`nx_coe_dsse.nx` source

↩ module page · 141 lines · 6435 B
1// nx_coe_dsse.nx -- DSSE-wrap the CoE in-toto attestation (F714 interop completion)
2// Reads coe_intoto.json (the in-toto ITE-6 Statement), wraps it in a DSSE envelope (Dead Simple
3// Signing Envelope, the standard Sigstore/in-toto signature wrapper): base64 payload + payloadType
4// + an ed25519 signature over the DSSE-PAE pre-authentication encoding. External verifiers can now
5// verify our attestation with just our public key. EXPORT-ONLY boundary. Written to coe_dsse.json.
6// PAE(t,b) = "DSSEv1" SP len(t) SP t SP len(b) SP b (RFC-style); sig = ed25519(seed, PAE).
7// Composes proven libs: nx_str/nx_syscalls + nx_ed25519_signature. x86-lane. license_tier: ORIGINAL
8import "nx_str.nx"
9import "nx_itoa_lib.nx"   // shared MSB-first emitter (zero-alloc)
10import "nx_syscalls.nx"
11import "nx_estate_path.nx"   // ep_anchor: the CWD must not decide this organ's verdict
12import "nx_ed25519_signature.nx"
13const CD_MAGIC_65536: i64 = 65536
14const CD_MAGIC_1024: i64 = 1024
15
16const CD_CAP: i64 = 1048576
17const CD_B64:  *u8 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
18const CD_TYPE: *u8 = "application/vnd.in-toto+json"
19const CD_KEYID: *u8 = "94e8a64c4e00009caeefde99599ea2e09dad102f48def0bf8a363da522135e50"
20
21func cd_puts(s: *u8) -> i64 { sys_write(1, s, nx_str_len(s)); return 0 }
22// MIGRATED to the shared emitter (debt 1785563586). The old body mmapped a scratch buffer
23// per call and never freed it. At PAGE granularity that is 4096B leaked PER CALL -- the
24// defect that took 28.5GB of a 36GB host in nx_ts_lumadiff (2MB input, ~3.66M calls).
25// nxi_* is MSB-first, allocates NOTHING, and emits identical bytes including the sign.
26func cd_pi(v: i64) -> i64 { nxi_out(v); return 0 }
27func cd_cat(dst: *u8, off: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { dst[off+i] = s[i]; i = i + 1 } return off + i }
28func cd_catn(dst: *u8, off: i64, v: i64) -> i64 {
29    let t: *u8 = sys_mmap(32)
30    var m: i64 = v
31    var k: i64 = 0
32    if m == 0 { t[0] = 48 as u8; k = 1 }
33    while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
34    var i: i64 = 0
35    while i < k { dst[off+i] = t[k-1-i]; i = i + 1 }
36    return off + k
37}
38func cd_q(dst: *u8, off: i64) -> i64 { dst[off] = 34 as u8; return off + 1 }
39func cd_cq(dst: *u8, off: i64, s: *u8) -> i64 { var o: i64 = cd_q(dst, off); o = cd_cat(dst, o, s); o = cd_q(dst, o); return o }
40func cd_coe_seed(out: *u8) -> i64 { var i: i64 = 0; while i < 32 { out[i] = ((i * 11 + 29) & 0xff) as u8; i = i + 1 } return 0 }
41
42// base64 encode src[0,n) into out (NUL-terminated); returns length
43func cd_b64enc(src: *u8, n: i64, out: *u8) -> i64 {
44    let b64: *u8 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" as *u8
45    var i: i64 = 0
46    var o: i64 = 0
47    while (i + 3) <= n {
48        let x: i64 = (src[i] as i64) * CD_MAGIC_65536 + (src[i+1] as i64) * 256 + (src[i+2] as i64)
49        out[o]   = b64[(x >> 18) & 63]
50        out[o+1] = b64[(x >> 12) & 63]
51        out[o+2] = b64[(x >> 6) & 63]
52        out[o+3] = b64[x & 63]
53        o = o + 4
54        i = i + 3
55    }
56    let rem: i64 = n - i
57    if rem == 1 {
58        let x: i64 = (src[i] as i64) * CD_MAGIC_65536
59        out[o]   = b64[(x >> 18) & 63]
60        out[o+1] = b64[(x >> 12) & 63]
61        out[o+2] = 61 as u8
62        out[o+3] = 61 as u8
63        o = o + 4
64    }
65    if rem == 2 {
66        let x: i64 = (src[i] as i64) * CD_MAGIC_65536 + (src[i+1] as i64) * 256
67        out[o]   = b64[(x >> 18) & 63]
68        out[o+1] = b64[(x >> 12) & 63]
69        out[o+2] = b64[(x >> 6) & 63]
70        out[o+3] = 61 as u8
71        o = o + 4
72    }
73    out[o] = 0 as u8
74    return o
75}
76func cd_write_file(path: *u8, buf: *u8, n: i64) -> i64 {
77    let fd: i64 = sys_openat_wr(path, 0x1a4)
78    if fd < 0 { return 0 - 1 }
79    sys_write(fd, buf, n)
80    sys_close(fd)
81    return n
82}
83
84func main() -> i64 {
85    // ANCHOR FIRST (2026-08-04, nx_cwdguard finding): this organ reads a RELATIVE
86    // knowledge/ path, so its answer depended on where it was launched. No-op when
87    // already at the estate root, so the cron/MCP context is unchanged.
88    ep_anchor()
89    cd_puts("=== COE-DSSE (F714): DSSE-wrap the in-toto attestation (ed25519-signed) ===\n" as *u8)
90
91    let lp: *i64 = sys_mmap(16) as *i64
92    lp[0] = 0
93    let body: *u8 = sys_read_file("knowledge/status/coe_intoto.json" as *u8, lp)
94    var blen: i64 = lp[0]
95    if blen <= 0 { cd_puts("COE-DSSE RED reason=no-intoto\n" as *u8); sys_exit(1); return 1 }
96    if blen > CD_CAP { blen = CD_CAP }
97    if body[blen - 1] == (10 as u8) { blen = blen - 1 }
98
99    // PAE = "DSSEv1 " len(type) " " type " " len(body) " " body
100    let tlen: i64 = nx_str_len(CD_TYPE)
101    let pae: *u8 = sys_mmap(CD_CAP + 256)
102    var p: i64 = 0
103    p = cd_cat(pae, p, "DSSEv1 " as *u8)
104    p = cd_catn(pae, p, tlen)
105    pae[p] = 32 as u8; p = p + 1
106    p = cd_cat(pae, p, CD_TYPE)
107    pae[p] = 32 as u8; p = p + 1
108    p = cd_catn(pae, p, blen)
109    pae[p] = 32 as u8; p = p + 1
110    var k: i64 = 0
111    while k < blen { pae[p + k] = body[k]; k = k + 1 }
112    p = p + blen
113
114    // ed25519 sign the PAE
115    let seed: *u8 = sys_mmap(32); cd_coe_seed(seed)
116    let sig: *u8 = sys_mmap(64); ed25519_sign_full(seed, pae, p, sig)
117
118    // base64 payload + signature
119    let payb64: *u8 = sys_mmap(blen * 2 + 16); cd_b64enc(body, blen, payb64)
120    let sigb64: *u8 = sys_mmap(128); cd_b64enc(sig, 64, sigb64)
121
122    // DSSE envelope JSON
123    let J: *u8 = sys_mmap(blen * 2 + CD_MAGIC_1024)
124    var o: i64 = 0
125    o = cd_cat(J, o, "{" as *u8)
126    o = cd_cq(J, o, "payloadType" as *u8); o = cd_cat(J, o, ":" as *u8); o = cd_cq(J, o, CD_TYPE); o = cd_cat(J, o, "," as *u8)
127    o = cd_cq(J, o, "payload" as *u8); o = cd_cat(J, o, ":" as *u8); o = cd_cq(J, o, payb64); o = cd_cat(J, o, "," as *u8)
128    o = cd_cq(J, o, "signatures" as *u8); o = cd_cat(J, o, ":[{" as *u8)
129    o = cd_cq(J, o, "keyid" as *u8); o = cd_cat(J, o, ":" as *u8); o = cd_cq(J, o, CD_KEYID); o = cd_cat(J, o, "," as *u8)
130    o = cd_cq(J, o, "sig" as *u8); o = cd_cat(J, o, ":" as *u8); o = cd_cq(J, o, sigb64); o = cd_cat(J, o, "}]}" as *u8)
131    J[o] = 10 as u8
132    o = o + 1
133
134    cd_write_file("knowledge/status/coe_dsse.json" as *u8, J, o)
135
136    cd_puts("COE-DSSE OK payloadType=" as *u8); cd_puts(CD_TYPE)
137    cd_puts(" alg=ed25519 pae-bytes=" as *u8); cd_pi(p)
138    cd_puts(" envelope-bytes=" as *u8); cd_pi(o)
139    cd_puts(" (signed DSSE -> coe_dsse.json, external-verifier-ready)\n" as *u8)
140    return 0
141}
nx_coe_dsse.nx source

`nx_coe_dsse.nx` source
