nordisk/dwarves

crates/dwarves-slsa/src/release_key.rs

//! ★ The release verification key: the owner's YubiKey key (serial 34569904, PIV slot 9c,
//! ECDSA P-256, PIN policy once, touch policy always, generated on the device). It is the
//! same file as `slsa/release-signing-key.pub` in holger and gunnar, where its YubiKey
//! attestation sits beside it. Every command that verifies a release bundle uses it unless
//! `--key` or `$SLSA_KEY` names another key.

use crate::{dsse, Error, Result};

/// The public key, PEM (`keys/release-signing-key.pub`).
pub const RELEASE_KEY_PEM: &str = include_str!("../keys/release-signing-key.pub");

/// Its key id: hex sha256 of the SubjectPublicKeyInfo DER (`dsse::keyid`).
pub const RELEASE_KEY_ID: &str = "d24d3785e8281bcd37e8f2c40a3a85e8152d3ce2200a5c929a1a5ca636e8249e";

/// The release key's SubjectPublicKeyInfo DER.
pub fn spki() -> Result<Vec<u8>> {
    let spki = dsse::spki_from_pem(RELEASE_KEY_PEM)?;
    if dsse::keyid(&spki) != RELEASE_KEY_ID {
        return Err(Error(
            "the built-in release key does not match its key id".into(),
        ));
    }
    Ok(spki)
}

/// The key to verify with: the `--key` file, else the `$SLSA_KEY` file, else the release key.
pub fn resolve(flag: Option<&str>, env: Option<&str>) -> Result<Vec<u8>> {
    match flag.or(env) {
        Some(p) => {
            let text = std::fs::read_to_string(p).map_err(|e| Error(format!("{p}: {e}")))?;
            dsse::spki_from_pem(&text)
        }
        None => spki(),
    }
}