provenance.rs 100.0%

49 of 49 lines run, 6 of 12 functions · run #537 on main · run missed

//! Provenance others can verify (oxygenhub#239): a Flow artifact's in-toto
//! Statement with an SLSA provenance v1 predicate, in a DSSE envelope signed
//! with the hub's Ed25519 key, as `cosign verify-blob-attestation` and other
//! in-toto and SLSA verifiers read it. The runner signed the job's receipt
//! with a key the hub holds no secret of; the hub checked that receipt when
//! it kept it, and this envelope is the hub's statement of what the receipt
//! says, in the shape the wider tools understand. `/.well-known/oxyhub-signing.pem`
//! is the public key, as cosign's `--key` takes it.

use crate::Shared;
pub use oxy_core::dsse::pae;

/// DSSE's payload type for in-toto statements.
pub const PAYLOAD_TYPE: &str = oxy_core::dsse::IN_TOTO;

/// What SLSA calls the build type of a Flow job: one URI wherever the job
/// ran, the same `oxy receipt export --format slsa` writes.
pub const BUILD_TYPE: &str = "https://oxygenhub.io/oxygenflow/job/v1";

/// What the statement says of one artifact.
pub struct Subject<'a> {
    /// The artifact's file name.
    pub name: &'a str,
    pub bytes: &'a [u8],
    /// `owner/name` and the hub's URL of the run.
    pub repo: &'a str,
    pub run_url: &'a str,
    pub bookmark: &'a str,
    /// The state the run built, and the heads it is.
    pub state: &'a str,
    pub heads: &'a str,
    pub pipeline_hash: &'a str,
    pub job: &'a str,
    /// The runner that ran it and signed its receipt.
    pub runner: &'a str,
    pub receipt_signer: &'a str,
    pub receipt_attest: &'a str,
    pub started_ms: Option<i64>,
    pub finished_ms: Option<i64>,
}

/// The in-toto Statement v1 with an SLSA provenance v1 predicate.
pub fn statement(base_url: &str, s: &Subject) -> serde_json::Value {
    use sha2::Digest;
    let sha256 = hex::encode(sha2::Sha256::digest(s.bytes));
    let when = |ms: Option<i64>| {
        ms.and_then(|t| time::OffsetDateTime::from_unix_timestamp_nanos(t as i128 * 1_000_000).ok())
            .and_then(|t| t.format(&time::format_description::well_known::Rfc3339).ok())
    };
    let mut metadata = serde_json::json!({ "invocationId": s.run_url });
    if let Some(t) = when(s.started_ms) {
        metadata["startedOn"] = t.into();
    }
    if let Some(t) = when(s.finished_ms) {
        metadata["finishedOn"] = t.into();
    }
    serde_json::json!({
        "_type": "https://in-toto.io/Statement/v1",
        "subject": [{ "name": s.name, "digest": { "sha256": sha256, "blake3": blake3::hash(s.bytes).to_hex().to_string() } }],
        "predicateType": "https://slsa.dev/provenance/v1",
        "predicate": {
            "buildDefinition": {
                "buildType": BUILD_TYPE,
                "externalParameters": {
                    "repository": format!("{base_url}/{}", s.repo),
                    "bookmark": s.bookmark,
                    "job": s.job,
                    "pipeline": s.pipeline_hash,
                },
                "resolvedDependencies": [{
                    "uri": format!("{base_url}/{}", s.repo),
                    "digest": { "oxygen-state": s.state },
                    "annotations": { "heads": s.heads },
                }],
            },
            "runDetails": {
                "builder": {
                    "id": format!("{base_url}/oxygenflow/runner/{}", s.runner),
                },
                "metadata": metadata,
                "byproducts": [{
                    "name": "oxygen-receipt",
                    "digest": { "oxygen-attestation": s.receipt_attest },
                    "annotations": { "signedBy": s.receipt_signer },
                }],
            },
        },
    })
}

/// `statement` in a DSSE envelope signed with the hub's key.
pub fn envelope(app: &Shared, statement: &serde_json::Value) -> anyhow::Result<serde_json::Value> {
    let payload = serde_json::to_vec(statement)?;
    let (key, secret) = crate::keys::load_secret(&app.config.keys_dir())?;
    Ok(serde_json::from_str(&oxy_core::dsse::envelope(PAYLOAD_TYPE, &payload, &key.to_hex(), &secret))?)
}

/// The hub's Ed25519 public key as a PEM SubjectPublicKeyInfo.
pub fn public_pem(app: &Shared) -> String {
    oxy_core::dsse::public_pem(&app.hub_key.identity)
}

1		//! Provenance others can verify (oxygenhub#239): a Flow artifact's in-toto
2		//! Statement with an SLSA provenance v1 predicate, in a DSSE envelope signed
3		//! with the hub's Ed25519 key, as `cosign verify-blob-attestation` and other
4		//! in-toto and SLSA verifiers read it. The runner signed the job's receipt
5		//! with a key the hub holds no secret of; the hub checked that receipt when
6		//! it kept it, and this envelope is the hub's statement of what the receipt
7		//! says, in the shape the wider tools understand. `/.well-known/oxyhub-signing.pem`
8		//! is the public key, as cosign's `--key` takes it.
9
10		use crate::Shared;
11		pub use oxy_core::dsse::pae;
12
13		/// DSSE's payload type for in-toto statements.
14		pub const PAYLOAD_TYPE: &str = oxy_core::dsse::IN_TOTO;
15
16		/// What SLSA calls the build type of a Flow job: one URI wherever the job
17		/// ran, the same `oxy receipt export --format slsa` writes.
18		pub const BUILD_TYPE: &str = "https://oxygenhub.io/oxygenflow/job/v1";
19
20		/// What the statement says of one artifact.
21		pub struct Subject<'a> {
22		/// The artifact's file name.
23		pub name: &'a str,
24		pub bytes: &'a [u8],
25		/// `owner/name` and the hub's URL of the run.
26		pub repo: &'a str,
27		pub run_url: &'a str,
28		pub bookmark: &'a str,
29		/// The state the run built, and the heads it is.
30		pub state: &'a str,
31		pub heads: &'a str,
32		pub pipeline_hash: &'a str,
33		pub job: &'a str,
34		/// The runner that ran it and signed its receipt.
35		pub runner: &'a str,
36		pub receipt_signer: &'a str,
37		pub receipt_attest: &'a str,
38		pub started_ms: Option<i64>,
39		pub finished_ms: Option<i64>,
40		}
41
42		/// The in-toto Statement v1 with an SLSA provenance v1 predicate.
43	1×	pub fn statement(base_url: &str, s: &Subject) -> serde_json::Value {
44		use sha2::Digest;
45	1×	let sha256 = hex::encode(sha2::Sha256::digest(s.bytes));
46	2×	let when = \|ms: Option<i64>\| {
47	2×	ms.and_then(\|t\| time::OffsetDateTime::from_unix_timestamp_nanos(t as i128 * 1_000_000).ok())
48	2×	.and_then(\|t\| t.format(&time::format_description::well_known::Rfc3339).ok())
49	2×	};
50	1×	let mut metadata = serde_json::json!({ "invocationId": s.run_url });
51	1×	if let Some(t) = when(s.started_ms) {
52	1×	metadata["startedOn"] = t.into();
53	1×	}
54	1×	if let Some(t) = when(s.finished_ms) {
55	1×	metadata["finishedOn"] = t.into();
56	1×	}
57	1×	serde_json::json!({
58	1×	"_type": "https://in-toto.io/Statement/v1",
59	1×	"subject": [{ "name": s.name, "digest": { "sha256": sha256, "blake3": blake3::hash(s.bytes).to_hex().to_string() } }],
60	1×	"predicateType": "https://slsa.dev/provenance/v1",
61	1×	"predicate": {
62	1×	"buildDefinition": {
63	1×	"buildType": BUILD_TYPE,
64	1×	"externalParameters": {
65	1×	"repository": format!("{base_url}/{}", s.repo),
66	1×	"bookmark": s.bookmark,
67	1×	"job": s.job,
68	1×	"pipeline": s.pipeline_hash,
69		},
70	1×	"resolvedDependencies": [{
71	1×	"uri": format!("{base_url}/{}", s.repo),
72	1×	"digest": { "oxygen-state": s.state },
73	1×	"annotations": { "heads": s.heads },
74		}],
75		},
76	1×	"runDetails": {
77	1×	"builder": {
78	1×	"id": format!("{base_url}/oxygenflow/runner/{}", s.runner),
79		},
80	1×	"metadata": metadata,
81	1×	"byproducts": [{
82	1×	"name": "oxygen-receipt",
83	1×	"digest": { "oxygen-attestation": s.receipt_attest },
84	1×	"annotations": { "signedBy": s.receipt_signer },
85		}],
86		},
87		},
88		})
89	1×	}
90
91		/// `statement` in a DSSE envelope signed with the hub's key.
92	1×	pub fn envelope(app: &Shared, statement: &serde_json::Value) -> anyhow::Result<serde_json::Value> {
93	1×	let payload = serde_json::to_vec(statement)?;
94	1×	let (key, secret) = crate::keys::load_secret(&app.config.keys_dir())?;
95	1×	Ok(serde_json::from_str(&oxy_core::dsse::envelope(PAYLOAD_TYPE, &payload, &key.to_hex(), &secret))?)
96	1×	}
97
98		/// The hub's Ed25519 public key as a PEM SubjectPublicKeyInfo.
99	1×	pub fn public_pem(app: &Shared) -> String {
100	1×	oxy_core::dsse::public_pem(&app.hub_key.identity)
101	1×	}

`/`	Search
`g` `c`	Code
`g` `h`	History
`g` `b`	Bookmarks
`g` `t`	Trust
`y`	Permalink to this state (files and trees)
`?`	This sheet

Coverage / crates/hub/src/provenance.rs 100.0%

Keyboard