| 1 | package release |
| 2 | |
| 3 | import ( |
| 4 | "context" |
| 5 | "crypto/ed25519" |
| 6 | "errors" |
| 7 | "fmt" |
| 8 | "os" |
| 9 | "time" |
| 10 | ) |
| 11 | |
| 12 | // PointerDigestsKey is the account's emission marker (#253, spec §4.6 |
| 13 | // "Writers before readers"). While it verifies, upgraded writers sign |
| 14 | // digests into the pointers they write; writers from before #253 do not know |
| 15 | // it, which is why every writer is upgraded before it is written. |
| 16 | func PointerDigestsKey(acct string) string { return "releases/" + acct + "/pointer-digests" } |
| 17 | |
| 18 | // DigestMarker is the marker's root-signed payload. At is when emission |
| 19 | // started: a pointer without digests promoted after At came from a writer |
| 20 | // that was not upgraded (DigestStateOf's straggler). |
| 21 | type DigestMarker struct { |
| 22 | Schema int `json:"schema"` |
| 23 | Account string `json:"account"` |
| 24 | At time.Time `json:"at"` |
| 25 | By string `json:"by,omitempty"` |
| 26 | } |
| 27 | |
| 28 | // WriteDigestMarker turns emission on for acct. Root key only: the marker is |
| 29 | // deployment control, not channel publication (SignRootEnvelope refuses a |
| 30 | // scoped signer). A marker that already verifies is left alone, so At stays |
| 31 | // the first time emission went on. |
| 32 | func WriteDigestMarker(ctx context.Context, s Store, sg Signer, acct, by string) error { |
| 33 | if !ValidAccount(acct) { |
| 34 | return fmt.Errorf("pointer digests: invalid account %q", acct) |
| 35 | } |
| 36 | key := PointerDigestsKey(acct) |
| 37 | _, etag, err := s.Get(ctx, key) |
| 38 | switch { |
| 39 | case errors.Is(err, os.ErrNotExist): |
| 40 | etag = "" |
| 41 | case err != nil: |
| 42 | return err |
| 43 | default: |
| 44 | if m, verr := ReadDigestMarker(ctx, s, sg.RootPublicKey(), acct); verr == nil && m != nil { |
| 45 | return nil |
| 46 | } |
| 47 | } |
| 48 | wire, err := SignRootEnvelope(sg, DigestMarker{Schema: 1, Account: acct, At: time.Now().UTC().Truncate(time.Second), By: by}) |
| 49 | if err != nil { |
| 50 | return fmt.Errorf("pointer digests: the marker needs the deployment's root key: %w", err) |
| 51 | } |
| 52 | _, err = s.Put(ctx, key, wire, etag) |
| 53 | return err |
| 54 | } |
| 55 | |
| 56 | // RemoveDigestMarker suspends emission for acct. It does not clear any box's |
| 57 | // ratchet: a box that has seen digests for a channel keeps refusing pointers |
| 58 | // without them (spec §4.6). |
| 59 | func RemoveDigestMarker(ctx context.Context, s Store, acct string) error { |
| 60 | if !ValidAccount(acct) { |
| 61 | return fmt.Errorf("pointer digests: invalid account %q", acct) |
| 62 | } |
| 63 | if err := s.Delete(ctx, PointerDigestsKey(acct)); err != nil && !errors.Is(err, os.ErrNotExist) { |
| 64 | return err |
| 65 | } |
| 66 | return nil |
| 67 | } |
| 68 | |
| 69 | // ReadDigestMarker is (nil, nil) when acct has no marker, the marker when it |
| 70 | // verifies against the root, and an error for anything else: a marker that is |
| 71 | // present but cannot be trusted is never read as "off" or as "on". |
| 72 | func ReadDigestMarker(ctx context.Context, s Store, pub ed25519.PublicKey, acct string) (*DigestMarker, error) { |
| 73 | raw, _, err := s.Get(ctx, PointerDigestsKey(acct)) |
| 74 | if errors.Is(err, os.ErrNotExist) { |
| 75 | return nil, nil |
| 76 | } |
| 77 | if err != nil { |
| 78 | return nil, err |
| 79 | } |
| 80 | var m DigestMarker |
| 81 | if err := VerifyRootEnvelope(pub, raw, &m); err != nil { |
| 82 | return nil, fmt.Errorf("pointer digest marker for %s: %w", acct, err) |
| 83 | } |
| 84 | if m.Schema != 1 || m.Account != acct || m.At.IsZero() { |
| 85 | return nil, fmt.Errorf("pointer digest marker for %s names account %q, schema %d", acct, m.Account, m.Schema) |
| 86 | } |
| 87 | return &m, nil |
| 88 | } |
| 89 | |
amadan