@intentius/chant 0.122.0 → 0.123.0

package/src/workspace/trust/seal.ts

@@ -28,7 +28,11 @@ import { homedir, tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import type { SealCode } from "../records";
 import { type TrustPolicy } from "./policy";
+import type { Signer } from "./trust-files";
 import { sshKeygen, verifySshSignature } from "./ssh-commit";
+import { GATE_SEAL_NAMESPACE, gateSealPayload, namespaceAllowed, sshSignatureKey, verifySshSignatureWith, type SealedGateApproval } from "./gate-seal";
+
+export { GATE_SEAL_NAMESPACE, gateSealPayload, type SealedGateApproval } from "./gate-seal";
 
 /** The ssh signature namespace of a verdict seal. */
 export const REVIEW_SEAL_NAMESPACE = "chant-review";
@@ -36,12 +40,6 @@ export const REVIEW_SEAL_NAMESPACE = "chant-review";
 /** The ssh signature namespace of a record's author seal (#2688). */
 export const RECORD_SEAL_NAMESPACE = "chant-record";
 
-/**
- * The ssh signature namespace of a gate approval's seal (#3163, ws-080), so a
- * verdict, record or commit signature can't stand in for one.
- */
-export const GATE_SEAL_NAMESPACE = "chant-gate";
-
 /** A seal as a review entry holds it. */
 export interface VerdictSeal {
   /** The principal who signed: the reviewer, as the signers file names them. */
@@ -87,33 +85,6 @@ export function recordSealPayload(record: string, digest: string, author: string
   return Buffer.from(`${record}\n${digest}\n${author}\n${state ?? ""}`, "utf-8");
 }
 
-/** The gate approval a seal covers (#3163): the fields of a gate resolution line that say what was approved, by whom and when. */
-export interface SealedGateApproval {
-  op: string;
-  gate: string;
-  environment?: string;
-  planDigest?: string;
-  resolvedBy: string;
-  /** Who relayed the approval for `resolvedBy` (#3402), when someone did. */
-  relayedBy?: string;
-  timestamp: string;
-  seal?: unknown;
-}
-
-/**
- * The bytes a gate approval's seal signs (#3163): the op (or component), the
- * gate, the environment, the plan digest, the approver and the time, joined
- * by LF with no final newline. An approval that binds no environment or plan
- * signs an empty line for it. A relayed approval (#3402) signs a seventh line,
- * `relayed-by <principal>`, so the relay can't be added, changed or removed
- * after sealing; an approval nobody relayed signs the six lines it always did,
- * so seals made before #3402 still verify.
- */
-export function gateSealPayload(a: SealedGateApproval): Buffer {
-  const relay = a.relayedBy !== undefined ? `\nrelayed-by ${a.relayedBy}` : "";
-  return Buffer.from(`${a.op}\n${a.gate}\n${a.environment ?? ""}\n${a.planDigest ?? ""}\n${a.resolvedBy}\n${a.timestamp}${relay}`, "utf-8");
-}
-
 /** The record an author seal covers (#2688). */
 export interface SealedRecord {
   record: string | null;
@@ -239,14 +210,28 @@ function checkSeal(policy: TrustPolicy, s: SealSubject): SealCheck {
   if (listed.length === 0) {
     return { attested: false, code: "seal-signer-unlisted", message: `${s.principal} has no key in ${where}, so the seal can't count` };
   }
-  const r = verifySshSignature(listed, s.payload, seal.signature, s.namespace);
+  const r = s.namespace === GATE_SEAL_NAMESPACE ? verifyGate(listed, s.payload, seal.signature) : verifySshSignature(listed, s.payload, seal.signature, s.namespace);
   if (r.ok) return { attested: true, message: `sealed by ${r.principal}${r.key ? ` with ${r.key}` : ""}, a signer ${where} lists`, ...(r.key ? { key: r.key } : {}) };
   if (r.missing) return { attested: null, code: "seal-unverifiable", message: `the seal by ${s.principal} can't be checked here: ${r.reason}` };
   return { attested: false, code: "seal-signature-invalid", message: `the seal does not verify for ${s.principal} against ${where}: ${r.reason}` };
 }
 
+/** A gate seal checked with node:crypto (#3785) against the keys `listed` for the approver in the gate namespace. */
+function verifyGate(listed: Signer[], payload: Buffer, signature: string): { ok: true; principal: string; key: string; missing?: undefined } | { ok: false; missing?: false; reason: string } {
+  const keys = listed.filter((x) => namespaceAllowed(x.namespaces, GATE_SEAL_NAMESPACE)).map((x) => Buffer.from(x.key.split(" ")[1] ?? "", "base64"));
+  const r = verifySshSignatureWith(signature, payload, GATE_SEAL_NAMESPACE, keys);
+  return r.ok ? { ok: true, principal: listed[0]!.principal, key: r.key } : { ok: false, reason: r.reason };
+}
+
 /** A seal checked with no signers file: is the signature over these bytes intact? */
 function checkIntegrity(principal: string, payload: Buffer, signature: string, namespace: string): SealCheck {
+  if (namespace === GATE_SEAL_NAMESPACE) {
+    // A gate seal is checked with node:crypto (#3785), against the key it carries.
+    const pk = sshSignatureKey(signature);
+    const r = pk ? verifySshSignatureWith(signature, payload, namespace, [pk]) : ({ ok: false, reason: "it is not an SSHSIG" } as const);
+    if (!r.ok) return { attested: false, code: "seal-signature-invalid", message: `the seal by ${principal} does not verify over this approval, even without a signers file` };
+    return { attested: null, code: "seal-unverifiable", message: `the signature is intact (${r.key}), and there is no signers file at base to say whose key it is`, key: r.key };
+  }
   const dir = mkdtempSync(join(tmpdir(), "chant-seal-"));
   try {
     const sigFile = join(dir, "signature");

package/src/workspace/trust/trust-files.test.ts

@@ -0,0 +1,50 @@
+/**
+ * #3763: the zod-free check of `.chant/trust.json` accepts exactly what the
+ * trust policy's zod schema accepts, so a bundled reader turns attestation
+ * off for the same files chant does.
+ */
+
+import { describe, expect, test } from "vitest";
+import { trustConfigSchema } from "./policy";
+import { trustConfigProblems } from "./trust-files";
+
+const commit = "a".repeat(40);
+const ed = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOv1";
+
+const cases: Array<[string, unknown]> = [
+  ["the smallest", { schema: 1 }],
+  ["everything", {
+    schema: 1,
+    signers: "ops/allowed_signers",
+    roles: { admin: ["alice"], "release-1": ["bob", "carol"] },
+    adopted: [{ to: commit }, { from: commit, to: "b".repeat(64), note: "import" }],
+    runners: [{ principal: "ci", class: "runner", key: ed }],
+    admitted: [{ return: "ret-0123456789ab", signers: [{ principal: "dana", key: "ssh-rsa AAAAB3Nza==" }], note: "n" }],
+  }],
+  ["schema 2", { schema: 2 }],
+  ["no schema", {}],
+  ["not an object", [1]],
+  ["null", null],
+  ["an unknown key", { schema: 1, extra: true }],
+  ["an absolute signers path", { schema: 1, signers: "/etc/signers" }],
+  ["a signers path with ..", { schema: 1, signers: "a/../b" }],
+  ["a signers path that is not normal", { schema: 1, signers: "./a" }],
+  ["a signers path with a backslash", { schema: 1, signers: "a\\b" }],
+  ["an empty signers path", { schema: 1, signers: "" }],
+  ["a role name with capitals", { schema: 1, roles: { Admin: ["a"] } }],
+  ["a role with an empty principal", { schema: 1, roles: { admin: [""] } }],
+  ["roles as a list", { schema: 1, roles: [] }],
+  ["a short adopted commit", { schema: 1, adopted: [{ to: "abc" }] }],
+  ["an adopted range with an extra key", { schema: 1, adopted: [{ to: commit, by: "x" }] }],
+  ["a runner with an rsa key", { schema: 1, runners: [{ principal: "ci", class: "runner", key: "ssh-rsa AAAA" }] }],
+  ["a runner of another class", { schema: 1, runners: [{ principal: "ci", class: "human", key: ed }] }],
+  ["an admission with no signers", { schema: 1, admitted: [{ return: "ret-0123456789ab", signers: [] }] }],
+  ["an admission with a bad id", { schema: 1, admitted: [{ return: "ret-1", signers: [{ principal: "d", key: ed }] }] }],
+  ["an admitted key with a comment", { schema: 1, admitted: [{ return: "ret-0123456789ab", signers: [{ principal: "d", key: `${ed} dana@laptop` }] }] }],
+];
+
+describe("trustConfigProblems", () => {
+  test.each(cases)("agrees with the zod schema: %s", (_name, raw) => {
+    expect(trustConfigProblems(raw).length === 0).toBe(trustConfigSchema.safeParse(raw).success);
+  });
+});

package/src/workspace/trust/trust-files.ts

@@ -0,0 +1,245 @@
+/**
+ * The trust files' plain readers (#3763): the signers file's parser, and a
+ * check of `.chant/trust.json` that says what `./policy.ts`'s zod schema
+ * says, so a bundle can read both without zod. `./policy.ts` re-exports the
+ * parser; `trust-files.test.ts` holds the check to the schema.
+ */
+
+import { posix } from "node:path";
+
+/** The trust config, relative to the repository root. Fixed: it is how the signers path is overridden. */
+export const TRUST_CONFIG_PATH = ".chant/trust.json";
+
+/** Where the signers are when `trust.json` names no other path. */
+export const DEFAULT_SIGNERS_PATH = ".chant/allowed_signers";
+
+// ── allowed_signers ──────────────────────────────────────────────────────────
+
+/** Key types ssh-keygen accepts in an allowed_signers line. */
+const KEY_TYPES = new Set([
+  "ssh-ed25519",
+  "ssh-rsa",
+  "ecdsa-sha2-nistp256",
+  "ecdsa-sha2-nistp384",
+  "ecdsa-sha2-nistp521",
+  "sk-ssh-ed25519@openssh.com",
+  "sk-ecdsa-sha2-nistp256@openssh.com",
+]);
+
+/** One usable signer: a principal and the public key it signs with. */
+export interface Signer {
+  principal: string;
+  /** `<type> <base64>`, with no comment. */
+  key: string;
+  /** The `namespaces="..."` option as written, or undefined when the key may sign any namespace. */
+  namespaces?: string;
+  /** 1-based line in the signers file. */
+  line: number;
+}
+
+/** A line of the signers file that is not used, and why. */
+export interface ExcludedSigner {
+  line: number;
+  reason: string;
+}
+
+export interface SignerSet {
+  signers: Signer[];
+  excluded: ExcludedSigner[];
+}
+
+/**
+ * Split one line into fields. Double quotes group, so an option such as
+ * `namespaces="git,file"` stays one field.
+ */
+function fields(line: string): string[] {
+  const out: string[] = [];
+  let cur = "";
+  let quoted = false;
+  let any = false;
+  for (const ch of line) {
+    if (ch === '"') {
+      quoted = !quoted;
+      cur += ch;
+      any = true;
+    } else if (!quoted && (ch === " " || ch === "\t")) {
+      if (any) out.push(cur);
+      cur = "";
+      any = false;
+    } else {
+      cur += ch;
+      any = true;
+    }
+  }
+  if (any) out.push(cur);
+  return out;
+}
+
+/** `a="x,y",b` as `{ a: "x,y", b: "" }`. */
+function options(field: string): Map<string, string> {
+  const opts = new Map<string, string>();
+  let cur = "";
+  let quoted = false;
+  const flush = () => {
+    if (!cur) return;
+    const eq = cur.indexOf("=");
+    const name = (eq < 0 ? cur : cur.slice(0, eq)).toLowerCase();
+    const value = eq < 0 ? "" : cur.slice(eq + 1).replace(/^"|"$/g, "");
+    opts.set(name, value);
+    cur = "";
+  };
+  for (const ch of field) {
+    if (ch === '"') quoted = !quoted;
+    if (ch === "," && !quoted) flush();
+    else cur += ch;
+  }
+  flush();
+  return opts;
+}
+
+/**
+ * Parse an allowed_signers file, keeping only lines whose meaning does not
+ * depend on anything the signer controls.
+ *
+ * Refused, each with a reason, rather than passed to ssh-keygen:
+ *
+ * - `valid-after` and `valid-before`. git checks them against the commit's own
+ *   date, which whoever makes the commit sets. A backdated commit would pass a
+ *   window its key has left. Revocation is by position in history (#2553),
+ *   never by date.
+ * - `cert-authority`. A certificate's validity is also a date, and a CA key
+ *   vouches for keys this file never names.
+ * - Principal patterns (`*`, `?`, `!`). A signer is named by one exact
+ *   principal, so role grants can name it.
+ */
+export function parseAllowedSigners(text: string): SignerSet {
+  const signers: Signer[] = [];
+  const excluded: ExcludedSigner[] = [];
+  const lines = text.replace(/\r\n?/g, "\n").split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = i + 1;
+    const raw = lines[i].trim();
+    if (!raw || raw.startsWith("#")) continue;
+    const f = fields(raw);
+    if (f.length < 3) {
+      excluded.push({ line, reason: "expected principals, optional options, a key type and a key" });
+      continue;
+    }
+    const [principals, second] = f;
+    const hasOptions = !KEY_TYPES.has(second);
+    const type = hasOptions ? f[2] : second;
+    const blob = hasOptions ? f[3] : f[2];
+    if (!KEY_TYPES.has(type) || !blob || !/^[A-Za-z0-9+/]+={0,2}$/.test(blob)) {
+      excluded.push({ line, reason: `no supported public key (${type ?? "none"})` });
+      continue;
+    }
+    const opts = hasOptions ? options(second) : new Map<string, string>();
+    const timed = ["valid-after", "valid-before"].filter((o) => opts.has(o));
+    if (timed.length > 0) {
+      excluded.push({
+        line,
+        reason: `${timed.join(" and ")} is checked against the commit's own date, which its author sets; revoke a key by removing it`,
+      });
+      continue;
+    }
+    if (opts.has("cert-authority")) {
+      excluded.push({ line, reason: "cert-authority keys are not supported: a certificate's validity is a date the signer controls" });
+      continue;
+    }
+    const unknown = [...opts.keys()].filter((o) => o !== "namespaces");
+    if (unknown.length > 0) {
+      excluded.push({ line, reason: `unknown option ${unknown.join(", ")}` });
+      continue;
+    }
+    const names = principals.replace(/^"|"$/g, "").split(",").filter(Boolean);
+    const pattern = names.find((p) => /[*?!]/.test(p));
+    if (pattern !== undefined || names.length === 0) {
+      excluded.push({ line, reason: `principal ${JSON.stringify(pattern ?? principals)} is a pattern; name one signer exactly` });
+      continue;
+    }
+    for (const principal of names) {
+      signers.push({ principal, key: `${type} ${blob}`, namespaces: opts.get("namespaces"), line });
+    }
+  }
+  return { signers, excluded };
+}
+
+/** The signers as an allowed_signers file ssh-keygen reads, holding only the usable lines. */
+export function renderAllowedSigners(signers: Signer[]): string {
+  return (
+    signers
+      .map((s) => `${JSON.stringify(s.principal)}${s.namespaces !== undefined ? ` namespaces=${JSON.stringify(s.namespaces)}` : ""} ${s.key}`)
+      .join("\n") + "\n"
+  );
+}
+
+// ── trust.json, without zod ──────────────────────────────────────────────────
+
+const isObject = (v: unknown): v is Record<string, unknown> => typeof v === "object" && v !== null && !Array.isArray(v);
+const FULL_COMMIT = /^[0-9a-f]{40}([0-9a-f]{24})?$/;
+const SSH_ED25519 = /^ssh-ed25519 [A-Za-z0-9+/]+={0,2}$/;
+const SSH_KEY = /^(ssh-ed25519|ssh-rsa|ecdsa-sha2-nistp(256|384|521)|sk-ssh-ed25519@openssh\.com|sk-ecdsa-sha2-nistp256@openssh\.com) [A-Za-z0-9+/]+={0,2}$/;
+
+/** A repository-relative path: no `..`, not absolute, `/` separators. */
+export function isRepoPath(p: unknown): p is string {
+  return typeof p === "string" && p.length > 0 && !p.startsWith("/") && !p.includes("\\") && posix.normalize(p) === p && !p.split("/").includes("..");
+}
+
+/** Whether `o` holds only `keys`, as zod's `.strict()` requires. */
+const only = (o: Record<string, unknown>, keys: string[]): boolean => Object.keys(o).every((k) => keys.includes(k));
+const optional = (v: unknown, ok: (v: unknown) => boolean): boolean => v === undefined || ok(v);
+const nonEmpty = (v: unknown): boolean => typeof v === "string" && v.length > 0;
+
+/**
+ * What is wrong with a parsed `.chant/trust.json`, one line per field, or an
+ * empty list when it is valid. It accepts exactly what `trustConfigSchema`
+ * in `./policy.ts` accepts, so a reader without zod treats a file as chant
+ * does: an invalid one turns attestation off.
+ */
+export function trustConfigProblems(raw: unknown): string[] {
+  if (!isObject(raw)) return ["/: expected an object"];
+  const problems: string[] = [];
+  const check = (field: string, ok: boolean, message: string) => {
+    if (!ok) problems.push(`${field}: ${message}`);
+  };
+  check("/", only(raw, ["schema", "signers", "roles", "adopted", "runners", "admitted"]), "unknown key");
+  check("schema", raw.schema === 1, "expected 1");
+  check("signers", optional(raw.signers, isRepoPath), "a path inside the repository, with / separators and no ..");
+  check(
+    "roles",
+    optional(raw.roles, (r) => isObject(r) && Object.entries(r).every(([k, v]) => /^[a-z][a-z0-9-]*$/.test(k) && Array.isArray(v) && v.every(nonEmpty))),
+    "role names to lists of principals",
+  );
+  check(
+    "adopted",
+    optional(raw.adopted, (a) =>
+      Array.isArray(a) &&
+      a.every((e) => isObject(e) && only(e, ["from", "to", "note"]) && optional(e.from, (f) => typeof f === "string" && FULL_COMMIT.test(f)) && typeof e.to === "string" && FULL_COMMIT.test(e.to) && optional(e.note, (n) => typeof n === "string")),
+    ),
+    "commit ranges of full commit ids",
+  );
+  check(
+    "runners",
+    optional(raw.runners, (a) =>
+      Array.isArray(a) &&
+      a.every((e) => isObject(e) && only(e, ["principal", "class", "key"]) && nonEmpty(e.principal) && (e.class === "runner" || e.class === "service") && typeof e.key === "string" && SSH_ED25519.test(e.key)),
+    ),
+    "runner keys: a principal, a class and an ssh-ed25519 key",
+  );
+  check(
+    "admitted",
+    optional(raw.admitted, (a) =>
+      Array.isArray(a) &&
+      a.every(
+        (e) =>
+          isObject(e) && only(e, ["return", "signers", "note"]) &&
+          typeof e.return === "string" && /^ret-[0-9a-f]{12}$/.test(e.return) &&
+          optional(e.note, (n) => typeof n === "string") &&
+          Array.isArray(e.signers) && e.signers.length > 0 &&
+          e.signers.every((s) => isObject(s) && only(s, ["principal", "key"]) && nonEmpty(s.principal) && typeof s.key === "string" && SSH_KEY.test(s.key)),
+      ),
+    ),
+    "admitted signers, by return id",
+  );
+  return problems;
+}

package/src/workspace/work-cli.ts

@@ -39,7 +39,8 @@ import {
   releaseWorkLease,
   renewWorkLease,
   workLeaseRef,
-  WORK_ITEM_ID_PATTERN,
+  isWorkItemId,
+  workItemIdProblem,
   WORK_LEASE_OUTCOMES,
   type KeptAttempt,
   type WorkLease,
@@ -203,7 +204,8 @@ export interface WorkLeaseRequest {
 export async function workLease(req: WorkLeaseRequest): Promise<WorkLeaseDocument> {
   const doc = { $schema: WORK_LEASE_OUTPUT_SCHEMA_ID, contract: WORK_LEASE_CONTRACT_VERSION };
   try {
-    if (!WORK_ITEM_ID_PATTERN.test(req.id) || req.id.includes("..")) throw new WorkError("write-usage-invalid", `${JSON.stringify(req.id)} is not a work item id`);
+    const idProblem = workItemIdProblem(req.id);
+    if (idProblem) throw new WorkError("write-usage-invalid", idProblem);
     if (req.outcome !== undefined && !isWorkLeaseOutcome(req.outcome)) {
       throw new WorkError("write-usage-invalid", `${JSON.stringify(req.outcome)} is not a lease outcome: use one of ${WORK_LEASE_OUTCOMES.join(", ")}`);
     }
@@ -381,7 +383,7 @@ export function attemptsOf(claims: readonly LeaseClaim[], limit: number | null):
 export async function workHistory(req: { id: string; cwd: string; kind?: string }): Promise<WorkHistoryDocument> {
   const head = { $schema: WORK_HISTORY_OUTPUT_SCHEMA_ID, contract: WORK_HISTORY_CONTRACT_VERSION, chant: readerVersion() };
   try {
-    if (!WORK_ITEM_ID_PATTERN.test(req.id) || req.id.includes("..")) throw new WorkError("work-item-unknown", `${JSON.stringify(req.id)} is not a work item id`);
+    if (!isWorkItemId(req.id)) throw new WorkError("work-item-unknown", `${JSON.stringify(req.id)} is not a work item id`);
     if (!gitRoot(req.cwd)) throw new WorkError("not-a-git-repository", "a work lease's history is on the chant/lifecycle branch, and this directory is not in a git repository");
     const { loaded, root, record } = await findWorkItem(req.id, req.cwd, req.kind);
     const leaseCwd = dirname(loaded.file);

package/src/workspace/work-history.test.ts

@@ -138,6 +138,13 @@ describe("workspace work history (#2785)", () => {
     expect(formatWorkHistory(doc)).toContain(`kept: ${kept}`);
   });
 
+  test("an id git rejects as a ref name is refused before any git call (#2815)", async () => {
+    for (const id of ["upgrade-.", "x.lock", "a..b"]) {
+      const doc = await workLease({ verb: "claim", id, holder: "worker-b", cwd: root });
+      expect(doc).toMatchObject({ error: { code: "write-usage-invalid" } });
+    }
+  });
+
   test("a release outside the closed list of outcomes is refused (#3147)", async () => {
     await expect(releaseWorkLease("W-002", "worker-b", { cwd: kindDir, outcome: "skipped" })).rejects.toThrow(/not a work lease outcome/);
     const doc = await workLease({ verb: "release", id: "W-002", holder: "worker-b", cwd: root, outcome: "skipped" });