0ae29ae342
Some checks failed
validate / Rego (opa fmt + opa test) (push) Successful in 16s
validate / JSON Schema (ajv) (push) Successful in 20s
build-images / signing-service image (push) Successful in 24s
validate / DB (migrate up/down dry-run) (push) Failing after 26s
validate / Go (vet + test) (push) Successful in 1m16s
Adds services/verification-service exposing POST /api/v1/verify/chain for sink:dummy-sink. The handler runs the six hard-coded chain checks described in DEV-612 and reserves decision_id in a new `verification_decisions` table so a replayed sink delivery is refused without recomputing signatures. - DSSE signature verification against configurable approval + transform signer key_ids, loaded from VERIFICATION_SIGNER_KEYS (pem/hex/b64/b64u) - RFC 6962 inclusion-proof verifier (shared leaf/node hashing with services/transparency-log/pkg/backend) - Content binding: subject.digest.sha256 must match predicate.content_hash (approval) and request.payload_hash (transform) - Hard-coded coverage of allowed_transformations / allowed_sinks / expires_at predicates (OPA deferred to Phase 2 per the subtask) - Replay guard via new db/trust/migrations/0005_verification_decisions (in-memory store ships; Postgres skeleton mirrors sibling pattern) - Dockerfile mirrors signing-service pattern (distroless static + nonroot) - README documents endpoint, reason-code taxonomy, required predicate fields, and the Phase-2 non-scope Tests: happy path + 7 negatives (bad signature, missing inclusion proof, hash drift, sink not allowed, expired, replay, operation not allowed). Co-Authored-By: Paperclip <noreply@paperclip.ing>
46 lines
2.3 KiB
SQL
46 lines
2.3 KiB
SQL
-- Migration: 0005_verification_decisions
|
|
-- Replay-Schutz-Tabelle für die verification-service-Kette (DEV-612).
|
|
--
|
|
-- Jede erfolgreiche POST /api/v1/verify/chain-Antwort reserviert hier
|
|
-- genau eine Zeile. Ein zweiter Aufruf mit dem gleichen decision_id
|
|
-- löst keine Prüfung erneut aus, sondern liefert `valid=false,
|
|
-- replay=true` zurück (dummy-sink mappt das auf 409 Conflict).
|
|
--
|
|
-- Design-Entscheidungen:
|
|
-- * decision_id ist caller-chosen und opaque — TEXT PK statt UUID.
|
|
-- * approval_signer_key / transform_signer_key sind die DSSE-key_ids
|
|
-- (z. B. "trust-api/approval-signer-2026-q4"), nicht Agent-IDs.
|
|
-- Wer tatsächlich signiert hat, ist das Signaturartefakt, nicht der
|
|
-- Agent-Slug.
|
|
-- * payload_hash + sink_target werden mit protokolliert, damit sich
|
|
-- eine Replay-Abweisung nachträglich auditieren lässt
|
|
-- ("gleiche decision_id, aber Payload wurde verändert").
|
|
-- * NO FK auf approvals/attestations: diese Tabelle ist bewusst eine
|
|
-- Insel und darf nicht an die Lebenszyklen der Signatur-Services
|
|
-- gebunden werden.
|
|
|
|
CREATE TABLE IF NOT EXISTS verification_decisions (
|
|
decision_id TEXT PRIMARY KEY
|
|
CHECK (length(decision_id) BETWEEN 1 AND 256),
|
|
approval_ref TEXT NOT NULL
|
|
CHECK (approval_ref ~ '^sha256:[0-9a-f]{64}$'),
|
|
transform_ref TEXT NOT NULL
|
|
CHECK (transform_ref ~ '^sha256:[0-9a-f]{64}$'),
|
|
payload_hash TEXT NOT NULL
|
|
CHECK (payload_hash ~ '^sha256:[0-9a-f]{64}$'),
|
|
sink_target TEXT NOT NULL
|
|
CHECK (length(sink_target) BETWEEN 1 AND 256),
|
|
approval_signer_key TEXT NOT NULL
|
|
CHECK (length(approval_signer_key) BETWEEN 1 AND 256),
|
|
transform_signer_key TEXT NOT NULL
|
|
CHECK (length(transform_signer_key) BETWEEN 1 AND 256),
|
|
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
|
|
);
|
|
|
|
-- Audit-Pfad: "wann wurde zuletzt auf diese Senke geschrieben?"
|
|
CREATE INDEX idx_verification_decisions_sink_created
|
|
ON verification_decisions (sink_target, created_at);
|
|
|
|
-- Audit-Pfad: "welche Entscheidungen hängen an diesem approval_ref?"
|
|
CREATE INDEX idx_verification_decisions_approval
|
|
ON verification_decisions (approval_ref);
|