1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
//! `onomancer record`: the DNS-publishable TXT record,
//! and optionally a signed ONC certificate.
use std::{net::SocketAddr, path::PathBuf};
use clap::Args;
use onomancy_core::{anchor::doc::DocAnchor, time::UnixSeconds, wire::OversizeUnit};
use onomancy_dnssec::{
certificate::{Certificate, CertificateParams},
chain::DnssecChain,
dns_name::DnsName,
txt::{generation_key::GenerationKey, record::TxtRecord, serial::Serial},
};
use onomancy_hickory::provider::FetchChainError;
use onomancy_keyhive::mint;
use crate::{
say,
seed::{self, SeedError},
};
/// Emit the TXT record (and optionally a certificate) for a binding.
#[derive(Debug, Args)]
pub(crate) struct Record {
/// The hostname being bound (display form accepted; stored as
/// A-labels).
#[arg(long)]
hostname: String,
/// Seed of the root document key (hex, 32 bytes). Prefer
/// --doc-key: inline seeds land in shell history.
#[arg(long, conflicts_with = "doc_key")]
doc_seed: Option<String>,
/// Key file holding the root document seed (from `keygen --out`).
#[arg(long)]
doc_key: Option<PathBuf>,
/// Seed of the current generation key (hex, 32 bytes). Prefer
/// --generation-key.
#[arg(long, conflicts_with = "generation_key")]
generation_seed: Option<String>,
/// Key file holding the generation seed.
#[arg(long)]
generation_key: Option<PathBuf>,
/// Record serial; defaults to the current time in milliseconds
/// (the serial-as-timestamp convention).
#[arg(long)]
serial: Option<u64>,
/// Also sign an ONC certificate and write it here.
#[arg(long)]
cert_out: Option<PathBuf>,
/// Seed of the certificate signer (defaults to the doc key —
/// self-signed until Keyhive delegation lands). Prefer
/// --signer-key.
#[arg(long, conflicts_with = "signer_key")]
signer_seed: Option<String>,
/// Key file holding the signer seed.
#[arg(long)]
signer_key: Option<PathBuf>,
/// Fetch the live DNSSEC chain and attach it to the certificate
/// (requires the TXT record to already be published).
#[arg(long)]
fetch_chain: bool,
/// Recursive resolver for --fetch-chain (default: system, then 1.1.1.1).
#[arg(long)]
resolver: Option<SocketAddr>,
}
impl Record {
/// Build and print (and optionally sign + write).
///
/// # Errors
///
/// Returns [`RecordError`] for malformed inputs, failed chain
/// fetches, oversize units, and IO failures.
pub(crate) fn run(&self) -> Result<(), RecordError> {
let hostname = DnsName::parse_display(&self.hostname)?;
let doc_key = seed::load(self.doc_seed.as_deref(), self.doc_key.as_deref())?;
let generation_key = seed::load(
self.generation_seed.as_deref(),
self.generation_key.as_deref(),
)?;
let document = DocAnchor::from(doc_key.verifying_key());
let generation = GenerationKey::from(generation_key.verifying_key());
let serial = Serial::from(self.serial.unwrap_or_else(crate::now_ms));
let record = TxtRecord::new(serial, generation, document);
say("; publish this record (then re-sign the zone):");
say(&format!("_onomancy.{hostname}. IN TXT \"{record}\""));
let Some(cert_out) = &self.cert_out else {
return Ok(());
};
let chain = if self.fetch_chain {
fetch_chain(self.resolver, &hostname)?
} else {
DnssecChain::default()
};
let signer = if self.signer_seed.is_some() || self.signer_key.is_some() {
let signer = seed::load(self.signer_seed.as_deref(), self.signer_key.as_deref())?;
// A carriage minted here proves the document delegates
// the GENERATION key; it says nothing about some third
// signer. Minting anyway would emit a certificate that
// fails for a reason its holder cannot see.
if signer.verifying_key() != doc_key.verifying_key() {
return Err(RecordError::UnprovableSigner);
}
signer
} else {
doc_key.clone()
};
// The generation-path proof, as `bind` mints it: without it the attested
// generation key lies on no path, so the certificate is
// REJECTED while its own chain is fresh and only graded
// provisional once stale — exactly backwards.
let carriage = mint::generation_carriage(&doc_key, &generation_key)?;
let certificate = Certificate::sign(
CertificateParams {
root_doc: document,
issued_at: UnixSeconds::from(crate::now_ms() / 1000),
hostname: hostname.clone(),
heads: vec![],
predecessor: None,
delegation_chain: carriage,
lineage: vec![],
chain,
},
&signer,
)?;
std::fs::write(cert_out, certificate.encode())?;
say(&format!("; wrote certificate: {}", cert_out.display()));
Ok(())
}
}
/// Fetch the live chain on a scratch runtime.
fn fetch_chain(
resolver: Option<SocketAddr>,
hostname: &DnsName,
) -> Result<DnssecChain, RecordError> {
let provider = crate::provider(resolver);
Ok(crate::block_on(provider.fetch_chain(hostname))??)
}
/// Record generation failed.
#[derive(Debug, thiserror::Error)]
pub(crate) enum RecordError {
/// The live chain could not be fetched.
#[error(transparent)]
Fetch(#[from] FetchChainError),
/// The hostname did not parse.
#[error("hostname: {0}")]
Hostname(#[from] onomancy_dnssec::dns_name::ParseDnsNameError),
/// File or runtime IO failed.
#[error(transparent)]
Io(#[from] std::io::Error),
/// The carriage could not be minted.
#[error(transparent)]
Mint(#[from] onomancy_keyhive::mint::MintError),
/// The certificate would exceed the unit cap.
#[error(transparent)]
Oversize(#[from] OversizeUnit),
/// A seed argument was malformed.
#[error(transparent)]
Seed(#[from] SeedError),
/// A signer was supplied whose authority this verb cannot prove.
///
/// `record` mints the one carriage it can derive from its own
/// arguments: the document delegating the generation key. A third
/// signer needs a delegation path from the document, which lives
/// in the Keyhive graph rather than in a seed file.
#[error(
"refusing to mint a certificate for a signer this verb cannot prove: \
--signer-key is not the document key, and the carriage minted here \
proves only that the document delegates the generation key. Such a \
certificate would be dropped by verifiers without a visible reason. \
Use the document key, or run the full `bind` ceremony."
)]
UnprovableSigner,
}