witnora 0.10.0 → 0.10.2

package/dist/vendor/witnora-probe/request-verifier.d.ts

@@ -0,0 +1,9 @@
+import { type ProbeBindings, type ProbeObservationRequestV02, type ProbeObserveBodyV02, type TrustedRequestKey } from "./types.js";
+export declare class RequestVerificationError extends Error {
+    readonly code: string;
+    readonly status: number;
+    constructor(code: string, message: string, status?: number);
+}
+export declare function verifyObservationRequest(body: ProbeObserveBodyV02, bindings: ProbeBindings, trustedKeys: Record<string, TrustedRequestKey>, now?: Date): ProbeObservationRequestV02;
+export declare function observationRequestDigest(request: ProbeObservationRequestV02): string;
+export declare function withoutSignature(request: ProbeObservationRequestV02): Omit<ProbeObservationRequestV02, "signature">;

package/dist/vendor/witnora-probe/request-verifier.js

@@ -0,0 +1,84 @@
+import { sha256Canonical } from "./canonical.js";
+import { verifyCanonical } from "./crypto.js";
+import { OBSERVATION_REQUEST_PROTOCOL, } from "./types.js";
+const SHA256 = /^[a-f0-9]{64}$/;
+export class RequestVerificationError extends Error {
+    code;
+    status;
+    constructor(code, message, status = 400) {
+        super(message);
+        this.code = code;
+        this.status = status;
+    }
+}
+export function verifyObservationRequest(body, bindings, trustedKeys, now = new Date()) {
+    const request = body?.request;
+    if (!request || body.expected === undefined || body.query === undefined) {
+        throw new RequestVerificationError("MALFORMED_REQUEST", "Body must contain request, expected, and query.");
+    }
+    if (request.protocolVersion !== OBSERVATION_REQUEST_PROTOCOL)
+        throw new RequestVerificationError("UNSUPPORTED_PROTOCOL", "Observation request protocol is unsupported.");
+    const key = trustedKeys[request.requestSignerKeyId];
+    if (!key || key.role !== "probe_observation_request_signer") {
+        throw new RequestVerificationError("UNTRUSTED_SIGNER_ROLE", "Observation request signer is not trusted for this role.", 401);
+    }
+    const unsigned = withoutSignature(request);
+    if (!verifyCanonical(unsigned, request.signature, key.publicKeyPem)) {
+        throw new RequestVerificationError("INVALID_SIGNATURE", "Observation request signature is invalid.", 401);
+    }
+    for (const field of ["requestId", "nonce", "requestSignerKeyId"])
+        requireText(request[field], field);
+    for (const field of ["actionDigest", "contractDigest", "resourceCommitment", "predicateDigest"]) {
+        if (!SHA256.test(request[field]))
+            throw new RequestVerificationError("INVALID_BINDING_DIGEST", `${field} must be a lowercase SHA-256 digest.`);
+    }
+    if (sha256Canonical(body.expected) !== request.predicateDigest) {
+        throw new RequestVerificationError("PREDICATE_BINDING_MISMATCH", "Expected predicate does not match predicateDigest.", 403);
+    }
+    if (sha256Canonical(body.query) !== request.resourceCommitment) {
+        throw new RequestVerificationError("RESOURCE_BINDING_MISMATCH", "Read query does not match resourceCommitment.", 403);
+    }
+    const requestedAt = parseTime(request.requestedAt, "requestedAt");
+    const notBefore = parseTime(request.notBefore, "notBefore");
+    const expiresAt = parseTime(request.expiresAt, "expiresAt");
+    const keyValidFrom = parseTime(key.validFrom, "key.validFrom");
+    const keyValidUntil = parseTime(key.validUntil, "key.validUntil");
+    if (expiresAt <= notBefore || requestedAt < notBefore || requestedAt > expiresAt)
+        throw new RequestVerificationError("INVALID_TIME_WINDOW", "Observation request time window is invalid.");
+    if (now.getTime() < notBefore)
+        throw new RequestVerificationError("REQUEST_NOT_YET_VALID", "Observation request is not yet valid.", 401);
+    if (now.getTime() >= expiresAt)
+        throw new RequestVerificationError("REQUEST_EXPIRED", "Observation request has expired.", 401);
+    if (requestedAt < keyValidFrom || requestedAt >= keyValidUntil)
+        throw new RequestVerificationError("SIGNER_KEY_TIME_INVALID", "Request was signed outside the trusted key validity interval.", 401);
+    if (key.revokedAt && now.getTime() >= parseTime(key.revokedAt, "key.revokedAt")) {
+        throw new RequestVerificationError("SIGNER_KEY_REVOKED", "Request signing key is revoked.", 401);
+    }
+    const expectedBindings = { ...bindings, probeId: bindings.probeId };
+    for (const field of ["tenantRef", "projectRef", "environment", "probeId"]) {
+        if (request[field] !== expectedBindings[field])
+            throw new RequestVerificationError("BOUNDARY_MISMATCH", `Observation request ${field} does not match this Probe.`, 403);
+    }
+    return request;
+}
+export function observationRequestDigest(request) {
+    return sha256Canonical(request);
+}
+export function withoutSignature(request) {
+    const { signature: _signature, ...unsigned } = request;
+    return unsigned;
+}
+function parseTime(value, field) {
+    if (typeof value !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/.test(value)) {
+        throw new RequestVerificationError("INVALID_TIMESTAMP", `${field} must be an RFC 3339 UTC timestamp.`);
+    }
+    const parsed = Date.parse(value);
+    if (!Number.isFinite(parsed))
+        throw new RequestVerificationError("INVALID_TIMESTAMP", `${field} must be an ISO timestamp.`);
+    return parsed;
+}
+function requireText(value, field) {
+    if (typeof value !== "string" || value.length < 1 || value.length > 512) {
+        throw new RequestVerificationError("INVALID_FIELD", `${field} must be a non-empty bounded string.`);
+    }
+}

package/dist/vendor/witnora-probe/server.d.ts

@@ -0,0 +1,9 @@
+import { type IncomingMessage, type ServerResponse } from "node:http";
+import type { AddressInfo } from "node:net";
+import { WitnoraProbe } from "./probe.js";
+import type { StructuredLogger } from "./types.js";
+export declare function createProbeServer(probe: WitnoraProbe, logger: StructuredLogger, bodyLimitBytes: number): {
+    server: import("http").Server<typeof IncomingMessage, typeof ServerResponse>;
+    listen(host: string, port: number): Promise<AddressInfo>;
+    close(): Promise<void>;
+};

package/dist/vendor/witnora-probe/server.js

@@ -0,0 +1,85 @@
+import { createServer } from "node:http";
+import { RequestVerificationError } from "./request-verifier.js";
+export function createProbeServer(probe, logger, bodyLimitBytes) {
+    const server = createServer(async (request, response) => {
+        response.setHeader("content-type", "application/json; charset=utf-8");
+        response.setHeader("cache-control", "no-store");
+        response.setHeader("x-content-type-options", "nosniff");
+        try {
+            const url = new URL(request.url ?? "/", "http://probe.local");
+            if (request.method === "GET" && url.pathname === "/health")
+                return json(response, 200, { status: "healthy" });
+            if (request.method === "GET" && url.pathname === "/ready")
+                return json(response, probe.isReady() ? 200 : 503, { status: probe.isReady() ? "ready" : "not_ready" });
+            if (request.method === "GET" && url.pathname === "/metrics") {
+                response.setHeader("content-type", "text/plain; version=0.0.4; charset=utf-8");
+                response.statusCode = 200;
+                response.end(probe.metrics.render());
+                return;
+            }
+            if (request.method === "POST" && url.pathname === "/v0.2/observe") {
+                const body = await readJson(request, bodyLimitBytes);
+                return json(response, 200, await probe.observe(body));
+            }
+            return json(response, 404, { error: { code: "NOT_FOUND", message: "Route not found." } });
+        }
+        catch (error) {
+            const status = error instanceof RequestVerificationError ? error.status : error instanceof PayloadError ? error.status : 500;
+            const code = error instanceof RequestVerificationError ? error.code : error instanceof PayloadError ? error.code : "INTERNAL_ERROR";
+            if (code === "INVALID_SIGNATURE")
+                probe.metrics.increment("probe_signature_failures_total");
+            if (code === "REQUEST_EXPIRED" || code === "REQUEST_NOT_YET_VALID" || code === "INVALID_TIME_WINDOW")
+                probe.metrics.increment("probe_stale_observations_total");
+            logger.warn("probe.http_request_rejected", { code, status });
+            return json(response, status, { error: { code, message: publicMessage(error) } });
+        }
+    });
+    return {
+        server,
+        async listen(host, port) {
+            await new Promise((resolve, reject) => {
+                server.once("error", reject);
+                server.listen(port, host, () => resolve());
+            });
+            return server.address();
+        },
+        async close() {
+            await new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
+        },
+    };
+}
+async function readJson(request, limit) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of request) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        size += buffer.byteLength;
+        if (size > limit)
+            throw new PayloadError("PAYLOAD_TOO_LARGE", "Request body exceeds the configured limit.", 413);
+        chunks.push(buffer);
+    }
+    try {
+        return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+    }
+    catch {
+        throw new PayloadError("INVALID_JSON", "Request body must contain valid JSON.", 400);
+    }
+}
+function json(response, status, value) {
+    response.statusCode = status;
+    response.end(JSON.stringify(value));
+}
+class PayloadError extends Error {
+    code;
+    status;
+    constructor(code, message, status) {
+        super(message);
+        this.code = code;
+        this.status = status;
+    }
+}
+function publicMessage(error) {
+    if (error instanceof RequestVerificationError || error instanceof PayloadError)
+        return error.message;
+    return "Probe could not complete the request.";
+}

package/dist/vendor/witnora-probe/storage.d.ts

@@ -0,0 +1,16 @@
+export declare class EncryptedJsonStore {
+    private readonly root;
+    private readonly key;
+    constructor(root: string, key: Buffer);
+    put(category: string, id: string, value: unknown): Promise<string>;
+    get<T>(category: string, id: string): Promise<T | undefined>;
+    list(category: string): Promise<string[]>;
+    delete(category: string, id: string): Promise<void>;
+    private path;
+}
+export declare class PersistentNonceCache {
+    private readonly root;
+    constructor(root: string);
+    claim(nonce: string, expiresAt: string): Promise<boolean>;
+    private prune;
+}

package/dist/vendor/witnora-probe/storage.js

@@ -0,0 +1,114 @@
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import { mkdir, open, readFile, readdir, rename, unlink, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { canonicalJson, sha256Canonical } from "./canonical.js";
+export class EncryptedJsonStore {
+    root;
+    key;
+    constructor(root, key) {
+        this.root = root;
+        this.key = key;
+        if (key.byteLength !== 32)
+            throw new Error("Local storage encryption key must contain exactly 32 bytes.");
+    }
+    async put(category, id, value) {
+        const path = this.path(category, id);
+        await mkdir(dirname(path), { recursive: true });
+        const iv = randomBytes(12);
+        const cipher = createCipheriv("aes-256-gcm", this.key, iv);
+        const ciphertext = Buffer.concat([cipher.update(canonicalJson(value), "utf8"), cipher.final()]);
+        const envelope = {
+            version: "witnora.local_aes_256_gcm.v0.1",
+            iv: iv.toString("base64"),
+            tag: cipher.getAuthTag().toString("base64"),
+            ciphertext: ciphertext.toString("base64"),
+        };
+        const temporary = `${path}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+        await writeFile(temporary, JSON.stringify(envelope), { mode: 0o600 });
+        await rename(temporary, path);
+        return `${category}/${safeId(id)}.enc.json`;
+    }
+    async get(category, id) {
+        try {
+            const envelope = JSON.parse(await readFile(this.path(category, id), "utf8"));
+            const decipher = createDecipheriv("aes-256-gcm", this.key, Buffer.from(envelope.iv, "base64"));
+            decipher.setAuthTag(Buffer.from(envelope.tag, "base64"));
+            const plaintext = Buffer.concat([
+                decipher.update(Buffer.from(envelope.ciphertext, "base64")),
+                decipher.final(),
+            ]);
+            return JSON.parse(plaintext.toString("utf8"));
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return undefined;
+            throw error;
+        }
+    }
+    async list(category) {
+        try {
+            return (await readdir(join(this.root, category)))
+                .filter((name) => name.endsWith(".enc.json"))
+                .map((name) => name.slice(0, -".enc.json".length));
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return [];
+            throw error;
+        }
+    }
+    async delete(category, id) {
+        try {
+            await unlink(this.path(category, id));
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    }
+    path(category, id) {
+        return join(this.root, safeId(category), `${safeId(id)}.enc.json`);
+    }
+}
+export class PersistentNonceCache {
+    root;
+    constructor(root) {
+        this.root = root;
+    }
+    async claim(nonce, expiresAt) {
+        await this.prune();
+        await mkdir(this.root, { recursive: true });
+        const digest = sha256Canonical(nonce);
+        try {
+            const handle = await open(join(this.root, `${digest}.nonce`), "wx", 0o600);
+            await handle.writeFile(expiresAt);
+            await handle.close();
+            return true;
+        }
+        catch (error) {
+            if (error.code === "EEXIST")
+                return false;
+            throw error;
+        }
+    }
+    async prune() {
+        try {
+            const now = Date.now();
+            for (const name of await readdir(this.root)) {
+                if (!name.endsWith(".nonce"))
+                    continue;
+                const path = join(this.root, name);
+                const expiry = Date.parse(await readFile(path, "utf8"));
+                if (!Number.isFinite(expiry) || expiry < now)
+                    await unlink(path);
+            }
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    }
+}
+function safeId(value) {
+    return value.replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 160);
+}

package/dist/vendor/witnora-probe/types.d.ts

@@ -0,0 +1,126 @@
+export declare const OBSERVATION_REQUEST_PROTOCOL: "witnora.probe_observation_request.v0.2";
+export declare const OBSERVATION_ATTESTATION_PROTOCOL: "witnora.probe_observation_attestation.v0.2";
+export interface ProbeObservationRequestV02 {
+    protocolVersion: typeof OBSERVATION_REQUEST_PROTOCOL;
+    requestId: string;
+    nonce: string;
+    tenantRef: string;
+    projectRef: string;
+    environment: string;
+    actionDigest: string;
+    contractDigest: string;
+    resourceCommitment: string;
+    predicateDigest: string;
+    probeId: string;
+    notBefore: string;
+    expiresAt: string;
+    requestedAt: string;
+    requestSignerKeyId: string;
+    signature: string;
+}
+export interface GitHubPullRequestReadQueryV02 {
+    type: "github.pull_request.read.v0.2";
+    repository: string;
+    pullRequestNumber: number;
+}
+export interface GitHubPullRequestExpectedV02 {
+    type: "github.pull_request.outcome.v0.2";
+    merged: boolean;
+    headSha: string;
+    baseBranch: string;
+}
+export interface ProbeObserveBodyV02<Expected = unknown, Query = unknown> {
+    request: ProbeObservationRequestV02;
+    expected: Expected;
+    query: Query;
+}
+export interface ProbeObservationAttestationV02 {
+    protocolVersion: typeof OBSERVATION_ATTESTATION_PROTOCOL;
+    attestationId: string;
+    requestId: string;
+    requestDigest: string;
+    nonce: string;
+    tenantRef: string;
+    projectRef: string;
+    environment: string;
+    actionDigest: string;
+    contractDigest: string;
+    resourceCommitment: string;
+    predicateDigest: string;
+    probeId: string;
+    probeVersion: string;
+    observationSource: string;
+    observedAt: string;
+    dataFreshnessMs: number;
+    normalizedObservation: Record<string, unknown>;
+    rawObservationCommitment: string;
+    targetVersion: string;
+    targetAuditReference?: string;
+    outcomeStatus: "VERIFIED" | "NOT_VERIFIED";
+    limitations: string[];
+    keyCertificateId: string;
+    signature: string;
+}
+export interface AdapterObservation {
+    normalizedObservation: Record<string, unknown>;
+    rawObservation: unknown;
+    observationSource: string;
+    sourceObservedAt: string;
+    targetVersion: string;
+    targetAuditReference?: string;
+    limitations: string[];
+}
+export interface ObservationTargetAdapter {
+    readonly id: string;
+    supports(query: unknown): boolean;
+    observe(input: {
+        query: unknown;
+        credential?: string;
+        signal: AbortSignal;
+    }): Promise<AdapterObservation>;
+}
+export interface ProbeBindings {
+    tenantRef: string;
+    projectRef: string;
+    environment: string;
+    probeId: string;
+}
+export interface TrustedRequestKey {
+    publicKeyPem: string;
+    role: "probe_observation_request_signer";
+    validFrom: string;
+    validUntil: string;
+    revokedAt?: string;
+}
+export interface ProbeConfig {
+    host: string;
+    port: number;
+    stateDirectory: string;
+    requestBodyLimitBytes: number;
+    observationTimeoutMs: number;
+    shutdownTimeoutMs: number;
+    retry: {
+        maxAttempts: number;
+        baseDelayMs: number;
+        scanIntervalMs: number;
+    };
+    bindings: ProbeBindings;
+    requestVerificationKeys: Record<string, TrustedRequestKey>;
+    probeSigningKey: {
+        keyCertificateId: string;
+        privateKeyPem: string;
+    };
+    probeVersion: string;
+    storageEncryptionKey: Buffer;
+    adapters: ObservationTargetAdapter[];
+    credentialReference?: string;
+    credentialResolver: CredentialResolver;
+}
+export interface CredentialResolver {
+    resolve(reference: string): Promise<string>;
+}
+export interface StructuredLogger {
+    info(event: string, fields?: Record<string, unknown>): void;
+    warn(event: string, fields?: Record<string, unknown>): void;
+    error(event: string, fields?: Record<string, unknown>): void;
+}

package/dist/vendor/witnora-probe/types.js

@@ -0,0 +1,2 @@
+export const OBSERVATION_REQUEST_PROTOCOL = "witnora.probe_observation_request.v0.2";
+export const OBSERVATION_ATTESTATION_PROTOCOL = "witnora.probe_observation_attestation.v0.2";

package/dist/vendor/witnora-verifier-python/README.md

@@ -0,0 +1,43 @@
+# Witnora verifier for Python
+
+This package independently verifies the strict `witnora.canonical_json.v0.2`
+profile and the v0.2 trust, Probe, and event-chain primitives without contacting
+Witnora or any customer system.
+
+The verifier is deliberately fail-closed. Trust roots must be pinned by the
+caller. A root carried inside an evidence packet cannot authorize itself.
+
+## Supported slice
+
+- deterministic UTF-8 canonical bytes and SHA-256;
+- strict JSON parsing with duplicate-key and ambiguous-number rejection;
+- Ed25519 signatures using raw base64url public keys;
+- role-scoped subordinate key certificates;
+- signed, hash-linked revocation journals with event-time semantics;
+- signed Probe observation requests and bound attestations;
+- structural event hash-chain verification;
+- offline verification of the shared v0.2 conformance corpus.
+
+```powershell
+python -m unittest discover -s tests -v
+witnora-verify conformance ../../test-vectors/witnora-v0.2-conformance
+witnora-verify canonical input.json
+witnora-verify event-chain events.json
+```
+
+## Strict canonical profile
+
+This is a Witnora-specific profile, not a claim of RFC 8785 conformance.
+
+- object keys are sorted by Unicode code point;
+- strings are emitted as Unicode and encoded as strict UTF-8;
+- array order is preserved;
+- integers must be within `[-(2^53-1), 2^53-1]`;
+- JSON numbers must be safe integers; decimal values must be represented by an
+  application-level normalized string;
+- negative zero, non-finite numbers, duplicate keys, unpaired surrogates, and
+  unsupported Python values are rejected;
+- nesting depth is limited to 64 containers.
+
+The package does not preserve or alter v0.1 behavior. It accepts only explicit
+v0.2 protocol identifiers.

package/dist/vendor/witnora-verifier-python/pyproject.toml

@@ -0,0 +1,23 @@
+[build-system]
+requires = ["setuptools>=77"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "witnora-verifier"
+version = "0.2.0.dev0"
+description = "Offline verifier for the strict Witnora canonical JSON v0.2 profile"
+readme = "README.md"
+requires-python = ">=3.10"
+license = "Apache-2.0"
+dependencies = ["cryptography>=43"]
+classifiers = [
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3 :: Only",
+  "Topic :: Security :: Cryptography",
+]
+
+[project.scripts]
+witnora-verify = "witnora_verifier.cli:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]

package/dist/vendor/witnora-verifier-python/src/witnora_verifier/__init__.py

@@ -0,0 +1,33 @@
+"""Offline verification primitives for Witnora v0.2."""
+
+from .canonical import (
+    CANONICAL_VERSION,
+    canonical_bytes,
+    canonical_json,
+    loads_strict,
+    sha256_canonical,
+)
+from .crypto import sign_value, verify_signed_value
+from .errors import VerificationError
+from .event_chain import make_event, verify_event_chain
+from .evidence import verify_evidence_packet
+from .probe import verify_probe_exchange
+from .trust import PinnedTrustStore, verify_key_certificate, verify_revocation_journal
+
+__all__ = [
+    "CANONICAL_VERSION",
+    "PinnedTrustStore",
+    "VerificationError",
+    "canonical_bytes",
+    "canonical_json",
+    "loads_strict",
+    "make_event",
+    "sha256_canonical",
+    "sign_value",
+    "verify_event_chain",
+    "verify_evidence_packet",
+    "verify_key_certificate",
+    "verify_probe_exchange",
+    "verify_revocation_journal",
+    "verify_signed_value",
+]