runx-receipts 0.6.19

Pure Rust receipt model, canonicalization, and verification parity for runx.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77

use runx_contracts::{ReceiptIssuer, ReceiptSignature};

use super::super::ReceiptFindingCode;

pub trait SignatureVerifier {
    fn verify(
        &self,
        issuer: &ReceiptIssuer,
        signature: &ReceiptSignature,
        body_digest: &str,
    ) -> Result<(), SignatureVerificationFailure>;
}

#[derive(Clone, Debug, PartialEq, Eq)]
pub enum SignatureVerificationFailure {
    MissingKey,
    MalformedKey,
    KeyHashMismatch,
    UnsupportedIssuer,
    UnsupportedAlgorithm,
    MalformedSignature,
    SignatureMismatch,
}

pub(super) fn signature_failure_code(error: &SignatureVerificationFailure) -> ReceiptFindingCode {
    match error {
        SignatureVerificationFailure::MissingKey => ReceiptFindingCode::SignatureKeyMissing,
        SignatureVerificationFailure::MalformedKey => ReceiptFindingCode::SignatureKeyMalformed,
        SignatureVerificationFailure::KeyHashMismatch => {
            ReceiptFindingCode::SignatureKeyHashMismatch
        }
        SignatureVerificationFailure::UnsupportedIssuer => {
            ReceiptFindingCode::SignatureUnsupportedIssuer
        }
        SignatureVerificationFailure::UnsupportedAlgorithm => {
            ReceiptFindingCode::SignatureUnsupportedAlgorithm
        }
        SignatureVerificationFailure::MalformedSignature => ReceiptFindingCode::SignatureMalformed,
        SignatureVerificationFailure::SignatureMismatch => ReceiptFindingCode::SignatureInvalid,
    }
}

pub(super) fn signature_failure_path(error: &SignatureVerificationFailure) -> &'static str {
    match error {
        SignatureVerificationFailure::MissingKey
        | SignatureVerificationFailure::MalformedKey
        | SignatureVerificationFailure::KeyHashMismatch
        | SignatureVerificationFailure::UnsupportedIssuer => "issuer",
        SignatureVerificationFailure::UnsupportedAlgorithm => "signature.alg",
        SignatureVerificationFailure::MalformedSignature
        | SignatureVerificationFailure::SignatureMismatch => "signature.value",
    }
}

pub(super) fn signature_failure_message(error: &SignatureVerificationFailure) -> &'static str {
    match error {
        SignatureVerificationFailure::MissingKey => {
            "signature verifier could not resolve the issuer key"
        }
        SignatureVerificationFailure::MalformedKey => {
            "signature verifier resolved malformed issuer key material"
        }
        SignatureVerificationFailure::KeyHashMismatch => {
            "issuer public key hash does not match the resolved verifier key"
        }
        SignatureVerificationFailure::UnsupportedIssuer => {
            "signature verifier does not support this issuer type"
        }
        SignatureVerificationFailure::UnsupportedAlgorithm => {
            "signature verifier does not support this algorithm"
        }
        SignatureVerificationFailure::MalformedSignature => "signature value is malformed",
        SignatureVerificationFailure::SignatureMismatch => {
            "signature does not verify against the receipt body commitment"
        }
    }
}