mur_common/

binary_attestation.rs

//! Binary attestation: verify that a spawned `mur-agent-runtime` carries a
//! valid signature from MUR's Developer ID team (launch-chain follow-on,
//! spec 2026-08-12). Gated to release builds by the build marker.

use std::fmt;
use std::path::{Path, PathBuf};
use std::process::Command;

/// True when this binary was built with `MUR_EMBED_RELEASE_MARKER=1`
/// (the release pipeline). Dev builds never verify.
pub const IS_EMBEDDED_RELEASE: bool = {
    // `==`/`match` on `&str` is not const-stable on current rustc, so compare
    // bytes (build.rs emits exactly "1" or "0").
    let bytes = env!("MUR_EMBEDDED_RELEASE").as_bytes();
    bytes.len() == 1 && bytes[0] == b'1'
};

/// MUR's Apple Developer Team ID (empty in dev builds; build.rs panics if the
/// marker is set without it).
pub const APPLE_TEAM_ID: &str = env!("MUR_APPLE_TEAM_ID");

/// The designated requirement used in production: valid signature chaining to
/// Apple plus a leaf certificate owned by MUR's team.
pub(crate) fn production_requirement() -> String {
    // Leading "=" marks the arg as literal requirement text to codesign (a
    // plain arg would be read as a file path); "designated =>" is accepted
    // only when *reading* a designated requirement, not as verification text.
    format!("=anchor apple generic and certificate leaf[subject.OU] = \"{APPLE_TEAM_ID}\"")
}

/// Verify `path` is a legitimate runtime binary. No-op unless this is a
/// macOS release build. Fail-closed: any verification error is returned.
pub fn verify_runtime_signature(path: &Path) -> Result<(), AttestError> {
    if !IS_EMBEDDED_RELEASE || !cfg!(target_os = "macos") {
        return Ok(());
    }
    // Canonicalize so a symlink or /var → /private/var redirect is verified
    // on the real file.
    let real = path.canonicalize().map_err(|e| AttestError::Io {
        path: path.to_path_buf(),
        source: e,
    })?;
    verify_with_requirement(&real, &production_requirement())
}

/// Testable core: run `codesign --verify --strict -R <requirement>` on `path`.
#[doc(hidden)]
pub fn verify_with_requirement(path: &Path, requirement: &str) -> Result<(), AttestError> {
    let out = Command::new("codesign")
        .args(["--verify", "--strict", "-R", requirement])
        .arg(path)
        .output()
        .map_err(|e| AttestError::Io {
            path: path.to_path_buf(),
            source: e,
        })?;
    if out.status.success() {
        Ok(())
    } else {
        Err(AttestError::VerificationFailed {
            path: path.to_path_buf(),
            stderr: String::from_utf8_lossy(&out.stderr).trim().to_string(),
        })
    }
}

#[derive(Debug)]
pub enum AttestError {
    /// The binary failed the designated requirement.
    VerificationFailed { path: PathBuf, stderr: String },
    /// Could not read/canonicalize the path or run codesign.
    Io {
        path: PathBuf,
        source: std::io::Error,
    },
}

impl fmt::Display for AttestError {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        match self {
            Self::VerificationFailed { path, stderr } => write!(
                f,
                "runtime binary at {} failed signature verification: {stderr}",
                path.display()
            ),
            Self::Io { path, source } => {
                write!(
                    f,
                    "cannot verify runtime binary at {}: {source}",
                    path.display()
                )
            }
        }
    }
}

impl std::error::Error for AttestError {
    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
        match self {
            Self::Io { source, .. } => Some(source),
            Self::VerificationFailed { .. } => None,
        }
    }
}

/// `codesign` stderr marker for a binary that carries no signature at all.
const STDERR_UNSIGNED: &str = "not signed at all";
/// `codesign` stderr marker for a valid signature from the wrong signer
/// (ad-hoc dev builds, a local re-sign identity, another team).
const STDERR_REQUIREMENT_UNMET: &str = "failed to satisfy specified code requirement";

/// Why attestation failed, as far as the error lets us tell. Drives the
/// remediation hint so a dev setup is not reported like a security event.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum AttestFailureKind {
    /// Intact binary, but not signed by MUR's Developer ID team — in
    /// practice a locally built runtime next to a release CLI.
    NotMurSigned,
    /// The signature no longer matches the bytes: modified after signing.
    Tampered,
    /// Could not read the binary or run `codesign`.
    Unverifiable,
}

impl AttestError {
    pub fn kind(&self) -> AttestFailureKind {
        match self {
            Self::Io { .. } => AttestFailureKind::Unverifiable,
            Self::VerificationFailed { stderr, .. } => {
                // codesign checks integrity before the requirement, so a
                // requirement miss means the bytes themselves are intact.
                if stderr.contains(STDERR_UNSIGNED) || stderr.contains(STDERR_REQUIREMENT_UNMET) {
                    AttestFailureKind::NotMurSigned
                } else {
                    AttestFailureKind::Tampered
                }
            }
        }
    }

    /// The remediation sentence for this failure. Shared by every mount site
    /// (CLI and Hub) so the guidance cannot drift between them.
    pub fn fix_hint(&self) -> &'static str {
        match self.kind() {
            AttestFailureKind::NotMurSigned => {
                "the runtime is not signed by MUR's Developer ID, which usually \
                 means a locally built (dev) mur-agent-runtime is installed next \
                 to a release mur. Fix: reinstall MUR to restore the release \
                 runtime, or use a dev build of mur together with the dev \
                 runtime. If you did not build it yourself, treat the binary as \
                 swapped and reinstall MUR."
            }
            AttestFailureKind::Tampered => {
                "the runtime binary was modified after it was signed \
                 (launch-chain protection covers writes, attestation covers \
                 swaps). Fix: reinstall MUR."
            }
            AttestFailureKind::Unverifiable => {
                "the runtime binary could not be checked. Fix: confirm the \
                 file exists and is readable, or reinstall MUR."
            }
        }
    }

    /// Full user-facing message for a refused runtime mount.
    pub fn mount_failure_message(&self) -> String {
        format!("{self} — {}", self.fix_hint())
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use std::path::PathBuf;

    // Compile-time gates: this binary is built without the release marker in
    // CI, so IS_EMBEDDED_RELEASE is false here — the skip behavior is the
    // negative control for every behavioral test below.
    // ── Remediation hint (#1716) ──────────────────────────────────────────
    // stderr strings are verbatim `codesign --verify --strict -R` output.
    fn failed(stderr: &str) -> AttestError {
        AttestError::VerificationFailed {
            path: PathBuf::from("/x/mur-agent-runtime"),
            stderr: stderr.to_string(),
        }
    }

    #[test]
    fn adhoc_dev_runtime_hint_names_dev_build_not_restart() {
        let e = failed("test-requirement: code failed to satisfy specified code requirement(s)");
        assert_eq!(e.kind(), AttestFailureKind::NotMurSigned);
        let msg = e.mount_failure_message();
        assert!(msg.contains("not signed by MUR's Developer ID"), "{msg}");
        assert!(msg.contains("dev build of mur"), "{msg}");
        assert!(msg.contains("reinstall MUR"), "{msg}");
        assert!(!msg.contains("--restart-agents"), "{msg}");
    }

    #[test]
    fn unsigned_runtime_is_not_mur_signed() {
        let e = failed("/x/mur-agent-runtime: code object is not signed at all");
        assert_eq!(e.kind(), AttestFailureKind::NotMurSigned);
    }

    #[test]
    fn modified_after_signing_is_tampered() {
        let e = failed("/x/mur-agent-runtime: main executable failed strict validation");
        assert_eq!(e.kind(), AttestFailureKind::Tampered);
        let msg = e.mount_failure_message();
        assert!(msg.contains("modified after it was signed"), "{msg}");
        assert!(!msg.contains("--restart-agents"), "{msg}");
    }

    #[test]
    fn io_failure_is_unverifiable() {
        let e = AttestError::Io {
            path: PathBuf::from("/x/mur-agent-runtime"),
            source: std::io::Error::from(std::io::ErrorKind::NotFound),
        };
        assert_eq!(e.kind(), AttestFailureKind::Unverifiable);
        assert!(
            e.mount_failure_message()
                .starts_with("cannot verify runtime binary at /x/mur-agent-runtime")
        );
    }

    #[test]
    #[allow(clippy::assertions_on_constants)] // runtime negative control on a compile-time const
    fn dev_build_never_verifies() {
        assert!(!IS_EMBEDDED_RELEASE);
        // verify_runtime_signature on a garbage path must still be Ok in dev:
        assert!(verify_runtime_signature(Path::new("/nonexistent/nope")).is_ok());
    }

    #[test]
    fn production_requirement_binds_anchor_and_team() {
        let req = production_requirement();
        assert!(req.contains("anchor apple generic"), "req: {req}");
        assert!(req.contains("subject.OU"), "req: {req}");
        assert!(req.starts_with("=anchor apple generic and"), "req: {req}");
    }

    // ── Behavioral matrix (macOS + test identity) ────────────────────────
    // These run only when MUR_TEST_SIGNING_OU is set (CI macOS job runs
    // scripts/test-signing-identity.sh first). Negative controls included.
    #[cfg(unix)]
    fn test_dir(name: &str) -> PathBuf {
        let d = std::env::temp_dir().join(format!("mur-attest-{}-{}", name, std::process::id()));
        let _ = std::fs::remove_dir_all(&d);
        std::fs::create_dir_all(&d).unwrap();
        d
    }

    #[cfg(unix)]
    fn test_ou() -> Option<String> {
        std::env::var("MUR_TEST_SIGNING_OU").ok()
    }

    #[test]
    #[cfg(unix)] // PermissionsExt::from_mode is unix-only (Windows CI compiles this module)
    fn unsigned_file_fails_test_requirement() {
        let Some(ou) = test_ou() else {
            eprintln!("skipping: MUR_TEST_SIGNING_OU not set");
            return;
        };
        let dir = test_dir("unsigned");
        let f = dir.join("runtime");
        std::fs::write(&f, b"#!/bin/sh\nexit 0\n").unwrap();
        std::fs::set_permissions(&f, std::fs::Permissions::from_mode(0o755)).unwrap();
        let req = format!("=certificate leaf[subject.OU] = \"{ou}\"");
        let err = verify_with_requirement(&f, &req).expect_err("unsigned must fail");
        assert!(matches!(err, AttestError::VerificationFailed { .. }));
        let _ = std::fs::remove_dir_all(&dir);
    }

    #[test]
    #[cfg(unix)] // PermissionsExt::from_mode is unix-only (Windows CI compiles this module)
    fn adhoc_signed_fails_test_requirement() {
        let Some(ou) = test_ou() else {
            eprintln!("skipping");
            return;
        };
        let dir = test_dir("adhoc");
        let f = dir.join("runtime");
        std::fs::write(&f, b"#!/bin/sh\nexit 0\n").unwrap();
        std::fs::set_permissions(&f, std::fs::Permissions::from_mode(0o755)).unwrap();
        let out = std::process::Command::new("codesign")
            .args(["--force", "-s", "-"])
            .arg(&f)
            .output()
            .unwrap();
        assert!(
            out.status.success(),
            "ad-hoc sign failed: {}",
            String::from_utf8_lossy(&out.stderr)
        );
        let req = format!("=certificate leaf[subject.OU] = \"{ou}\"");
        let err = verify_with_requirement(&f, &req).expect_err("ad-hoc (no OU) must fail");
        assert!(matches!(err, AttestError::VerificationFailed { .. }));
        let _ = std::fs::remove_dir_all(&dir);
    }

    #[test]
    #[cfg(unix)] // PermissionsExt::from_mode is unix-only (Windows CI compiles this module)
    fn wrong_ou_fails_test_requirement() {
        let Some(ou) = test_ou() else {
            eprintln!("skipping");
            return;
        };
        let dir = test_dir("wrongou");
        let f = dir.join("runtime");
        std::fs::write(&f, b"#!/bin/sh\nexit 0\n").unwrap();
        std::fs::set_permissions(&f, std::fs::Permissions::from_mode(0o755)).unwrap();
        let out = std::process::Command::new("codesign")
            .args(["--force", "-s", &format!("Mur Test ({ou})")])
            .arg(&f)
            .output()
            .unwrap();
        assert!(
            out.status.success(),
            "sign failed: {}",
            String::from_utf8_lossy(&out.stderr)
        );
        let wrong = "=certificate leaf[subject.OU] = \"WRONGTEAM000\"".to_string();
        let err = verify_with_requirement(&f, &wrong).expect_err("wrong OU must fail");
        assert!(matches!(err, AttestError::VerificationFailed { .. }));
        // Positive control: the same signed binary passes with the right OU.
        let right = format!("=certificate leaf[subject.OU] = \"{ou}\"");
        verify_with_requirement(&f, &right).expect("matching OU must pass");
        let _ = std::fs::remove_dir_all(&dir);
    }

    #[cfg(unix)]
    use std::os::unix::fs::PermissionsExt;
}