witnora 0.10.0 → 0.10.2

package/dist/vendor/witnora-verifier-python/src/witnora_verifier/trust.py

@@ -0,0 +1,337 @@
+from __future__ import annotations
+
+import hashlib
+import re
+from collections.abc import Iterable, Mapping
+from dataclasses import dataclass
+from datetime import UTC, datetime
+from typing import Any
+
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+
+from .canonical import sha256_canonical
+from .crypto import verify_document_signature
+from .errors import VerificationError, require
+
+TRUST_ROOT_VERSION = "witnora.trust_root.v0.2"
+KEY_CERTIFICATE_VERSION = "witnora.key_certificate.v0.2"
+REVOCATION_STATEMENT_VERSION = "witnora.key_revocation_statement.v0.2"
+REVOCATION_JOURNAL_VERSION = "witnora.revocation_journal.v0.2"
+
+CERTIFIED_ROLES = {
+    "source_collector",
+    "gateway_runtime",
+    "outcome_probe",
+    "resource_scope_evaluator",
+    "server_attestor",
+    "reviewer",
+}
+
+
+@dataclass(frozen=True)
+class PinnedTrustStore:
+    """Caller-owned roots. Packet-carried roots are intentionally not accepted."""
+
+    roots: Mapping[str, Mapping[str, Any]]
+
+    @classmethod
+    def from_roots(cls, roots: Iterable[Mapping[str, Any]]) -> PinnedTrustStore:
+        indexed: dict[str, Mapping[str, Any]] = {}
+        for root in roots:
+            _verify_root_shape(root)
+            root_id = str(root["rootId"])
+            require(
+                root_id not in indexed,
+                "DUPLICATE_ROOT_ID",
+                f"Root {root_id} appears more than once.",
+            )
+            indexed[root_id] = dict(root)
+        require(
+            bool(indexed),
+            "PINNED_ROOT_REQUIRED",
+            "At least one out-of-band pinned root is required.",
+        )
+        return cls(indexed)
+
+    def get(self, root_id: str) -> Mapping[str, Any]:
+        root = self.roots.get(root_id)
+        require(
+            root is not None,
+            "UNPINNED_ROOT",
+            f"Root {root_id} is not pinned by the verifier caller.",
+        )
+        return root
+
+
+def parse_timestamp(value: Any, field: str) -> datetime:
+    require(
+        isinstance(value, str), "INVALID_TIMESTAMP", f"{field} must be an RFC 3339 UTC timestamp."
+    )
+    require(
+        bool(re.fullmatch(r"\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z", value)),
+        "INVALID_TIMESTAMP",
+        f"{field} must use UTC Z notation with at most millisecond precision.",
+    )
+    try:
+        parsed = datetime.fromisoformat(value[:-1] + "+00:00")
+    except ValueError as exc:
+        raise VerificationError("INVALID_TIMESTAMP", f"{field} is not a real timestamp.") from exc
+    return parsed.astimezone(UTC)
+
+
+def root_fingerprint(public_key_pem: str) -> str:
+    key = _load_ed25519_public_key(public_key_pem)
+    der = key.public_bytes(
+        serialization.Encoding.DER, serialization.PublicFormat.SubjectPublicKeyInfo
+    )
+    return hashlib.sha256(der).hexdigest()
+
+
+def verify_key_certificate(
+    certificate: Mapping[str, Any],
+    trust_store: PinnedTrustStore,
+    *,
+    expected_role: str,
+    tenant_ref: str,
+    project_ref: str,
+    environment: str,
+    at: datetime | str,
+    revocation_journal: Mapping[str, Any] | None = None,
+) -> Mapping[str, Any]:
+    require(
+        certificate.get("protocolVersion") == KEY_CERTIFICATE_VERSION,
+        "CERTIFICATE_VERSION_UNSUPPORTED",
+        "Key certificate is not v0.2.",
+    )
+    role = str(certificate.get("role", ""))
+    require(
+        role in CERTIFIED_ROLES, "CERTIFICATE_ROLE_UNKNOWN", f"Unknown certificate role {role!r}."
+    )
+    require(
+        role == expected_role,
+        "CERTIFICATE_ROLE_MISMATCH",
+        f"Expected role {expected_role}, received {role}.",
+    )
+    root = trust_store.get(str(certificate.get("issuerRootId", "")))
+    _verify_root_shape(root)
+    require(
+        role in root.get("allowedRoles", []),
+        "ROOT_ROLE_DENIED",
+        "Pinned root does not authorize this role.",
+    )
+    require(
+        certificate.get("tenantRef") == tenant_ref
+        and certificate.get("projectRef") == project_ref
+        and certificate.get("environment") == environment,
+        "CERTIFICATE_SCOPE_MISMATCH",
+        "Certificate tenant, project, or environment scope does not match.",
+    )
+    event_at = parse_timestamp(at, "eventAt") if isinstance(at, str) else _utc(at)
+    not_before = parse_timestamp(certificate.get("notBefore"), "certificate.notBefore")
+    not_after = parse_timestamp(certificate.get("notAfter"), "certificate.notAfter")
+    require(
+        not_before <= event_at <= not_after,
+        "CERTIFICATE_INACTIVE",
+        "Certificate is outside its validity interval.",
+    )
+    root_not_before = parse_timestamp(root.get("notBefore"), "root.notBefore")
+    root_not_after = parse_timestamp(root.get("notAfter"), "root.notAfter")
+    require(
+        root_not_before <= event_at <= root_not_after,
+        "ROOT_INACTIVE",
+        "Pinned root is outside its validity interval.",
+    )
+
+    body = {
+        key: value
+        for key, value in certificate.items()
+        if key not in {"certificateDigest", "signature"}
+    }
+    require(
+        certificate.get("certificateDigest") == sha256_canonical(body),
+        "CERTIFICATE_DIGEST_MISMATCH",
+        "Certificate digest does not match its canonical body.",
+    )
+    signed = {**body, "certificateDigest": certificate["certificateDigest"]}
+    verify_document_signature(
+        signed, str(certificate.get("signature", "")), str(root.get("publicKeyPem", ""))
+    )
+    _load_ed25519_public_key(str(certificate.get("publicKeyPem", "")))
+
+    if revocation_journal is not None:
+        verify_revocation_journal(revocation_journal, trust_store)
+        assert_not_revoked(certificate, revocation_journal, event_at)
+    return root
+
+
+def verify_revocation_journal(journal: Mapping[str, Any], trust_store: PinnedTrustStore) -> None:
+    require(
+        journal.get("protocolVersion") == REVOCATION_JOURNAL_VERSION,
+        "REVOCATION_JOURNAL_VERSION_UNSUPPORTED",
+        "Revocation journal is not v0.2.",
+    )
+    root_id = str(journal.get("rootId", ""))
+    root = trust_store.get(root_id)
+    statements = journal.get("statements")
+    require(
+        isinstance(statements, list),
+        "REVOCATION_JOURNAL_INVALID",
+        "Revocation statements must be an array.",
+    )
+
+    previous_checkpoint: str | None = None
+    seen_subjects: set[tuple[int, str]] = set()
+    for index, statement in enumerate(statements):
+        require(
+            isinstance(statement, dict),
+            "REVOCATION_STATEMENT_INVALID",
+            "Revocation statement must be an object.",
+        )
+        require(
+            statement.get("protocolVersion") == REVOCATION_STATEMENT_VERSION,
+            "REVOCATION_STATEMENT_VERSION_UNSUPPORTED",
+            "Revocation statement is not v0.2.",
+        )
+        require(
+            statement.get("sequence") == index + 1,
+            "REVOCATION_SEQUENCE_INVALID",
+            f"Expected revocation sequence {index + 1}.",
+        )
+        require(
+            statement.get("previousJournalDigest") == previous_checkpoint,
+            "REVOCATION_CHAIN_BROKEN",
+            "Revocation journal continuity is invalid.",
+        )
+        require(
+            statement.get("issuerRootId") == root_id,
+            "REVOCATION_ISSUER_MISMATCH",
+            "Revocation statement issuer differs from the journal root.",
+        )
+        require(
+            isinstance(statement.get("retroactive"), bool),
+            "REVOCATION_RETROACTIVE_INVALID",
+            "retroactive must be boolean.",
+        )
+        parse_timestamp(statement.get("effectiveAt"), "revocation.effectiveAt")
+        body = {
+            key: value
+            for key, value in statement.items()
+            if key not in {"statementDigest", "signature"}
+        }
+        require(
+            statement.get("statementDigest") == sha256_canonical(body),
+            "REVOCATION_DIGEST_MISMATCH",
+            "Revocation statement digest is invalid.",
+        )
+        signed = {**body, "statementDigest": statement["statementDigest"]}
+        verify_document_signature(
+            signed, str(statement.get("signature", "")), str(root.get("publicKeyPem", ""))
+        )
+        subject_key = (int(statement["sequence"]), str(statement.get("revokedId", "")))
+        require(
+            subject_key not in seen_subjects,
+            "REVOCATION_DUPLICATE_ENTRY",
+            "Duplicate revocation entry detected.",
+        )
+        seen_subjects.add(subject_key)
+        previous_checkpoint = sha256_canonical(statements[: index + 1])
+
+    expected_checkpoint = (
+        previous_checkpoint if previous_checkpoint is not None else sha256_canonical([])
+    )
+    require(
+        journal.get("checkpointDigest") == expected_checkpoint,
+        "REVOCATION_CHECKPOINT_MISMATCH",
+        "Revocation checkpoint digest is invalid.",
+    )
+
+
+def assert_not_revoked(
+    certificate: Mapping[str, Any], journal: Mapping[str, Any], event_at: datetime
+) -> None:
+    for statement in journal.get("statements", []):
+        if statement.get("revokedId") not in {
+            certificate.get("certificateId"),
+            certificate.get("subjectKeyId"),
+        }:
+            continue
+        effective_at = parse_timestamp(statement.get("effectiveAt"), "revocation.effectiveAt")
+        if statement.get("retroactive") is True or event_at >= effective_at:
+            raise VerificationError(
+                "CERTIFICATE_REVOKED", "Certificate was revoked for the event time."
+            )
+
+
+def assert_revocation_journal_extends(
+    packet_journal: Mapping[str, Any], latest_journal: Mapping[str, Any]
+) -> None:
+    require(
+        packet_journal.get("rootId") == latest_journal.get("rootId"),
+        "REVOCATION_ROOT_MISMATCH",
+        "Packet and latest revocation journals use different roots.",
+    )
+    packet_statements = packet_journal.get("statements")
+    latest_statements = latest_journal.get("statements")
+    require(
+        isinstance(packet_statements, list) and isinstance(latest_statements, list),
+        "REVOCATION_JOURNAL_INVALID",
+        "Revocation statements must be arrays.",
+    )
+    require(
+        len(latest_statements) >= len(packet_statements)
+        and latest_statements[: len(packet_statements)] == packet_statements,
+        "REVOCATION_ROLLBACK_DETECTED",
+        "Latest revocation journal does not extend the packet checkpoint.",
+    )
+
+
+def _verify_root_shape(root: Mapping[str, Any]) -> None:
+    require(
+        root.get("protocolVersion") == TRUST_ROOT_VERSION,
+        "ROOT_VERSION_UNSUPPORTED",
+        "Pinned root is not v0.2.",
+    )
+    require(
+        root.get("algorithm") == "Ed25519",
+        "ROOT_ALGORITHM_UNSUPPORTED",
+        "Pinned root must use Ed25519.",
+    )
+    require(
+        isinstance(root.get("rootId"), str) and bool(root["rootId"]),
+        "ROOT_ID_MISSING",
+        "Pinned root ID is required.",
+    )
+    roles = root.get("allowedRoles")
+    require(
+        isinstance(roles, list) and all(role in CERTIFIED_ROLES for role in roles),
+        "ROOT_ROLES_INVALID",
+        "Pinned root roles are invalid.",
+    )
+    fingerprint = root_fingerprint(str(root.get("publicKeyPem", "")))
+    require(
+        root.get("rootFingerprint") == fingerprint,
+        "ROOT_FINGERPRINT_MISMATCH",
+        "Pinned root fingerprint does not match its public key.",
+    )
+    not_before = parse_timestamp(root.get("notBefore"), "root.notBefore")
+    not_after = parse_timestamp(root.get("notAfter"), "root.notAfter")
+    require(
+        not_after > not_before,
+        "ROOT_VALIDITY_INVALID",
+        "Pinned root validity interval is invalid.",
+    )
+
+
+def _load_ed25519_public_key(public_key_pem: str) -> Ed25519PublicKey:
+    try:
+        key = serialization.load_pem_public_key(public_key_pem.encode("ascii"))
+    except (ValueError, TypeError, UnicodeError) as exc:
+        raise VerificationError("INVALID_PUBLIC_KEY", "Public key PEM is invalid.") from exc
+    require(isinstance(key, Ed25519PublicKey), "INVALID_PUBLIC_KEY", "Public key must be Ed25519.")
+    return key
+
+
+def _utc(value: datetime) -> datetime:
+    require(value.tzinfo is not None, "INVALID_TIMESTAMP", "Datetime must be timezone-aware.")
+    return value.astimezone(UTC)

package/package.json

@@ -1,17 +1,17 @@
 {
   "name": "witnora",
-  "version": "0.10.0",
+  "version": "0.10.2",
   "description": "Independent assurance for covered agent action paths across models and frameworks.",
   "type": "module",
   "license": "Apache-2.0",
   "homepage": "https://witnora.com/",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/Kakarottoooo/agentcert.git",
+    "url": "git+https://github.com/Kakarottoooo/witnora.git",
     "directory": "packages/witnora-cli"
   },
   "bugs": {
-    "url": "https://github.com/Kakarottoooo/agentcert/issues"
+    "url": "https://github.com/Kakarottoooo/witnora/issues"
   },
   "publishConfig": {
     "access": "public",
@@ -51,7 +51,7 @@
     "package.json"
   ],
   "scripts": {
-    "build": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.json && tsc -p tsconfig.onegent-vendor.json && tsc -p tsconfig.sdk-vendor.json",
+    "build": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.json && tsc -p tsconfig.onegent-vendor.json && tsc -p tsconfig.sdk-vendor.json && tsc -p tsconfig.probe-vendor.json && node scripts/vendor-design-partner-assets.mjs",
     "prepack": "npm run build",
     "test": "vitest run tests",
     "demo:report": "node dist/cli.js report --mcpbench ../../examples/reports/passing/results.json --out .witnora/demo --subject demo-agent"