sliftutils 1.7.133 → 1.7.134

package/security/signedFiles/signFiles.ts

@@ -4,23 +4,16 @@ import path from "path";
 import { runPromise } from "socket-function/src/runPromise";
 import { expandHome } from "../helpers/paths";
 import { spawnPromise } from "../helpers/spawn";
-import { buildManifest, formatManifest, MANIFEST_NAME, SIGNATURE_NAME, SIGN_NAMESPACE } from "./manifest";
+import { buildManifest, formatManifest, MANIFEST_NAME, normalizeContent, SIGNATURE_NAME, SIGN_NAMESPACE } from "./manifest";
+import { verifySSHSIG } from "./sshsig";
 import { revokedKeysInRepo } from "../authorizedKeys/unrevoke";
-import { resolveKeysRepo } from "../authorizedKeys/keysRepo";
 import { findKeyProblems, normalizeKeys } from "../authorizedKeys/authorizedKeys";
 
 // A hardware backed key is the entire point. A key sitting on disk is compromised the moment the
 // machine is, and then the signature proves nothing, so this is what we make when asked to make one.
-const DEFAULT_KEY_TYPE = "ed25519-sk";
-const DEFAULT_KEY_PATH = "~/.ssh/signfiles_ed25519_sk";
-const GIT_KEYWORD = "git";
-const COMMIT_MESSAGE = "deploying signed files";
+export const DEFAULT_KEY_TYPE = "ed25519-sk";
+export const DEFAULT_KEY_PATH = "~/.ssh/signfiles_ed25519_sk";
 const MAX_ERROR_BODY_LENGTH = 500;
-const USAGE = `Usage: yarn signfiles [signing-key] [${GIT_KEYWORD}]
-
-Signs the files of the repo in the current directory. With no key, a hardware backed
-${DEFAULT_KEY_TYPE} key at ${DEFAULT_KEY_PATH} is used, and created if it does not exist.
-Pass ${GIT_KEYWORD} to also commit and push the result.`;
 
 /** runPromise takes a command line rather than an argument list, so anything holding a path has to
     survive the shell. Double quotes work on both cmd and posix shells. */
@@ -113,15 +106,6 @@ async function refuseRevokedKeys(repoPath: string) {
     );
 }
 
-function parseArgs(argv: string[]) {
-    let pushToGit = argv.includes(GIT_KEYWORD);
-    let positional = argv.filter(arg => arg !== GIT_KEYWORD);
-    if (positional.length > 1) {
-        throw new Error(`Expected at most a signing key, was ${positional.length} argument(s): ${positional.join(" ")}\n${USAGE}`);
-    }
-    return { keyPath: positional[0], pushToGit };
-}
-
 /** Writes the manifest and its signature into a repo. Separate from the command so anything that
     changes a keys repo can leave it signed, rather than telling someone to go and do it. */
 export async function signRepo(config: { repoPath: string; keyPath?: string }) {
@@ -147,40 +131,15 @@ export async function signRepo(config: { repoPath: string; keyPath?: string }) {
 
     // Signing happens before any git work, so a failed push never costs a second touch of the key.
     await runPromise(`ssh-keygen -Y sign -f ${quote(signingKey)} -n ${SIGN_NAMESPACE} ${quote(stagedManifest)}`);
-    // Checked here rather than left for a machine that has already pulled it to discover.
-    await runPromise(
-        `ssh-keygen -Y check-novalidate -n ${SIGN_NAMESPACE} -s ${quote(stagedSignature)} < ${quote(stagedManifest)}`
-    );
+    // Checked with the same code the daemon verifies with, over the same normalised bytes, so what
+    // is about to be committed is proven to pass the check every other machine will run on it.
+    verifySSHSIG({
+        signature: await fs.readFile(stagedSignature, "utf8"),
+        message: normalizeContent(await fs.readFile(stagedManifest)),
+        namespace: SIGN_NAMESPACE,
+    });
     await fs.copyFile(stagedManifest, path.join(repoPath, MANIFEST_NAME));
     await fs.copyFile(stagedSignature, path.join(repoPath, SIGNATURE_NAME));
     await fs.rm(stagingDirectory, { recursive: true, force: true });
     console.log(`Signed with ${await publicKeyOf(signingKey)}`);
 }
-
-export async function main() {
-    let { keyPath, pushToGit } = parseArgs(process.argv.slice(2));
-
-    // The keys repo, which is this one when it holds keys and this machine's otherwise. Signing
-    // whatever repo the terminal happened to be in is how you end up signing something that is not
-    // a keys repo at all.
-    let { repoPath } = await resolveKeysRepo();
-    console.log(`Signing ${repoPath}`);
-    await signRepo({ repoPath, keyPath });
-
-    if (!pushToGit) {
-        console.log(`Commit and push ${MANIFEST_NAME} and ${SIGNATURE_NAME} for anything to see them.`);
-        return;
-    }
-    await runPromise(`git add -A`, { cwd: repoPath });
-    // Nothing staged is not worth stopping on. git commit calls that a failure, but it only means
-    // the signature matches the one already committed, so there is nothing to deploy.
-    let status = await spawnPromise({ command: "git", args: ["status", "--porcelain"], cwd: repoPath });
-    let staged = status.stdout;
-    if (!staged.trim()) {
-        console.log(`Nothing changed, ${MANIFEST_NAME} and ${SIGNATURE_NAME} are already committed.`);
-        return;
-    }
-    await runPromise(`git commit -m ${quote(COMMIT_MESSAGE)}`, { cwd: repoPath });
-    await runPromise(`git push`, { cwd: repoPath });
-    console.log(`Committed and pushed.`);
-}

package/security/signedFiles/signFilesCli.ts

@@ -0,0 +1,54 @@
+import { runPromise } from "socket-function/src/runPromise";
+import { spawnPromise } from "../helpers/spawn";
+import { resolveKeysRepo } from "../authorizedKeys/keysRepo";
+import { MANIFEST_NAME, SIGNATURE_NAME } from "./manifest";
+import { DEFAULT_KEY_PATH, DEFAULT_KEY_TYPE, signRepo } from "./signFiles";
+
+const GIT_KEYWORD = "git";
+const COMMIT_MESSAGE = "deploying signed files";
+const USAGE = `Usage: yarn signfiles [signing-key] [${GIT_KEYWORD}]
+
+Signs the files of the repo in the current directory. With no key, a hardware backed
+${DEFAULT_KEY_TYPE} key at ${DEFAULT_KEY_PATH} is used, and created if it does not exist.
+Pass ${GIT_KEYWORD} to also commit and push the result.`;
+
+function parseArgs(argv: string[]) {
+    let pushToGit = argv.includes(GIT_KEYWORD);
+    let positional = argv.filter(arg => arg !== GIT_KEYWORD);
+    if (positional.length > 1) {
+        throw new Error(`Expected at most a signing key, was ${positional.length} argument(s): ${positional.join(" ")}\n${USAGE}`);
+    }
+    return { keyPath: positional[0], pushToGit };
+}
+
+async function main() {
+    let { keyPath, pushToGit } = parseArgs(process.argv.slice(2));
+
+    // The keys repo, which is this one when it holds keys and this machine's otherwise. Signing
+    // whatever repo the terminal happened to be in is how you end up signing something that is not
+    // a keys repo at all.
+    let { repoPath } = await resolveKeysRepo();
+    console.log(`Signing ${repoPath}`);
+    await signRepo({ repoPath, keyPath });
+
+    if (!pushToGit) {
+        console.log(`Commit and push ${MANIFEST_NAME} and ${SIGNATURE_NAME} for anything to see them.`);
+        return;
+    }
+    await runPromise(`git add -A`, { cwd: repoPath });
+    // Nothing staged is not worth stopping on. git commit calls that a failure, but it only means
+    // the signature matches the one already committed, so there is nothing to deploy.
+    let status = await spawnPromise({ command: "git", args: ["status", "--porcelain"], cwd: repoPath });
+    if (!status.stdout.trim()) {
+        console.log(`Nothing changed, ${MANIFEST_NAME} and ${SIGNATURE_NAME} are already committed.`);
+        return;
+    }
+    await runPromise(`git commit -m "${COMMIT_MESSAGE}"`, { cwd: repoPath });
+    await runPromise(`git push`, { cwd: repoPath });
+    console.log(`Committed and pushed.`);
+}
+
+main().catch(e => {
+    console.error(`${e}`);
+    process.exitCode = 1;
+}).finally(() => process.exit());

package/security/signedFiles/sshsig.d.ts

@@ -0,0 +1,13 @@
+/// <reference types="node" />
+/// <reference types="node" />
+/** Verifies an SSHSIG signature over a message, and that it was made for the given namespace.
+    Returns the signing public key and its fingerprint, in the forms ssh-keygen reports them.
+    Throws if it does not verify, or is not for this namespace. */
+export declare function verifySSHSIG(config: {
+    signature: string;
+    message: Buffer;
+    namespace: string;
+}): {
+    publicKey: string;
+    fingerprint: string;
+};

package/security/signedFiles/sshsig.ts

@@ -0,0 +1,141 @@
+import crypto from "crypto";
+
+// Verifies an SSHSIG signature (the format ssh-keygen -Y sign produces) in process, so nothing has
+// to shell out to ssh-keygen to check one. The wire format is PROTOCOL.sshsig, and the actual
+// check is one ed25519 verification.
+//
+// Both ed25519 and the hardware sk-ed25519 variant are handled, since signfiles signs with a
+// hardware ed25519-sk key. The sk variant signs a little more than the message - the authenticator
+// flags and counter go in too - but it is still ed25519 underneath.
+
+const MAGIC = "SSHSIG";
+// An ed25519 public key as a DER SPKI is this fixed 12 byte header followed by the 32 byte key.
+const ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+
+/** Reads the length prefixed fields SSH wire format is made of. */
+class Reader {
+    private offset = 0;
+    constructor(private buffer: Buffer) { }
+    u8() {
+        return this.buffer.readUInt8(this.offset++);
+    }
+    u32() {
+        let value = this.buffer.readUInt32BE(this.offset);
+        this.offset += 4;
+        return value;
+    }
+    string() {
+        let length = this.u32();
+        let value = this.buffer.subarray(this.offset, this.offset + length);
+        this.offset += length;
+        return value;
+    }
+    remaining() {
+        return this.buffer.length - this.offset;
+    }
+}
+
+/** One length prefixed field, the way SSH writes them. */
+function sshString(bytes: Buffer) {
+    let length = Buffer.alloc(4);
+    length.writeUInt32BE(bytes.length);
+    return Buffer.concat([length, bytes]);
+}
+
+function hash(algorithm: string, data: Buffer) {
+    // SSHSIG names sha256 or sha512; node uses the same names.
+    if (algorithm !== "sha256" && algorithm !== "sha512") {
+        throw new Error(`Unsupported SSHSIG hash algorithm ${JSON.stringify(algorithm)}`);
+    }
+    return crypto.createHash(algorithm).update(data).digest();
+}
+
+function ed25519PublicKey(rawKey: Buffer) {
+    if (rawKey.length !== 32) {
+        throw new Error(`Expected a 32 byte ed25519 key, was ${rawKey.length}`);
+    }
+    return crypto.createPublicKey({
+        key: Buffer.concat([ED25519_SPKI_PREFIX, rawKey]),
+        format: "der",
+        type: "spki",
+    });
+}
+
+/** Verifies an SSHSIG signature over a message, and that it was made for the given namespace.
+    Returns the signing public key and its fingerprint, in the forms ssh-keygen reports them.
+    Throws if it does not verify, or is not for this namespace. */
+export function verifySSHSIG(config: { signature: string; message: Buffer; namespace: string }) {
+    let { signature, message, namespace } = config;
+
+    let body = signature.split("\n").filter(line => line && !line.startsWith("-----")).join("");
+    let blob = Buffer.from(body, "base64");
+    if (blob.subarray(0, MAGIC.length).toString() !== MAGIC) {
+        throw new Error(`Expected an ${MAGIC} signature, started with ${JSON.stringify(blob.subarray(0, MAGIC.length).toString())}`);
+    }
+
+    let reader = new Reader(blob.subarray(MAGIC.length));
+    let version = reader.u32();
+    if (version !== 1) {
+        throw new Error(`Expected SSHSIG version 1, was ${version}`);
+    }
+    let publicKeyBlob = reader.string();
+    let signatureNamespace = reader.string().toString();
+    reader.string(); // reserved
+    let hashAlgorithm = reader.string().toString();
+    let signatureBlob = reader.string();
+
+    if (signatureNamespace !== namespace) {
+        throw new Error(`Signature is for namespace ${JSON.stringify(signatureNamespace)}, expected ${JSON.stringify(namespace)}`);
+    }
+
+    let publicKeyReader = new Reader(publicKeyBlob);
+    let keyType = publicKeyReader.string().toString();
+    let rawKey = publicKeyReader.string();
+    let application = publicKeyReader.remaining() ? publicKeyReader.string() : Buffer.alloc(0);
+
+    let signatureReader = new Reader(signatureBlob);
+    let signatureType = signatureReader.string().toString();
+    let rawSignature = signatureReader.string();
+    if (signatureType !== keyType) {
+        throw new Error(`Signature type ${signatureType} does not match key type ${keyType}`);
+    }
+
+    // The bytes the signature is over: the magic, the namespace, the reserved field, the hash
+    // algorithm, and the hash of the message. Never the message itself, so a huge file still signs
+    // a fixed size blob.
+    let signed = Buffer.concat([
+        Buffer.from(MAGIC),
+        sshString(Buffer.from(signatureNamespace)),
+        sshString(Buffer.alloc(0)),
+        sshString(Buffer.from(hashAlgorithm)),
+        sshString(hash(hashAlgorithm, message)),
+    ]);
+
+    let toVerify: Buffer;
+    if (keyType === "ssh-ed25519") {
+        toVerify = signed;
+    } else if (keyType === "sk-ssh-ed25519@openssh.com") {
+        // A hardware key signs over what the authenticator saw, not the blob directly: the hash of
+        // the application it is scoped to, the flags and counter it returned, and the hash of the
+        // blob. Reconstructing that is the whole difference from a plain ed25519 signature.
+        let flags = signatureReader.u8();
+        let counter = signatureReader.u32();
+        let counterBytes = Buffer.alloc(4);
+        counterBytes.writeUInt32BE(counter);
+        toVerify = Buffer.concat([
+            hash("sha256", application),
+            Buffer.from([flags]),
+            counterBytes,
+            hash("sha256", signed),
+        ]);
+    } else {
+        throw new Error(`Unsupported SSHSIG key type ${JSON.stringify(keyType)}`);
+    }
+
+    if (!crypto.verify(null, toVerify, ed25519PublicKey(rawKey), rawSignature)) {
+        throw new Error(`The SSHSIG signature does not verify`);
+    }
+
+    let fingerprint = "SHA256:" + crypto.createHash("sha256").update(publicKeyBlob).digest("base64").replace(/=+$/, "");
+    return { publicKey: `${keyType} ${publicKeyBlob.toString("base64")}`, fingerprint };
+}