bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

feat(domain-access): verify manifest signatures

Browse source
This commit is contained in:
冰朔 2026-08-10 02:07:25 +08:00
commit fa2c868e0a
2 changed files with 153 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

81
product-source/guanghu-knowledge-base/server/domain-access.ts
View file

@ -1,11 +1,16 @@
import { createHash, verify as verifySignature } from 'node:crypto';
const MANIFEST_SCHEMA = 'gh-aios.domain-manifest/v1' as const;
const SHA256_PATTERN = /^[a-f0-9]{64}$/;
const COMMIT_PATTERN = /^[a-f0-9]{40}(?:[a-f0-9]{24})?$/;
const cryptographicallyVerifiedManifests = new WeakSet<object>();
export interface DomainManifestEvidence {
digest: string;
domainId: string;
repositoryId: string;
schema: typeof MANIFEST_SCHEMA;
signature: string;
signerId: string;
sourceCommit: string;
verifierReceipt: {
@ -17,6 +22,21 @@ export interface DomainManifestEvidence {
};
}
export interface DomainManifestSignedPayload {
domainId: string;
repositoryId: string;
schema: typeof MANIFEST_SCHEMA;
signerId: string;
sourceCommit: string;
}
export interface TrustedManifestSigner {
algorithm: 'Ed25519';
publicKeyPem: string;
repositoryId: string;
signerId: string;
}
export interface DomainSessionCapability {
capabilityId: string;
domainId: string;
@ -75,6 +95,16 @@ function invalidHandoff(): never {
throw new Error('domain_access_handoff_invalid');
}
export function domainManifestSigningBytes(payload: DomainManifestSignedPayload): Buffer {
return Buffer.from(JSON.stringify({
domainId: payload.domainId,
repositoryId: payload.repositoryId,
schema: payload.schema,
signerId: payload.signerId,
sourceCommit: payload.sourceCommit,
}), 'utf8');
}
/**
* Validates the structure and binding of evidence returned by a trusted route.
* Cryptographic signature verification is deliberately external: this boundary
@ -84,30 +114,45 @@ export function parseDomainAccessHandoff(
input: unknown,
expectedDomainId: string,
expectedNodeId: string,
trustedSigner: TrustedManifestSigner,
now = Date.now(),
): DomainAccessHandoff {
if (!isRecord(input) || !hasExactKeys(input, ['connectionReceipt', 'manifest', 'sessionCapability'])) invalidHandoff();
const manifest = input.manifest;
const capability = input.sessionCapability;
const connection = input.connectionReceipt;
if (!isRecord(manifest) || !hasExactKeys(manifest, ['digest', 'domainId', 'schema', 'signerId', 'sourceCommit', 'verifierReceipt'])) invalidHandoff();
if (!isRecord(manifest) || !hasExactKeys(manifest, ['digest', 'domainId', 'repositoryId', 'schema', 'signature', 'signerId', 'sourceCommit'])) invalidHandoff();
if (!isRecord(capability) || !hasExactKeys(capability, ['capabilityId', 'domainId', 'expiresAt', 'nodeId', 'scopes'])) invalidHandoff();
if (!isRecord(connection) || !hasExactKeys(connection, ['connectionId', 'domainId', 'manifestDigest', 'nodeId', 'receiptId', 'state'])) invalidHandoff();
const verifier = manifest.verifierReceipt;
if (!isRecord(verifier) || !hasExactKeys(verifier, ['manifestDigest', 'signerId', 'state', 'verifiedAt', 'verifierId'])) invalidHandoff();
const digest = manifest.digest;
if (manifest.schema !== MANIFEST_SCHEMA
|| typeof digest !== 'string' || !SHA256_PATTERN.test(digest)
|| manifest.domainId !== expectedDomainId
|| manifest.repositoryId !== trustedSigner.repositoryId
|| manifest.signerId !== trustedSigner.signerId
|| trustedSigner.algorithm !== 'Ed25519'
|| !isIdentifier(trustedSigner.publicKeyPem)
|| !isIdentifier(manifest.signerId)
|| typeof manifest.sourceCommit !== 'string' || !COMMIT_PATTERN.test(manifest.sourceCommit)
|| verifier.state !== 'verified'
|| verifier.manifestDigest !== digest
|| verifier.signerId !== manifest.signerId
|| !isIdentifier(verifier.verifierId)
|| typeof verifier.verifiedAt !== 'number' || !Number.isSafeInteger(verifier.verifiedAt) || verifier.verifiedAt > now) invalidHandoff();
|| typeof manifest.signature !== 'string') invalidHandoff();
const signedPayload = domainManifestSigningBytes({
domainId: manifest.domainId,
repositoryId: manifest.repositoryId,
schema: manifest.schema,
signerId: manifest.signerId,
sourceCommit: manifest.sourceCommit,
});
if (createHash('sha256').update(signedPayload).digest('hex') !== digest) invalidHandoff();
let signature: Buffer;
try {
signature = Buffer.from(manifest.signature, 'base64');
if (signature.length !== 64 || signature.toString('base64') !== manifest.signature) invalidHandoff();
if (!verifySignature(null, signedPayload, trustedSigner.publicKeyPem, signature)) invalidHandoff();
} catch {
invalidHandoff();
}
if (!isIdentifier(capability.capabilityId)
|| capability.domainId !== expectedDomainId
@ -124,7 +169,22 @@ export function parseDomainAccessHandoff(
|| connection.manifestDigest !== digest
|| connection.state !== 'online') invalidHandoff();
return input as unknown as DomainAccessHandoff;
const handoff: DomainAccessHandoff = {
connectionReceipt: connection as unknown as DomainConnectionReceipt,
manifest: {
...(manifest as unknown as Omit<DomainManifestEvidence, 'verifierReceipt'>),
verifierReceipt: {
manifestDigest: digest,
signerId: manifest.signerId,
state: 'verified',
verifiedAt: now,
verifierId: 'HOLOLAKE-DESKTOP-ED25519',
},
},
sessionCapability: capability as unknown as DomainSessionCapability,
};
cryptographicallyVerifiedManifests.add(handoff.manifest);
return handoff;
}
export function evaluateDomainAccess(evidence: DomainAccessEvidence, now = Date.now()): DomainAccessStatus {
@ -133,6 +193,7 @@ export function evaluateDomainAccess(evidence: DomainAccessEvidence, now = Date.
const manifest = evidence.manifest;
const verifier = manifest?.verifierReceipt;
if (!manifest
|| !cryptographicallyVerifiedManifests.has(manifest)
|| manifest.schema !== MANIFEST_SCHEMA
|| manifest.domainId !== evidence.domainId
|| !SHA256_PATTERN.test(manifest.digest)