holger_intel/
bundle.rs

1//! The online side's last step: an [`AdvisorySet`] becomes a signed
2//! `holger.update-bundle/v1` with `product = holger.intel/v1`.
3//!
4//! Nothing here is a new format. The set is the bundle's one payload, the feed
5//! record is its `Advisory` evidence, and `update-bundle`'s own `Preparation`,
6//! `add_approval` and `finalize` do the hashing, the approvals and the release
7//! signature — so `holger-verify` verifies an intel bundle exactly like a
8//! firmware one, and `finalize` refuses to emit one that does not verify.
9
10use std::path::{Path, PathBuf};
11
12use anyhow::{Context, Result};
13use chrono::{DateTime, Utc};
14use holger_update_bundle::core::{EvidenceKind, PolicyResult, SourceProvenance};
15use holger_update_bundle::digest::sha256_hex;
16use holger_update_bundle::finalize::{add_approval, finalize};
17use holger_update_bundle::prepare::{EvidenceInput, PayloadInput, Preparation};
18use holger_update_bundle::{pack_bundle, TrustPolicy, VerifyReport};
19
20use crate::set::AdvisorySet;
21use crate::{ADVISORIES_MEDIA_TYPE, ADVISORIES_REL, INTEL_PRODUCT, SOURCES_REL};
22
23/// One signer's certificate (DER) and ed25519 key (PKCS#8 DER). The key never
24/// enters the bundle and is never printed.
25pub struct SignerFiles {
26    pub cert_der: Vec<u8>,
27    pub key_pkcs8: Vec<u8>,
28}
29
30impl SignerFiles {
31    pub fn read(cert: &Path, key: &Path) -> Result<Self> {
32        Ok(Self {
33            cert_der: std::fs::read(cert).with_context(|| format!("read cert {}", cert.display()))?,
34            key_pkcs8: std::fs::read(key).with_context(|| format!("read key {}", key.display()))?,
35        })
36    }
37}
38
39/// What the bundle says about itself, and who signs it.
40pub struct BuildOptions {
41    /// Monotonic per `(supplier, holger.intel/v1)`. The secure side refuses a
42    /// bundle whose sequence is below the one it already holds.
43    pub sequence: u64,
44    pub created_at: DateTime<Utc>,
45    pub expires_at: Option<DateTime<Utc>>,
46    pub supplier: String,
47    pub producer: String,
48    /// The trust policy the downstream verifies against; `finalize` checks the
49    /// bundle under it before it is written.
50    pub policy: TrustPolicy,
51    /// Approvals, `(role, signer)`, as many as the policy's two-person rule asks.
52    pub approvals: Vec<(String, SignerFiles)>,
53    pub release: SignerFiles,
54    pub out: PathBuf,
55}
56
57/// The written bundle.
58pub struct BuiltBundle {
59    pub path: PathBuf,
60    pub bundle_id: String,
61    pub sequence: u64,
62    pub advisories: usize,
63    pub advisories_sha256: String,
64    pub report: VerifyReport,
65}
66
67/// The default sequence for a bundle built at `t`: `YYYYMMDDHHMMSS`, which only
68/// grows as long as the builder's clock does.
69pub fn sequence_for(t: DateTime<Utc>) -> u64 {
70    t.format("%Y%m%d%H%M%S").to_string().parse().unwrap_or(0)
71}
72
73/// Sign `set` into a bundle at `opts.out`.
74pub fn build_bundle(set: &AdvisorySet, opts: BuildOptions) -> Result<BuiltBundle> {
75    let payload = set.to_json_bytes()?;
76    let sources = serde_json::to_vec_pretty(&set.sources)?;
77    let digest = sha256_hex(&payload);
78    let date = opts.created_at.format("%Y-%m-%d");
79    let bundle_id = format!("holger-intel-{}-{date}", opts.sequence);
80    let fetched_at = set.sources.iter().map(|s| s.fetched_at).max();
81    let policy_digest = sha256_hex(opts.policy.to_ron()?.as_bytes());
82
83    let prep = Preparation {
84        bundle_id: bundle_id.clone(),
85        sequence: opts.sequence,
86        created_at: opts.created_at,
87        expires_at: opts.expires_at,
88        producer: opts.producer.clone(),
89        supplier: opts.supplier.clone(),
90        product: INTEL_PRODUCT.to_string(),
91        release_version: format!("{date}.{}", opts.sequence),
92        supported_hardware_models: vec![],
93        supported_hardware_revisions: vec![],
94        source_provenance: SourceProvenance {
95            source_kind: "intel-feeds".into(),
96            source_uri: None,
97            source_repository: None,
98            source_asset_path: None,
99            fetched_at,
100            reported_size: Some(payload.len() as u64),
101            vendor_checksum: None,
102            vendor_signature_status: None,
103            tls_origin: None,
104            transfer_receipt_digest: None,
105        },
106        policy_result: PolicyResult {
107            policy_digest,
108            advisory_snapshot_digest: Some(digest.clone()),
109            verdict: "pass".into(),
110            non_production: false,
111        },
112        supersedes: vec![],
113        withdraws: vec![],
114        payloads: vec![PayloadInput {
115            relative_path: ADVISORIES_REL.into(),
116            bytes: payload,
117            media_type: ADVISORIES_MEDIA_TYPE.into(),
118        }],
119        evidence: vec![EvidenceInput {
120            relative_path: SOURCES_REL.into(),
121            bytes: sources,
122            media_type: "application/json".into(),
123            kind: EvidenceKind::Advisory,
124        }],
125    };
126    let candidate = prep.build().map_err(|e| anyhow::anyhow!("prepare intel bundle: {e}"))?;
127    let mut members = candidate.members;
128    let now = Utc::now();
129    for (role, s) in &opts.approvals {
130        add_approval(&mut members, role, &s.cert_der, &s.key_pkcs8, None, now)
131            .map_err(|e| anyhow::anyhow!("approve intel bundle as {role}: {e}"))?;
132    }
133    let report = finalize(&mut members, &opts.policy, &opts.release.cert_der, &opts.release.key_pkcs8, now)
134        .map_err(|e| anyhow::anyhow!("sign intel bundle: {e}"))?;
135    if let Some(p) = opts.out.parent().filter(|p| !p.as_os_str().is_empty()) {
136        std::fs::create_dir_all(p).ok();
137    }
138    pack_bundle(&members, &opts.out).map_err(|e| anyhow::anyhow!("pack intel bundle: {e}"))?;
139    Ok(BuiltBundle {
140        path: opts.out,
141        bundle_id,
142        sequence: opts.sequence,
143        advisories: set.advisories.len(),
144        advisories_sha256: digest,
145        report,
146    })
147}
holger_intel/bundle.rs

holger_intel/
bundle.rs
