| 1 | import { type Database, schema } from '@ghost/db'; |
| 2 | import { Inject, Injectable |
| 3 | import { inArray } |
| 4 | |
| 5 | import { DATABASE } |
| 6 | import { readSignedCommits } |
| 7 | import { signingKeyIds, verifySignature |
| 8 | import { UsersService } |
| 9 | |
| 10 | export interface CommitVerification |
| 11 | verified: boolean; |
| 12 | /** Why the badge says what it says, short enough for a tooltip. */ |
| 13 | reason: string; |
| 14 | /** Long key id the signature names, lowercase hex. */ |
| 15 | keyId: string; |
| 16 | } |
| 17 | |
| 18 | /** Commit identity a verification is judged against. */ |
| 19 | export interface VerifiableCommit |
| 20 | sha: string; |
| 21 | authorEmail: string; |
| 22 | } |
| 23 | |
| 24 | @Injectable() |
| 25 | export class CommitVerificationService |
| 26 | constructor( |
| 27 | @Inject(DATABASE) |
| 28 | private readonly users |
| 29 | ) {} |
| 30 | |
| 31 | /** |
| 32 | * The signature status of each commit that carries one, keyed by sha. Unsigned commits are absent. |
| 33 | * |
| 34 | * Signatures are checked on read rather than stamped at push time: keys are added and removed after the fact, and the cache a commit is read from is rebuilt from the log, so a stored verdict would go stale either way. |
| 35 | */ |
| 36 | async verifyCommits({ |
| 37 | gitDir, |
| 38 | env, |
| 39 | commits, |
| 40 | }: { |
| 41 | gitDir: string |
| 42 | env?: Record |
| 43 | commits: VerifiableCommit |
| 44 | }): Promise |
| 45 | const verdicts = |
| 46 | if (commits.length |
| 47 | |
| 48 | const signed = |
| 49 | gitDir, |
| 50 | env, |
| 51 | shas: commits.map |
| 52 | }); |
| 53 | if (signed.size |
| 54 | |
| 55 | // The key id comes from the signature itself, so one lookup covers the whole page no matter how many people signed it. |
| 56 | const claimed = |
| 57 | for (const [sha |
| 58 | claimed.set(sha |
| 59 | } |
| 60 | |
| 61 | const keys = |
| 62 | |
| 63 | for (const commit |
| 64 | const entry = |
| 65 | if (!entry) |
| 66 | |
| 67 | const keyIds = |
| 68 | verdicts.set( |
| 69 | commit.sha, |
| 70 | await this.judge |
| 71 | ); |
| 72 | } |
| 73 | |
| 74 | return verdicts; |
| 75 | } |
| 76 | |
| 77 | private async judge |
| 78 | authorEmail, |
| 79 | payload, |
| 80 | signature, |
| 81 | keyIds, |
| 82 | keys, |
| 83 | }: VerifiableCommit |
| 84 | payload: string |
| 85 | signature: string |
| 86 | keyIds: string |
| 87 | keys: Map |
| 88 | }): Promise |
| 89 | const keyId = |
| 90 | const known = |
| 91 | |
| 92 | if (known.length |
| 93 | return { |
| 94 | verified: false, |
| 95 | reason: 'Signed with a key no Ghost account has uploaded', |
| 96 | keyId, |
| 97 | }; |
| 98 | } |
| 99 | |
| 100 | for (const key |
| 101 | const matches = |
| 102 | payload, |
| 103 | armoredSignature: signature, |
| 104 | armoredKey: key.publicKey |
| 105 | }); |
| 106 | if (!matches) |
| 107 | |
| 108 | // Holding a key proves who signed, never who authored: without this the badge would vouch for a commit forged under someone else's address. |
| 109 | if (!key.emails |
| 110 | return { |
| 111 | verified: false, |
| 112 | reason: `The signing key is not linked to ${authorEmail |
| 113 | keyId: key.keyId |
| 114 | }; |
| 115 | } |
| 116 | |
| 117 | return { |
| 118 | verified: true, |
| 119 | reason: 'Signed and verified', |
| 120 | keyId: key.keyId |
| 121 | }; |
| 122 | } |
| 123 | |
| 124 | return { |
| 125 | verified: false, |
| 126 | reason: 'Signature does not match the commit', |
| 127 | keyId, |
| 128 | }; |
| 129 | } |
| 130 | |
| 131 | /** Uploaded keys for these ids, each with the addresses its owner proved. */ |
| 132 | private async keysById |
| 133 | const wanted = |
| 134 | const found = |
| 135 | if (wanted.length |
| 136 | |
| 137 | const rows = |
| 138 | .select({ |
| 139 | keyId: schema.userGpgKey |
| 140 | publicKey: schema.userGpgKey |
| 141 | userId: schema.userGpgKey |
| 142 | }) |
| 143 | .from(schema.userGpgKey |
| 144 | .where(inArray(schema |
| 145 | if (rows.length |
| 146 | |
| 147 | const emails = |
| 148 | rows.map((row |
| 149 | ); |
| 150 | |
| 151 | for (const row |
| 152 | found.set(row |
| 153 | keyId: row.keyId |
| 154 | publicKey: row.publicKey |
| 155 | emails: emails.get |
| 156 | }); |
| 157 | } |
| 158 | |
| 159 | return found; |
| 160 | } |
| 161 | } |
| 162 | |
| 163 | interface KnownKey { |
| 164 | keyId: string; |
| 165 | publicKey: string; |
| 166 | /** Addresses the key's owner has verified, lowercased. */ |
| 167 | emails: string[] |
| 168 | } |