github.com/vchain-us/vcn@v0.9.11-0.20210921212052-a2484d23c0b3/pkg/cmd/verify/verify.go

/*
 * Copyright (c) 2018-2020 vChain, Inc. All Rights Reserved.
 * This software is released under GPL3.
 * The full license information can be found under:
 * https://www.gnu.org/licenses/gpl-3.0.en.html
 *
 */

package verify

import (
	"context"
	"encoding/json"
	"fmt"
	"regexp"
	"strconv"
	"strings"

	"github.com/blang/semver"
	"github.com/fatih/color"
	"github.com/spf13/cobra"
	"github.com/spf13/viper"
	"google.golang.org/grpc/metadata"

	immuschema "github.com/codenotary/immudb/pkg/api/schema"
	"github.com/vchain-us/ledger-compliance-go/schema"
	vcnerr "github.com/vchain-us/vcn/internal/errors"
	"github.com/vchain-us/vcn/pkg/api"
	"github.com/vchain-us/vcn/pkg/bom/artifact"
	"github.com/vchain-us/vcn/pkg/cmd/internal/cli"
	"github.com/vchain-us/vcn/pkg/cmd/internal/types"
	"github.com/vchain-us/vcn/pkg/extractor"
	"github.com/vchain-us/vcn/pkg/meta"
	"github.com/vchain-us/vcn/pkg/signature"
	"github.com/vchain-us/vcn/pkg/store"
)

type pkg struct {
	Name   string
	Hash   string
	Kind   string
	Md     md `json:"metadata"`
	Status int
}

type md struct {
	Version  string `json:"version,omitempty"`
	HashType string `json:"hashType"`
}

var (
	keyRegExp = regexp.MustCompile("0x[0-9a-z]{40}")
)

func getSignerIDs() []string {
	ids := viper.GetStringSlice("signerID")
	if len(ids) > 0 {
		return ids
	}
	return viper.GetStringSlice("key")
}

// NewCommand returns the cobra command for `vcn verify`
func NewCommand() *cobra.Command {
	cmd := &cobra.Command{
		Use:     "authenticate",
		Example: "  vcn authenticate /bin/vcn",
		Aliases: []string{"a", "verify", "v"},
		Short:   "Authenticate assets against the blockchain",
		Long: `
Authenticate assets against the blockchain.

Authentication is the process of matching the hash of a local asset to
a hash on the blockchain.
If matched, the returned result (the authentication) is the blockchain-stored
metadata that’s bound to the matching hash.
Otherwise, the returned result status equals UNKNOWN.

Note that your assets will not be uploaded but processed locally.

The exit code will be 0 only if all assets' statuses are equal to TRUSTED.
Otherwise, the exit code will be 1.

Assets are referenced by the passed ARG(s), with authentication accepting
1 or more ARG(s) at a time. Multiple assets can be authenticated at the
same time while passing them within ARG(s).

ARG must be one of:
  <file>
  file://<file>
  dir://<directory>
  git://<repository>
  docker://<image>
  podman://<image>
  javacom://<java mvn jar or pom.xml>
  nodecom://<node component>
  gocom://<Go module in name@version format>
  pythoncom://<Python module in name@version format>
  dotnetcom://<.Net module in name@version format>
Environment variables:
VCN_USER=
VCN_PASSWORD=
VCN_NOTARIZATION_PASSWORD=
VCN_NOTARIZATION_PASSWORD_EMPTY=
VCN_OTP=
VCN_OTP_EMPTY=
VCN_LC_HOST=
VCN_LC_PORT=
VCN_LC_CERT=
VCN_LC_SKIP_TLS_VERIFY=false
VCN_LC_NO_TLS=false
VCN_LC_API_KEY=
VCN_LC_LEDGER=
VCN_SIGNING_PUB_KEY_FILE=
VCN_SIGNING_PUB_KEY=
VCN_ENFORCE_SIGNATURE_VERIFY=
`,
		RunE: runVerify,
		PreRun: func(cmd *cobra.Command, args []string) {
			// Bind to all flags to env vars (after flags were parsed),
			// but only ones retrivied by using viper will be used.
			viper.BindPFlags(cmd.Flags())
		},
		Args: func(cmd *cobra.Command, args []string) error {
			if org := viper.GetString("org"); org != "" {
				if keys := getSignerIDs(); len(keys) > 0 {
					return fmt.Errorf("cannot use both --org and SignerID(s)")
				}
			}

			alerts, _ := cmd.Flags().GetBool("alerts")
			if alerts {
				if len(args) > 0 {
					return fmt.Errorf("cannot use ARG(s) with --alerts")
				}
				return nil
			}

			if hash, _ := cmd.Flags().GetString("hash"); hash != "" {
				if len(args) > 0 {
					return fmt.Errorf("cannot use ARG(s) with --hash")
				}
				if alerts {
					return fmt.Errorf("cannot use both --alerts and --hash")
				}

				return nil
			}

			if name, _ := cmd.Flags().GetString("name"); name != "" {
				if len(args) > 0 {
					return fmt.Errorf("cannot use ARG(s) with --name")
				}
				return nil
			}

			return cobra.MinimumNArgs(1)(cmd, args)
		},
	}

	cmd.SetUsageTemplate(
		strings.Replace(cmd.UsageTemplate(), "{{.UseLine}}", "{{.UseLine}} ARG(s)", 1),
	)

	cmd.Flags().StringSliceP("signerID", "s", nil, "accept only authentications matching the passed SignerID(s)\n(overrides VCN_SIGNERID env var, if any). It's valid both for blockchain and ledger compliance")
	cmd.Flags().StringSliceP("key", "k", nil, "")
	cmd.Flags().MarkDeprecated("key", "please use --signerID instead")
	cmd.Flags().StringP("org", "I", "", "accept only authentications matching the passed organisation's ID,\nif set no SignerID can be used\n(overrides VCN_ORG env var, if any)")
	cmd.Flags().String("hash", "", "specify a hash to authenticate, if set no ARG(s) can be used")
	cmd.Flags().Bool("alerts", false, "specify to authenticate and monitor for the configured alerts, if set no ARG(s) can be used")
	cmd.Flags().Bool("raw-diff", false, "print raw a diff, if any")
	cmd.Flags().Int("exit-code", meta.VcnDefaultExitCode, meta.VcnExitCode)
	cmd.Flags().String("lc-host", "", meta.VcnLcHostFlagDesc)
	cmd.Flags().String("lc-port", "443", meta.VcnLcPortFlagDesc)
	cmd.Flags().String("lc-cert", "", meta.VcnLcCertPathDesc)
	cmd.Flags().Bool("lc-skip-tls-verify", false, meta.VcnLcSkipTlsVerifyDesc)
	cmd.Flags().Bool("lc-no-tls", false, meta.VcnLcNoTlsDesc)
	cmd.Flags().String("lc-api-key", "", meta.VcnLcApiKeyDesc)
	cmd.Flags().String("lc-ledger", "", meta.VcnLcLedgerDesc)
	cmd.Flags().String("lc-uid", "", meta.VcnLcUidDesc)
	cmd.Flags().String("attach", "", meta.VcnLcAttachmentAuthDesc)
	cmd.Flags().Bool("force", false, meta.VcnLcForceAttachmentDownloadDesc)
	cmd.Flags().String("name", "", "asset name to look up")
	cmd.Flags().String("version", "", "asset version to look up")
	cmd.Flags().Bool("bom", false, "link asset to its dependencies from BoM")
	cmd.Flags().String("bom-trust-level", "trusted", "min trust level: untrusted (unt) / unsupported (uns) / unknown (unk) / trusted (t)")
	cmd.Flags().Float64("bom-max-unsupported", 0, "max number (in %) of unsupported dependencies")
	cmd.Flags().String("bom-file", "", "store BoM in the file for later processing")
	cmd.Flags().Bool("bom-deps-only", false, "authenticate only the dependencies, not the asset")
	cmd.Flags().Bool("bom-what-includes", false, "output all assets that use the specified asset")
	cmd.Flags().StringSlice("bom-container-binary", []string{}, "list of binaries to be executed inside the container - only the relevant dependencies will be processed")
	cmd.Flags().Uint("bom-batch-size", 10, "By default BoM dependencies are authenticated/notarized in batches of up to 10 dependencies each. Use this flag to set a different batch size. A value of 0 will disable batching (all dependencies will be authenticated/notarized at once).")
	// BoM output options
	cmd.Flags().Bool("bom-debug", false, "show extra debug info for BoM processing, also disable progress indicators")
	cmd.Flags().String("bom-spdx", "", "name of the file to output BoM in SPDX format")
	cmd.Flags().String("bom-cyclonedx-json", "", "name of the file to output BoM in CycloneDX JSON format")
	cmd.Flags().String("bom-cyclonedx-xml", "", "name of the file to output BoM in CycloneDX XML format")
	cmd.Flags().String("github-token", "", "Github OAuth token for querying BoM Github package details. Either authenticated or not, requests are subject to Github limits")

	cmd.Flags().String("signing-pub-key-file", "", meta.VcnSigningPubKeyFileNameDesc)
	cmd.Flags().String("signing-pub-key", "", meta.VcnSigningPubKeyDesc)
	cmd.Flags().Bool("enforce-signature-verify", false, meta.VcnEnforceSignatureVerifyDesc)
	cmd.Flags().MarkHidden("raw-diff")

	return cmd
}

// runVerify first determine if the context is LC or blockchain, then call the correct verify
func runVerify(cmd *cobra.Command, args []string) error {
	hashes := make([]string, 0)
	hash, err := cmd.Flags().GetString("hash")
	if err != nil {
		return err
	}
	if hash != "" {
		hashes = append(hashes, strings.ToLower(hash))
	}

	output, err := cmd.Flags().GetString("output")
	if err != nil {
		return err
	}

	useAlerts, err := cmd.Flags().GetBool("alerts")
	if err != nil {
		return err
	}

	cmd.SilenceUsage = true

	lcHost := viper.GetString("lc-host")
	lcPort := viper.GetString("lc-port")
	lcCert := viper.GetString("lc-cert")
	skipTlsVerify := viper.GetBool("lc-skip-tls-verify")
	noTls := viper.GetBool("lc-no-tls")
	lcApiKey := viper.GetString("lc-api-key")
	lcLedger := viper.GetString("lc-ledger")
	lcUid := viper.GetString("lc-uid")
	lcAttach := viper.GetString("attach")
	lcAttachForce := viper.GetBool("force")
	lcVerbose := viper.GetBool("verbose")

	signingPubKey, skipLocalPubKeyComp, err := signature.PrepareSignatureParams(
		viper.GetString("signing-pub-key"),
		viper.GetString("signing-pub-key-file"))
	if err != nil {
		return err
	}
	enforceSignatureVerify := viper.GetBool("enforce-signature-verify")

	//check if an lcUser is present inside the context
	var lcUser *api.LcUser

	uif, err := api.GetUserFromContext(store.Config().CurrentContext, lcApiKey, lcLedger, signingPubKey)
	if err != nil {
		return err
	}
	if lctmp, ok := uif.(*api.LcUser); ok {
		lcUser = lctmp
	}

	// It uses flags for CNC context client constructor if at least host is provided. A client with empty api-key is allowed for public authentications
	if lcHost != "" {
		// client from context could be override by the one created from local flags
		lcUser, err = api.NewLcUser(lcApiKey, lcLedger, lcHost, lcPort, lcCert, skipTlsVerify, noTls, signingPubKey)
		if err != nil {
			return err
		}
		// Store the new config
		if lcApiKey != "" {
			if err := store.SaveConfig(); err != nil {
				return err
			}
		}
	}

	if lcUser != nil {
		var signerID string
		signerIDs := getSignerIDs()
		if len(signerIDs) > 0 {
			signerID = signerIDs[0]
		}
		if lcApiKey == "" && signerID == "" {
			return vcnerr.ErrPubAuthNoSignerID
		}

		err = lcUser.Client.Connect()
		if err != nil {
			return err
		}

		if !skipLocalPubKeyComp {
			err = lcUser.CheckConnectionPublicKey(enforceSignatureVerify)
			if err != nil {
				return err
			}
		}

		name := viper.GetString("name")
		if name != "" {
			// asset selection by name with optional filtering by version
			if hash != "" {
				return fmt.Errorf("cannot specify both the assets name/version and hash")
			}
			version := viper.GetString("version")
			md := metadata.Pairs(meta.VcnLCPluginTypeHeaderName, meta.VcnLCPluginTypeHeaderValue)
			ctx := metadata.NewOutgoingContext(context.Background(), md)
			if signerID == "" {
				signerID = api.GetSignerIDByApiKey(lcUser.Client.ApiKey)
			}

			zItems, err := lcUser.Client.ZScan(ctx, &immuschema.ZScanRequest{
				Set:    []byte(name),
				NoWait: true,
			})
			if err != nil {
				return fmt.Errorf("cannot get components by name: %w", err)
			}
			var vRange semver.Range
			if version != "" {
				vRange, err = semver.ParseRange(version)
				if err != nil {
					return fmt.Errorf("cannot parse version range expression: %w", err)
				}
			}
			for _, item := range zItems.Entries {
				var p pkg
				err := json.Unmarshal(item.Entry.Value, &p)
				if err != nil {
					return fmt.Errorf("cannot parse JSON: %w", err)
				}
				if version != "" {
					if p.Md.Version != "" {
						ver := strings.TrimPrefix(p.Md.Version, "v")
						v, err := semver.Parse(ver)
						if err != nil {
							fmt.Printf("asset has invalid version %s\n", p.Md.Version)
							continue
						}
						if vRange(v) {
							hashes = append(hashes, p.Hash)
						}
					}
				} else {
					// no version condition - add all
					hashes = append(hashes, p.Hash)
				}
			}
			if len(hashes) == 0 {
				return fmt.Errorf("no assets matching specified name/version found")
			}
		}

		// any set 'bom-xxx' option, except 'bom-what-includes', implies BoM
		bomFlag := viper.GetBool("bom") ||
			viper.IsSet("bom-file") ||
			viper.IsSet("bom-deps-only") ||
			viper.IsSet("bom-debug") ||
			viper.IsSet("bom-trust-level") ||
			viper.IsSet("bom-max-unsupported") ||
			viper.IsSet("bom-spdx") ||
			viper.IsSet("bom-cyclonedx-json") ||
			viper.IsSet("bom-cyclonedx-xml") ||
			viper.IsSet("bom-container-binary") ||
			viper.IsSet("bom-batch-size")

		if bomFlag {
			err := lcUser.RequireFeatOrErr(schema.FeatBoM)
			if err != nil {
				return err
			}
		}

		var bomArtifact artifact.Artifact
		if bomFlag {
			if len(hashes)+len(args) > 1 {
				return fmt.Errorf("asset selection criteria match several assets - BoM can be processed only for single asset")
			}
			if len(hashes)+len(args) < 1 {
				return fmt.Errorf("asset selection criteria don't match any assets - BoM cannot be processed")
			}

			if len(hashes) > 0 {
				bomArtifact, err = processBOM(lcUser, signerID, output, hashes[0], "")
			} else {
				bomArtifact, err = processBOM(lcUser, signerID, output, "", args[0])
			}
			if err != nil {
				return err
			}
		}

		if !viper.GetBool("bom-deps-only") {
			// by hash
			if len(hashes) > 0 {
				for _, hash := range hashes {
					a := &api.Artifact{
						Hash: hash,
					}
					if viper.GetBool("bom-what-includes") {
						a.IncludedIn, err = GetIncluded(hash, signerID, lcUser)
						if err != nil {
							return err
						}
					}
					err = lcVerify(cmd, a, lcUser, signerID, lcUid, lcAttach, lcAttachForce, lcVerbose, output)
					if err != nil {
						return err
					}
				}
			} else {
				artifacts, err := extractor.Extract([]string{args[0]})
				if err != nil {
					return err
				}
				for _, a := range artifacts {
					if viper.GetBool("bom-what-includes") {
						a.IncludedIn, err = GetIncluded(a.Hash, signerID, lcUser)
						if err != nil {
							return err
						}
					}
					if bomArtifact != nil {
						a.Deps = DepsToPackageDetails(bomArtifact.Dependencies())
					}
					err := lcVerify(cmd, a, lcUser, signerID, lcUid, lcAttach, lcAttachForce, lcVerbose, output)
					if err != nil {
						return err
					}
				}
			}
		}

		return nil
	}

	if output == "attachments" {
		return fmt.Errorf("in order to download attachments, you need to be logged in on Codenotary Cloud®\nProceed by authenticating yourself using <vcn login>")
	}
	// blockchain context
	org := viper.GetString("org")
	var keys []string
	if org != "" {
		bo, err := api.GetBlockChainOrganisation(org)
		if err != nil {
			return err
		}
		keys = bo.MembersIDs()
	} else {
		keys = getSignerIDs()
		// add 0x if missing, lower case, and check if format is correct
		for i, k := range keys {
			if !strings.HasPrefix(k, "0x") {
				keys[i] = "0x" + k
			}
			keys[i] = strings.ToLower(keys[i])
			if !keyRegExp.MatchString(keys[i]) {
				return fmt.Errorf("invalid public address format: %s", k)
			}
		}
	}

	user := api.NewUser(store.Config().CurrentContext.Email)

	// by alerts
	if useAlerts {
		if hasAuth, _ := user.IsAuthenticated(); !hasAuth {
			return fmt.Errorf("in order to use --alerts, you need to be logged in\nProceed by authenticating yourself using <vcn login>")
		}

		alertConfigPath, err := store.AlertFilepath(user.Email())
		if err != nil {
			return err
		}
		if output == "" {
			fmt.Printf("Using alert configuration: %s\n\n", alertConfigPath)
		}

		alerts, err := store.ReadAlerts(user.Email())
		if err != nil {
			return err
		}

		if len(alerts) == 0 {
			return fmt.Errorf("no configured alerts")
		}

		for _, alert := range alerts {
			var alertConfig api.AlertConfig
			if err := alert.ExportConfig(&alertConfig); err != nil {
				cli.PrintWarning(output, fmt.Sprintf(
					`invalid alert config (name="%s") for %s: %s`,
					alert.Name,
					alert.Arg,
					err,
				))
				continue
			}
			alertConfig.Metadata["arg"] = alert.Arg

			artifacts, err := extractor.Extract([]string{alert.Arg})
			if err != nil {
				cli.PrintWarning(output, err.Error())
				alertConfig.Metadata["error"] = err.Error()
				user.TriggerAlert(alertConfig)
				continue
			}
			if artifacts == nil {
				cli.PrintWarning(output, fmt.Sprintf("unable to process the input asset provided: %s", alert.Arg))
				alertConfig.Metadata["error"] = err.Error()
				user.TriggerAlert(alertConfig)
				continue
			}
			for _, a := range artifacts {
				if err := verify(cmd, a, keys, org, user, &alertConfig, output); err != nil {
					cli.PrintWarning(output, fmt.Sprintf("%s: %s", alert.Arg, err))
				}
				if output == "" {
					fmt.Println()
				}
			}
		}
		return nil
	}

	// by hash
	if hash != "" {
		a := &api.Artifact{
			Hash: strings.ToLower(hash),
		}
		if err := verify(cmd, a, keys, org, user, nil, output); err != nil {
			return err
		}
		return nil
	}

	// by args
	for _, arg := range args {
		artifacts, err := extractor.Extract([]string{arg})
		if err != nil {
			return err
		}
		if artifacts == nil {
			return fmt.Errorf("unable to process the input asset provided: %s", arg)
		}
		for _, a := range artifacts {
			if err := verify(cmd, a, keys, org, user, nil, output); err != nil {
				return err
			}
		}
	}

	return nil
}

func verify(cmd *cobra.Command, a *api.Artifact, keys []string, org string, user *api.User, alertConfig *api.AlertConfig, output string) (err error) {
	hook := newHook(cmd, a)
	var verification *api.BlockchainVerification
	if output == "" {
		fmt.Println()
		color.Set(meta.StyleAffordance())
		fmt.Println("Your assets will not be uploaded. They will be processed locally.")
		color.Unset()
		fmt.Println()
	}
	// if keys have been passed, check for a verification matching them
	if len(keys) > 0 {
		if output == "" {
			if org == "" {
				fmt.Printf("Looking for blockchain entry matching the passed SignerIDs...\n")
			} else {
				fmt.Printf("Looking for blockchain entry matching the organization (%s)...\n", org)
			}
		}
		verification, err = api.VerifyMatchingSignerIDs(a.Hash, keys)

	} else {
		// if we have an user, check for verification matching user's key first
		userKey := ""
		if hasAuth, _ := user.IsAuthenticated(); hasAuth {
			userKey, _ = user.SignerID() // todo(leogr): double check this
		}
		if userKey != "" {
			if output == "" {
				fmt.Printf("Looking for blockchain entry matching the current user (%s)...\n", user.Email())
			}
			verification, err = api.VerifyMatchingSignerIDWithFallback(a.Hash, userKey)
			if output == "" {
				if verification.SignerID() != userKey {
					fmt.Printf("No blockchain entry matching the current user found.\n")
					if !verification.Unknown() {
						fmt.Printf("Showing the last blockchain entry with highest level available.\n")
					}
				}
			}
		} else {
			// if no passed keys nor user,
			// just get the last with highest level available verification
			if output == "" {
				fmt.Printf("Looking for the last blockchain entry with highest level available...\n")
			}
			verification, err = api.Verify(a.Hash)
		}
	}

	if output == "" {
		fmt.Println()
	}

	if err != nil {
		return fmt.Errorf("unable to authenticate the hash: %s", err)
	}

	err = hook.finalize(alertConfig, output)
	if err != nil {
		return err
	}

	var ar *api.ArtifactResponse
	if !verification.Unknown() {
		ar, _ = api.LoadArtifact(user, a.Hash, verification.MetaHash())
	}

	if err = cli.Print(output, types.NewResult(a, ar, verification)); err != nil {
		return err
	}

	if output != "" {
		cmd.SilenceErrors = true
	}

	// todo(ameingast/leogr): remove reduntat event - need backend improvement
	if verification.Trusted() {
		api.TrackVerify(user, a.Hash, a.Name)
	}

	if alertConfig != nil {
		var err error
		if verification.Trusted() {
			err = user.PingAlert(*alertConfig)
		} else {
			err = user.TriggerAlert(*alertConfig)
		}
		if err != nil {
			return err
		}

		if output == "" {
			fmt.Printf("\nPing for alert %s sent.\n", alertConfig.AlertUUID)
		}
		api.TrackPublisher(user, meta.VcnAlertVerifyEvent)
	} else {
		api.TrackPublisher(user, meta.VcnVerifyEvent)
	}

	if !verification.Trusted() {
		errLabels := map[meta.Status]string{
			meta.StatusUnknown:     "was not notarized",
			meta.StatusUntrusted:   "is untrusted",
			meta.StatusUnsupported: "is unsupported",
		}

		viper.Set("exit-code", strconv.Itoa(verification.Status.Int()))

		switch true {
		case org != "":
			return fmt.Errorf(`%s %s by "%s"`, a.Hash, errLabels[verification.Status], org)
		case len(keys) == 1:
			return fmt.Errorf("%s %s by %s", a.Hash, errLabels[verification.Status], keys[0])
		case len(keys) > 1:
			return fmt.Errorf("%s %s by any of %s", a.Hash, errLabels[verification.Status], strings.Join(keys, ", "))
		default:
			return fmt.Errorf("%s %s", a.Hash, errLabels[verification.Status])
		}
	}

	return
}