feat(rust/signed-doc): Add signing and verification logic to Catalyst Signed Docs

rust/signed_doc/Cargo.toml

@@ -16,7 +16,7 @@ anyhow = "1.0.95"
 serde = { version = "1.0.217", features = ["derive"] }
 serde_json = "1.0.134"
 coset = "0.3.8"
-minicbor = "0.25.1"
+minicbor = { version = "0.25.1", features = ["half"] }
 brotli = "7.0.0"
 ed25519-dalek = { version = "2.1.1", features = ["pem", "rand_core"] }
 uuid = { version = "1.11.0", features = ["v4", "v7", "serde"] }
@@ -31,4 +31,4 @@ rand = "0.8.5"
 
 [[bin]]
 name = "signed-docs"
-path = "examples/mk_signed_doc.rs"
+path = "examples/mk_signed_doc.rs"

rust/signed_doc/examples/mk_signed_doc.rs

@@ -10,8 +10,7 @@ use std::{
 
 use catalyst_signed_doc::{Builder, CatalystSignedDocument, KidUri, Metadata};
 use clap::Parser;
-use coset::CborSerializable;
-use ed25519_dalek::{ed25519::signature::Signer, pkcs8::DecodePrivateKey};
+use ed25519_dalek::pkcs8::{DecodePrivateKey, DecodePublicKey};
 
 fn main() {
     if let Err(err) = Cli::parse().exec() {
@@ -52,6 +51,16 @@ enum Cli {
         /// Hex-formatted COSE SIGN Bytes
         cose_sign_hex: String,
     },
+    /// Validates a signature by Key ID and verifying key
+    Verify {
+        /// Path to the formed (could be empty, without any signatures) COSE document
+        /// This exact file would be modified and new signature would be added
+        path: PathBuf,
+        /// Path to the verifying key in PEM format
+        pk: PathBuf,
+        /// Signer kid
+        kid: KidUri,
+    },
 }
 
 impl Cli {
@@ -68,53 +77,80 @@ impl Cli {
                 let payload = serde_json::to_vec(&json_doc)?;
                 // Start with no signatures.
                 let signed_doc = Builder::new()
-                    .with_content(payload)
+                    .with_decoded_content(payload)
                     .with_metadata(metadata)
                     .build()?;
-                let mut bytes: Vec<u8> = Vec::new();
-                minicbor::encode(signed_doc, &mut bytes)
-                    .map_err(|e| anyhow::anyhow!("Failed to encode document: {e}"))?;
-
-                write_bytes_to_file(&bytes, &output)?;
+                save_signed_doc(signed_doc, &output)?;
             },
             Self::Sign { sk, doc, kid } => {
                 let sk = load_secret_key_from_file(&sk)
                     .map_err(|e| anyhow::anyhow!("Failed to load SK FILE: {e}"))?;
-                let mut cose = load_cose_from_file(&doc)
-                    .map_err(|e| anyhow::anyhow!("Failed to load COSE FROM FILE: {e}"))?;
-                add_signature_to_cose(&mut cose, &sk, kid.to_string());
-                store_cose_file(cose, &doc)?;
+                let cose_bytes = read_bytes_from_file(&doc)?;
+                let signed_doc = signed_doc_from_bytes(cose_bytes.as_slice())?;
+                let builder = signed_doc.as_signed_doc_builder();
+                let new_signed_doc = builder.add_signature(sk.to_bytes(), kid)?.build()?;
+                save_signed_doc(new_signed_doc, &doc)?;
             },
             Self::Inspect { path } => {
-                let mut cose_file = File::open(path)?;
-                let mut cose_bytes = Vec::new();
-                cose_file.read_to_end(&mut cose_bytes)?;
-                decode_signed_doc(&cose_bytes);
+                let cose_bytes = read_bytes_from_file(&path)?;
+                inspect_signed_doc(&cose_bytes)?;
             },
             Self::InspectBytes { cose_sign_hex } => {
                 let cose_bytes = hex::decode(&cose_sign_hex)?;
-                decode_signed_doc(&cose_bytes);
+                inspect_signed_doc(&cose_bytes)?;
+            },
+            Self::Verify { path, pk, kid } => {
+                let pk = load_public_key_from_file(&pk)
+                    .map_err(|e| anyhow::anyhow!("Failed to load PK FILE {pk:?}: {e}"))?;
+                let cose_bytes = read_bytes_from_file(&path)?;
+                let signed_doc = signed_doc_from_bytes(cose_bytes.as_slice())?;
+                signed_doc
+                    .verify(|k| {
+                        if k.to_string() == kid.to_string() {
+                            pk
+                        } else {
+                            k.role0_pk()
+                        }
+                    })
+                    .map_err(|e| anyhow::anyhow!("Catalyst Document Verification failed: {e}"))?;
+                println!("Catalyst Signed Document is Verified.");
             },
         }
         println!("Done");
         Ok(())
     }
 }
 
-fn decode_signed_doc(cose_bytes: &[u8]) {
+fn read_bytes_from_file(path: &PathBuf) -> anyhow::Result<Vec<u8>> {
+    let mut cose_file = File::open(path)?;
+    let mut cose_bytes = Vec::new();
+    cose_file.read_to_end(&mut cose_bytes)?;
+    Ok(cose_bytes)
+}
+
+fn inspect_signed_doc(cose_bytes: &[u8]) -> anyhow::Result<()> {
     println!(
-        "Decoding {} bytes: {}",
+        "Decoding {} bytes:\n{}",
         cose_bytes.len(),
         hex::encode(cose_bytes)
     );
+    let cat_signed_doc = signed_doc_from_bytes(cose_bytes)?;
+    println!("This is a valid Catalyst Document.");
+    println!("{cat_signed_doc}");
+    Ok(())
+}
 
-    match CatalystSignedDocument::try_from(cose_bytes) {
-        Ok(cat_signed_doc) => {
-            println!("This is a valid Catalyst Document.");
-            println!("{cat_signed_doc}");
-        },
-        Err(e) => eprintln!("Invalid Catalyst Document, err: {e}"),
-    }
+fn save_signed_doc(signed_doc: CatalystSignedDocument, path: &PathBuf) -> anyhow::Result<()> {
+    let mut bytes: Vec<u8> = Vec::new();
+    minicbor::encode(signed_doc, &mut bytes)
+        .map_err(|e| anyhow::anyhow!("Failed to encode document: {e}"))?;
+
+    write_bytes_to_file(&bytes, path)
+}
+
+fn signed_doc_from_bytes(cose_bytes: &[u8]) -> anyhow::Result<CatalystSignedDocument> {
+    CatalystSignedDocument::try_from(cose_bytes)
+        .map_err(|e| anyhow::anyhow!("Invalid Catalyst Document: {e}"))
 }
 
 fn load_json_from_file<T>(path: &PathBuf) -> anyhow::Result<T>
@@ -124,45 +160,20 @@ where T: for<'de> serde::Deserialize<'de> {
     Ok(json)
 }
 
-fn load_cose_from_file(cose_path: &PathBuf) -> anyhow::Result<coset::CoseSign> {
-    let cose_file_bytes = read_bytes_from_file(cose_path)?;
-    let cose = coset::CoseSign::from_slice(&cose_file_bytes).map_err(|e| anyhow::anyhow!("{e}"))?;
-    Ok(cose)
-}
-
-fn read_bytes_from_file(path: &PathBuf) -> anyhow::Result<Vec<u8>> {
-    let mut file_bytes = Vec::new();
-    File::open(path)?.read_to_end(&mut file_bytes)?;
-    Ok(file_bytes)
-}
-
 fn write_bytes_to_file(bytes: &[u8], output: &PathBuf) -> anyhow::Result<()> {
     File::create(output)?
         .write_all(bytes)
         .map_err(|e| anyhow::anyhow!("Failed to write to file {output:?}: {e}"))
 }
 
-fn store_cose_file(cose: coset::CoseSign, output: &PathBuf) -> anyhow::Result<()> {
-    let cose_bytes = cose
-        .to_vec()
-        .map_err(|e| anyhow::anyhow!("Failed to Store COSE SIGN: {e}"))?;
-    write_bytes_to_file(&cose_bytes, output)
-}
-
 fn load_secret_key_from_file(sk_path: &PathBuf) -> anyhow::Result<ed25519_dalek::SigningKey> {
     let sk_str = read_to_string(sk_path)?;
     let sk = ed25519_dalek::SigningKey::from_pkcs8_pem(&sk_str)?;
     Ok(sk)
 }
 
-fn add_signature_to_cose(cose: &mut coset::CoseSign, sk: &ed25519_dalek::SigningKey, kid: String) {
-    let protected_header = coset::HeaderBuilder::new()
-        .key_id(kid.into_bytes())
-        .algorithm(coset::iana::Algorithm::EdDSA);
-    let mut signature = coset::CoseSignatureBuilder::new()
-        .protected(protected_header.build())
-        .build();
-    let data_to_sign = cose.tbs_data(&[], &signature);
-    signature.signature = sk.sign(&data_to_sign).to_vec();
-    cose.signatures.push(signature);
+fn load_public_key_from_file(pk_path: &PathBuf) -> anyhow::Result<ed25519_dalek::VerifyingKey> {
+    let pk_str = read_to_string(pk_path)?;
+    let pk = ed25519_dalek::VerifyingKey::from_public_key_pem(&pk_str)?;
+    Ok(pk)
 }

rust/signed_doc/src/builder.rs

@@ -1,15 +1,18 @@
 //! Catalyst Signed Document Builder.
+use catalyst_types::kid_uri::KidUri;
+use ed25519_dalek::{ed25519::signature::Signer, SecretKey};
+
 use crate::{CatalystSignedDocument, Content, InnerCatalystSignedDocument, Metadata, Signatures};
 
 /// Catalyst Signed Document Builder.
-#[derive(Debug, Default)]
+#[derive(Debug, Default, Clone)]
 pub struct Builder {
     /// Document Metadata
-    metadata: Option<Metadata>,
+    pub(crate) metadata: Option<Metadata>,
     /// Document Content
-    content: Option<Vec<u8>>,
+    pub(crate) content: Option<Vec<u8>>,
     /// Signatures
-    signatures: Signatures,
+    pub(crate) signatures: Signatures,
 }
 
 impl Builder {
@@ -26,13 +29,58 @@ impl Builder {
         self
     }
 
-    /// Set document content
+    /// Set decoded (original) document content bytes
     #[must_use]
-    pub fn with_content(mut self, content: Vec<u8>) -> Self {
+    pub fn with_decoded_content(mut self, content: Vec<u8>) -> Self {
         self.content = Some(content);
         self
     }
 
+    /// Set document signatures
+    #[must_use]
+    pub fn with_signatures(mut self, signatures: Signatures) -> Self {
+        self.signatures = signatures;
+        self
+    }
+
+    /// Add a signature to the document
+    ///
+    /// # Errors
+    ///
+    /// Fails if a `CatalystSignedDocument` cannot be created due to missing metadata or
+    /// content, due to malformed data, or when the signed document cannot be
+    /// converted into `coset::CoseSign`.
+    pub fn add_signature(self, sk: SecretKey, kid: KidUri) -> anyhow::Result<Self> {
+        let cose_sign = self
+            .clone()
+            .build()
+            .map_err(|e| anyhow::anyhow!("Failed to sign: {e}"))?
+            .as_cose_sign()
+            .map_err(|e| anyhow::anyhow!("Failed to sign: {e}"))?;
+        let Self {
+            metadata: Some(metadata),
+            content: Some(content),
+            mut signatures,
+        } = self
+        else {
+            anyhow::bail!("Metadata and Content are needed for signing");
+        };
+        let sk = ed25519_dalek::SigningKey::from_bytes(&sk);
+        let protected_header = coset::HeaderBuilder::new()
+            .key_id(kid.to_string().into_bytes())
+            .algorithm(metadata.algorithm().into());
+        let mut signature = coset::CoseSignatureBuilder::new()
+            .protected(protected_header.build())
+            .build();
+        let data_to_sign = cose_sign.tbs_data(&[], &signature);
+        signature.signature = sk.sign(&data_to_sign).to_vec();
+        signatures.push(kid, signature);
+        Ok(Self::new()
+            .with_decoded_content(content)
+            .with_metadata(metadata)
+            .with_signatures(signatures))
+    }
+
     /// Build a signed document
     ///
     /// ## Errors

rust/signed_doc/src/content.rs

@@ -41,11 +41,21 @@ impl Content {
     ///
     /// # Errors
     /// Returns an error if content is not correctly encoded
-    #[allow(clippy::unnecessary_wraps)]
     pub(crate) fn from_decoded(
         data: Vec<u8>, content_type: ContentType, content_encoding: Option<ContentEncoding>,
     ) -> anyhow::Result<Self> {
-        // TODO add content_type verification
+        match content_type {
+            ContentType::Json => {
+                if let Err(e) = serde_json::to_value(&data) {
+                    anyhow::bail!("Invalid {content_type} content: {e}")
+                }
+            },
+            ContentType::Cbor => {
+                if let Err(e) = minicbor::decode::<minicbor::data::Token>(&data) {
+                    anyhow::bail!("Invalid {content_type} content: {e}")
+                }
+            },
+        }
         Ok(Self {
             data,
             content_type,