pray-cli 1.6.0

data/lib/pray/sync.rb

@@ -0,0 +1,219 @@
+# frozen_string_literal: true
+
+require "json"
+require "fileutils"
+require "uri"
+
+module Pray
+  module Sync
+    module_function
+
+    def synchronize_registry(root, peer_sources)
+      root = File.expand_path(root)
+      if peer_sources.empty?
+        raise Error.unsupported("no federation peers configured")
+      end
+
+      peer_sources.each do |peer|
+        if peer.start_with?("pray+ssh://", "ssh+pray://")
+          raise Error.unsupported("pray_ssh sync peers are not implemented yet in pray-cli Ruby")
+        end
+      end
+
+      known_peers = load_known_peers(root)
+      pending = peer_sources.dup
+      discovered = peer_sources.to_set
+      peer_sources.each { |url| upsert_known_peer(known_peers, {"name" => url, "url" => url, "public" => false}) }
+
+      package_versions = {}
+      peer_count = 0
+
+      while (peer_source = pending.shift)
+        next unless discovered.delete?(peer_source)
+
+        peer_count += 1
+        discovery = fetch_json("#{trim_slash(peer_source)}/.well-known/pray-federation.json")
+        unless discovery["spec"] == "pray-federation-v1"
+          raise Error.resolution("peer #{peer_source} does not speak the pray federation protocol")
+        end
+
+        Array(discovery["peers"]).each do |peer|
+          peer = normalize_peer(peer)
+          next if peer["url"] == peer_source
+
+          upsert_known_peer(known_peers, peer)
+          next if pending.include?(peer["url"]) || discovered.include?(peer["url"])
+
+          pending << peer["url"]
+          discovered << peer["url"]
+        end
+
+        index = fetch_json("#{trim_slash(peer_source)}/v1/sync/index")
+        unless index["spec"] == "prayfile-distribution-1"
+          raise Error.resolution(
+            "peer #{peer_source} returned unsupported registry index spec: #{index["spec"]}"
+          )
+        end
+
+        Array(index["packages"]).each do |summary|
+          name = summary["name"]
+          metadata = fetch_json("#{trim_slash(peer_source)}/v1/sync/package/#{name}")
+          unless metadata["name"] == name
+            raise Error.resolution(
+              "peer #{peer_source} returned mismatched package metadata for #{name}"
+            )
+          end
+          sync_package(root, peer_source, metadata, package_versions)
+        end
+      end
+
+      write_known_peers(root, known_peers)
+      write_local_index(root, package_versions)
+      {peers: peer_count, packages: package_versions.length, known_peers: known_peers.length}
+    end
+
+    def load_sync_peers(root)
+      path = File.join(root, "v1", "peers.json")
+      unless File.file?(path)
+        raise Error.unsupported("no federation peers configured")
+      end
+
+      Array(JSON.parse(File.read(path))).map { |peer| normalize_peer(peer) }
+    rescue JSON::ParserError => error
+      raise Error.parse("peer list", error.message)
+    end
+
+    def sync_package(root, peer_source, metadata, package_versions)
+      name = metadata["name"]
+      package_versions[name] ||= load_local_versions(root, name)
+
+      Array(metadata["versions"]).each do |version_data|
+        version = registry_version_from_transport(version_data)
+        existing = package_versions[name][version.version]
+        if existing
+          if same_identity?(existing, version)
+            package_versions[name][version.version] = existing
+            next
+          end
+          raise Error.integrity(
+            "conflicting metadata for package #{name} version #{version.version}"
+          )
+        end
+
+        artifact_hash = version.artifact_hash
+        unless artifact_hash
+          raise Error.integrity("federation package #{name} #{version.version} is missing an artifact hash")
+        end
+
+        bytes = fetch_bytes(peer_source, version.artifact)
+        computed = Hashing.sha256_prefixed(bytes)
+        if computed != artifact_hash
+          raise Error.integrity("artifact hash mismatch for #{name} #{version.version}")
+        end
+
+        write_artifact(root, version.artifact, bytes)
+        package_versions[name][version.version] = version
+      end
+    end
+
+    def registry_version_from_transport(data)
+      signer = data.dig("publisher", "id") || data["signer"]
+      fingerprint = data.dig("publisher", "key_fingerprint") || data["signer_fingerprint"]
+      signature = data.dig("signature", "value") || data["signature"]
+      RegistryPackageVersion.new(
+        version: data["version"].to_s,
+        artifact: data["artifact"].to_s,
+        artifact_hash: data["artifact_hash"].to_s,
+        tree_hash: data["tree_hash"],
+        yanked: data.fetch("yanked", false),
+        targets: Array(data["targets"]),
+        exports: Array(data["exports"]),
+        signer: signer,
+        signer_fingerprint: fingerprint,
+        published_at: data["published_at"],
+        signature: signature.is_a?(Hash) ? signature["value"] : signature
+      )
+    end
+
+    def same_identity?(left, right)
+      left.artifact_hash == right.artifact_hash && left.tree_hash == right.tree_hash
+    end
+
+    def load_local_versions(root, package_name)
+      path = Publish.registry_metadata_path(root, package_name)
+      metadata = Publish.load_registry_package_metadata(path, package_name)
+      metadata.versions.to_h { |version| [version.version, version] }
+    end
+
+    def write_local_index(root, package_versions)
+      package_versions.each do |name, versions|
+        metadata = RegistryPackageMetadata.new(name: name, versions: versions.values)
+        Publish.write_registry_package_metadata(
+          Publish.registry_metadata_path(root, name), metadata
+        )
+      end
+      index = Publish.load_registry_index(root)
+      names = index.packages.to_set
+      package_versions.each_key { |name| names << name }
+      index.packages = names.sort
+      Publish.write_registry_index(root, index)
+    end
+
+    def write_artifact(root, artifact_path, bytes)
+      relative = PathSafety.sanitize_relative_path(artifact_path)
+      path = File.join(root, relative)
+      FileUtils.mkdir_p(File.dirname(path))
+      File.binwrite(path, bytes)
+    end
+
+    def load_known_peers(root)
+      path = File.join(root, "v1", "peers.json")
+      return [] unless File.file?(path)
+
+      Array(JSON.parse(File.read(path))).map { |peer| normalize_peer(peer) }
+    rescue JSON::ParserError
+      []
+    end
+
+    def write_known_peers(root, peers)
+      path = File.join(root, "v1", "peers.json")
+      FileUtils.mkdir_p(File.dirname(path))
+      File.write(path, JSON.pretty_generate(peers))
+    end
+
+    def upsert_known_peer(peers, peer)
+      existing = peers.find { |entry| entry["url"] == peer["url"] }
+      if existing
+        existing.merge!(peer)
+      else
+        peers << peer
+      end
+    end
+
+    def normalize_peer(peer)
+      url = peer["url"].to_s
+      raise Error.parse("peer list", "peer url is required") if url.empty?
+
+      {"name" => peer["name"].to_s.empty? ? url : peer["name"], "url" => url,
+       "public" => !!peer["public"]}
+    end
+
+    def fetch_json(url)
+      JSON.parse(Registry.http_get(url))
+    rescue JSON::ParserError => error
+      raise Error.parse("federation response", error.message)
+    end
+
+    def fetch_bytes(peer_source, artifact)
+      if artifact.start_with?("http://", "https://")
+        return Registry.http_get(artifact).b
+      end
+
+      Registry.http_get("#{trim_slash(peer_source)}/#{artifact.delete_prefix("/")}").b
+    end
+
+    def trim_slash(value)
+      value.to_s.sub(%r{/+\z}, "")
+    end
+  end
+end

data/lib/pray/terminal.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module Pray
+  module Terminal
+    module_function
+
+    def color_enabled?
+      return false if env_truthy?("PRAY_NO_COLOR") || no_color_requested?
+
+      term = ENV.fetch("TERM", nil)
+      term.nil? || term != "dumb"
+    end
+
+    def no_color_requested?
+      value = ENV.fetch("NO_COLOR", nil)
+      !value.nil? && !value.empty?
+    end
+
+    def no_input_requested?
+      env_truthy?("PRAY_NO_INPUT")
+    end
+
+    def env_truthy?(name)
+      value = ENV.fetch(name, nil)
+      return false if value.nil?
+
+      %w[1 true yes on].include?(value.strip.downcase)
+    end
+  end
+end

data/lib/pray/trust.rb

@@ -0,0 +1,201 @@
+# frozen_string_literal: true
+
+require "toml-rb"
+require "fileutils"
+
+module Pray
+  TrustRule = Struct.new(
+    :match_prefix, :allow, :require_signed_commit,
+    :allowed_signing_keys, :allowed_host_keys, :allowed_publishers
+  ) do
+    def initialize(
+      match_prefix: nil, allow: true, require_signed_commit: false,
+      allowed_signing_keys: [], allowed_host_keys: [], allowed_publishers: []
+    )
+      super
+    end
+  end
+
+  TrustPolicy = Struct.new(:default_rule, :rules) do
+    def initialize(default_rule: TrustRule.new, rules: [])
+      super
+    end
+  end
+
+  CompromisedKeyEntry = Struct.new(:key, :reason, :reference, :reported_at, keyword_init: true)
+
+  module Trust
+    module_function
+
+    def trust_home
+      return ENV["PRAY_HOME"] if ENV["PRAY_HOME"]
+
+      home = ENV["HOME"]
+      raise Error.manifest("HOME is not set; set PRAY_HOME to configure trust policy") unless home
+
+      File.join(home, ".pray")
+    end
+
+    def trust_policy_path(home = trust_home)
+      File.join(home, "trust.toml")
+    end
+
+    def load_policy(home = trust_home)
+      path = trust_policy_path(home)
+      return nil unless File.file?(path)
+
+      parse_policy(TomlRB.load_file(path))
+    rescue TomlRB::ParseError => error
+      raise Error.parse("trust policy", "#{path}: #{error.message}")
+    end
+
+    def load_policy_or_default(home = trust_home)
+      load_policy(home) || TrustPolicy.new
+    end
+
+    def save_policy(policy, home = trust_home)
+      path = trust_policy_path(home)
+      FileUtils.mkdir_p(File.dirname(path))
+      File.write(path, "#{format_policy(policy)}\n")
+    end
+
+    def parse_policy(data)
+      TrustPolicy.new(
+        default_rule: parse_rule(data["default"] || {}),
+        rules: Array(data["rules"]).map { |entry| parse_rule(entry) }
+      )
+    end
+
+    def parse_rule(data)
+      TrustRule.new(
+        match_prefix: data["match_prefix"],
+        allow: data.fetch("allow", true),
+        require_signed_commit: data.fetch("require_signed_commit", false),
+        allowed_signing_keys: Array(data["allowed_signing_keys"]),
+        allowed_host_keys: Array(data["allowed_host_keys"]),
+        allowed_publishers: Array(data["allowed_publishers"])
+      )
+    end
+
+    def best_rule(policy, source_url)
+      selected = nil
+      selected_length = 0
+      policy.rules.each do |rule|
+        prefix = rule.match_prefix
+        next if prefix.nil? || prefix.empty?
+        next unless source_url.start_with?(prefix)
+        next unless prefix.length > selected_length
+
+        selected = rule
+        selected_length = prefix.length
+      end
+      selected || policy.default_rule
+    end
+
+    def mutable_rule_for_match_prefix!(policy, match_prefix)
+      existing = policy.rules.find { |rule| rule.match_prefix == match_prefix }
+      return existing if existing
+
+      rule = TrustRule.new(match_prefix: match_prefix)
+      policy.rules << rule
+      rule
+    end
+
+    def normalize_key(value)
+      value.strip.upcase
+    end
+
+    def fingerprint_matches?(allowed, candidate)
+      normalize_key(allowed) == candidate || candidate.end_with?(normalize_key(allowed))
+    end
+
+    def prepare_source_host_keys(sources)
+      policy = load_policy_or_default
+      sources.each_with_object({}) do |source, host_keys|
+        next unless source.kind == "pray_ssh"
+
+        rule = best_rule(policy, source.url)
+        fingerprint = rule.allowed_host_keys.first
+        host_keys[source.name] = fingerprint if fingerprint
+      end
+    end
+
+    def verify_publisher_fingerprint!(source_url, selected)
+      return unless selected.signature
+      return unless selected.signer_fingerprint
+
+      policy = load_policy_or_default
+      rule = best_rule(policy, source_url)
+      return if rule.allowed_publishers.empty?
+
+      normalized = normalize_key(selected.signer_fingerprint)
+      trusted = rule.allowed_publishers.any? do |publisher|
+        fingerprint_matches?(publisher, normalized)
+      end
+      return if trusted
+
+      raise Error.integrity(
+        "publisher fingerprint #{selected.signer_fingerprint} is not trusted for #{source_url}"
+      )
+    end
+
+    def format_policy(policy)
+      lines = ["[default]"]
+      lines.concat(format_rule_lines(policy.default_rule))
+      policy.rules.each do |rule|
+        lines << ""
+        lines << "[[rules]]"
+        lines << "match_prefix = #{rule.match_prefix.inspect}" if rule.match_prefix
+        lines.concat(format_rule_lines(rule))
+      end
+      lines.join("\n")
+    end
+
+    def format_rule_lines(rule)
+      [
+        "allow = #{rule.allow}",
+        "require_signed_commit = #{rule.require_signed_commit}",
+        "allowed_signing_keys = #{toml_array(rule.allowed_signing_keys)}",
+        "allowed_host_keys = #{toml_array(rule.allowed_host_keys)}",
+        "allowed_publishers = #{toml_array(rule.allowed_publishers)}"
+      ]
+    end
+
+    def toml_array(values)
+      "[#{values.map(&:inspect).join(", ")}]"
+    end
+
+    def format_rule_block(scope, rule)
+      lines = [
+        scope,
+        "  allow: #{rule.allow}",
+        "  require_signed_commit: #{rule.require_signed_commit}",
+        format_keyed_list("allowed_signing_keys", rule.allowed_signing_keys),
+        format_keyed_list("allowed_host_keys", rule.allowed_host_keys),
+        format_keyed_list("allowed_publishers", rule.allowed_publishers)
+      ]
+      "#{lines.join("\n")}\n"
+    end
+
+    def format_keyed_list(name, values)
+      return "  #{name}: []" if values.empty?
+
+      ["  #{name}:", *values.map { |value| "    - #{value}" }].join("\n")
+    end
+
+    def append_missing!(target, keys)
+      added = 0
+      keys.each do |key|
+        normalized = normalize_key(key)
+        next if normalized.empty?
+        next if target.any? { |existing| normalize_key(existing) == normalized }
+
+        target << normalized
+        added += 1
+      end
+      added
+    end
+  end
+end
+
+require_relative "trust_ops"

data/lib/pray/trust_feed.rb

@@ -0,0 +1,110 @@
+# frozen_string_literal: true
+
+require "net/http"
+require "uri"
+
+module Pray
+  module Trust
+    DEFAULT_COMPROMISED_KEYS_SOURCE =
+      "https://raw.githubusercontent.com/bmx-rs/trust-lists/main/compromised-keys.toml"
+
+    module_function
+
+    def check_compromised(source = nil, home: trust_home)
+      source_description, body = fetch_compromised_feed(source)
+      entries = parse_compromised_feed(body, source_description)
+      [source_description, compromised_hits(home, entries)]
+    end
+
+    def parse_compromised_feed(body, source_hint)
+      if source_hint.downcase.end_with?(".txt")
+        parse_compromised_txt(body)
+      else
+        parse_compromised_toml(body)
+      end
+    end
+
+    def fetch_compromised_feed(source)
+      url = source || DEFAULT_COMPROMISED_KEYS_SOURCE
+      if url.start_with?("http://", "https://")
+        uri = URI(url)
+        response = Net::HTTP.start(
+          uri.hostname, uri.port, use_ssl: uri.scheme == "https",
+          open_timeout: 10, read_timeout: 30
+        ) { |http| http.get(uri.request_uri) }
+        unless response.is_a?(Net::HTTPSuccess)
+          raise Error.resolution("HTTP request failed for #{url}: #{response.code}")
+        end
+
+        return [url, response.body]
+      end
+
+      path = File.expand_path(url)
+      [path, File.read(path)]
+    end
+
+    def parse_compromised_toml(body)
+      data = TomlRB.parse(body)
+      Array(data["keys"]).filter_map do |entry|
+        key = normalize_key(entry["value"].to_s)
+        next if key.empty?
+
+        CompromisedKeyEntry.new(
+          key: key, reason: entry["reason"],
+          reference: entry["reference"], reported_at: entry["reported_at"]
+        )
+      end
+    rescue TomlRB::ParseError
+      []
+    end
+
+    def parse_compromised_txt(body)
+      body.each_line.filter_map do |raw_line|
+        line = raw_line.strip
+        next if line.empty? || line.start_with?("#")
+
+        head, reason = line.split("#", 2)
+        key = normalize_key(head.to_s.split(/\s+/).first.to_s)
+        next if key.empty?
+
+        CompromisedKeyEntry.new(
+          key: key,
+          reason: reason&.strip&.empty? ? nil : reason&.strip,
+          reference: nil, reported_at: nil
+        )
+      end
+    end
+
+    def compromised_hits(home, entries)
+      trusted = trusted_keys_by_scope(home)
+      return [] if trusted.empty?
+
+      by_key = entries.group_by(&:key)
+      trusted.filter_map do |key, scopes|
+        matches = by_key[key]
+        next unless matches
+
+        [key, scopes, matches]
+      end
+    end
+
+    def trusted_keys_by_scope(home)
+      policy = load_policy(home)
+      return {} unless policy
+
+      output = Hash.new { |hash, key| hash[key] = [] }
+      policy.default_rule.allowed_signing_keys.each do |key|
+        normalized = normalize_key(key)
+        output[normalized] << "global/default" unless normalized.empty?
+      end
+      policy.rules.each do |rule|
+        scope = "local:#{rule.match_prefix || "-"}"
+        rule.allowed_signing_keys.each do |key|
+          normalized = normalize_key(key)
+          output[normalized] << scope unless normalized.empty?
+        end
+      end
+      output
+    end
+  end
+end