| 1 | package release |
| 2 | |
| 3 | import ( |
| 4 | "bytes" |
| 5 | "context" |
| 6 | "crypto/ed25519" |
| 7 | "encoding/base64" |
| 8 | "encoding/json" |
| 9 | "errors" |
| 10 | "os" |
| 11 | "reflect" |
| 12 | "strings" |
| 13 | ) |
| 14 | |
| 15 | func ReleaseTag(tag string) (SemVer, bool) { |
| 16 | if !strings.HasPrefix(tag, "v") { |
| 17 | return SemVer{}, false |
| 18 | } |
| 19 | return ParseSemVer(strings.TrimPrefix(tag, "v")) |
| 20 | } |
| 21 | |
| 22 | func VerifySystemIdentity(pub ed25519.PublicKey, wire []byte) (*SystemPointer, error) { |
| 23 | var wrapper signedWrapper |
| 24 | if json.Unmarshal(wire, &wrapper) != nil { |
| 25 | return nil, ErrBadSystemPointer |
| 26 | } |
| 27 | raw, err := base64.StdEncoding.DecodeString(wrapper.Payload) |
| 28 | if err != nil { |
| 29 | return nil, ErrBadSystemPointer |
| 30 | } |
| 31 | var claimed SystemPointer |
| 32 | if json.Unmarshal(raw, &claimed) != nil { |
| 33 | return nil, ErrBadSystemPointer |
| 34 | } |
| 35 | p, err := verifySystemPointer(pub, wire, SystemComponentRouter, claimed.Channel) |
| 36 | if err != nil { |
| 37 | return nil, err |
| 38 | } |
| 39 | if _, ok := ReleaseTag(p.Current.ReleaseTag); !ok || p.Current.MovesProtocol < 1 { |
| 40 | return nil, ErrBadSystemPointer |
| 41 | } |
| 42 | return p, nil |
| 43 | } |
| 44 | |
| 45 | func IdentityKey(tag string) (string, error) { |
| 46 | if _, ok := ReleaseTag(tag); !ok { |
| 47 | return "", ErrBadSystemPointer |
| 48 | } |
| 49 | return "control/system/router/releases/" + tag + ".json", nil |
| 50 | } |
| 51 | |
| 52 | // SignSystemIdentity signs one release's identity on the trusted host: the |
| 53 | // router component on the stable channel, no history, no audit and a zero |
| 54 | // spread, so the record says only what the release is. The channel is |
| 55 | // required by the pointer format and read by nothing that checks an |
| 56 | // identity. rel.ReleasedAt is kept as given (zero from the claims phase), so |
| 57 | // signing the same release again gives an equal Current and |
| 58 | // PublishSystemIdentity treats it as a no-op. The result verifies as an |
| 59 | // identity before it is returned. |
| 60 | func SignSystemIdentity(sg Signer, rel SystemRelease) ([]byte, error) { |
| 61 | p := &SystemPointer{Component: SystemComponentRouter, Channel: "stable", Current: rel, Spread: "0s"} |
| 62 | wire, err := signSystemPointer(sg, p) |
| 63 | if err != nil { |
| 64 | return nil, err |
| 65 | } |
| 66 | if _, err = VerifySystemIdentity(sg.verifyPub(), wire); err != nil { |
| 67 | return nil, err |
| 68 | } |
| 69 | return wire, nil |
| 70 | } |
| 71 | |
| 72 | // PublishSystemIdentity accepts a release-workflow signed pointer, never an |
| 73 | // upload request's assertion of its own tag. |
| 74 | func PublishSystemIdentity(ctx context.Context, s Store, pub ed25519.PublicKey, wire []byte) error { |
| 75 | p, err := VerifySystemIdentity(pub, wire) |
| 76 | if err != nil { |
| 77 | return err |
| 78 | } |
| 79 | key, err := IdentityKey(p.Current.ReleaseTag) |
| 80 | if err != nil { |
| 81 | return err |
| 82 | } |
| 83 | _, err = s.Put(ctx, key, wire, "") |
| 84 | if !errors.Is(err, ErrCASConflict) { |
| 85 | return err |
| 86 | } |
| 87 | old, _, err := s.Get(ctx, key) |
| 88 | if err != nil { |
| 89 | return err |
| 90 | } |
| 91 | prev, err := VerifySystemIdentity(pub, old) |
| 92 | if err != nil || !reflect.DeepEqual(prev.Current, p.Current) { |
| 93 | return ErrCASConflict |
| 94 | } |
| 95 | return nil |
| 96 | } |
| 97 | |
| 98 | func GetSystemIdentity(ctx context.Context, s Store, pub ed25519.PublicKey, tag string) (*SystemPointer, error) { |
| 99 | key, err := IdentityKey(tag) |
| 100 | if err != nil { |
| 101 | return nil, err |
| 102 | } |
| 103 | raw, _, err := s.Get(ctx, key) |
| 104 | if err != nil { |
| 105 | return nil, err |
| 106 | } |
| 107 | p, err := VerifySystemIdentity(pub, raw) |
| 108 | if err != nil { |
| 109 | return nil, err |
| 110 | } |
| 111 | if p.Current.ReleaseTag != tag { |
| 112 | return nil, ErrBadSystemPointer |
| 113 | } |
| 114 | return p, nil |
| 115 | } |
| 116 | |
| 117 | func CreateExact(ctx context.Context, s Store, key string, raw []byte) error { |
| 118 | _, err := s.Put(ctx, key, raw, "") |
| 119 | if err == nil { |
| 120 | return nil |
| 121 | } |
| 122 | // A timed-out PUT may have committed. Only identical bytes count as success. |
| 123 | got, _, readErr := s.Get(ctx, key) |
| 124 | if readErr == nil && bytes.Equal(raw, got) { |
| 125 | return nil |
| 126 | } |
| 127 | if readErr != nil && !errors.Is(readErr, os.ErrNotExist) { |
| 128 | return errors.Join(err, readErr) |
| 129 | } |
| 130 | return err |
| 131 | } |
| 132 | |
amadan