nordisk/dwarves

crates/dwarves-slsa/src/lib.rs

//! # dwarves-slsa
//!
//! The release half of the forge: SLSA v1.0 **Build L3** for the constellation's
//! releases (first the crates.io releases of Holger and Gunnar; the monetize
//! self-release and the media builds call the same library later).
//!
//! * [`runner`] makes a release a **Runa pipeline** (lane RELBUILD-RUNA): sealed
//!   containers (`Sandbox` steps: the pinned sources read-only, the crates vendored by
//!   a fetch container and checked against every `Cargo.lock`, the network off for every
//!   build step, no `$HOME`, no key, no shell) and the forge's own `Forge` actions
//!   between them. The dwarves forge runs it ([`runner::Executor`]) with CI's caps and
//!   cancel, and records it in its history.
//! * [`statement`] is the provenance the PLATFORM writes after the build, outside
//!   the build container: one in-toto Statement v1 per release, SLSA Provenance v1,
//!   every output's sha256 as a subject.
//! * [`dsse`] is the envelope the owner's YubiKey signs (ECDSA P-256 over the DSSE
//!   PAE); `cosign verify-blob-attestation` and Holger's provenance scanner both read it.
//! * [`verify`] checks a signed bundle against the committed release key, the
//!   builder, the build type and the artifacts.
//! * [`release_key`] is that key (the owner's YubiKey key, built in), the default of
//!   every verifying command.

pub mod cli;
pub mod dsse;
pub mod lock;
pub mod publish;
pub mod release_key;
pub mod release_mode;
pub mod runner;
pub mod spec;
pub mod statement;
pub mod subjects;
pub mod time;
pub mod verify;

/// Every refusal, by name.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct Error(pub String);

impl std::fmt::Display for Error {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.write_str(&self.0)
    }
}

impl std::error::Error for Error {}

impl From<std::io::Error> for Error {
    fn from(e: std::io::Error) -> Self {
        Error(format!("io: {e}"))
    }
}

impl From<serde_json::Error> for Error {
    fn from(e: serde_json::Error) -> Self {
        Error(format!("json: {e}"))
    }
}

pub type Result<T> = std::result::Result<T, Error>;

/// `Err(Error(format!(..)))`.
#[macro_export]
macro_rules! bail {
    ($($t:tt)*) => { return Err($crate::Error(format!($($t)*))) };
}