0ae29ae342
Some checks failed
validate / Rego (opa fmt + opa test) (push) Successful in 16s
validate / JSON Schema (ajv) (push) Successful in 20s
build-images / signing-service image (push) Successful in 24s
validate / DB (migrate up/down dry-run) (push) Failing after 26s
validate / Go (vet + test) (push) Successful in 1m16s
Adds services/verification-service exposing POST /api/v1/verify/chain for sink:dummy-sink. The handler runs the six hard-coded chain checks described in DEV-612 and reserves decision_id in a new `verification_decisions` table so a replayed sink delivery is refused without recomputing signatures. - DSSE signature verification against configurable approval + transform signer key_ids, loaded from VERIFICATION_SIGNER_KEYS (pem/hex/b64/b64u) - RFC 6962 inclusion-proof verifier (shared leaf/node hashing with services/transparency-log/pkg/backend) - Content binding: subject.digest.sha256 must match predicate.content_hash (approval) and request.payload_hash (transform) - Hard-coded coverage of allowed_transformations / allowed_sinks / expires_at predicates (OPA deferred to Phase 2 per the subtask) - Replay guard via new db/trust/migrations/0005_verification_decisions (in-memory store ships; Postgres skeleton mirrors sibling pattern) - Dockerfile mirrors signing-service pattern (distroless static + nonroot) - README documents endpoint, reason-code taxonomy, required predicate fields, and the Phase-2 non-scope Tests: happy path + 7 negatives (bad signature, missing inclusion proof, hash drift, sink not allowed, expired, replay, operation not allowed). Co-Authored-By: Paperclip <noreply@paperclip.ing>
106 lines
2.4 KiB
Go
106 lines
2.4 KiB
Go
// Package canonical implements the deterministic JSON serialisation
|
|
// (sorted object keys) the verification-service uses when it computes
|
|
// payload / subject digests that MUST reproduce byte-for-byte on the
|
|
// signer side.
|
|
//
|
|
// MUST stay compatible with:
|
|
// - services/approval-service/internal/canonical/canonical.go
|
|
// - services/signing-service/internal/canonical/canonical.go
|
|
// - services/testagent-transform/internal/canonical/canonical.go
|
|
// - services/dummy-sink/internal/canonical/canonical.go
|
|
// - services/transparency-log/pkg/backend (canonicalJSON used for leaf hashing)
|
|
package canonical
|
|
|
|
import (
|
|
"bytes"
|
|
"crypto/sha256"
|
|
"encoding/hex"
|
|
"encoding/json"
|
|
"fmt"
|
|
"sort"
|
|
)
|
|
|
|
// SHA256Hex returns the hex-encoded SHA-256 of b.
|
|
func SHA256Hex(b []byte) string {
|
|
sum := sha256.Sum256(b)
|
|
return hex.EncodeToString(sum[:])
|
|
}
|
|
|
|
// Marshal returns the canonical JSON encoding of v (sorted object keys).
|
|
func Marshal(v any) ([]byte, error) {
|
|
first, err := json.Marshal(v)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
var any_ any
|
|
if err := json.Unmarshal(first, &any_); err != nil {
|
|
return nil, err
|
|
}
|
|
var buf bytes.Buffer
|
|
if err := writeSorted(&buf, any_); err != nil {
|
|
return nil, err
|
|
}
|
|
return buf.Bytes(), nil
|
|
}
|
|
|
|
// Hash returns the sha256:<hex> content hash of v's canonical JSON along
|
|
// with the raw canonical bytes.
|
|
func Hash(v any) (string, []byte, error) {
|
|
raw, err := Marshal(v)
|
|
if err != nil {
|
|
return "", nil, err
|
|
}
|
|
return "sha256:" + SHA256Hex(raw), raw, nil
|
|
}
|
|
|
|
func writeSorted(buf *bytes.Buffer, v any) error {
|
|
switch x := v.(type) {
|
|
case nil:
|
|
buf.WriteString("null")
|
|
case bool:
|
|
if x {
|
|
buf.WriteString("true")
|
|
} else {
|
|
buf.WriteString("false")
|
|
}
|
|
case float64:
|
|
b, _ := json.Marshal(x)
|
|
buf.Write(b)
|
|
case string:
|
|
b, _ := json.Marshal(x)
|
|
buf.Write(b)
|
|
case []any:
|
|
buf.WriteByte('[')
|
|
for i, el := range x {
|
|
if i > 0 {
|
|
buf.WriteByte(',')
|
|
}
|
|
if err := writeSorted(buf, el); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
buf.WriteByte(']')
|
|
case map[string]any:
|
|
keys := make([]string, 0, len(x))
|
|
for k := range x {
|
|
keys = append(keys, k)
|
|
}
|
|
sort.Strings(keys)
|
|
buf.WriteByte('{')
|
|
for i, k := range keys {
|
|
if i > 0 {
|
|
buf.WriteByte(',')
|
|
}
|
|
kb, _ := json.Marshal(k)
|
|
buf.Write(kb)
|
|
buf.WriteByte(':')
|
|
if err := writeSorted(buf, x[k]); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
buf.WriteByte('}')
|
|
default:
|
|
return fmt.Errorf("canonical.writeSorted: unsupported type %T", v)
|
|
}
|
|
return nil
|
|
}
|