b45ad34169
All checks were successful
validate / JSON Schema (ajv) (push) Successful in 19s
build-images / signing-service image (push) Successful in 22s
validate / Rego (opa fmt + opa test) (push) Successful in 13s
validate / DB (migrate up/down dry-run) (push) Successful in 26s
validate / Go (vet + test) (push) Successful in 1m13s
Trivial Senken-Adapter per §7 of architecture V1.1. Accepts
{decision_id, payload_hash, payload, approval_ref, transform_ref}
on POST /api/v1/sink/dummy/deliver; calls verification-service's
/api/v1/verify/chain and branches:
- valid=true → atomic .tmp+rename write of payload to
/data/dummy-sink/<decision_id>.json, builds a
basicstack.de/attestations/handover/v1 statement, signs via
signing-service with the double identity flow (Pocket-ID bearer
+ projected SA token), submits DSSE envelope to the TLog and
returns 201 {handover_ref, log_index}.
- valid=false & replay=true → 409.
- valid=false → 403 {reasons:[…]}.
Replay protection lives in verification-service per the parent plan;
dummy-sink keeps no local replay store. The payload_hash field is
verified against both the raw and canonical form so a verifier can
reproduce either hash.
Tests use httptest-backed fakes for verify / sign / tlog and cover
the DEV-611 acceptance criteria plus the bad-request shapes:
- happy path writes the file, calls signer with the handover
statement, submits the envelope to the TLog
- 403 keeps the disk and never calls signer/tlog
- replay returns 409 without re-signing
- payload_hash mismatch rejects before verify
- malformed bodies return 400
- verify unavailable → 502, signing denied → 403
Co-Authored-By: Paperclip <noreply@paperclip.ing>
103 lines
2.3 KiB
Go
103 lines
2.3 KiB
Go
// Package canonical implements the deterministic JSON serialisation
|
|
// (sorted object keys) dummy-sink uses when it computes payload / subject
|
|
// digests that MUST reproduce byte-for-byte on the verifier side.
|
|
//
|
|
// MUST stay compatible with:
|
|
// - services/approval-service/internal/canonical/canonical.go
|
|
// - services/signing-service/internal/canonical/canonical.go
|
|
// - services/testagent-transform/internal/canonical/canonical.go
|
|
package canonical
|
|
|
|
import (
|
|
"bytes"
|
|
"crypto/sha256"
|
|
"encoding/hex"
|
|
"encoding/json"
|
|
"fmt"
|
|
"sort"
|
|
)
|
|
|
|
// SHA256Hex returns the hex-encoded SHA-256 of b.
|
|
func SHA256Hex(b []byte) string {
|
|
sum := sha256.Sum256(b)
|
|
return hex.EncodeToString(sum[:])
|
|
}
|
|
|
|
// Marshal returns the canonical JSON encoding of v (sorted object keys).
|
|
func Marshal(v any) ([]byte, error) {
|
|
first, err := json.Marshal(v)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
var any_ any
|
|
if err := json.Unmarshal(first, &any_); err != nil {
|
|
return nil, err
|
|
}
|
|
var buf bytes.Buffer
|
|
if err := writeSorted(&buf, any_); err != nil {
|
|
return nil, err
|
|
}
|
|
return buf.Bytes(), nil
|
|
}
|
|
|
|
// Hash returns the sha256:<hex> content hash of v's canonical JSON along
|
|
// with the raw canonical bytes.
|
|
func Hash(v any) (string, []byte, error) {
|
|
raw, err := Marshal(v)
|
|
if err != nil {
|
|
return "", nil, err
|
|
}
|
|
return "sha256:" + SHA256Hex(raw), raw, nil
|
|
}
|
|
|
|
func writeSorted(buf *bytes.Buffer, v any) error {
|
|
switch x := v.(type) {
|
|
case nil:
|
|
buf.WriteString("null")
|
|
case bool:
|
|
if x {
|
|
buf.WriteString("true")
|
|
} else {
|
|
buf.WriteString("false")
|
|
}
|
|
case float64:
|
|
b, _ := json.Marshal(x)
|
|
buf.Write(b)
|
|
case string:
|
|
b, _ := json.Marshal(x)
|
|
buf.Write(b)
|
|
case []any:
|
|
buf.WriteByte('[')
|
|
for i, el := range x {
|
|
if i > 0 {
|
|
buf.WriteByte(',')
|
|
}
|
|
if err := writeSorted(buf, el); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
buf.WriteByte(']')
|
|
case map[string]any:
|
|
keys := make([]string, 0, len(x))
|
|
for k := range x {
|
|
keys = append(keys, k)
|
|
}
|
|
sort.Strings(keys)
|
|
buf.WriteByte('{')
|
|
for i, k := range keys {
|
|
if i > 0 {
|
|
buf.WriteByte(',')
|
|
}
|
|
kb, _ := json.Marshal(k)
|
|
buf.Write(kb)
|
|
buf.WriteByte(':')
|
|
if err := writeSorted(buf, x[k]); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
buf.WriteByte('}')
|
|
default:
|
|
return fmt.Errorf("canonical.writeSorted: unsupported type %T", v)
|
|
}
|
|
return nil
|
|
}
|