Skip to main content

Module verify

homecore_plugins

Module verify 

Source
Expand description

Plugin signature & integrity verification (ADR-162, P4).

ADR-161/B5 honestly relabelled the manifest’s wasm_module_hash / wasm_module_sig / publisher_key fields as “(P4 — not yet enforced)”: they were parsed and round-tripped but never checked before a plugin ran. This module makes that claim TRUE — it is the real verification gate the plugin load path runs before instantiating any .wasm module.

§What is verified, in order

  1. Module hash — SHA-256 of the actual .wasm bytes must equal the manifest’s wasm_module_hash (sha256:<hex>). A tampered module (one byte changed) fails here.
  2. Ed25519 signature — wasm_module_sig (ed25519:<base64>, 64-byte raw signature) must verify over the 32-byte SHA-256 digest under the publisher_key (ed25519:<base64>, 32-byte raw verifying key).
  3. Trust policy — the publisher_key must be on the configured allowlist, unless PluginPolicy::AllowUnsigned is in force (a loud dev escape hatch).

The crypto mirrors the in-repo Ed25519 pattern from cog-ha-matter::witness_signing (same ed25519-dalek 2.x API, same deterministic-test-key convention). SHA-256 matches the sha256: prefix the manifest doc already declared for wasm_module_hash, and the cog-ha-matter cog manifest’s binary_sha256 hex convention.

§Secure default

PluginPolicy::trusted (the production constructor) rejects:

  • an unsigned module (no hash / sig / key),
  • a signature from a key not on the allowlist,
  • any hash or signature mismatch.

Only PluginPolicy::AllowUnsigned loosens this, and every load it waves through emits a warn-level log line so it cannot pass silently.

Enums§

PluginPolicy
Trust policy governing which plugins may load.

Functions§

encode_sha256
Encode a SHA-256 digest as the manifest sha256:<hex> form. Exposed so tooling (and tests) can produce a manifest hash for real .wasm bytes.
encode_signature
Encode an Ed25519 signature as the manifest ed25519:<base64> form.
encode_verifying_key
Encode an Ed25519 verifying key as the manifest ed25519:<base64> form.
verify_module
Verify a .wasm module’s integrity and signature against its manifest, under the given trust policy. Returns Ok(()) only if the module may be instantiated.