Skip to content

Commit e8044fa

Browse files
volmedovolmedo
authored
fix: trust attestations from trusted authorities (#23)
* fix: trust attestations from trusted authorities * test the actual validation context created by the consolidator
1 parent 2a82117 commit e8044fa

File tree

7 files changed

+185
-48
lines changed

7 files changed

+185
-48
lines changed

‎cmd/etracker/start.go‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,13 @@ func init() {
134134
"List of known provider DIDs (defaults to presets if not specified)",
135135
)
136136
cobra.CheckErr(viper.BindPFlag("known_providers", startCmd.Flags().Lookup("known-providers")))
137+
138+
startCmd.Flags().StringSlice(
139+
"trusted-authorities",
140+
[]string{},
141+
"List of trusted authorities, identified by their DIDs (comma-separated)",
142+
)
143+
cobra.CheckErr(viper.BindPFlag("trusted_authorities", startCmd.Flags().Lookup("trusted-authorities")))
137144
}
138145

139146
func startService(cmd *cobra.Command, args []string) error {
@@ -218,7 +225,8 @@ func startService(cmd *cobra.Command, args []string) error {
218225
cfg.KnownProviders,
219226
interval,
220227
batchSize,
221-
presolver,
228+
presolver.ResolveDIDKey,
229+
cfg.TrustedAuthorities,
222230
)
223231
if err != nil {
224232
return fmt.Errorf("creating consolidator: %w", err)

‎deploy/.env.production.local.tpl‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@ if [ "$TF_WORKSPACE" == "forge-prod" ]; then
1010
CONSUMER_TABLE_REGION="us-west-2"
1111
CONSUMER_CONSUMER_INDEX_NAME="consumer"
1212
CONSUMER_CUSTOMER_INDEX_NAME="customer"
13+
14+
TRUSTED_AUTHORITIES="did:web:up.forge.storacha.network"
1315
else
1416
STORAGE_PROVIDER_TABLE_NAME="staging-warm-upload-api-storage-provider"
1517
STORAGE_PROVIDER_TABLE_REGION="us-east-2"
@@ -21,11 +23,11 @@ else
2123
CONSUMER_TABLE_REGION="us-east-2"
2224
CONSUMER_CONSUMER_INDEX_NAME="consumer"
2325
CONSUMER_CUSTOMER_INDEX_NAME="customer"
26+
27+
TRUSTED_AUTHORITIES="did:web:staging.up.forge.storacha.network,did:web:staging.up.warm.storacha.network"
2428
fi
2529
%>
2630

27-
ETRACKER_METRICS_ENVIRONMENT=<%= $TF_WORKSPACE %>
28-
2931
STORAGE_PROVIDER_TABLE_NAME=<%= $STORAGE_PROVIDER_TABLE_NAME %>
3032
STORAGE_PROVIDER_TABLE_REGION=<%= $STORAGE_PROVIDER_TABLE_REGION %>
3133

@@ -36,3 +38,6 @@ CONSUMER_TABLE_NAME=<%= $CONSUMER_TABLE_NAME %>
3638
CONSUMER_TABLE_REGION=<%= $CONSUMER_TABLE_REGION %>
3739
CONSUMER_CONSUMER_INDEX_NAME=<%= $CONSUMER_CONSUMER_INDEX_NAME %>
3840
CONSUMER_CUSTOMER_INDEX_NAME=<%= $CONSUMER_CUSTOMER_INDEX_NAME %>
41+
42+
ETRACKER_METRICS_ENVIRONMENT=<%= $TF_WORKSPACE %>
43+
ETRACKER_TRUSTED_AUTHORITIES=<%= $TRUSTED_AUTHORITIES %>

‎go.mod‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ module github.com/storacha/etracker
33
go 1.24.4
44

55
require (
6-
github.com/aws/aws-sdk-go-v2 v1.39.1
6+
github.com/aws/aws-sdk-go-v2 v1.39.2
77
github.com/aws/aws-sdk-go-v2/config v1.31.10
88
github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.20.3
99
github.com/aws/aws-sdk-go-v2/service/dynamodb v1.47.0
@@ -14,8 +14,8 @@ require (
1414
github.com/prometheus/client_golang v1.23.2
1515
github.com/spf13/cobra v1.2.1
1616
github.com/spf13/viper v1.8.1
17-
github.com/storacha/go-libstoracha v0.2.9
18-
github.com/storacha/go-ucanto v0.6.8-0.20251103120651-427b55a78410
17+
github.com/storacha/go-libstoracha v0.4.0
18+
github.com/storacha/go-ucanto v0.7.1
1919
github.com/stretchr/testify v1.11.1
2020
go.opentelemetry.io/otel v1.38.0
2121
go.opentelemetry.io/otel/exporters/prometheus v0.60.0
@@ -26,13 +26,13 @@ require (
2626
require (
2727
github.com/aws/aws-sdk-go-v2/credentials v1.18.14 // indirect
2828
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.8 // indirect
29-
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.8 // indirect
30-
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.8 // indirect
29+
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.9 // indirect
30+
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.9 // indirect
3131
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
3232
github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.29.0 // indirect
3333
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1 // indirect
3434
github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.11.3 // indirect
35-
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.8 // indirect
35+
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.9 // indirect
3636
github.com/aws/aws-sdk-go-v2/service/sso v1.29.4 // indirect
3737
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.0 // indirect
3838
github.com/aws/aws-sdk-go-v2/service/sts v1.38.5 // indirect

‎go.sum‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -43,8 +43,8 @@ github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kd
4343
github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
4444
github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
4545
github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
46-
github.com/aws/aws-sdk-go-v2 v1.39.1 h1:fWZhGAwVRK/fAN2tmt7ilH4PPAE11rDj7HytrmbZ2FE=
47-
github.com/aws/aws-sdk-go-v2 v1.39.1/go.mod h1:sDioUELIUO9Znk23YVmIk86/9DOpkbyyVb1i/gUNFXY=
46+
github.com/aws/aws-sdk-go-v2 v1.39.2 h1:EJLg8IdbzgeD7xgvZ+I8M1e0fL0ptn/M47lianzth0I=
47+
github.com/aws/aws-sdk-go-v2 v1.39.2/go.mod h1:sDioUELIUO9Znk23YVmIk86/9DOpkbyyVb1i/gUNFXY=
4848
github.com/aws/aws-sdk-go-v2/config v1.31.10 h1:7LllDZAegXU3yk41mwM6KcPu0wmjKGQB1bg99bNdQm4=
4949
github.com/aws/aws-sdk-go-v2/config v1.31.10/go.mod h1:Ge6gzXPjqu4v0oHvgAwvGzYcK921GU0hQM25WF/Kl+8=
5050
github.com/aws/aws-sdk-go-v2/credentials v1.18.14 h1:TxkI7QI+sFkTItN/6cJuMZEIVMFXeu2dI1ZffkXngKI=
@@ -53,10 +53,10 @@ github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.20.3 h1:RrxJ6g7+
5353
github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.20.3/go.mod h1:e4y84j44vA9IFksSDDuAtNj9t3W20iJlsbXhbo/JU10=
5454
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.8 h1:gLD09eaJUdiszm7vd1btiQUYE0Hj+0I2b8AS+75z9AY=
5555
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.8/go.mod h1:4RW3oMPt1POR74qVOC4SbubxAwdP4pCT0nSw3jycOU4=
56-
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.8 h1:6bgAZgRyT4RoFWhxS+aoGMFyE0cD1bSzFnEEi4bFPGI=
57-
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.8/go.mod h1:KcGkXFVU8U28qS4KvLEcPxytPZPBcRawaH2Pf/0jptE=
58-
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.8 h1:HhJYoES3zOz34yWEpGENqJvRVPqpmJyR3+AFg9ybhdY=
59-
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.8/go.mod h1:JnA+hPWeYAVbDssp83tv+ysAG8lTfLVXvSsyKg/7xNA=
56+
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.9 h1:se2vOWGD3dWQUtfn4wEjRQJb1HK1XsNIt825gskZ970=
57+
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.9/go.mod h1:hijCGH2VfbZQxqCDN7bwz/4dzxV+hkyhjawAtdPWKZA=
58+
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.9 h1:6RBnKZLkJM4hQ+kN6E7yWFveOTg8NLPHAkqrs4ZPlTU=
59+
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.9/go.mod h1:V9rQKRmK7AWuEsOMnHzKj8WyrIir1yUJbZxDuZLFvXI=
6060
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 h1:bIqFDwgGXXN1Kpp99pDOdKMTTb5d2KyU5X/BZxjOkRo=
6161
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3/go.mod h1:H5O/EsxDWyU+LP/V8i5sm8cxoZgc2fdNR9bxlOFrQTo=
6262
github.com/aws/aws-sdk-go-v2/service/dynamodb v1.47.0 h1:A5zeikrrAgz3YtNzhMat4K8hK/CFzOjFKLVk8pI7Cz8=
@@ -67,8 +67,8 @@ github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1 h1:oegbebP
6767
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1/go.mod h1:kemo5Myr9ac0U9JfSjMo9yHLtw+pECEHsFtJ9tqCEI8=
6868
github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.11.3 h1:xMmJPUT0G1q9+I0mzH4B6oN9fB5PkDoD+jvpVIcom1I=
6969
github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.11.3/go.mod h1:U0JFMTY/gPxV07XTXXz152nX0Hg1eBenzyslKF2j4j4=
70-
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.8 h1:M6JI2aGFEzYxsF6CXIuRBnkge9Wf9a2xU39rNeXgu10=
71-
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.8/go.mod h1:Fw+MyTwlwjFsSTE31mH211Np+CUslml8mzc0AFEG09s=
70+
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.9 h1:5r34CgVOD4WZudeEKZ9/iKpiT6cM1JyEROpXjOcdWv8=
71+
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.9/go.mod h1:dB12CEbNWPbzO2uC6QSWHteqOg4JfBVJOojbAoAUb5I=
7272
github.com/aws/aws-sdk-go-v2/service/sso v1.29.4 h1:FTdEN9dtWPB0EOURNtDPmwGp6GGvMqRJCAihkSl/1No=
7373
github.com/aws/aws-sdk-go-v2/service/sso v1.29.4/go.mod h1:mYubxV9Ff42fZH4kexj43gFPhgc/LyC7KqvUKt1watc=
7474
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.0 h1:I7ghctfGXrscr7r1Ga/mDqSJKm7Fkpl5Mwq79Z+rZqU=
@@ -517,10 +517,10 @@ github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
517517
github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
518518
github.com/spf13/viper v1.8.1 h1:Kq1fyeebqsBfbjZj4EL7gj2IO0mMaiyjYUWcUsl2O44=
519519
github.com/spf13/viper v1.8.1/go.mod h1:o0Pch8wJ9BVSWGQMbra6iw0oQ5oktSIBaujf1rJH9Ns=
520-
github.com/storacha/go-libstoracha v0.2.9 h1:1EMhYNpT72dsNBDrbgnXUN/A2wpyEcUWL63wCiSOZwA=
521-
github.com/storacha/go-libstoracha v0.2.9/go.mod h1:nkVcVfEVeeGH1dA7SYpvYC6ip1hmoL1k6z/x+QTynXQ=
522-
github.com/storacha/go-ucanto v0.6.8-0.20251103120651-427b55a78410 h1:ZQb2e/CR4Vll+jIFw/qW0NnVu5D+pWr0EVeAGpVXJ8E=
523-
github.com/storacha/go-ucanto v0.6.8-0.20251103120651-427b55a78410/go.mod h1:O35Ze4x18EWtz3ftRXXd/mTZ+b8OQVjYYrnadJ/xNjg=
520+
github.com/storacha/go-libstoracha v0.4.0 h1:QkJKOE4zQ13p478tMr6C5pY3VHQxqaBE8kGDiY3TqTQ=
521+
github.com/storacha/go-libstoracha v0.4.0/go.mod h1:PLTFCREzKlZMY9cuZDCJUh2DiCWLKQEyTQhYM1muy9M=
522+
github.com/storacha/go-ucanto v0.7.1 h1:/KRsCltQt57+3sqNqM8ygh9TwA6+0DGC2LIYaOnhcSY=
523+
github.com/storacha/go-ucanto v0.7.1/go.mod h1:O35Ze4x18EWtz3ftRXXd/mTZ+b8OQVjYYrnadJ/xNjg=
524524
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
525525
github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
526526
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=

‎internal/config/config.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,8 @@ type Config struct {
3333
ConsumerTableRegion string `mapstructure:"consumer_table_region" validate:"required"`
3434
ConsumerConsumerIndexName string `mapstructure:"consumer_consumer_index_name" validate:"required"`
3535
ConsumerCustomerIndexName string `mapstructure:"consumer_customer_index_name" validate:"required"`
36-
KnownProviders []string `mapstructure:"known_providers"`
36+
KnownProviders []string `mapstructure:"known_providers" validate:"dive,startswith=did:web:"`
37+
TrustedAuthorities []string `mapstructure:"trusted_authorities" validate:"dive,startswith=did:web:"`
3738
}
3839

3940
func Load(ctx context.Context) (*Config, error) {

‎internal/consolidator/consolidator.go‎

Lines changed: 32 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ import (
1313
logging "github.com/ipfs/go-log/v2"
1414
"github.com/storacha/go-libstoracha/capabilities/space/content"
1515
capegress "github.com/storacha/go-libstoracha/capabilities/space/egress"
16+
ucancap "github.com/storacha/go-libstoracha/capabilities/ucan"
1617
"github.com/storacha/go-ucanto/client"
1718
"github.com/storacha/go-ucanto/core/car"
1819
"github.com/storacha/go-ucanto/core/dag/blockstore"
@@ -69,8 +70,36 @@ func New(
6970
knownProviders []string,
7071
interval time.Duration,
7172
batchSize int,
72-
presolver validator.PrincipalResolver,
73+
presolver validator.PrincipalResolverFunc,
74+
trustedAuthorities []string,
7375
) (*Consolidator, error) {
76+
// trust attestations from trusted authorities
77+
var authProofs []delegation.Delegation
78+
for _, authority := range trustedAuthorities {
79+
auth, err := did.Parse(authority)
80+
if err != nil {
81+
return nil, fmt.Errorf("parsing trusted authority: %w", err)
82+
}
83+
84+
attestDlg, err := delegation.Delegate(
85+
id,
86+
auth,
87+
[]ucan.Capability[ucan.NoCaveats]{
88+
ucan.NewCapability(
89+
ucancap.AttestAbility,
90+
id.DID().String(),
91+
ucan.NoCaveats{},
92+
),
93+
},
94+
delegation.WithNoExpiration(),
95+
)
96+
if err != nil {
97+
return nil, err
98+
}
99+
100+
authProofs = append(authProofs, attestDlg)
101+
}
102+
74103
retrieveValidationCtx := validator.NewValidationContext(
75104
id.Verifier(),
76105
content.Retrieve,
@@ -80,11 +109,12 @@ func New(
80109
},
81110
validator.ProofUnavailable,
82111
verifier.Parse,
83-
presolver.ResolveDIDKey,
112+
presolver,
84113
// ignore expiration and not valid before
85114
func(dlg delegation.Delegation) validator.InvalidProof {
86115
return nil
87116
},
117+
authProofs...,
88118
)
89119

90120
c := &Consolidator{

0 commit comments

Comments
 (0)