570 lines
18 KiB
Rust
570 lines
18 KiB
Rust
//! Custody annotations across real, separately-owned chains.
|
|
//!
|
|
//! Each node here is a genuinely separate store with its own signing key
|
|
//! and its own chain. Nothing writes to anybody else's, which is the
|
|
//! property the design rests on: a node cannot forge an annotation it did not
|
|
//! perform, because it can only sign its own.
|
|
|
|
use trusty_core::{
|
|
Layer,
|
|
entity_id_for, verify_annotations, Ed25519Signer, Annotation, SecretKey, SourceRef,
|
|
AnnotationProblem,
|
|
};
|
|
use trusty_sqlite::Trusty;
|
|
|
|
const TAG: &str = "sha256:d41d8cd9";
|
|
|
|
/// A node: its own store, its own key, its own chain.
|
|
struct Node {
|
|
name: String,
|
|
store: Trusty,
|
|
signer: Ed25519Signer,
|
|
}
|
|
|
|
impl Node {
|
|
fn new(name: &str, seed: u8) -> Self {
|
|
Self {
|
|
name: name.to_string(),
|
|
store: Trusty::open_in_memory(SecretKey::new([seed; 16])).expect("store"),
|
|
signer: Ed25519Signer::generate(),
|
|
}
|
|
}
|
|
|
|
/// Record that this node holds the data, and say where it came from.
|
|
/// Returns the reference a downstream node will cite.
|
|
fn record(&mut self, from: Option<SourceRef>, note: &str) -> SourceRef {
|
|
let mut annotation = Annotation::custody(TAG, &self.name).because(note);
|
|
annotation.received_from = from;
|
|
let entity = entity_id_for(TAG, &self.name);
|
|
let appended = self
|
|
.store
|
|
.append_signed(
|
|
&entity,
|
|
&annotation.to_data(),
|
|
"custody://test",
|
|
&self.signer,
|
|
)
|
|
.expect("append");
|
|
let bundle = self.store.export_bundle(&entity, None, None).expect("export");
|
|
let row = bundle
|
|
.rows
|
|
.iter()
|
|
.find(|r| r.row_hash.as_deref() == Some(appended.row_hash.as_str()))
|
|
.expect("the row just written must be in the bundle");
|
|
SourceRef {
|
|
chain_id: row.chain_id.clone(),
|
|
sequence: row.sequence,
|
|
row_hash: appended.row_hash.clone(),
|
|
}
|
|
}
|
|
|
|
fn bundle(&self) -> trusty_core::ProofBundle {
|
|
self.store
|
|
.export_bundle(&entity_id_for(TAG, &self.name), None, None)
|
|
.expect("export")
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn a_path_across_three_nodes_reads_in_order() {
|
|
let mut origin = Node::new("origin", 1);
|
|
let mut relay = Node::new("relay", 2);
|
|
let mut sink = Node::new("sink", 3);
|
|
|
|
let a = origin.record(None, "produced here");
|
|
let b = relay.record(Some(a), "forwarded");
|
|
sink.record(Some(b), "delivered");
|
|
|
|
let report = verify_annotations(&[origin.bundle(), relay.bundle(), sink.bundle()], TAG);
|
|
|
|
assert!(
|
|
report.intact(),
|
|
"three honest nodes must produce a clean path; problems: {:?}",
|
|
report.problems
|
|
);
|
|
assert_eq!(
|
|
report.custody_line(),
|
|
vec!["origin", "relay", "sink"],
|
|
"the order is reconstructed from the links, not from the order the \
|
|
bundles happened to be passed in"
|
|
);
|
|
assert_eq!(report.found, 3);
|
|
}
|
|
|
|
#[test]
|
|
fn the_order_does_not_depend_on_the_order_bundles_arrive_in() {
|
|
let mut origin = Node::new("origin", 1);
|
|
let mut relay = Node::new("relay", 2);
|
|
let mut sink = Node::new("sink", 3);
|
|
let a = origin.record(None, "produced here");
|
|
let b = relay.record(Some(a), "forwarded");
|
|
sink.record(Some(b), "delivered");
|
|
|
|
let shuffled = verify_annotations(&[sink.bundle(), origin.bundle(), relay.bundle()], TAG);
|
|
|
|
assert_eq!(
|
|
shuffled.custody_line(),
|
|
vec!["origin", "relay", "sink"],
|
|
"a merge that depended on argument order would be reporting the \
|
|
caller's filing habits rather than the history"
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn a_missing_middle_node_is_reported_not_papered_over() {
|
|
let mut origin = Node::new("origin", 1);
|
|
let mut relay = Node::new("relay", 2);
|
|
let mut sink = Node::new("sink", 3);
|
|
|
|
let a = origin.record(None, "produced here");
|
|
let b = relay.record(Some(a), "forwarded");
|
|
sink.record(Some(b), "delivered");
|
|
|
|
// The relay's bundle is withheld -- exactly what a relay that would
|
|
// rather not be in the record would do.
|
|
let report = verify_annotations(&[origin.bundle(), sink.bundle()], TAG);
|
|
|
|
assert!(
|
|
!report.intact(),
|
|
"a gap must not read as a clean history; problems: {:?}",
|
|
report.problems
|
|
);
|
|
assert!(
|
|
report
|
|
.problems
|
|
.iter()
|
|
.any(|p| matches!(p, AnnotationProblem::DanglingPredecessor { node, .. } if node == "sink")),
|
|
"the sink cites a row nobody can produce, and that is the finding; \
|
|
got {:?}",
|
|
report.problems
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn a_hop_citing_a_row_that_was_altered_does_not_link() {
|
|
let mut origin = Node::new("origin", 1);
|
|
let mut relay = Node::new("relay", 2);
|
|
|
|
let a = origin.record(None, "produced here");
|
|
// The relay cites the right position but the wrong content -- what a
|
|
// forged provenance claim looks like when the citation is guessed.
|
|
relay.record(
|
|
Some(SourceRef {
|
|
row_hash: "00".repeat(32),
|
|
..a
|
|
}),
|
|
"claims to have had it from origin",
|
|
);
|
|
|
|
let report = verify_annotations(&[origin.bundle(), relay.bundle()], TAG);
|
|
|
|
assert!(
|
|
report
|
|
.problems
|
|
.iter()
|
|
.any(|p| matches!(p, AnnotationProblem::DanglingPredecessor { .. })),
|
|
"naming a real position with the wrong hash must not link; the hash \
|
|
is what makes the citation a citation; got {:?}",
|
|
report.problems
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn two_nodes_receiving_from_the_same_hop_is_reported_as_a_fork() {
|
|
let mut origin = Node::new("origin", 1);
|
|
let mut left = Node::new("left", 2);
|
|
let mut right = Node::new("right", 3);
|
|
|
|
let a = origin.record(None, "produced here");
|
|
left.record(Some(a.clone()), "one copy");
|
|
right.record(Some(a), "another copy");
|
|
|
|
let report = verify_annotations(&[origin.bundle(), left.bundle(), right.bundle()], TAG);
|
|
|
|
assert!(
|
|
report
|
|
.problems
|
|
.iter()
|
|
.any(|p| matches!(p, AnnotationProblem::Fork { .. })),
|
|
"fanning out is legitimate, but a caller expecting a line must be \
|
|
told it got a tree; got {:?}",
|
|
report.problems
|
|
);
|
|
assert!(
|
|
!report.intact(),
|
|
"intact() is the strict reading; a caller who accepts forks reads \
|
|
problems and decides"
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn two_claimed_origins_are_reported() {
|
|
let mut one = Node::new("one", 1);
|
|
let mut two = Node::new("two", 2);
|
|
one.record(None, "I made this");
|
|
two.record(None, "no, I made this");
|
|
|
|
let report = verify_annotations(&[one.bundle(), two.bundle()], TAG);
|
|
|
|
assert!(
|
|
report
|
|
.problems
|
|
.iter()
|
|
.any(|p| matches!(p, AnnotationProblem::MultipleOrigins { .. })),
|
|
"the same data cannot originate twice, and which claim is false is \
|
|
not something the log can settle -- but it can refuse to pick; got {:?}",
|
|
report.problems
|
|
);
|
|
assert!(report.hops.is_empty(), "with no single origin there is no order");
|
|
}
|
|
|
|
#[test]
|
|
fn traffic_about_other_data_is_ignored() {
|
|
let mut origin = Node::new("origin", 1);
|
|
let mut relay = Node::new("relay", 2);
|
|
|
|
// The relay's chain also carries an annotation about something else.
|
|
let other = Annotation::custody("sha256:something-else", &relay.name);
|
|
relay
|
|
.store
|
|
.append_signed(
|
|
&entity_id_for(TAG, &relay.name),
|
|
&other.to_data(),
|
|
"custody://test",
|
|
&relay.signer,
|
|
)
|
|
.expect("append other");
|
|
|
|
let a = origin.record(None, "produced here");
|
|
relay.record(Some(a), "forwarded");
|
|
|
|
let report = verify_annotations(&[origin.bundle(), relay.bundle()], TAG);
|
|
|
|
assert!(
|
|
report.intact(),
|
|
"a bundle may carry unrelated traffic; problems: {:?}",
|
|
report.problems
|
|
);
|
|
assert_eq!(
|
|
report.found, 2,
|
|
"only annotations about the tag asked for count, or a busy node would \
|
|
appear to have handled everything"
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn nothing_recorded_is_not_a_clean_history() {
|
|
let origin = Node::new("origin", 1);
|
|
let report = verify_annotations(&[origin.bundle()], TAG);
|
|
|
|
assert!(
|
|
!report.intact(),
|
|
"no records at all must not read as an unbroken chain of custody; \
|
|
the difference matters most exactly when someone is asking"
|
|
);
|
|
assert_eq!(report.found, 0);
|
|
}
|
|
|
|
#[test]
|
|
fn a_tampered_bundle_takes_no_part_in_the_path() {
|
|
let mut origin = Node::new("origin", 1);
|
|
let mut relay = Node::new("relay", 2);
|
|
let a = origin.record(None, "produced here");
|
|
relay.record(Some(a), "forwarded");
|
|
|
|
// Rewrite what the relay claims it did, after export. The signature
|
|
// no longer covers it.
|
|
let mut forged = relay.bundle();
|
|
for row in forged.rows.iter_mut() {
|
|
if let Some(payload) = row.raw_payload.as_mut() {
|
|
*payload = payload.replace("forwarded", "never touched it");
|
|
}
|
|
}
|
|
|
|
let report = verify_annotations(&[origin.bundle(), forged], TAG);
|
|
|
|
assert!(
|
|
report
|
|
.problems
|
|
.iter()
|
|
.any(|p| matches!(p, AnnotationProblem::BundleUnverified { .. })),
|
|
"a bundle whose rows no longer match their signatures must be \
|
|
reported as such; got {:?}",
|
|
report.problems
|
|
);
|
|
assert_eq!(
|
|
report.found, 1,
|
|
"and its rows must not contribute hops -- a tidy custody report \
|
|
built over forged rows is worse than no report at all"
|
|
);
|
|
assert!(!report.intact());
|
|
}
|
|
|
|
#[test]
|
|
fn an_honest_bundle_beside_a_forged_one_still_counts() {
|
|
let mut origin = Node::new("origin", 1);
|
|
let mut relay = Node::new("relay", 2);
|
|
let a = origin.record(None, "produced here");
|
|
relay.record(Some(a), "forwarded");
|
|
|
|
let mut forged = relay.bundle();
|
|
for row in forged.rows.iter_mut() {
|
|
if let Some(payload) = row.raw_payload.as_mut() {
|
|
*payload = payload.replace("forwarded", "never touched it");
|
|
}
|
|
}
|
|
let report = verify_annotations(&[origin.bundle(), forged], TAG);
|
|
|
|
// The origin is untouched and still says what it said. One party
|
|
// lying must not erase another party's honest record.
|
|
assert_eq!(
|
|
report.custody_line(),
|
|
vec!["origin"],
|
|
"the surviving path is what the verified bundles support, no more \
|
|
and no less; got {:?}",
|
|
report.custody_line()
|
|
);
|
|
}
|
|
|
|
// ---------------------------------------------------------------------
|
|
// Kinds beyond custody.
|
|
// ---------------------------------------------------------------------
|
|
|
|
impl Node {
|
|
/// Record that this node ran a check, and what it concluded.
|
|
fn checked(&mut self, ok: bool, note: &str) {
|
|
let annotation = Annotation::integrity(TAG, &self.name, ok)
|
|
.at_layer(Layer::Device)
|
|
.because(note);
|
|
self.store
|
|
.append_signed(
|
|
&entity_id_for(TAG, &self.name),
|
|
&annotation.to_data(),
|
|
"custody://test",
|
|
&self.signer,
|
|
)
|
|
.expect("append");
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn a_failed_check_becomes_an_actionable_marker() {
|
|
let mut origin = Node::new("origin", 1);
|
|
let mut relay = Node::new("relay", 2);
|
|
|
|
let a = origin.record(None, "produced here");
|
|
relay.record(Some(a), "forwarded");
|
|
relay.checked(false, "checksum mismatch on receipt");
|
|
|
|
let report = verify_annotations(&[origin.bundle(), relay.bundle()], TAG);
|
|
|
|
assert_eq!(
|
|
report.failed_checks().len(),
|
|
1,
|
|
"a node that ran a check and found a problem must surface it \
|
|
separately from structural findings, so a peer can decide to \
|
|
refuse, quarantine or inspect; got {:?}",
|
|
report.problems
|
|
);
|
|
assert!(
|
|
!report.intact(),
|
|
"a datum somebody found wrong must not read as clean"
|
|
);
|
|
assert_eq!(
|
|
report.custody_line(),
|
|
vec!["origin", "relay"],
|
|
"the custody path is still readable; a failed check is a finding \
|
|
about the datum, not a reason to lose the history"
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn a_passed_check_is_recorded_without_becoming_a_problem() {
|
|
let mut origin = Node::new("origin", 1);
|
|
let mut relay = Node::new("relay", 2);
|
|
let a = origin.record(None, "produced here");
|
|
relay.record(Some(a), "forwarded");
|
|
relay.checked(true, "checksum matched");
|
|
|
|
let report = verify_annotations(&[origin.bundle(), relay.bundle()], TAG);
|
|
|
|
assert!(
|
|
report.intact(),
|
|
"a check that passed is evidence in favour, not a finding; \
|
|
problems: {:?}",
|
|
report.problems
|
|
);
|
|
assert_eq!(
|
|
report.found, 3,
|
|
"the passing check must still be counted -- knowing a check RAN is \
|
|
the difference between verified and merely unexamined"
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn a_custody_claim_is_not_read_as_a_check_that_passed() {
|
|
let mut origin = Node::new("origin", 1);
|
|
origin.record(None, "produced here");
|
|
|
|
let report = verify_annotations(&[origin.bundle()], TAG);
|
|
|
|
assert!(
|
|
report.failed_checks().is_empty(),
|
|
"holding data is not a claim about its correctness"
|
|
);
|
|
assert_eq!(
|
|
report.found, 1,
|
|
"and it is still an annotation, counted as one"
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn an_annotation_of_an_unknown_kind_is_reported_not_ignored() {
|
|
let mut origin = Node::new("origin", 1);
|
|
origin.record(None, "produced here");
|
|
|
|
let mut odd = Annotation::custody(TAG, &origin.name);
|
|
odd.kind = trusty_core::AnnotationKind::Other("future.kind.v9".into());
|
|
origin
|
|
.store
|
|
.append_signed(
|
|
&entity_id_for(TAG, &origin.name),
|
|
&odd.to_data(),
|
|
"custody://test",
|
|
&origin.signer,
|
|
)
|
|
.expect("append");
|
|
|
|
let report = verify_annotations(&[origin.bundle()], TAG);
|
|
|
|
assert!(
|
|
report.problems.iter().any(|p| matches!(
|
|
p,
|
|
AnnotationProblem::UnrecognisedKind { kind, .. } if kind == "future.kind.v9"
|
|
)),
|
|
"silence would let a future kind carrying a failed check pass an old \
|
|
verifier unnoticed; got {:?}",
|
|
report.problems
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn a_forged_bundle_cannot_erase_a_failed_check() {
|
|
let mut origin = Node::new("origin", 1);
|
|
let mut relay = Node::new("relay", 2);
|
|
let a = origin.record(None, "produced here");
|
|
relay.record(Some(a), "forwarded");
|
|
relay.checked(false, "checksum mismatch on receipt");
|
|
|
|
// The relay rewrites its own bundle to say the check passed.
|
|
let mut forged = relay.bundle();
|
|
for row in forged.rows.iter_mut() {
|
|
if let Some(payload) = row.raw_payload.as_mut() {
|
|
*payload = payload.replace("\"satisfied\":false", "\"satisfied\":true");
|
|
}
|
|
}
|
|
|
|
let report = verify_annotations(&[origin.bundle(), forged], TAG);
|
|
|
|
assert!(
|
|
report.problems.iter().any(|p| matches!(
|
|
p,
|
|
AnnotationProblem::BundleUnverified { .. }
|
|
)),
|
|
"editing a finding out of your own bundle must break its signature, \
|
|
not quietly succeed; got {:?}",
|
|
report.problems
|
|
);
|
|
assert!(
|
|
!report.intact(),
|
|
"and the result must not read as clean just because the evidence was \
|
|
removed"
|
|
);
|
|
}
|
|
|
|
// ---------------------------------------------------------------------
|
|
// Credential formats. A WebAuthn credential must never be checked as a
|
|
// bare signature.
|
|
// ---------------------------------------------------------------------
|
|
|
|
#[test]
|
|
fn a_cose_producer_is_refused_by_the_bare_signature_path() {
|
|
use trusty_core::KeyFormat;
|
|
|
|
let mut trusty = Trusty::open_in_memory(SecretKey::new([4u8; 16])).expect("store");
|
|
let signer = Ed25519Signer::generate();
|
|
trusty
|
|
.append_signed("doc", &serde_json::json!({ "v": 1 }), "t://", &signer)
|
|
.expect("append");
|
|
|
|
// A user enrolled through WebAuthn: the credential is a COSE key,
|
|
// and its signatures cover authenticatorData ||
|
|
// SHA-256(clientDataJSON) rather than the message.
|
|
trusty
|
|
.register_producer_with_format("user:01H", &[0u8; 32], &[0u8; 16], None, KeyFormat::Cose)
|
|
.expect("enrol");
|
|
|
|
let err = trusty
|
|
.verify_with_producer("doc", "user:01H")
|
|
.expect_err("must refuse");
|
|
let msg = err.to_string();
|
|
|
|
assert!(
|
|
msg.contains("clientDataJSON"),
|
|
"the refusal must explain WHY, or the next person reads it as a wrong key and loosens the check until it passes: {msg}"
|
|
);
|
|
assert!(
|
|
!msg.contains("verification failed"),
|
|
"and it must not look like a failed verification -- that confusion is what the change exists to remove: {msg}"
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn a_raw_producer_is_still_verified_normally() {
|
|
use trusty_core::KeyFormat;
|
|
|
|
let mut trusty = Trusty::open_in_memory(SecretKey::new([6u8; 16])).expect("store");
|
|
let signer = Ed25519Signer::generate();
|
|
trusty
|
|
.append_signed("doc", &serde_json::json!({ "v": 1 }), "t://", &signer)
|
|
.expect("append");
|
|
trusty
|
|
.register_producer_with_format(
|
|
"agent:01J",
|
|
&[0u8; 32],
|
|
&[0u8; 16],
|
|
None,
|
|
KeyFormat::Ed25519Raw,
|
|
)
|
|
.expect("enrol");
|
|
|
|
// May or may not verify -- the key is a placeholder. What matters is
|
|
// that it is not REFUSED: the raw path must be untouched, or this
|
|
// change would have broken every existing producer.
|
|
match trusty.verify_with_producer("doc", "agent:01J") {
|
|
Ok(_) => {}
|
|
Err(e) => assert!(
|
|
!e.to_string().contains("unsupported credential"),
|
|
"a raw Ed25519 producer must reach the signature check, not be turned away before it: {e}"
|
|
),
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn a_producer_enrolled_before_the_column_existed_reads_as_raw() {
|
|
let mut trusty = Trusty::open_in_memory(SecretKey::new([5u8; 16])).expect("store");
|
|
trusty
|
|
.register_producer("agent:old", &[0u8; 32], &[0u8; 16], None)
|
|
.expect("enrol");
|
|
|
|
let found = trusty
|
|
.lookup_producer("agent:old")
|
|
.expect("lookup")
|
|
.expect("row");
|
|
assert_eq!(
|
|
found.key_format,
|
|
trusty_core::KeyFormat::Ed25519Raw,
|
|
"every credential enrolled before the column existed WAS a raw Ed25519 key, so the schema default is correct -- applied at write time, never as a parse fallback"
|
|
);
|
|
}
|