| 1 | import { type Database, schema } from '@ghost/db'; |
| 2 | import { Inject, Injectable |
| 3 | import { inArray } |
| 4 | |
| 5 | import { DATABASE } |
| 6 | import { readSignedCommits } |
| 7 | import { GITHUB_WEB_FLOW_KEYS } |
| 8 | import { |
| 9 | publicKeyIds, |
| 10 | signingKeyIds, |
| 11 | verifySignature, |
| 12 | } from '../../lib/gpg/openpgp.js'; |
| 13 | import { UsersService } |
| 14 | import { CommitSigningService } |
| 15 | |
| 16 | export interface CommitVerification |
| 17 | verified: boolean; |
| 18 | /** Why the badge says what it says, short enough for a tooltip. */ |
| 19 | reason: string; |
| 20 | /** Long key id the signature names, lowercase hex. */ |
| 21 | keyId: string; |
| 22 | } |
| 23 | |
| 24 | export interface VerifiableCommit |
| 25 | sha: string; |
| 26 | authorEmail: string; |
| 27 | } |
| 28 | |
| 29 | @Injectable() |
| 30 | export class CommitVerificationService |
| 31 | private platformKeys?: |
| 32 | |
| 33 | constructor( |
| 34 | @Inject(DATABASE) |
| 35 | private readonly users |
| 36 | private readonly signing |
| 37 | ) {} |
| 38 | |
| 39 | /** The signature status of each commit that carries one, keyed by sha; unsigned commits are absent. Checked on read, not stamped at push: keys change after the fact and the cache is rebuilt from the log, so a stored verdict would go stale. */ |
| 40 | async verifyCommits({ |
| 41 | gitDir, |
| 42 | env, |
| 43 | commits, |
| 44 | }: { |
| 45 | gitDir: string |
| 46 | env?: Record |
| 47 | commits: VerifiableCommit |
| 48 | }): Promise |
| 49 | const verdicts = |
| 50 | if (commits.length |
| 51 | |
| 52 | const signed = |
| 53 | gitDir, |
| 54 | env, |
| 55 | shas: commits.map |
| 56 | }); |
| 57 | if (signed.size |
| 58 | |
| 59 | // The key id comes from the signature itself, so one lookup covers the whole page no matter how many people signed it. |
| 60 | const claimed = |
| 61 | for (const [sha |
| 62 | claimed.set(sha |
| 63 | } |
| 64 | |
| 65 | const keys = |
| 66 | const platform = |
| 67 | |
| 68 | for (const commit |
| 69 | const entry = |
| 70 | if (!entry) |
| 71 | |
| 72 | const keyIds = |
| 73 | verdicts.set( |
| 74 | commit.sha, |
| 75 | await this.judge |
| 76 | ); |
| 77 | } |
| 78 | |
| 79 | return verdicts; |
| 80 | } |
| 81 | |
| 82 | private async judge |
| 83 | authorEmail, |
| 84 | payload, |
| 85 | signature, |
| 86 | keyIds, |
| 87 | keys, |
| 88 | platform, |
| 89 | }: VerifiableCommit |
| 90 | payload: string |
| 91 | signature: string |
| 92 | keyIds: string |
| 93 | keys: Map |
| 94 | platform: Map |
| 95 | }): Promise |
| 96 | const keyId = |
| 97 | const known = |
| 98 | const vouching = |
| 99 | |
| 100 | // A platform signs what it wrote itself, under whatever author the commit names, so no address is checked. It is tried first: anyone can upload GitHub's public key to their own account. |
| 101 | for (const { |
| 102 | if ( |
| 103 | await verifySignature({ |
| 104 | payload, |
| 105 | armoredSignature: signature, |
| 106 | armoredKey, |
| 107 | }) |
| 108 | ) { |
| 109 | return { verified: |
| 110 | } |
| 111 | } |
| 112 | |
| 113 | if (known.length |
| 114 | return { |
| 115 | verified: false, |
| 116 | reason: 'Signed with a key no Ghost account has uploaded', |
| 117 | keyId, |
| 118 | }; |
| 119 | } |
| 120 | |
| 121 | for (const key |
| 122 | const matches = |
| 123 | payload, |
| 124 | armoredSignature: signature, |
| 125 | armoredKey: key.publicKey |
| 126 | }); |
| 127 | if (!matches) |
| 128 | |
| 129 | // Holding a key proves who signed, never who authored: without this the badge would vouch for a commit forged under someone else's address. |
| 130 | if (!key.emails |
| 131 | return { |
| 132 | verified: false, |
| 133 | reason: `The signing key is not linked to ${authorEmail |
| 134 | keyId: key.keyId |
| 135 | }; |
| 136 | } |
| 137 | |
| 138 | return { |
| 139 | verified: true, |
| 140 | reason: 'Signed and verified', |
| 141 | keyId: key.keyId |
| 142 | }; |
| 143 | } |
| 144 | |
| 145 | return { |
| 146 | verified: false, |
| 147 | reason: 'Signature does not match the commit', |
| 148 | keyId, |
| 149 | }; |
| 150 | } |
| 151 | |
| 152 | /** Keys of the platforms that sign their own commits, by every key id they can sign under. */ |
| 153 | private platformKeysById(): |
| 154 | this.platformKeys ??= |
| 155 | const platforms = |
| 156 | { signer: 'GitHub', |
| 157 | ...(this.signing |
| 158 | ? [{ signer: ' |
| 159 | : []), |
| 160 | ]; |
| 161 | const byId = |
| 162 | for (const platform |
| 163 | for (const id |
| 164 | byId.set(id |
| 165 | } |
| 166 | } |
| 167 | return byId; |
| 168 | })(); |
| 169 | return this.platformKeys |
| 170 | } |
| 171 | |
| 172 | /** Uploaded keys for these ids, each with the addresses its owner proved. */ |
| 173 | private async keysById |
| 174 | const wanted = |
| 175 | const found = |
| 176 | if (wanted.length |
| 177 | |
| 178 | const rows = |
| 179 | .select({ |
| 180 | keyId: schema.userGpgKey |
| 181 | publicKey: schema.userGpgKey |
| 182 | userId: schema.userGpgKey |
| 183 | }) |
| 184 | .from(schema.userGpgKey |
| 185 | .where(inArray(schema |
| 186 | if (rows.length |
| 187 | |
| 188 | const emails = |
| 189 | rows.map((row |
| 190 | ); |
| 191 | |
| 192 | for (const row |
| 193 | found.set(row |
| 194 | keyId: row.keyId |
| 195 | publicKey: row.publicKey |
| 196 | emails: emails.get |
| 197 | }); |
| 198 | } |
| 199 | |
| 200 | return found; |
| 201 | } |
| 202 | } |
| 203 | |
| 204 | interface KnownKey { |
| 205 | keyId: string; |
| 206 | publicKey: string; |
| 207 | /** Addresses the key's owner has verified, lowercased. */ |
| 208 | emails: string[] |
| 209 | } |
| 210 | |
| 211 | interface PlatformKey { |
| 212 | /** Who the badge says signed, such as `GitHub`. */ |
| 213 | signer: string; |
| 214 | armoredKey: string; |
| 215 | } |