims `repository`, `bookmark`, `run`, `job`, `runner`, and `environment` with `approved_by` once an approved job may deploy), or one of this hub's OIDC tokens for the audience `{base_url}/keyless` (its `sub` the subject, and the same claims it carries). The body is `{"identity": base64 identity object, "proof": base64 CBOR Signature, "scope": "changes,refs"}`, the proof the fresh key's challenge signature (§14.3) over `certify_challenge(credential)` (`"oxy1 certify "` and the BLAKE3 of the credential), so it cannot be replayed with another credential. The answer is `{"certificate": base64 [certificate, signature], "subject", "expires_ms"}`; a certificate never outlives its credential, and it starts 30 s back for clocks a little behind. Each one is audited (`keyless.certified`). A runner may sign a job's receipt with such a key, certified just before it signs (scope `seal`): the receipt carries the certificate (Oxygen spec §14.6), and the hub keeps it when the certificate is this hub's, its subject is the run's repository and bookmark, its `run` and `job` claims are the run's and the job's, and it covers the moment the hub accepts it; no runner key is bound then, and the run names the signer as the runner's name with "(short-lived key)". Which issuers and subjects a repository trusts for changes and references is its policy's (docs/keyless.md, step 4).