Trust and audit for each release df940d75cd3d

//! A release's trust report (hub spec §9.1): who wrote what the release

//! holds and how it is authenticated, what built each asset, in which

//! pinned environment, from which inputs, under which signed receipt, and

//! an audit of all of it. The page draws it as a graph; the same report is

//! JSON for export, carrying the signed receipts so an auditor can check

//! them offline with `oxy receipt verify`.

use super::{filters, lookup, Error, Page, RepoShell, Shell};

use crate::auth::Viewer;

use crate::db::{self, flow as fdb, releases as rdb};

use crate::repos::RepoName;

use crate::Shared;

use askama::Template;

use axum::extract::{Path, Query, State};

use axum::response::{IntoResponse, Response};

use oxy_core::hash::{ChangeHash, ObjectRef};

use oxy_core::identity::{verify, Domain};

use oxy_core::repo::SignatureStatus;

use serde::{Deserialize, Serialize};

use std::collections::{BTreeMap, HashMap};

/// A key as the report names it.

#[derive(Clone, Debug, Default, Serialize)]

pub struct KeyInfo {

    pub key: String,

    pub name: String,

    pub email: String,

    /// The account the key is linked to on this hub.

    pub account: Option<String>,

}

#[derive(Clone, Debug, Default, Serialize)]

pub struct AuthorTrust {

    pub who: KeyInfo,

    pub changes: usize,

    /// Changes authenticated by their own signature.

    pub signed: usize,

    /// Changes authenticated by a seal.

    pub sealed: usize,

    pub unsigned: usize,

    /// Authenticated by a key since revoked.

    pub revoked: usize,

    pub invalid: usize,

}

#[derive(Clone, Debug, Serialize)]

pub struct BuildTrust {

    pub run: i64,

    pub job: String,

    pub run_url: String,

    /// The heads the run built, joined with `+`.

    pub heads: String,

    /// Whether that is exactly the tagged state.

    pub same_state_as_tag: bool,

    pub pipeline_hash: String,

    pub scope_tree_hash: String,

    /// Hash of the environment the job ran in (runtime, pinned parts,

    /// rootfs, argv, env).

    pub environment: String,

    pub rootfs: String,

    pub runtime: String,

    pub exit_code: Option<i64>,

    pub runner: Option<KeyInfo>,

    /// The receipt attestation, when a signed receipt was kept.

    pub receipt: Option<String>,

    pub receipt_url: Option<String>,

    /// Why the kept receipt does not verify now, if it does not.

    pub receipt_problem: Option<String>,

    pub runner_revoked: bool,

    /// The runner's key is one a runner token on this hub signs with.

    pub runner_known: bool,

    /// The signed receipt, hex, for `oxy receipt verify`.

    pub signed_receipt: Option<String>,

}

#[derive(Clone, Debug, Serialize)]

pub struct AssetTrust {

    pub name: String,

    pub size: i64,

    pub blake3: String,

    pub url: String,

    pub build: Option<BuildTrust>,

}

#[derive(Clone, Debug, Serialize, PartialEq, Eq)]

#[serde(rename_all = "lowercase")]

pub enum Verdict {

    Pass,

    Warn,

    Fail,

}

#[derive(Clone, Debug, Serialize)]

pub struct Check {

    pub verdict: Verdict,

    pub title: String,

    pub detail: String,

}

impl Check {

    pub fn glyph(&self) -> &'static str {

        match self.verdict {

            Verdict::Pass => "✔",

            Verdict::Warn => "!",

            Verdict::Fail => "✘",

        }

    }

    pub fn class(&self) -> &'static str {

        match self.verdict {

            Verdict::Pass => "pass",

            Verdict::Warn => "warn",

            Verdict::Fail => "fail",

        }

    }

}

#[derive(Clone, Debug, Serialize)]

pub struct ReleaseTrust {

    pub repository: String,

    pub tag: String,

    pub title: String,

    pub release_url: String,

    pub heads: Vec<String>,

    pub tag_signer: Option<KeyInfo>,

    /// `valid`, `unsigned`, `invalid: …` or `revoked`.

    pub tag_signature: String,

    /// The previous release, which bounds the changes counted.

    pub since: Option<String>,

    pub changes: usize,

    pub authors: Vec<AuthorTrust>,

    pub assets: Vec<AssetTrust>,

    pub audit: Vec<Check>,

    pub generated_ms: i64,

}

impl ReleaseTrust {

    pub fn verdict_class(&self) -> &'static str {

        match self.verdict() {

            Verdict::Pass => "pass",

            Verdict::Warn => "warn",

            Verdict::Fail => "fail",

        }

    }

    pub fn verdict(&self) -> Verdict {

        if self.audit.iter().any(|c| c.verdict == Verdict::Fail) {

            Verdict::Fail

        } else if self.audit.iter().any(|c| c.verdict == Verdict::Warn) {

            Verdict::Warn

        } else {

            Verdict::Pass

        }

    }

}

/// What the repository says about the release: read in one go.

struct RepoFacts {

    heads: Vec<ChangeHash>,

    tag_signer: Option<KeyInfo>,

    tag_signature: String,

    authors: Vec<AuthorTrust>,

    changes: usize,

    /// Kept receipts by attestation: (runner, problem, revoked, signed hex).

    receipts: HashMap<String, (KeyInfo, Option<String>, bool, String)>,

}

fn key_info(r: &oxy_core::repo::Repo, key: &ObjectRef) -> KeyInfo {

    match r.store().get_identity(key) {

        Ok(i) => KeyInfo { key: key.to_hex(), name: i.name, email: i.email, account: None },

        Err(_) => KeyInfo { key: key.to_hex(), ..Default::default() },

    }

}

/// An asset's build: the matching artifact's job, with its run and job rows.

type Build = (fdb::Provenance, Option<fdb::Run>, Option<fdb::Job>);

/// Build the report for release `tag`, or `None` when there is no such

/// release or its tag is gone.

pub async fn report(app: &Shared, repo: &RepoName, row: &db::repos::RepoRow, tag: &str) -> Result<Option<ReleaseTrust>, String> {

    let releases = rdb::list(&app.db, row.id).await.map_err(|e| e.to_string())?;

    let Some(rel) = releases.iter().find(|r| r.tag == tag).cloned() else { return Ok(None) };

    // The previous release: the next older one in the list (newest first).

    let since = releases.iter().skip_while(|r| r.id != rel.id).nth(1).map(|r| r.tag.clone());

    let assets = rdb::assets(&app.db, rel.id).await.map_err(|e| e.to_string())?;

    let mut builds: Vec<Option<Build>> = Vec::new();

    for a in &assets {

        match fdb::provenance(&app.db, row.id, &a.hash).await.map_err(|e| e.to_string())? {

            Some(p) => {

                let run = fdb::run(&app.db, row.id, p.run_number).await.map_err(|e| e.to_string())?;

                let job = match &run {

                    Some(r) => fdb::jobs(&app.db, r.id).await.map_err(|e| e.to_string())?.into_iter().find(|j| j.name == p.job),

                    None => None,

                };

                builds.push(Some((p, run, job)));

            }

            None => builds.push(None),

        }

    }

    let attests: Vec<String> = builds.iter().flatten().map(|(p, _, _)| p.receipt_attest.clone()).filter(|a| !a.is_empty()).collect();

    let (tag_s, since_s) = (tag.to_string(), since.clone());

    let facts = app

        .repos

        .read(repo, move |r, cache| {

            let Some(heads) = r.tag_heads(&tag_s)? else { return Ok(None) };

            // The tag's attestation and whether its signature verifies.

            let (tag_signer, tag_signature) = match r.tag_attest(&tag_s)? {

                Some((ar, sa)) => match sa.sigs.first() {

                    Some(sig) => {

                        let who = key_info(r, &sig.key);

                        let verdict = match r.store().get_identity(&sig.key) {

                            Ok(id) => match verify(&id, sig, Domain::Attest, &ar) {

                                Ok(()) if r.is_revoked(&sig.key)? => "revoked".to_string(),

                                Ok(()) => "valid".to_string(),

                                Err(e) => format!("invalid: {e}"),

                            },

                            Err(_) => "invalid: the signer's identity is missing".to_string(),

                        };

                        (Some(who), verdict)

                    }

                    None => (None, "unsigned".to_string()),

                },

                None => (None, "unsigned".to_string()),

            };

            // The changes the release adds over the previous one, by author.

            let now = cache.load(r, &heads)?;

            let before = match &since_s {

                Some(p) => r.tag_heads(p)?.unwrap_or_default(),

                None => vec![],

            };

            let then = cache.load(r, &before)?;

            let mut by_author: BTreeMap<String, AuthorTrust> = BTreeMap::new();

            let mut changes = 0;

            for (h, meta) in now.state.changes() {

                if then.state.contains(h) {

                    continue;

                }

                changes += 1;

                let a = by_author

                    .entry(meta.author.to_hex())

                    .or_insert_with(|| AuthorTrust { who: key_info(r, &meta.author), ..Default::default() });

                if meta.author.is_zero() {

                    a.who.name = "(no author: imported or made before an identity)".into();

                }

                a.changes += 1;

                match r.authenticate_change(h)? {

                    SignatureStatus::Valid { revoked: true, .. } => a.revoked += 1,

                    SignatureStatus::Valid { sealed: true, .. } => a.sealed += 1,

                    SignatureStatus::Valid { .. } => a.signed += 1,

                    SignatureStatus::Unsigned => a.unsigned += 1,

                    SignatureStatus::Invalid(_) => a.invalid += 1,

                }

            }

            let mut authors: Vec<AuthorTrust> = by_author.into_values().collect();

            authors.sort_by(|a, b| b.changes.cmp(&a.changes).then(a.who.name.cmp(&b.who.name)));

            // Kept receipts, verified again from the store.

            let mut receipts = HashMap::new();

            for a in &attests {

                let Some(ar) = ObjectRef::from_hex(a) else { continue };

                if let Ok(i) = r.receipt(&ar) {

                    let runner = KeyInfo {

                        key: i.signed.runner.hash().to_hex(),

                        name: i.signed.runner.name.clone(),

                        email: i.signed.runner.email.clone(),

                        account: None,

                    };

                    receipts.insert(a.clone(), (runner, i.problem.clone(), i.revoked, hex::encode(i.signed.encode())));

                }

            }

            Ok(Some(RepoFacts { heads, tag_signer, tag_signature, authors, changes, receipts }))

        })

        .await

        .map_err(|e| e.to_string())?;

    let Some(mut facts) = facts else { return Ok(None) };

    // Link keys to accounts.

    let links: HashMap<String, String> = db::accounts::identity_accounts(&app.db).await.unwrap_or_default().into_iter().collect();

    if let Some(s) = facts.tag_signer.as_mut() {

        s.account = links.get(&s.key).cloned();

    }

    for a in &mut facts.authors {

        a.who.account = links.get(&a.who.key).cloned();

    }

    let known_runner_keys: Vec<String> =

        sqlx::query_scalar("SELECT key FROM flow_runner_keys").fetch_all(&app.db).await.unwrap_or_default();

    let base = format!("{}/{}", app.config.base_url(), row.slug());

    let mut tag_heads: Vec<String> = facts.heads.iter().map(|h| h.to_hex()).collect();

    tag_heads.sort();

    let tag_state = tag_heads.join("+");

    let mut asset_rows = Vec::new();

    for (a, b) in assets.iter().zip(builds) {

        let build = b.map(|(p, run, job)| {

            let receipt_json: serde_json::Value =

                job.as_ref().and_then(|j| serde_json::from_str(&j.receipt).ok()).unwrap_or(serde_json::Value::Null);

            let sandbox: serde_json::Value =

                job.as_ref().and_then(|j| serde_json::from_str(&j.sandbox).ok()).unwrap_or(serde_json::Value::Null);

            let heads = run.as_ref().map(|r| r.heads.clone()).unwrap_or_default();

            let kept = facts.receipts.get(&p.receipt_attest).cloned();

            let s = |v: &serde_json::Value| v.as_str().unwrap_or("").to_string();

            BuildTrust {

                run: p.run_number,

                job: p.job.clone(),

                run_url: format!("{base}/flow/{}", p.run_number),

                same_state_as_tag: heads == tag_state,

                heads,

                pipeline_hash: s(&receipt_json["pipeline_hash"]),

                scope_tree_hash: s(&receipt_json["scope_tree_hash"]),

                environment: s(&receipt_json["environment"]),

                rootfs: s(&sandbox["rootfs"]),

                runtime: s(&sandbox["runtime"]),

                exit_code: job.as_ref().and_then(|j| j.exit_code),

                runner_known: kept.as_ref().is_some_and(|(k, ..)| known_runner_keys.contains(&k.key)),

                runner: kept.as_ref().map(|(k, ..)| k.clone()),

                receipt: kept.as_ref().map(|_| p.receipt_attest.clone()),

                receipt_url: kept.as_ref().map(|_| format!("{base}/receipts/{}", p.receipt_attest)),

                receipt_problem: kept.as_ref().and_then(|(_, pr, ..)| pr.clone()),

                runner_revoked: kept.as_ref().is_some_and(|(_, _, rv, _)| *rv),

                signed_receipt: kept.map(|(.., hex)| hex),

            }

        });

        asset_rows.push(AssetTrust {

            name: a.name.clone(),

            size: a.size,

            blake3: a.hash.clone(),

            url: format!("{base}/asset/{}/{}", a.id, a.name),

            build,

        });

    }

    let mut t = ReleaseTrust {

        repository: row.slug(),

        tag: tag.to_string(),

        title: rel.title.clone(),

        release_url: format!("{base}/releases/tag/{tag}"),

        heads: tag_heads,

        tag_signer: facts.tag_signer,

        tag_signature: facts.tag_signature,

        since,

        changes: facts.changes,

        authors: facts.authors,

        assets: asset_rows,

        audit: vec![],

        generated_ms: db::now_ms(),

    };

    t.audit = audit(&t);

    Ok(Some(t))

}

/// The audit: every claim the report makes, judged.

pub fn audit(t: &ReleaseTrust) -> Vec<Check> {

    let mut out = Vec::new();

    let check = |verdict, title: String, detail: String| Check { verdict, title, detail };

    let signer = t.tag_signer.as_ref().map(|k| if k.name.is_empty() { k.key[..12].to_string() } else { k.name.clone() });

    out.push(match t.tag_signature.as_str() {

        "valid" => check(Verdict::Pass, format!("Tag {} is signed", t.tag), format!("by {}", signer.unwrap_or_default())),

        "unsigned" => check(

            Verdict::Warn,

            format!("Tag {} is not signed", t.tag),

            "Create tags with a key (`oxy identity create`) so they carry a signed attestation.".into(),

        ),

        "revoked" => check(Verdict::Fail, format!("Tag {} is signed by a revoked key", t.tag), signer.unwrap_or_default()),

        other => check(Verdict::Fail, format!("Tag {}'s signature does not verify", t.tag), other.to_string()),

    });

    let sum = |f: fn(&AuthorTrust) -> usize| t.authors.iter().map(f).sum::<usize>();

    let (unsigned, invalid, revoked) = (sum(|a| a.unsigned), sum(|a| a.invalid), sum(|a| a.revoked));

    let scope = match &t.since {

        Some(p) => format!("since {p}"),

        None => "in the release".to_string(),

    };

    out.push(if invalid > 0 || revoked > 0 {

        check(

            Verdict::Fail,

            format!("{} of {} changes {scope} fail authentication", invalid + revoked, t.changes),

            format!("{invalid} with an invalid signature, {revoked} by revoked keys"),

        )

    } else if unsigned > 0 {

        check(

            Verdict::Warn,

            format!("{unsigned} of {} changes {scope} are unsigned", t.changes),

            "Changes are authenticated when their author signs or seals them on push (Oxygen spec §14.4).".into(),

        )

    } else {

        let what = match t.changes {

            1 => format!("The one change {scope} is authenticated"),

            n => format!("All {n} changes {scope} are authenticated"),

        };

        let by = match t.authors.len() {

            1 => "by one author".to_string(),

            n => format!("by {n} authors"),

        };

        check(Verdict::Pass, what, by)

    });

    if t.assets.is_empty() {

        out.push(check(Verdict::Warn, "The release has no assets".into(), "Nothing to trace to a build.".into()));

    }

    for a in &t.assets {

        match &a.build {

            None => out.push(check(

                Verdict::Warn,

                format!("{}: no build found", a.name),

                "No passed OxygenFlow job of this repository produced these bytes; it was uploaded by hand.".into(),

            )),

            Some(b) => {

                out.push(match (&b.receipt, &b.receipt_problem, b.runner_revoked, b.runner_known) {

                    (None, ..) => check(

                        Verdict::Warn,

                        format!("{}: built by run #{} {}, without a signed receipt", a.name, b.run, b.job),

                        "The runner did not sign its receipt, or the hub did not keep it.".into(),

                    ),

                    (Some(_), Some(p), ..) => check(Verdict::Fail, format!("{}: the signed receipt does not verify", a.name), p.clone()),

                    (Some(_), None, true, _) => {

                        check(Verdict::Fail, format!("{}: the receipt's runner key was revoked", a.name), String::new())

                    }

                    (Some(_), None, false, known) => check(

                        if known { Verdict::Pass } else { Verdict::Warn },

                        format!("{}: signed receipt from run #{} {}", a.name, b.run, b.job),

                        format!(

                            "signed by {}{}",

                            b.runner.as_ref().map(|k| k.name.as_str()).unwrap_or(""),

                            if known { ", a runner key of this hub" } else { "; that key is not one this hub's runners use" }

                        ),

                    ),

                });

                out.push(if b.same_state_as_tag {

                    check(

                        Verdict::Pass,

                        format!("{}: built from the tagged state", a.name),

                        t.heads.iter().map(|h| &h[..12]).collect::<Vec<_>>().join("+"),

                    )

                } else {

                    check(

                        Verdict::Warn,

                        format!("{}: built from another state than the tag's", a.name),

                        format!("run #{} built {}", b.run, b.heads.split('+').map(|h| &h[..12.min(h.len())]).collect::<Vec<_>>().join("+")),

                    )

                });

                let pinned = b.rootfs.len() == 64 && b.rootfs.bytes().all(|c| c.is_ascii_hexdigit()) && !b.environment.is_empty();

                out.push(if pinned {

                    check(Verdict::Pass, format!("{}: pinned environment", a.name), format!("{} rootfs {}", b.runtime, &b.rootfs[..12]))

                } else {

                    check(Verdict::Warn, format!("{}: environment not pinned by hash", a.name), b.rootfs.clone())

                });

            }

        }

    }

    out

}

/// The report as a graph: authors, the tagged state, the builds and the

/// assets, in four columns, as inline SVG.

pub fn graph(t: &ReleaseTrust) -> String {

    const W: f64 = 180.0;

    const H: f64 = 34.0;

    const GAP: f64 = 12.0;

    const COL: f64 = 230.0;

    let esc = crate::render::escape;

    let mut nodes: Vec<(f64, f64, String, String, &str)> = Vec::new();

    let mut edges: Vec<(usize, usize, bool)> = Vec::new();

    let y = |i: usize| 10.0 + i as f64 * (H + GAP);

    let authors: Vec<usize> = t

        .authors

        .iter()

        .take(12)

        .enumerate()

        .map(|(i, a)| {

            let name = if a.who.name.is_empty() { a.who.key[..12].to_string() } else { a.who.name.clone() };

            let ok = a.invalid + a.revoked == 0 && a.unsigned == 0;

            nodes.push((

                0.0,

                y(i),

                name,

                format!("{} changes", a.changes),

                if ok {

                    "pass"

                } else if a.invalid + a.revoked > 0 {

                    "fail"

                } else {

                    "warn"

                },

            ));

            nodes.len() - 1

        })

        .collect();

    let tag_class = match t.tag_signature.as_str() {

        "valid" => "pass",

        "unsigned" => "warn",

        _ => "fail",

    };

    nodes.push((COL, y(0), format!("tag {}", t.tag), format!("{} change{}", t.changes, if t.changes == 1 { "" } else { "s" }), tag_class));

    let tag = nodes.len() - 1;

    for a in authors {

        edges.push((a, tag, true));

    }

    let mut builds: HashMap<(i64, String), usize> = HashMap::new();

    for (i, a) in t.assets.iter().enumerate() {

        let build = a.build.as_ref().map(|b| {

            *builds.entry((b.run, b.job.clone())).or_insert_with(|| {

                let class = match (&b.receipt, &b.receipt_problem) {

                    (Some(_), None) => "pass",

                    (Some(_), Some(_)) => "fail",

                    _ => "warn",

                };

                let row = nodes.iter().filter(|n| n.0 == 2.0 * COL).count();

                nodes.push((

                    2.0 * COL,

                    y(row),

                    format!("run #{} {}", b.run, b.job),

                    b.runner.as_ref().map(|r| r.name.clone()).unwrap_or_else(|| "unsigned".into()),

                    class,

                ));

                edges.push((tag, nodes.len() - 1, b.same_state_as_tag));

                nodes.len() - 1

            })

        });

        let class = if a.build.is_some() { "pass" } else { "warn" };

        nodes.push((3.0 * COL, y(i), a.name.clone(), crate::render::bytes(a.size as u64), class));

        if let Some(b) = build {

            edges.push((b, nodes.len() - 1, true));

        }

    }

    let rows = nodes.iter().map(|n| n.1).fold(0.0, f64::max) + H + 10.0;

    let mut svg =

        format!(r#"<svg class="trust-graph" viewBox="0 0 {} {rows}" role="img" aria-label="Release trust graph">"#, 3.0 * COL + W + 2.0);

    for (a, b, solid) in &edges {

        let (x1, y1) = (nodes[*a].0 + W, nodes[*a].1 + H / 2.0);

        let (x2, y2) = (nodes[*b].0, nodes[*b].1 + H / 2.0);

        let mx = (x1 + x2) / 2.0;

        svg.push_str(&format!(

            r#"<path class="edge{}" d="M{x1},{y1} C{mx},{y1} {mx},{y2} {x2},{y2}"/>"#,

            if *solid { "" } else { " dashed" }

        ));

    }

    for (x, y, title, sub, class) in &nodes {

        svg.push_str(&format!(

            r#"<g class="node {class}"><rect x="{x}" y="{y}" width="{W}" height="{H}" rx="4"/><text x="{}" y="{}" class="t">{}</text><text x="{}" y="{}" class="s">{}</text></g>"#,

            x + 8.0,

            y + 14.0,

            esc(&truncate(title, 26)),

            x + 8.0,

            y + 27.0,

            esc(&truncate(sub, 30)),

        ));

    }

    svg.push_str("</svg>");

    svg

}

fn truncate(s: &str, n: usize) -> String {

    if s.chars().count() <= n {

        s.to_string()

    } else {

        format!("{}…", s.chars().take(n - 1).collect::<String>())

    }

}

#[derive(Template)]

#[template(path = "release_trust.html")]

pub struct ReleaseTrustPage {

    shell: Shell,

    repo: RepoShell,

    t: ReleaseTrust,

    graph: String,

}

#[derive(Deserialize, Default)]

pub struct TrustQuery {

    #[serde(default)]

    format: Option<String>,

}

/// `GET /{owner}/{name}/releases/trust/{*tag}`: the page, or with

/// `?format=json` the report as a download.

pub async fn page(

    State(app): State<Shared>,

    viewer: Viewer,

    Path((owner, name, tag)): Path<(String, String, String)>,

    Query(q): Query<TrustQuery>,

) -> Result<Response, Error> {

    let shell = Shell::new(&app, &format!("/{owner}/{name}/releases/trust/{tag}"), &viewer);

    let (repo, row, role) = lookup(&app, &shell, &viewer, &owner, &name).await?;

    let t =

        report(&app, &repo, &row, &tag).await.map_err(|m| Error::bad(shell.clone(), m))?.ok_or_else(|| Error::not_found(shell.clone()))?;

    if q.format.as_deref() == Some("json") {

        let file: String = tag.chars().map(|c| if c.is_ascii_alphanumeric() || matches!(c, '.' | '-' | '_') { c } else { '-' }).collect();

        return Ok((

            [

                (axum::http::header::CONTENT_TYPE, "application/json".to_string()),

                (axum::http::header::CONTENT_DISPOSITION, format!("attachment; filename=\"{}-{file}-trust.json\"", row.name)),

            ],

            serde_json::to_string_pretty(&t).unwrap_or_default(),

        )

            .into_response());

    }

    let graph = graph(&t);

    Ok(Page(ReleaseTrustPage { shell, repo: RepoShell::new(&app, &row, "releases").with_role(role), t, graph }).into_response())

}

{% extends "base.html" %}

{% import "repo_tabs.html" as m %}

{% block title %}Trust · {{ t.tag }} · {{ repo.owner }}/{{ repo.name }}{% endblock %}

{% block bodyattrs %} data-repo="{{ repo.url }}"{% endblock %}

{% block tabs %}{% call m::tabs(repo, "releases") %}{% endblock %}

{% block mainclass %} class="wide"{% endblock %}

{% block content %}

<div class="head"><h1>Trust <small>release <a href="{{ repo.url }}/releases/tag/{{ t.tag }}">{{ t.tag }}</a>{% if !t.title.is_empty() %} · {{ t.title }}{% endif %}</small></h1>

<a class="go small" href="?format=json" download>Export JSON</a></div>

<p class="small mute">Who wrote what this release holds, how it is authenticated, what built each asset and from what, with every claim audited below.{% if let Some(p) = t.since %} Changes are counted since the previous release, {{ p }}.{% endif %} The export carries the signed receipts: check each with <code>oxy receipt verify</code>.</p>

<section class="panel audit audit-{{ t.verdict_class() }}">

  <h2>Audit <span class="small mute">{{ t.audit.len()|plural("check", "checks") }}</span></h2>

  <ul class="plain checks">{% for c in t.audit %}<li class="{{ c.class() }}"><span class="glyph">{{ c.glyph() }}</span> <strong>{{ c.title }}</strong>{% if !c.detail.is_empty() %} <span class="small mute">{{ c.detail }}</span>{% endif %}</li>{% endfor %}</ul>

</section>

<section class="panel">

  <h2>Graph</h2>

  <p class="small mute">Authors → the tagged state → the jobs that built the assets → the assets. A dashed line is a build from another state than the tag's.</p>

  <div class="trust-graph-wrap">{{ graph|safe }}</div>

</section>

<section class="panel">

  <h2>Tag <span class="lbl lbl-tag">{{ t.tag }}</span></h2>

  <dl class="facts">

    <dt>Signature</dt><dd>{% if t.tag_signature == "valid" %}<span class="sig sig-valid">✔</span> valid{% else if t.tag_signature == "unsigned" %}<span class="sig sig-unsigned">○</span> unsigned{% else %}<span class="sig sig-invalid">✘</span> {{ t.tag_signature }}{% endif %}{% if let Some(k) = t.tag_signer %} · {% if let Some(a) = k.account %}<a href="/{{ a }}">{{ k.name }}</a>{% else %}{{ k.name }}{% endif %} <code title="{{ k.key }}">{{ k.key|short }}</code>{% endif %}</dd>

    <dt>State</dt><dd>{% for h in t.heads %}<a class="chip" href="{{ repo.url }}/change/{{ h }}">{{ h|short }}</a> {% endfor %}</dd>

  </dl>

</section>

<section class="panel">

  <h2>Authors <span class="small mute">{{ t.changes|plural("change", "changes") }}</span></h2>

  <div class="table"><table>

  <tr><th>Author</th><th>Key</th><th>Changes</th><th>Signed</th><th>Sealed</th><th>Unsigned</th><th>Problems</th></tr>

  {% for a in t.authors %}<tr><td>{% if let Some(acc) = a.who.account %}<a href="/{{ acc }}">{{ a.who.name }}</a>{% else %}{{ a.who.name }}{% endif %}</td><td><code title="{{ a.who.key }}">{{ a.who.key|short }}</code></td><td>{{ a.changes }}</td><td>{{ a.signed }}</td><td>{{ a.sealed }}</td><td>{% if a.unsigned > 0 %}<span class="warn">{{ a.unsigned }}</span>{% else %}0{% endif %}</td><td>{% if a.invalid + a.revoked > 0 %}<span class="bad">{{ a.invalid }} invalid, {{ a.revoked }} revoked</span>{% else %}none{% endif %}</td></tr>{% endfor %}

  </table></div>

</section>

<section class="panel">

  <h2>Assets</h2>

  {% if t.assets.is_empty() %}<p class="mute">This release has no assets.</p>{% endif %}

  {% for a in t.assets %}

  <h3><a href="{{ a.url }}">{{ a.name }}</a> <span class="small mute">{{ a.size|bytes }} · blake3 <code title="{{ a.blake3 }}">{{ a.blake3|short }}</code></span></h3>

  {% if let Some(b) = a.build %}

  <dl class="facts">

    <dt>Built by</dt><dd><a href="{{ b.run_url }}">run #{{ b.run }}</a> job <strong>{{ b.job }}</strong>{% if let Some(c) = b.exit_code %}, exit {{ c }}{% endif %}</dd>

    <dt>Runner</dt><dd>{% if let Some(r) = b.runner %}{{ r.name }} <code title="{{ r.key }}">{{ r.key|short }}</code>{% if b.runner_known %} <span class="tag">runner key of this hub</span>{% endif %}{% if b.runner_revoked %} <span class="tag bad">revoked</span>{% endif %}{% else %}<span class="mute">no signed receipt</span>{% endif %}</dd>

    <dt>Receipt</dt><dd>{% if let Some(u) = b.receipt_url %}<a href="{{ u }}">signed receipt</a>{% if let Some(p) = b.receipt_problem %} <span class="bad">{{ p }}</span>{% else %} <span class="sig sig-valid">✔</span> verifies{% endif %}{% else %}<span class="mute">none kept</span>{% endif %}</dd>

    <dt>Environment</dt><dd>{{ b.runtime }} · rootfs <code title="{{ b.rootfs }}">{{ b.rootfs|short }}</code> · environment <code title="{{ b.environment }}">{{ b.environment|short }}</code></dd>

    <dt>Inputs</dt><dd>state {% for h in b.heads.split('+') %}<a class="chip" href="{{ repo.url }}/change/{{ h }}">{{ h|short }}</a> {% endfor %}{% if b.same_state_as_tag %}<span class="tag">the tagged state</span>{% else %}<span class="tag warn">not the tagged state</span>{% endif %} · pipeline <code title="{{ b.pipeline_hash }}">{{ b.pipeline_hash|short }}</code> · scope <code title="{{ b.scope_tree_hash }}">{{ b.scope_tree_hash|short }}</code></dd>

  </dl>

  {% else %}

  <p class="small warn">No passed OxygenFlow job of this repository produced these bytes: uploaded by hand.</p>

  {% endif %}

  {% endfor %}

</section>

{% endblock %}

        .route("/repos/{owner}/{name}/releases/trust/{*tag}", get(release_trust))

}

/// `GET /repos/{o}/{n}/releases/trust/{tag}`: a release's trust report

/// (hub spec §9.1), as the page's JSON export.

async fn release_trust(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path((owner, name, tag)): Path<(String, String, String)>,

) -> Result<Json<crate::web::release_trust::ReleaseTrust>, ApiError> {

    let c = caller(&app, &headers).await?;

    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;

    match crate::web::release_trust::report(&app, &repo, &row, &tag).await.map_err(|m| ApiError(StatusCode::INTERNAL_SERVER_ERROR, m))? {

        Some(t) => Ok(Json(t)),

        None => Err(ApiError(StatusCode::NOT_FOUND, format!("no release {tag}"))),

    }

pub mod release_trust;

        .route("/{owner}/{name}/releases/trust/{*tag}", get(release_trust::page))

/// A release's trust report (hub spec §9.1): a signed tag, an asset built

/// by a job with a signed receipt from the tagged state, and one uploaded

/// by hand; the page, its JSON export and the API.

#[tokio::test(flavor = "multi_thread")]

async fn a_release_is_audited_from_authors_to_receipts() {

    use oxy_core::hash::{hash_object, ChangeHash, ObjectType};

    use oxy_core::identity::SecretKey;

    use oxy_core::objects::StateObject;

    use oxy_core::receipt::SignedReceipt;

    let h = hub().await;

    create(&h.app, "andy", "demo").await;

    let url = format!("{}/andy/demo", h.base);

    let work = tempfile::tempdir().unwrap();

    let mut c = client(&url, work.path());

    c.create_identity("Andy", "[email protected]", oxy_core::repo::IdentityScope::Repo).unwrap();

    write(

        work.path(),

        ".flow/pipeline.kdl",

        &format!(

            "schema-version 1\nsandbox \"alpine\" {{\n    rootfs \"cas://blob/{ROOTFS}\"\n}}\njob \"build\" {{\n    sandbox \"alpine\"\n    exec \"make\"\n    output {{\n        artifact \"tool\" {{\n            path \"/src/out/tool\"\n        }}\n    }}\n}}\n"

        ),

    );

    c.snapshot("test").unwrap();

    c.commit("Build a tool", &[]).unwrap();

    let heads = c.bookmark_heads().unwrap();

    c.tag_create("v1", &heads, "first").unwrap();

    assert!(c.push("origin", false).unwrap().iter().all(|r| r.ok));

    // The runner builds, uploads the artifact and signs its receipt.

    let run = runs_of(&h.app, "andy", "demo").await.remove(0);

    let a = claim(&h.app).await.unwrap();

    let id = a["job_id"].as_i64().unwrap();

    let body: Vec<u8> = b"#!/bin/sh\necho tool\n".to_vec();

    let (_, text) = upload(&h.app, id, "tool", &body).await;

    let blob = serde_json::from_str::<serde_json::Value>(&text).unwrap()["blob"].as_str().unwrap().to_string();

    let mut r = receipt("build", a["pipeline_hash"].as_str().unwrap(), 0);

    r["outputs"] = serde_json::json!([blob]);

    let heads_run: Vec<ChangeHash> = run.head_list().into_iter().filter_map(ChangeHash::from_hex).collect();

    let state = hash_object(ObjectType::State, &StateObject::new(heads_run).encode());

    let repo_id = h.app.repos.open(&RepoName::parse("andy/demo").unwrap()).unwrap().id().unwrap();

    let sk = SecretKey::generate();

    let runner = sk.identity("test-1 (OxygenFlow runner)", "", 1);

    let fr: flow_core::Receipt = serde_json::from_value(r.clone()).unwrap();

    let signed = hex::encode(SignedReceipt::sign(fr.to_oxy(), repo_id, state, &format!("{url}/flow/1"), &runner, &sk).encode());

    let done = serde_json::json!({ "exit_code": 0, "duration_ms": 900, "receipt": r, "signed_receipt": signed });

    assert_eq!(finish(&h.app, id, done).await, StatusCode::NO_CONTENT);

    // A release with the built asset and a file uploaded by hand.

    let row = db::repos::get(&h.app.db, "andy", "demo").await.unwrap().unwrap();

    let rel = db::releases::create(&h.app.db, row.id, "v1", "One", "", false, None).await.unwrap();

    oxygenhub::web::releases::store_asset(&h.app, rel.id, "tool", "", &body).await.unwrap();

    oxygenhub::web::releases::store_asset(&h.app, rel.id, "notes.txt", "", b"by hand\n").await.unwrap();

    let (st, page) = call(&h.app, "GET", "/andy/demo/releases/trust/v1", None, None).await;

    assert_eq!(st, StatusCode::OK);

    for want in [

        "Tag v1 is signed",

        "The one change in the release is authenticated",

        "tool: signed receipt from run #1 build",

        "a runner key of this hub",

        "tool: built from the tagged state",

        "tool: pinned environment",

        "notes.txt: no build found",

        "<svg class=\"trust-graph\"",

    ] {

        assert!(page.contains(want), "missing {want:?}");

    }

    let (_, releases) = call(&h.app, "GET", "/andy/demo/releases", None, None).await;

    assert!(releases.contains("/andy/demo/releases/trust/v1"), "the release links its audit");

    // The export carries the signed receipt, which checks on its own.

    let (st, json) = call(&h.app, "GET", "/andy/demo/releases/trust/v1?format=json", None, None).await;

    assert_eq!(st, StatusCode::OK);

    let t: serde_json::Value = serde_json::from_str(&json).unwrap();

    assert_eq!((t["tag"].as_str(), t["tag_signature"].as_str(), t["changes"].as_i64()), (Some("v1"), Some("valid"), Some(1)));

    assert_eq!(t["authors"][0]["who"]["name"], "Andy");

    let tool = t["assets"].as_array().unwrap().iter().find(|a| a["name"] == "tool").unwrap();

    let hex_receipt = tool["build"]["signed_receipt"].as_str().unwrap();

    let sr = SignedReceipt::decode(&hex::decode(hex_receipt).unwrap()).unwrap();

    sr.verify().unwrap();

    assert_eq!(sr.receipt.outputs[0].to_hex(), blob);

    let audit = t["audit"].as_array().unwrap();

    assert!(audit.iter().any(|c| c["verdict"] == "warn" && c["title"].as_str().unwrap().starts_with("notes.txt")));

    assert!(!audit.iter().any(|c| c["verdict"] == "fail"), "{audit:?}");

    // The API gives the same report; an unknown release is a 404.

    let (st, api) = call(&h.app, "GET", "/api/v1/repos/andy/demo/releases/trust/v1", None, None).await;

    assert_eq!(st, StatusCode::OK);

    assert_eq!(serde_json::from_str::<serde_json::Value>(&api).unwrap()["assets"].as_array().unwrap().len(), 2);

    assert_eq!(call(&h.app, "GET", "/api/v1/repos/andy/demo/releases/trust/v9", None, None).await.0, StatusCode::NOT_FOUND);

    assert_eq!(call(&h.app, "GET", "/andy/demo/releases/trust/v9", None, None).await.0, StatusCode::NOT_FOUND);

}

**Trust and audit** (§9.1). `/{owner}/{name}/releases/trust/{tag}` reports on a release; each release on the releases page links it.

- **Tag:** the tag's signer and whether its attestation verifies.

- **Authors:** everyone whose changes the release adds since the previous release (all of its changes for the first release). For each: how many changes are signed, sealed, unsigned, invalid or signed by revoked keys, and the account their key is linked to.

- **Assets:** for each asset, what built it: the run and job, the runner's identity (and whether it is a key one of this hub's runner tokens signs with), and the pinned environment (tier, rootfs hash, environment hash). Also its inputs (the state built, the pipeline hash and the scope hash) and its signed receipt, verified again from the repository.

- **Graph:** authors → tagged state → jobs → assets, drawn as SVG. A dashed edge is a build from another state than the tag's.

- **Audit:** pass, warn or fail for each claim:

  - the tag is signed;

  - the changes are authenticated;

  - each asset has a verifying signed receipt from a known runner;

  - each asset was built from the tagged state;

  - each asset's environment is pinned by hash.

  A hand-uploaded asset, an unsigned tag or an unsigned change is a warning. A signature or receipt that does not verify, or a revoked key, is a failure.

- **Export:** `?format=json` downloads the report, and `GET /api/v1/repos/{owner}/{name}/releases/trust/{tag}` returns the same. The JSON carries each signed receipt as hex, so an auditor can check it offline with `oxy receipt verify`.

    <a class="small" href="{{ repo.url }}/releases/trust/{{ v.r.tag }}" title="Authors, signatures, builds and receipts, audited">Trust and audit</a>

/* Release trust (hub spec §9.1) */

.audit ul.checks li { padding: 3px 0; }

.audit ul.checks li .glyph { display: inline-block; width: 1.2em; text-align: center; font-weight: 700; }

.audit ul.checks li.pass .glyph { color: var(--ok); }

.audit ul.checks li.warn .glyph { color: var(--warn); }

.audit ul.checks li.fail .glyph { color: var(--bad); }

.audit-fail { border-left: 3px solid var(--bad); }

.audit-warn { border-left: 3px solid var(--warn); }

.audit-pass { border-left: 3px solid var(--ok); }

.trust-graph-wrap { overflow-x: auto; }

svg.trust-graph { min-width: 720px; width: 100%; height: auto; }

svg.trust-graph .edge { fill: none; stroke: var(--line); stroke-width: 1.5; }

svg.trust-graph .edge.dashed { stroke-dasharray: 5 4; stroke: var(--warn); }

svg.trust-graph .node rect { fill: var(--panel); stroke: var(--line); }

svg.trust-graph .node.pass rect { stroke: var(--ok); }

svg.trust-graph .node.warn rect { stroke: var(--warn); }

svg.trust-graph .node.fail rect { stroke: var(--bad); }

svg.trust-graph text { font-size: 11px; fill: var(--ink); }

svg.trust-graph text.s { font-size: 10px; fill: var(--mute); }