go.fuchsia.dev/infra@v0.0.0-20240507153436-9b593402251b/cmd/gcs-util/lib/lib.go

// Copyright 2022 The Fuchsia Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

package lib

import (
	"bytes"
	"context"
	"crypto/ed25519"
	"crypto/x509"
	"encoding/base64"
	"encoding/pem"
	"errors"
	"fmt"
	"os"
	"time"

	"cloud.google.com/go/storage"

	"go.chromium.org/luci/common/retry"
	"go.chromium.org/luci/common/retry/transient"

	"go.fuchsia.dev/infra/cmd/gcs-util/types"
)

const (
	// The name of the public key file to be uploaded with release builds.
	releasePubkeyFilename = "publickey.pem"

	signatureKey = "signature"
)

// Sign signs the upload files and attaches the signatures as metadata.
func Sign(uploads []types.Upload, privateKey ed25519.PrivateKey) ([]types.Upload, error) {
	for i := range uploads {
		if !uploads[i].Signed {
			continue
		}
		data, err := os.ReadFile(uploads[i].Source)
		if err != nil {
			if os.IsNotExist(err) {
				continue
			}
			return nil, fmt.Errorf("failed to read %s: %w", uploads[i].Source, err)
		}
		signature := base64.StdEncoding.EncodeToString(ed25519.Sign(privateKey, data))
		if signature != "" {
			uploads[i].Metadata = map[string]string{
				signatureKey: signature,
			}
		}
	}
	return uploads, nil
}

// PrivateKey parses an ed25519 private key from a pem-formatted key file.
// It expects the key to be in a PKCS#8, ASN.1 DER format as generated by
// running `openssl genpkey -algorithm ed25519 -out <private key>.pem`.
func PrivateKey(keyPath string) (ed25519.PrivateKey, error) {
	if keyPath == "" {
		return nil, nil
	}

	pemData, err := os.ReadFile(keyPath)
	if err != nil {
		return nil, fmt.Errorf("failed to read pkey: %w", err)
	}
	block, _ := pem.Decode(pemData)
	if len(block.Bytes) == 0 {
		return nil, fmt.Errorf("failed to decode private key")
	}
	// The decoded key should be in PKCS#8, ASN.1 DER form.
	// We need to convert it to an ed25519.PrivateKey.
	pkey, err := x509.ParsePKCS8PrivateKey(block.Bytes)
	if err != nil {
		return nil, fmt.Errorf("failed to parse private key from DER bytes: %w", err)
	}
	if _, ok := pkey.(ed25519.PrivateKey); !ok {
		return nil, fmt.Errorf("private key is not of type ed25519")
	}
	return pkey.(ed25519.PrivateKey), nil
}

// PublicKeyUpload returns an Upload representing the public key used for release builds.
func PublicKeyUpload(publicKey ed25519.PublicKey) (*types.Upload, error) {
	if len(publicKey) == 0 {
		return nil, fmt.Errorf("nil public key provided")
	}

	// Convert to PKIX, ASN.1 DER form to match what is generated by openssl.
	pubkeyDER, err := x509.MarshalPKIXPublicKey(publicKey)
	if err != nil {
		return nil, fmt.Errorf("failed to convert public key to DER form: %w", err)
	}
	block := &pem.Block{
		Type:  "PUBLIC KEY",
		Bytes: pubkeyDER,
	}

	var data bytes.Buffer
	if err := pem.Encode(&data, block); err != nil {
		return nil, fmt.Errorf("failed to encode public key: %w", err)
	}
	return &types.Upload{
		Destination: releasePubkeyFilename,
		Contents:    data.Bytes(),
	}, nil
}

// Retry wraps a function that makes a GCS API call, adding retries for failures
// that might be transient.
func Retry(ctx context.Context, f func() error) error {
	policy := transient.Only(func() retry.Iterator {
		return &retry.ExponentialBackoff{
			Limited: retry.Limited{
				Delay:   1 * time.Second,
				Retries: 4,
			},
			Multiplier: 2,
		}
	})
	return retryWithPolicy(ctx, policy, f)
}

// Extracted to allow dependency injection for testing.
func retryWithPolicy(ctx context.Context, policy retry.Factory, f func() error) error {
	return retry.Retry(ctx, policy, func() error {
		if err := f(); err != nil {
			if errors.Is(err, storage.ErrBucketNotExist) || errors.Is(err, storage.ErrObjectNotExist) {
				return err
			}
			return transient.Tag.Apply(err)
		}
		return nil
	}, nil)
}

// ObjectAttrs gets the attributes for the given object, with retries.
func ObjectAttrs(ctx context.Context, obj *storage.ObjectHandle) (*storage.ObjectAttrs, error) {
	var objAttrs *storage.ObjectAttrs
	err := Retry(ctx, func() error {
		var err error
		objAttrs, err = obj.Attrs(ctx)
		return err
	})
	return objAttrs, err
}

// NewObjectReader gets a reader for the given object, with retries.
func NewObjectReader(ctx context.Context, obj *storage.ObjectHandle) (*storage.Reader, error) {
	var reader *storage.Reader
	err := Retry(ctx, func() error {
		var err error
		reader, err = obj.NewReader(ctx)
		return err
	})
	return reader, err
}