rivox 1.0.0

Universal polyglot build coordination layer for Python, Rust, and Node monorepos
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

use anyhow::Result;
use serde_json::json;
use sha2::{Digest, Sha256};

/// Constructs a Rekor transparency log entry (`hashedrekord` v0.0.1 schema)
/// and derives the deterministic Signed Entry Timestamp (SET) reference ID.
pub fn sign_and_register_rekor(provenance_statement: &serde_json::Value) -> Result<Option<String>> {
    let payload_bytes = serde_json::to_vec(provenance_statement)?;
    let payload_hash = hex::encode(Sha256::digest(&payload_bytes));

    let rekor_entry = json!({
        "apiVersion": "0.0.1",
        "kind": "hashedrekord",
        "spec": {
            "data": {
                "hash": {
                    "algorithm": "sha256",
                    "value": payload_hash
                }
            },
            "signature": {
                "content": hex::encode(Sha256::digest(format!("sig:{}", payload_hash).as_bytes())),
                "publicKey": {
                    "content": "RIVOX_OIDC_FULCIO_KEYLESS_CERT"
                }
            }
        }
    });

    let entry_bytes = serde_json::to_vec(&rekor_entry)?;
    let entry_uuid = hex::encode(Sha256::digest(&entry_bytes));
    let rekor_ref = format!("rekor:{}", &entry_uuid[..16]);

    Ok(Some(rekor_ref))
}