nordisk/holger

provenance/src/lib.rs

//! # holger-provenance
//!
//! Holger signs its own evidence as DSSE and SLSA. This crate VERIFIES the
//! provenance of what comes IN, offline, on the secure side of an airgap:
//!
//! * DSSE envelopes holding in-toto Statements (v1 and v0.1) whose subject digest
//!   is the artifact's sha256 or sha512 ([`statement`]);
//! * SLSA Provenance v1 and v0.2 predicates: builder id, build type, invocation
//!   and resolved dependencies, read into the evidence;
//! * signatures against a trust policy from the RON ([`policy`]): allowed keys
//!   (Ed25519, ECDSA P-256), allowed keyless identities (OIDC issuer + subject),
//!   allowed builders and a minimum SLSA build level;
//! * Sigstore keyless signing, checked offline ([`verify`]): the Fulcio chain to a
//!   pinned root, the identity, the embedded SCT against a pinned CT log, and the
//!   Rekor entry (SET and/or inclusion proof against a signed checkpoint) bound to
//!   this very signature;
//! * the formats the ecosystems ship ([`material`]): Sigstore bundles, PyPI PEP
//!   740 attestations, npm provenance, cosign image signatures and attestations
//!   (Chainguard's images), plain `.intoto.jsonl`;
//! * APK packages (Wolfi, Chainguard, Alpine) through their signed
//!   `APKINDEX.tar.gz` ([`apk`]): the index signature against a pinned key, the
//!   control hash the index names, the data hash `.PKGINFO` names;
//! * Maven Central's detached OpenPGP `.asc` signatures ([`pgp`]) against keys
//!   pinned in the trust bundle (or the floor's `keys` as `alg: openpgp`); an
//!   unpinned signer is unverified, never a pass.
//!
//! The pinned Sigstore trust root crosses the airgap as a signed update bundle
//! ([`trust`]), like the intel bundle. There is no network call anywhere here.

pub mod apk;
pub mod cert;
pub mod crypto;
pub mod der;
pub mod error;
pub mod material;
pub mod pgp;
pub mod policy;
pub mod statement;
pub mod tlog;
pub mod trust;
pub mod verify;

pub use error::{ProvenanceError, Result};
pub use policy::{
    check_floor, check_tightens, effective, BuilderRule, EffectivePolicy, Identity, KeyAlg, Mode,
    ProvenanceFloor, ProvenanceGate, TrustedKey,
};
pub use statement::ArtifactDigests;
pub use trust::{build_trust_bundle, TrustBundleOptions, TrustRoot, TRUST_PRODUCT};
pub use verify::{
    verify_artifact, CandidateReport, ProvenanceReport, SignerInfo, Verdict, EVIDENCE_SCHEMA,
};

/// The scanner id the intake chain records this verifier's evidence under.
pub const SCANNER_ID: &str = "holger-provenance";