mirror of
https://github.com/BigBodyCobain/Shadowbroker.git
synced 2026-07-09 21:58:41 +02:00
BigBodyCobain
b86a258535
Ship the v0.9.79 runtime refresh with transport lane isolation, Infonet secure-message address management, MeshChat MQTT controls, selected asset trail behavior, telemetry panel refinements, onboarding updates, and desktop/package metadata alignment. Also ignore local graphify work products so analysis folders do not leak into future commits.
2175 lines
102 KiB
Python
2175 lines
102 KiB
Python
"""Stable DM root manifest publication and witness receipts.
|
|
|
|
This module publishes a root-signed manifest for the current Wormhole DM root
|
|
identity together with a witness policy and a threshold-satisfying witness
|
|
receipt set. Sprint 10 extends the earlier single-witness format so strong
|
|
invite/bootstrap trust can depend on quorum-style witnessed distribution rather
|
|
than one local witness receipt.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import base64
|
|
import hashlib
|
|
import json
|
|
import logging
|
|
import time
|
|
from pathlib import Path
|
|
from typing import Any
|
|
import urllib.error
|
|
import urllib.request
|
|
|
|
from cryptography.hazmat.primitives import serialization
|
|
from cryptography.hazmat.primitives.asymmetric import ed25519
|
|
|
|
from services.mesh.mesh_crypto import build_signature_payload, derive_node_id, verify_node_binding, verify_signature
|
|
from services.mesh.mesh_protocol import PROTOCOL_VERSION
|
|
from services.mesh.mesh_secure_storage import SecureStorageError, read_domain_json, write_domain_json
|
|
from services.mesh.mesh_wormhole_identity import root_identity_fingerprint_for_material
|
|
from services.mesh.mesh_wormhole_persona import (
|
|
bootstrap_wormhole_persona_state,
|
|
get_root_identity,
|
|
read_previous_root_identity,
|
|
sign_previous_root_wormhole_event,
|
|
sign_root_wormhole_event,
|
|
)
|
|
|
|
BACKEND_DIR = Path(__file__).resolve().parents[2]
|
|
DATA_DIR = BACKEND_DIR / "data"
|
|
ROOT_DISTRIBUTION_DOMAIN = "root_distribution"
|
|
ROOT_DISTRIBUTION_FILE = "wormhole_root_distribution.json"
|
|
STABLE_DM_ROOT_MANIFEST_EVENT_TYPE = "stable_dm_root_manifest"
|
|
STABLE_DM_ROOT_MANIFEST_WITNESS_EVENT_TYPE = "stable_dm_root_manifest_witness"
|
|
STABLE_DM_ROOT_MANIFEST_PREVIOUS_ROOT_EVENT_TYPE = "stable_dm_root_manifest_previous_root"
|
|
STABLE_DM_ROOT_MANIFEST_POLICY_CHANGE_EVENT_TYPE = "stable_dm_root_manifest_policy_change"
|
|
STABLE_DM_ROOT_MANIFEST_TYPE = "stable_dm_root_manifest"
|
|
STABLE_DM_ROOT_MANIFEST_WITNESS_TYPE = "stable_dm_root_manifest_witness"
|
|
STABLE_DM_ROOT_MANIFEST_WITNESS_POLICY_TYPE = "stable_dm_root_manifest_witness_policy"
|
|
STABLE_DM_ROOT_MANIFEST_EXTERNAL_WITNESS_IMPORT_TYPE = "stable_dm_root_manifest_external_witness_import"
|
|
DEFAULT_ROOT_MANIFEST_TTL_S = 7 * 24 * 60 * 60
|
|
DEFAULT_ROOT_WITNESS_COUNT = 3
|
|
DEFAULT_ROOT_WITNESS_THRESHOLD = 2
|
|
DEFAULT_ROOT_WITNESS_MANAGEMENT_SCOPE = "local"
|
|
DEFAULT_ROOT_WITNESS_INDEPENDENCE_GROUP = "local_system"
|
|
DEFAULT_ROOT_EXTERNAL_WITNESS_MAX_AGE_S = 3600
|
|
logger = logging.getLogger(__name__)
|
|
|
|
|
|
def _safe_int(val: Any, default: int = 0) -> int:
|
|
try:
|
|
return int(val)
|
|
except (TypeError, ValueError):
|
|
return default
|
|
|
|
|
|
def _stable_json(value: Any) -> str:
|
|
return json.dumps(value, sort_keys=True, separators=(",", ":"))
|
|
|
|
|
|
def _resolve_external_material_path(raw_path: str) -> Path | None:
|
|
raw = str(raw_path or "").strip()
|
|
if not raw:
|
|
return None
|
|
candidate = Path(raw)
|
|
if candidate.is_absolute():
|
|
return candidate
|
|
return BACKEND_DIR / candidate
|
|
|
|
|
|
def _external_root_witness_max_age_s() -> int:
|
|
from services.config import get_settings
|
|
|
|
return max(
|
|
0,
|
|
_safe_int(
|
|
getattr(
|
|
get_settings(),
|
|
"MESH_DM_ROOT_EXTERNAL_WITNESS_MAX_AGE_S",
|
|
DEFAULT_ROOT_EXTERNAL_WITNESS_MAX_AGE_S,
|
|
)
|
|
or DEFAULT_ROOT_EXTERNAL_WITNESS_MAX_AGE_S,
|
|
DEFAULT_ROOT_EXTERNAL_WITNESS_MAX_AGE_S,
|
|
),
|
|
)
|
|
|
|
|
|
def _default_witness_label(index: int) -> str:
|
|
return "root-witness" if index <= 1 else f"root-witness-{index}"
|
|
|
|
|
|
def _normalize_witness_management_scope(value: Any) -> str:
|
|
normalized = str(value or "").strip().lower()
|
|
return "external" if normalized == "external" else DEFAULT_ROOT_WITNESS_MANAGEMENT_SCOPE
|
|
|
|
|
|
def _normalize_witness_independence_group(value: Any, *, management_scope: str) -> str:
|
|
normalized = str(value or "").strip().lower()
|
|
if normalized:
|
|
return normalized
|
|
return (
|
|
DEFAULT_ROOT_WITNESS_INDEPENDENCE_GROUP
|
|
if management_scope == DEFAULT_ROOT_WITNESS_MANAGEMENT_SCOPE
|
|
else "external_unknown"
|
|
)
|
|
|
|
|
|
def root_witness_finality_met(
|
|
*,
|
|
witness_threshold: int,
|
|
witness_quorum_met: bool,
|
|
witness_independent_quorum_met: bool,
|
|
) -> bool:
|
|
threshold = _safe_int(witness_threshold, 0)
|
|
if threshold <= 0 or not bool(witness_quorum_met):
|
|
return False
|
|
if threshold <= 1:
|
|
return True
|
|
return bool(witness_independent_quorum_met)
|
|
|
|
|
|
def _empty_witness_identity(*, index: int = 1) -> dict[str, Any]:
|
|
return {
|
|
"scope": "root_witness",
|
|
"label": _default_witness_label(index),
|
|
"node_id": "",
|
|
"public_key": "",
|
|
"public_key_algo": "Ed25519",
|
|
"management_scope": DEFAULT_ROOT_WITNESS_MANAGEMENT_SCOPE,
|
|
"independence_group": DEFAULT_ROOT_WITNESS_INDEPENDENCE_GROUP,
|
|
"private_key": "",
|
|
"sequence": 0,
|
|
"created_at": 0,
|
|
"last_used_at": 0,
|
|
}
|
|
|
|
|
|
def _default_state() -> dict[str, Any]:
|
|
return {
|
|
"updated_at": 0,
|
|
"witness_identity": _empty_witness_identity(),
|
|
"witness_identities": [],
|
|
"external_witness_descriptors": [],
|
|
"external_witness_source_scope": "",
|
|
"external_witness_source_label": "",
|
|
"external_witness_imported_at": 0,
|
|
"external_witness_source_exported_at": 0,
|
|
"external_witness_refresh_attempted_at": 0,
|
|
"external_witness_refresh_ok": False,
|
|
"external_witness_refresh_detail": "",
|
|
"external_witness_refresh_source_path": "",
|
|
"external_witness_refresh_source_ref": "",
|
|
"external_witness_manifest_fingerprint": "",
|
|
"external_witness_receipts": [],
|
|
"published_manifest": {},
|
|
"published_manifest_fingerprint": "",
|
|
"published_witness": {},
|
|
"published_witnesses": [],
|
|
}
|
|
|
|
|
|
def _witness_identity_record(*, index: int = 1) -> dict[str, Any]:
|
|
signing_priv = ed25519.Ed25519PrivateKey.generate()
|
|
signing_priv_raw = signing_priv.private_bytes(
|
|
encoding=serialization.Encoding.Raw,
|
|
format=serialization.PrivateFormat.Raw,
|
|
encryption_algorithm=serialization.NoEncryption(),
|
|
)
|
|
signing_pub_raw = signing_priv.public_key().public_bytes(
|
|
encoding=serialization.Encoding.Raw,
|
|
format=serialization.PublicFormat.Raw,
|
|
)
|
|
now = int(time.time())
|
|
public_key_b64 = base64.b64encode(signing_pub_raw).decode("ascii")
|
|
private_key_b64 = base64.b64encode(signing_priv_raw).decode("ascii")
|
|
return {
|
|
"scope": "root_witness",
|
|
"label": _default_witness_label(index),
|
|
"node_id": derive_node_id(public_key_b64),
|
|
"public_key": public_key_b64,
|
|
"public_key_algo": "Ed25519",
|
|
"management_scope": DEFAULT_ROOT_WITNESS_MANAGEMENT_SCOPE,
|
|
"independence_group": DEFAULT_ROOT_WITNESS_INDEPENDENCE_GROUP,
|
|
"private_key": private_key_b64,
|
|
"sequence": 0,
|
|
"created_at": now,
|
|
"last_used_at": now,
|
|
}
|
|
|
|
|
|
def _public_witness_identity(identity: dict[str, Any]) -> dict[str, Any]:
|
|
return {
|
|
"scope": str(identity.get("scope", "root_witness") or "root_witness"),
|
|
"label": str(identity.get("label", "root-witness") or "root-witness"),
|
|
"node_id": str(identity.get("node_id", "") or ""),
|
|
"public_key": str(identity.get("public_key", "") or ""),
|
|
"public_key_algo": str(identity.get("public_key_algo", "Ed25519") or "Ed25519"),
|
|
"management_scope": _normalize_witness_management_scope(identity.get("management_scope")),
|
|
"independence_group": _normalize_witness_independence_group(
|
|
identity.get("independence_group"),
|
|
management_scope=_normalize_witness_management_scope(identity.get("management_scope")),
|
|
),
|
|
"sequence": _safe_int(identity.get("sequence", 0) or 0, 0),
|
|
"created_at": _safe_int(identity.get("created_at", 0) or 0, 0),
|
|
"last_used_at": _safe_int(identity.get("last_used_at", 0) or 0, 0),
|
|
}
|
|
|
|
|
|
def _public_witness_descriptor(identity: dict[str, Any]) -> dict[str, Any]:
|
|
management_scope = _normalize_witness_management_scope(identity.get("management_scope"))
|
|
return {
|
|
"scope": str(identity.get("scope", "root_witness") or "root_witness"),
|
|
"label": str(identity.get("label", "root-witness") or "root-witness"),
|
|
"node_id": str(identity.get("node_id", "") or "").strip(),
|
|
"public_key": str(identity.get("public_key", "") or "").strip(),
|
|
"public_key_algo": str(identity.get("public_key_algo", "Ed25519") or "Ed25519"),
|
|
"management_scope": management_scope,
|
|
"independence_group": _normalize_witness_independence_group(
|
|
identity.get("independence_group"),
|
|
management_scope=management_scope,
|
|
),
|
|
}
|
|
|
|
|
|
def _coerce_witness_identity(value: Any, *, index: int = 1) -> dict[str, Any] | None:
|
|
if not isinstance(value, dict):
|
|
return None
|
|
identity = {
|
|
**_empty_witness_identity(index=index),
|
|
**dict(value or {}),
|
|
}
|
|
if not str(identity.get("private_key", "") or "").strip():
|
|
return None
|
|
if not str(identity.get("public_key", "") or "").strip():
|
|
return None
|
|
if not str(identity.get("node_id", "") or "").strip():
|
|
identity["node_id"] = derive_node_id(str(identity.get("public_key", "") or "").strip())
|
|
identity["label"] = str(identity.get("label", _default_witness_label(index)) or _default_witness_label(index))
|
|
identity["management_scope"] = _normalize_witness_management_scope(identity.get("management_scope"))
|
|
identity["independence_group"] = _normalize_witness_independence_group(
|
|
identity.get("independence_group"),
|
|
management_scope=identity["management_scope"],
|
|
)
|
|
return identity
|
|
|
|
|
|
def _normalize_witness_identities(
|
|
values: Any,
|
|
*,
|
|
legacy_identity: dict[str, Any] | None = None,
|
|
) -> tuple[list[dict[str, Any]], bool]:
|
|
normalized: list[dict[str, Any]] = []
|
|
changed = False
|
|
candidates = list(values or [])
|
|
if legacy_identity:
|
|
candidates.insert(0, legacy_identity)
|
|
seen: set[tuple[str, str]] = set()
|
|
for index, value in enumerate(candidates, start=1):
|
|
identity = _coerce_witness_identity(value, index=index)
|
|
if not identity:
|
|
changed = True
|
|
continue
|
|
key = (
|
|
str(identity.get("node_id", "") or "").strip(),
|
|
str(identity.get("public_key", "") or "").strip(),
|
|
)
|
|
if not key[0] or not key[1] or key in seen:
|
|
changed = True
|
|
continue
|
|
seen.add(key)
|
|
normalized.append(identity)
|
|
if values != normalized:
|
|
changed = True
|
|
return normalized, changed
|
|
|
|
|
|
def _normalize_external_witness_descriptor(value: Any) -> dict[str, Any] | None:
|
|
if not isinstance(value, dict):
|
|
return None
|
|
raw = dict(value or {})
|
|
if not raw.get("management_scope"):
|
|
raw["management_scope"] = "external"
|
|
descriptor = _public_witness_descriptor(raw)
|
|
descriptor["management_scope"] = "external"
|
|
descriptor["independence_group"] = _normalize_witness_independence_group(
|
|
raw.get("independence_group"),
|
|
management_scope="external",
|
|
)
|
|
if not descriptor["node_id"] or not descriptor["public_key"]:
|
|
return None
|
|
if not verify_node_binding(descriptor["node_id"], descriptor["public_key"]):
|
|
return None
|
|
return descriptor
|
|
|
|
|
|
def _normalize_external_witness_descriptors(values: Any) -> tuple[list[dict[str, Any]], bool]:
|
|
normalized: list[dict[str, Any]] = []
|
|
changed = False
|
|
seen: set[tuple[str, str]] = set()
|
|
for value in list(values or []):
|
|
descriptor = _normalize_external_witness_descriptor(value)
|
|
if not descriptor:
|
|
changed = True
|
|
continue
|
|
key = (
|
|
str(descriptor.get("node_id", "") or "").strip(),
|
|
str(descriptor.get("public_key", "") or "").strip(),
|
|
)
|
|
if not key[0] or not key[1] or key in seen:
|
|
changed = True
|
|
continue
|
|
seen.add(key)
|
|
normalized.append(descriptor)
|
|
if list(values or []) != normalized:
|
|
changed = True
|
|
return normalized, changed
|
|
|
|
|
|
def _configured_witness_descriptors(
|
|
state: dict[str, Any],
|
|
local_witness_identities: list[dict[str, Any]],
|
|
) -> list[dict[str, Any]]:
|
|
descriptors: list[dict[str, Any]] = []
|
|
seen: set[tuple[str, str]] = set()
|
|
for value in list(local_witness_identities or []):
|
|
descriptor = _public_witness_descriptor(value)
|
|
key = (
|
|
str(descriptor.get("node_id", "") or "").strip(),
|
|
str(descriptor.get("public_key", "") or "").strip(),
|
|
)
|
|
if not key[0] or not key[1] or key in seen:
|
|
continue
|
|
seen.add(key)
|
|
descriptors.append(descriptor)
|
|
for value in list(state.get("external_witness_descriptors") or []):
|
|
descriptor = _normalize_external_witness_descriptor(value)
|
|
if not descriptor:
|
|
continue
|
|
key = (
|
|
str(descriptor.get("node_id", "") or "").strip(),
|
|
str(descriptor.get("public_key", "") or "").strip(),
|
|
)
|
|
if not key[0] or not key[1] or key in seen:
|
|
continue
|
|
seen.add(key)
|
|
descriptors.append(descriptor)
|
|
return descriptors
|
|
|
|
|
|
def _current_external_witness_receipts(
|
|
state: dict[str, Any],
|
|
*,
|
|
manifest_fingerprint: str,
|
|
) -> list[dict[str, Any]]:
|
|
expected_fingerprint = str(manifest_fingerprint or "").strip().lower()
|
|
current_fingerprint = str(state.get("external_witness_manifest_fingerprint", "") or "").strip().lower()
|
|
if not expected_fingerprint or current_fingerprint != expected_fingerprint:
|
|
return []
|
|
return [
|
|
dict(item or {})
|
|
for item in list(state.get("external_witness_receipts") or [])
|
|
if isinstance(item, dict)
|
|
]
|
|
|
|
|
|
def _record_external_witness_refresh_status(
|
|
state: dict[str, Any],
|
|
*,
|
|
ok: bool,
|
|
detail: str,
|
|
source_path: str = "",
|
|
attempted_at: int | None = None,
|
|
) -> None:
|
|
state["external_witness_refresh_attempted_at"] = _safe_int(
|
|
attempted_at or time.time(),
|
|
int(time.time()),
|
|
)
|
|
state["external_witness_refresh_ok"] = bool(ok)
|
|
state["external_witness_refresh_detail"] = str(detail or "").strip()
|
|
state["external_witness_refresh_source_path"] = str(source_path or "").strip()
|
|
state["external_witness_refresh_source_ref"] = str(source_path or "").strip()
|
|
|
|
|
|
def _ensure_witness_identities(
|
|
state: dict[str, Any],
|
|
*,
|
|
count: int = DEFAULT_ROOT_WITNESS_COUNT,
|
|
) -> tuple[list[dict[str, Any]], bool]:
|
|
identities, changed = _normalize_witness_identities(
|
|
state.get("witness_identities"),
|
|
legacy_identity=dict(state.get("witness_identity") or {}),
|
|
)
|
|
target_count = max(1, int(count or DEFAULT_ROOT_WITNESS_COUNT))
|
|
while len(identities) < target_count:
|
|
identities.append(_witness_identity_record(index=len(identities) + 1))
|
|
changed = True
|
|
state["witness_identity"] = identities[0] if identities else _empty_witness_identity()
|
|
state["witness_identities"] = identities
|
|
return identities, changed
|
|
|
|
|
|
def _witness_policy(
|
|
identities: list[dict[str, Any]],
|
|
*,
|
|
policy_version: int,
|
|
threshold: int = DEFAULT_ROOT_WITNESS_THRESHOLD,
|
|
) -> dict[str, Any]:
|
|
descriptors = [
|
|
_public_witness_descriptor(identity)
|
|
for identity in sorted(
|
|
list(identities or []),
|
|
key=lambda item: (
|
|
str(item.get("node_id", "") or "").strip(),
|
|
str(item.get("public_key", "") or "").strip(),
|
|
),
|
|
)
|
|
if str(identity.get("node_id", "") or "").strip() and str(identity.get("public_key", "") or "").strip()
|
|
]
|
|
resolved_threshold = max(1, min(len(descriptors), int(threshold or DEFAULT_ROOT_WITNESS_THRESHOLD or 1)))
|
|
return {
|
|
"type": STABLE_DM_ROOT_MANIFEST_WITNESS_POLICY_TYPE,
|
|
"policy_version": max(1, int(policy_version or 1)),
|
|
"threshold": resolved_threshold,
|
|
"witnesses": descriptors,
|
|
}
|
|
|
|
|
|
def witness_policy_fingerprint(policy: dict[str, Any]) -> str:
|
|
current = dict(policy or {})
|
|
canonical = {
|
|
"type": str(
|
|
current.get("type", STABLE_DM_ROOT_MANIFEST_WITNESS_POLICY_TYPE)
|
|
or STABLE_DM_ROOT_MANIFEST_WITNESS_POLICY_TYPE
|
|
),
|
|
"policy_version": _safe_int(current.get("policy_version", 1) or 1, 1),
|
|
"threshold": _safe_int(current.get("threshold", 0) or 0, 0),
|
|
"witnesses": [
|
|
{
|
|
"scope": str(item.get("scope", "root_witness") or "root_witness"),
|
|
"label": str(item.get("label", "") or ""),
|
|
"node_id": str(item.get("node_id", "") or "").strip(),
|
|
"public_key": str(item.get("public_key", "") or "").strip(),
|
|
"public_key_algo": str(item.get("public_key_algo", "Ed25519") or "Ed25519"),
|
|
"management_scope": _normalize_witness_management_scope(item.get("management_scope")),
|
|
"independence_group": _normalize_witness_independence_group(
|
|
item.get("independence_group"),
|
|
management_scope=_normalize_witness_management_scope(item.get("management_scope")),
|
|
),
|
|
}
|
|
for item in list(current.get("witnesses") or [])
|
|
if isinstance(item, dict)
|
|
],
|
|
}
|
|
return hashlib.sha256(_stable_json(canonical).encode("utf-8")).hexdigest()
|
|
|
|
|
|
def read_root_distribution_state() -> dict[str, Any]:
|
|
try:
|
|
raw = read_domain_json(
|
|
ROOT_DISTRIBUTION_DOMAIN,
|
|
ROOT_DISTRIBUTION_FILE,
|
|
_default_state,
|
|
base_dir=DATA_DIR,
|
|
)
|
|
except SecureStorageError as exc:
|
|
detail = str(exc)
|
|
if "Failed to decrypt domain JSON" not in detail:
|
|
raise
|
|
logger.warning(
|
|
"Root distribution state could not decrypt; regenerating local witness distribution: %s",
|
|
detail,
|
|
)
|
|
raw = _default_state()
|
|
state = {**_default_state(), **dict(raw or {})}
|
|
state["witness_identity"] = {**_empty_witness_identity(), **dict(state.get("witness_identity") or {})}
|
|
witness_identities, witness_changed = _normalize_witness_identities(
|
|
state.get("witness_identities"),
|
|
legacy_identity=dict(state.get("witness_identity") or {}),
|
|
)
|
|
state["witness_identities"] = witness_identities
|
|
if witness_identities:
|
|
state["witness_identity"] = witness_identities[0]
|
|
elif witness_changed:
|
|
state["witness_identity"] = _empty_witness_identity()
|
|
external_witness_descriptors, external_changed = _normalize_external_witness_descriptors(
|
|
state.get("external_witness_descriptors")
|
|
)
|
|
state["external_witness_descriptors"] = external_witness_descriptors
|
|
state["external_witness_source_scope"] = str(state.get("external_witness_source_scope", "") or "").strip().lower()
|
|
state["external_witness_source_label"] = str(state.get("external_witness_source_label", "") or "").strip()
|
|
state["external_witness_imported_at"] = _safe_int(state.get("external_witness_imported_at", 0) or 0, 0)
|
|
state["external_witness_source_exported_at"] = _safe_int(
|
|
state.get("external_witness_source_exported_at", 0) or 0,
|
|
0,
|
|
)
|
|
state["external_witness_refresh_attempted_at"] = _safe_int(
|
|
state.get("external_witness_refresh_attempted_at", 0) or 0,
|
|
0,
|
|
)
|
|
state["external_witness_refresh_ok"] = bool(state.get("external_witness_refresh_ok", False))
|
|
state["external_witness_refresh_detail"] = str(state.get("external_witness_refresh_detail", "") or "").strip()
|
|
state["external_witness_refresh_source_path"] = str(
|
|
state.get("external_witness_refresh_source_path", "") or ""
|
|
).strip()
|
|
state["external_witness_refresh_source_ref"] = str(
|
|
state.get("external_witness_refresh_source_ref", state.get("external_witness_refresh_source_path", "")) or ""
|
|
).strip()
|
|
state["external_witness_manifest_fingerprint"] = str(
|
|
state.get("external_witness_manifest_fingerprint", "") or ""
|
|
).strip().lower()
|
|
state["external_witness_receipts"] = [
|
|
dict(item or {}) for item in list(state.get("external_witness_receipts") or []) if isinstance(item, dict)
|
|
]
|
|
if not state["external_witness_manifest_fingerprint"]:
|
|
state["external_witness_receipts"] = []
|
|
if external_changed and not state["external_witness_descriptors"]:
|
|
state["external_witness_manifest_fingerprint"] = ""
|
|
state["external_witness_receipts"] = []
|
|
state["published_manifest"] = dict(state.get("published_manifest") or {})
|
|
state["published_witness"] = dict(state.get("published_witness") or {})
|
|
state["published_witnesses"] = [
|
|
dict(item or {}) for item in list(state.get("published_witnesses") or []) if isinstance(item, dict)
|
|
]
|
|
if not state["published_witnesses"] and state["published_witness"]:
|
|
state["published_witnesses"] = [dict(state["published_witness"] or {})]
|
|
state["published_manifest_fingerprint"] = str(state.get("published_manifest_fingerprint", "") or "").strip().lower()
|
|
return state
|
|
|
|
|
|
def _write_root_distribution_state(state: dict[str, Any]) -> dict[str, Any]:
|
|
witness_identities, _ = _normalize_witness_identities(
|
|
(state or {}).get("witness_identities"),
|
|
legacy_identity=dict((state or {}).get("witness_identity") or {}),
|
|
)
|
|
published_witnesses = [
|
|
dict(item or {})
|
|
for item in list((state or {}).get("published_witnesses") or [])
|
|
if isinstance(item, dict)
|
|
]
|
|
external_witness_descriptors, _ = _normalize_external_witness_descriptors(
|
|
(state or {}).get("external_witness_descriptors")
|
|
)
|
|
external_witness_manifest_fingerprint = str(
|
|
(state or {}).get("external_witness_manifest_fingerprint", "") or ""
|
|
).strip().lower()
|
|
external_witness_receipts = [
|
|
dict(item or {})
|
|
for item in list((state or {}).get("external_witness_receipts") or [])
|
|
if isinstance(item, dict)
|
|
]
|
|
if not external_witness_manifest_fingerprint:
|
|
external_witness_receipts = []
|
|
payload = {
|
|
**_default_state(),
|
|
**dict(state or {}),
|
|
"updated_at": int(time.time()),
|
|
"witness_identity": witness_identities[0] if witness_identities else _empty_witness_identity(),
|
|
"witness_identities": witness_identities,
|
|
"external_witness_descriptors": external_witness_descriptors,
|
|
"external_witness_source_scope": str((state or {}).get("external_witness_source_scope", "") or "").strip().lower(),
|
|
"external_witness_source_label": str((state or {}).get("external_witness_source_label", "") or "").strip(),
|
|
"external_witness_imported_at": _safe_int((state or {}).get("external_witness_imported_at", 0) or 0, 0),
|
|
"external_witness_source_exported_at": _safe_int(
|
|
(state or {}).get("external_witness_source_exported_at", 0) or 0,
|
|
0,
|
|
),
|
|
"external_witness_refresh_attempted_at": _safe_int(
|
|
(state or {}).get("external_witness_refresh_attempted_at", 0) or 0,
|
|
0,
|
|
),
|
|
"external_witness_refresh_ok": bool((state or {}).get("external_witness_refresh_ok", False)),
|
|
"external_witness_refresh_detail": str(
|
|
(state or {}).get("external_witness_refresh_detail", "") or ""
|
|
).strip(),
|
|
"external_witness_refresh_source_path": str(
|
|
(state or {}).get("external_witness_refresh_source_path", "") or ""
|
|
).strip(),
|
|
"external_witness_refresh_source_ref": str(
|
|
(state or {}).get(
|
|
"external_witness_refresh_source_ref",
|
|
(state or {}).get("external_witness_refresh_source_path", ""),
|
|
)
|
|
or ""
|
|
).strip(),
|
|
"external_witness_manifest_fingerprint": external_witness_manifest_fingerprint,
|
|
"external_witness_receipts": external_witness_receipts,
|
|
"published_manifest": dict((state or {}).get("published_manifest") or {}),
|
|
"published_witness": dict(published_witnesses[0] or {}) if published_witnesses else {},
|
|
"published_witnesses": published_witnesses,
|
|
"published_manifest_fingerprint": str(
|
|
(state or {}).get("published_manifest_fingerprint", "") or ""
|
|
).strip().lower(),
|
|
}
|
|
write_domain_json(
|
|
ROOT_DISTRIBUTION_DOMAIN,
|
|
ROOT_DISTRIBUTION_FILE,
|
|
payload,
|
|
base_dir=DATA_DIR,
|
|
)
|
|
return payload
|
|
|
|
|
|
def _current_root_view() -> dict[str, Any]:
|
|
bootstrap_wormhole_persona_state()
|
|
root_identity = get_root_identity()
|
|
return {
|
|
"root_node_id": str(root_identity.get("node_id", "") or "").strip(),
|
|
"root_public_key": str(root_identity.get("public_key", "") or "").strip(),
|
|
"root_public_key_algo": str(root_identity.get("public_key_algo", "Ed25519") or "Ed25519"),
|
|
"protocol_version": str(root_identity.get("protocol_version", PROTOCOL_VERSION) or PROTOCOL_VERSION),
|
|
}
|
|
|
|
|
|
def manifest_fingerprint_for_envelope(manifest: dict[str, Any]) -> str:
|
|
envelope = dict(manifest or {})
|
|
canonical = {
|
|
"type": str(envelope.get("type", STABLE_DM_ROOT_MANIFEST_TYPE) or STABLE_DM_ROOT_MANIFEST_TYPE),
|
|
"event_type": str(
|
|
envelope.get("event_type", STABLE_DM_ROOT_MANIFEST_EVENT_TYPE) or STABLE_DM_ROOT_MANIFEST_EVENT_TYPE
|
|
),
|
|
"node_id": str(envelope.get("node_id", "") or "").strip(),
|
|
"public_key": str(envelope.get("public_key", "") or "").strip(),
|
|
"public_key_algo": str(envelope.get("public_key_algo", "Ed25519") or "Ed25519"),
|
|
"protocol_version": str(envelope.get("protocol_version", PROTOCOL_VERSION) or PROTOCOL_VERSION),
|
|
"sequence": _safe_int(envelope.get("sequence", 0) or 0, 0),
|
|
"payload": dict(envelope.get("payload") or {}),
|
|
"signature": str(envelope.get("signature", "") or "").strip(),
|
|
}
|
|
return hashlib.sha256(_stable_json(canonical).encode("utf-8")).hexdigest()
|
|
|
|
|
|
def _manifest_payload(
|
|
*,
|
|
current_root: dict[str, Any],
|
|
previous_manifest: dict[str, Any] | None = None,
|
|
issued_at: int,
|
|
expires_at: int,
|
|
policy_version: int,
|
|
witness_policy: dict[str, Any],
|
|
) -> dict[str, Any]:
|
|
current_root_node_id = str(current_root.get("root_node_id", "") or "").strip()
|
|
current_root_public_key = str(current_root.get("root_public_key", "") or "").strip()
|
|
current_root_public_key_algo = str(current_root.get("root_public_key_algo", "Ed25519") or "Ed25519")
|
|
protocol_version = str(current_root.get("protocol_version", PROTOCOL_VERSION) or PROTOCOL_VERSION)
|
|
current_root_fingerprint = root_identity_fingerprint_for_material(
|
|
root_node_id=current_root_node_id,
|
|
root_public_key=current_root_public_key,
|
|
root_public_key_algo=current_root_public_key_algo,
|
|
protocol_version=protocol_version,
|
|
)
|
|
current_witness_policy_fingerprint = witness_policy_fingerprint(dict(witness_policy or {})) if witness_policy else ""
|
|
previous_payload = dict((previous_manifest or {}).get("payload") or {})
|
|
previous_generation = _safe_int(previous_payload.get("generation", 0) or 0, 0)
|
|
previous_manifest_root_fingerprint = str(previous_payload.get("root_fingerprint", "") or "").strip().lower()
|
|
previous_manifest_witness_policy = dict(previous_payload.get("witness_policy") or {})
|
|
previous_manifest_witness_policy_fingerprint = (
|
|
witness_policy_fingerprint(previous_manifest_witness_policy) if previous_manifest_witness_policy else ""
|
|
)
|
|
if not previous_manifest_root_fingerprint and previous_payload:
|
|
previous_manifest_root_fingerprint = root_identity_fingerprint_for_material(
|
|
root_node_id=str(previous_payload.get("root_node_id", "") or "").strip(),
|
|
root_public_key=str(previous_payload.get("root_public_key", "") or "").strip(),
|
|
root_public_key_algo=str(previous_payload.get("root_public_key_algo", "Ed25519") or "Ed25519"),
|
|
protocol_version=str(previous_payload.get("protocol_version", protocol_version) or protocol_version),
|
|
)
|
|
if previous_manifest_root_fingerprint == current_root_fingerprint:
|
|
generation = max(1, previous_generation or 1)
|
|
previous_root_fingerprint = str(previous_payload.get("previous_root_fingerprint", "") or "").strip().lower()
|
|
previous_root_node_id = str(previous_payload.get("previous_root_node_id", "") or "").strip()
|
|
previous_root_public_key = str(previous_payload.get("previous_root_public_key", "") or "").strip()
|
|
previous_root_public_key_algo = str(
|
|
previous_payload.get("previous_root_public_key_algo", "Ed25519") or "Ed25519"
|
|
).strip()
|
|
previous_root_protocol_version = str(
|
|
previous_payload.get("previous_root_protocol_version", protocol_version) or protocol_version
|
|
).strip()
|
|
previous_root_cross_sequence = _safe_int(previous_payload.get("previous_root_cross_sequence", 0) or 0, 0)
|
|
previous_root_cross_signature = str(previous_payload.get("previous_root_cross_signature", "") or "").strip()
|
|
if (
|
|
previous_manifest_witness_policy_fingerprint
|
|
and previous_manifest_witness_policy_fingerprint != current_witness_policy_fingerprint
|
|
):
|
|
previous_witness_policy_fingerprint = previous_manifest_witness_policy_fingerprint
|
|
previous_witness_policy_sequence = 0
|
|
previous_witness_policy_signature = ""
|
|
else:
|
|
previous_witness_policy_fingerprint = str(
|
|
previous_payload.get("previous_witness_policy_fingerprint", "") or ""
|
|
).strip().lower()
|
|
previous_witness_policy_sequence = _safe_int(
|
|
previous_payload.get("previous_witness_policy_sequence", 0) or 0,
|
|
0,
|
|
)
|
|
previous_witness_policy_signature = str(
|
|
previous_payload.get("previous_witness_policy_signature", "") or ""
|
|
).strip()
|
|
else:
|
|
generation = max(1, previous_generation + 1)
|
|
previous_root_fingerprint = previous_manifest_root_fingerprint
|
|
previous_root_node_id = str(previous_payload.get("root_node_id", "") or "").strip()
|
|
previous_root_public_key = str(previous_payload.get("root_public_key", "") or "").strip()
|
|
previous_root_public_key_algo = str(previous_payload.get("root_public_key_algo", "Ed25519") or "Ed25519").strip()
|
|
previous_root_protocol_version = str(previous_payload.get("protocol_version", protocol_version) or protocol_version)
|
|
previous_root_cross_sequence = 0
|
|
previous_root_cross_signature = ""
|
|
previous_witness_policy_fingerprint = ""
|
|
previous_witness_policy_sequence = 0
|
|
previous_witness_policy_signature = ""
|
|
return {
|
|
"root_node_id": current_root_node_id,
|
|
"root_public_key": current_root_public_key,
|
|
"root_public_key_algo": current_root_public_key_algo,
|
|
"root_fingerprint": current_root_fingerprint,
|
|
"protocol_version": protocol_version,
|
|
"generation": generation,
|
|
"issued_at": int(issued_at or 0),
|
|
"expires_at": int(expires_at or 0),
|
|
"previous_root_fingerprint": previous_root_fingerprint,
|
|
"previous_root_node_id": previous_root_node_id,
|
|
"previous_root_public_key": previous_root_public_key,
|
|
"previous_root_public_key_algo": previous_root_public_key_algo,
|
|
"previous_root_protocol_version": previous_root_protocol_version,
|
|
"previous_root_cross_sequence": previous_root_cross_sequence,
|
|
"previous_root_cross_signature": previous_root_cross_signature,
|
|
"previous_witness_policy_fingerprint": previous_witness_policy_fingerprint,
|
|
"previous_witness_policy_sequence": previous_witness_policy_sequence,
|
|
"previous_witness_policy_signature": previous_witness_policy_signature,
|
|
"policy_version": _safe_int(policy_version or 1, 1),
|
|
"witness_policy": dict(witness_policy or {}),
|
|
}
|
|
|
|
|
|
def _previous_root_cross_payload(payload: dict[str, Any]) -> dict[str, Any]:
|
|
current = dict(payload or {})
|
|
return {
|
|
"manifest_type": STABLE_DM_ROOT_MANIFEST_TYPE,
|
|
"manifest_event_type": STABLE_DM_ROOT_MANIFEST_EVENT_TYPE,
|
|
"root_node_id": str(current.get("root_node_id", "") or "").strip(),
|
|
"root_public_key": str(current.get("root_public_key", "") or "").strip(),
|
|
"root_public_key_algo": str(current.get("root_public_key_algo", "Ed25519") or "Ed25519").strip(),
|
|
"root_fingerprint": str(current.get("root_fingerprint", "") or "").strip().lower(),
|
|
"protocol_version": str(current.get("protocol_version", PROTOCOL_VERSION) or PROTOCOL_VERSION).strip(),
|
|
"generation": _safe_int(current.get("generation", 0) or 0, 0),
|
|
"issued_at": _safe_int(current.get("issued_at", 0) or 0, 0),
|
|
"expires_at": _safe_int(current.get("expires_at", 0) or 0, 0),
|
|
"previous_root_fingerprint": str(current.get("previous_root_fingerprint", "") or "").strip().lower(),
|
|
"policy_version": _safe_int(current.get("policy_version", 1) or 1, 1),
|
|
}
|
|
|
|
|
|
def _previous_witness_policy_change_payload(payload: dict[str, Any]) -> dict[str, Any]:
|
|
current = dict(payload or {})
|
|
witness_policy = dict(current.get("witness_policy") or {})
|
|
return {
|
|
"manifest_type": STABLE_DM_ROOT_MANIFEST_TYPE,
|
|
"manifest_event_type": STABLE_DM_ROOT_MANIFEST_EVENT_TYPE,
|
|
"root_node_id": str(current.get("root_node_id", "") or "").strip(),
|
|
"root_public_key": str(current.get("root_public_key", "") or "").strip(),
|
|
"root_public_key_algo": str(current.get("root_public_key_algo", "Ed25519") or "Ed25519").strip(),
|
|
"root_fingerprint": str(current.get("root_fingerprint", "") or "").strip().lower(),
|
|
"protocol_version": str(current.get("protocol_version", PROTOCOL_VERSION) or PROTOCOL_VERSION).strip(),
|
|
"generation": _safe_int(current.get("generation", 0) or 0, 0),
|
|
"issued_at": _safe_int(current.get("issued_at", 0) or 0, 0),
|
|
"expires_at": _safe_int(current.get("expires_at", 0) or 0, 0),
|
|
"policy_version": _safe_int(current.get("policy_version", 1) or 1, 1),
|
|
"witness_policy_fingerprint": witness_policy_fingerprint(witness_policy) if witness_policy else "",
|
|
"previous_witness_policy_fingerprint": str(
|
|
current.get("previous_witness_policy_fingerprint", "") or ""
|
|
).strip().lower(),
|
|
}
|
|
|
|
|
|
def _touch(identity: dict[str, Any]) -> None:
|
|
identity["last_used_at"] = int(time.time())
|
|
|
|
|
|
def _next_sequence(identity: dict[str, Any], sequence: int | None = None) -> int:
|
|
if sequence is None:
|
|
next_value = _safe_int(identity.get("sequence", 0) or 0, 0) + 1
|
|
else:
|
|
next_value = max(_safe_int(identity.get("sequence", 0) or 0, 0), int(sequence))
|
|
identity["sequence"] = next_value
|
|
_touch(identity)
|
|
return next_value
|
|
|
|
|
|
def _sign_with_witness_identity(
|
|
*,
|
|
identity: dict[str, Any],
|
|
event_type: str,
|
|
payload: dict[str, Any],
|
|
sequence: int | None = None,
|
|
) -> dict[str, Any]:
|
|
signed_sequence = _next_sequence(identity, sequence)
|
|
payload_str = build_signature_payload(
|
|
event_type=event_type,
|
|
node_id=str(identity.get("node_id", "") or ""),
|
|
sequence=signed_sequence,
|
|
payload=dict(payload or {}),
|
|
)
|
|
signing_priv = ed25519.Ed25519PrivateKey.from_private_bytes(
|
|
base64.b64decode(str(identity.get("private_key", "") or "").encode("ascii"))
|
|
)
|
|
signature = signing_priv.sign(payload_str.encode("utf-8")).hex()
|
|
return {
|
|
"type": STABLE_DM_ROOT_MANIFEST_WITNESS_TYPE,
|
|
"event_type": event_type,
|
|
"node_id": str(identity.get("node_id", "") or ""),
|
|
"public_key": str(identity.get("public_key", "") or ""),
|
|
"public_key_algo": str(identity.get("public_key_algo", "Ed25519") or "Ed25519"),
|
|
"protocol_version": PROTOCOL_VERSION,
|
|
"sequence": signed_sequence,
|
|
"payload": dict(payload or {}),
|
|
"signature": signature,
|
|
"identity_scope": "root_witness",
|
|
}
|
|
|
|
|
|
def _witness_payload(manifest: dict[str, Any]) -> dict[str, Any]:
|
|
payload = dict((manifest or {}).get("payload") or {})
|
|
witness_policy = dict(payload.get("witness_policy") or {})
|
|
return {
|
|
"manifest_type": str((manifest or {}).get("type", STABLE_DM_ROOT_MANIFEST_TYPE) or STABLE_DM_ROOT_MANIFEST_TYPE),
|
|
"manifest_event_type": str(
|
|
(manifest or {}).get("event_type", STABLE_DM_ROOT_MANIFEST_EVENT_TYPE) or STABLE_DM_ROOT_MANIFEST_EVENT_TYPE
|
|
),
|
|
"manifest_fingerprint": manifest_fingerprint_for_envelope(manifest),
|
|
"root_fingerprint": str(payload.get("root_fingerprint", "") or "").strip().lower(),
|
|
"root_node_id": str(payload.get("root_node_id", "") or "").strip(),
|
|
"generation": _safe_int(payload.get("generation", 0) or 0, 0),
|
|
"issued_at": _safe_int(payload.get("issued_at", 0) or 0, 0),
|
|
"expires_at": _safe_int(payload.get("expires_at", 0) or 0, 0),
|
|
"policy_version": _safe_int(payload.get("policy_version", 1) or 1, 1),
|
|
"witness_policy_fingerprint": witness_policy_fingerprint(witness_policy) if witness_policy else "",
|
|
"witness_threshold": _safe_int(witness_policy.get("threshold", 0) or 0, 0),
|
|
}
|
|
|
|
|
|
def _verify_witness_policy(policy: dict[str, Any]) -> dict[str, Any]:
|
|
current = dict(policy or {})
|
|
if str(current.get("type", STABLE_DM_ROOT_MANIFEST_WITNESS_POLICY_TYPE) or STABLE_DM_ROOT_MANIFEST_WITNESS_POLICY_TYPE) != STABLE_DM_ROOT_MANIFEST_WITNESS_POLICY_TYPE:
|
|
return {"ok": False, "detail": "stable root manifest witness policy type invalid"}
|
|
policy_version = _safe_int(current.get("policy_version", 0) or 0, 0)
|
|
if policy_version <= 0:
|
|
return {"ok": False, "detail": "stable root manifest witness policy version required"}
|
|
witnesses: list[dict[str, Any]] = []
|
|
seen: set[tuple[str, str]] = set()
|
|
for item in list(current.get("witnesses") or []):
|
|
if not isinstance(item, dict):
|
|
continue
|
|
descriptor = _public_witness_descriptor(item)
|
|
if not descriptor["node_id"] or not descriptor["public_key"]:
|
|
return {"ok": False, "detail": "stable root manifest witness policy witness incomplete"}
|
|
if not verify_node_binding(descriptor["node_id"], descriptor["public_key"]):
|
|
return {"ok": False, "detail": "stable root manifest witness policy witness binding invalid"}
|
|
if not descriptor["independence_group"]:
|
|
return {"ok": False, "detail": "stable root manifest witness policy witness independence group invalid"}
|
|
key = (descriptor["node_id"], descriptor["public_key"])
|
|
if key in seen:
|
|
return {"ok": False, "detail": "stable root manifest witness policy witness duplicated"}
|
|
seen.add(key)
|
|
witnesses.append(descriptor)
|
|
if not witnesses:
|
|
return {"ok": False, "detail": "stable root manifest witness policy witnesses required"}
|
|
threshold = _safe_int(current.get("threshold", 0) or 0, 0)
|
|
if threshold <= 0 or threshold > len(witnesses):
|
|
return {"ok": False, "detail": "stable root manifest witness policy threshold invalid"}
|
|
normalized = {
|
|
"type": STABLE_DM_ROOT_MANIFEST_WITNESS_POLICY_TYPE,
|
|
"policy_version": policy_version,
|
|
"threshold": threshold,
|
|
"witnesses": sorted(
|
|
witnesses,
|
|
key=lambda item: (item["node_id"], item["public_key"]),
|
|
),
|
|
}
|
|
return {
|
|
"ok": True,
|
|
"policy": normalized,
|
|
"policy_fingerprint": witness_policy_fingerprint(normalized),
|
|
"threshold": threshold,
|
|
"witness_count": len(normalized["witnesses"]),
|
|
}
|
|
|
|
|
|
def publish_current_root_manifest(
|
|
*,
|
|
expires_in_s: int = DEFAULT_ROOT_MANIFEST_TTL_S,
|
|
policy_version: int = 1,
|
|
) -> dict[str, Any]:
|
|
state = read_root_distribution_state()
|
|
witness_identities, _ = _ensure_witness_identities(state)
|
|
witness_descriptors = _configured_witness_descriptors(state, witness_identities)
|
|
witness_policy = _witness_policy(witness_descriptors, policy_version=policy_version)
|
|
current_root = _current_root_view()
|
|
now = int(time.time())
|
|
ttl_s = max(1, _safe_int(expires_in_s or DEFAULT_ROOT_MANIFEST_TTL_S, DEFAULT_ROOT_MANIFEST_TTL_S))
|
|
manifest_payload = _manifest_payload(
|
|
current_root=current_root,
|
|
previous_manifest=dict(state.get("published_manifest") or {}),
|
|
issued_at=now,
|
|
expires_at=now + ttl_s,
|
|
policy_version=policy_version,
|
|
witness_policy=witness_policy,
|
|
)
|
|
current_root_fingerprint = str(manifest_payload.get("root_fingerprint", "") or "").strip().lower()
|
|
previous_root_fingerprint = str(manifest_payload.get("previous_root_fingerprint", "") or "").strip().lower()
|
|
if previous_root_fingerprint and previous_root_fingerprint != current_root_fingerprint:
|
|
previous_root_identity = read_previous_root_identity()
|
|
previous_root_identity_fingerprint = root_identity_fingerprint_for_material(
|
|
root_node_id=str(previous_root_identity.get("node_id", "") or "").strip(),
|
|
root_public_key=str(previous_root_identity.get("public_key", "") or "").strip(),
|
|
root_public_key_algo=str(previous_root_identity.get("public_key_algo", "Ed25519") or "Ed25519"),
|
|
protocol_version=str(previous_root_identity.get("protocol_version", PROTOCOL_VERSION) or PROTOCOL_VERSION),
|
|
)
|
|
if previous_root_identity_fingerprint == previous_root_fingerprint:
|
|
previous_signed = sign_previous_root_wormhole_event(
|
|
event_type=STABLE_DM_ROOT_MANIFEST_PREVIOUS_ROOT_EVENT_TYPE,
|
|
payload=_previous_root_cross_payload(manifest_payload),
|
|
)
|
|
if previous_signed.get("ok"):
|
|
manifest_payload["previous_root_node_id"] = str(previous_signed.get("node_id", "") or "").strip()
|
|
manifest_payload["previous_root_public_key"] = str(previous_signed.get("public_key", "") or "").strip()
|
|
manifest_payload["previous_root_public_key_algo"] = str(
|
|
previous_signed.get("public_key_algo", "Ed25519") or "Ed25519"
|
|
).strip()
|
|
manifest_payload["previous_root_protocol_version"] = str(
|
|
previous_signed.get("protocol_version", PROTOCOL_VERSION) or PROTOCOL_VERSION
|
|
).strip()
|
|
manifest_payload["previous_root_cross_sequence"] = _safe_int(
|
|
previous_signed.get("sequence", 0) or 0,
|
|
0,
|
|
)
|
|
manifest_payload["previous_root_cross_signature"] = str(
|
|
previous_signed.get("signature", "") or ""
|
|
).strip()
|
|
current_policy_fingerprint = witness_policy_fingerprint(dict(manifest_payload.get("witness_policy") or {}))
|
|
previous_policy_fingerprint = str(
|
|
manifest_payload.get("previous_witness_policy_fingerprint", "") or ""
|
|
).strip().lower()
|
|
if previous_policy_fingerprint and previous_policy_fingerprint != current_policy_fingerprint:
|
|
previous_policy_signed = sign_root_wormhole_event(
|
|
event_type=STABLE_DM_ROOT_MANIFEST_POLICY_CHANGE_EVENT_TYPE,
|
|
payload=_previous_witness_policy_change_payload(manifest_payload),
|
|
)
|
|
manifest_payload["previous_witness_policy_sequence"] = _safe_int(
|
|
previous_policy_signed.get("sequence", 0) or 0,
|
|
0,
|
|
)
|
|
manifest_payload["previous_witness_policy_signature"] = str(
|
|
previous_policy_signed.get("signature", "") or ""
|
|
).strip()
|
|
signed_manifest = sign_root_wormhole_event(
|
|
event_type=STABLE_DM_ROOT_MANIFEST_EVENT_TYPE,
|
|
payload=manifest_payload,
|
|
)
|
|
manifest = {
|
|
"type": STABLE_DM_ROOT_MANIFEST_TYPE,
|
|
"event_type": STABLE_DM_ROOT_MANIFEST_EVENT_TYPE,
|
|
"node_id": str(signed_manifest.get("node_id", "") or "").strip(),
|
|
"public_key": str(signed_manifest.get("public_key", "") or "").strip(),
|
|
"public_key_algo": str(signed_manifest.get("public_key_algo", "Ed25519") or "Ed25519"),
|
|
"protocol_version": str(signed_manifest.get("protocol_version", PROTOCOL_VERSION) or PROTOCOL_VERSION),
|
|
"sequence": _safe_int(signed_manifest.get("sequence", 0) or 0, 0),
|
|
"payload": dict(signed_manifest.get("payload") or {}),
|
|
"signature": str(signed_manifest.get("signature", "") or "").strip(),
|
|
"identity_scope": str(signed_manifest.get("identity_scope", "root") or "root"),
|
|
}
|
|
manifest_fingerprint = manifest_fingerprint_for_envelope(manifest)
|
|
witnesses = [
|
|
_sign_with_witness_identity(
|
|
identity=identity,
|
|
event_type=STABLE_DM_ROOT_MANIFEST_WITNESS_EVENT_TYPE,
|
|
payload=_witness_payload(manifest),
|
|
)
|
|
for identity in witness_identities
|
|
]
|
|
witness_policy_verified = _verify_witness_policy(witness_policy)
|
|
witness_verified = verify_root_manifest_witness_set(manifest, witnesses)
|
|
state["witness_identity"] = witness_identities[0] if witness_identities else _empty_witness_identity()
|
|
state["witness_identities"] = witness_identities
|
|
state["external_witness_manifest_fingerprint"] = ""
|
|
state["external_witness_receipts"] = []
|
|
state["published_manifest"] = manifest
|
|
state["published_manifest_fingerprint"] = manifest_fingerprint
|
|
state["published_witness"] = dict(witnesses[0] or {}) if witnesses else {}
|
|
state["published_witnesses"] = witnesses
|
|
_write_root_distribution_state(state)
|
|
operator_status = _external_witness_operator_status(
|
|
state,
|
|
manifest_fingerprint=manifest_fingerprint,
|
|
external_witnesses=[],
|
|
)
|
|
return {
|
|
"ok": True,
|
|
"manifest": manifest,
|
|
"manifest_fingerprint": manifest_fingerprint,
|
|
"witness": dict(witnesses[0] or {}) if witnesses else {},
|
|
"witnesses": witnesses,
|
|
"witness_identity": _public_witness_identity(witness_identities[0]) if witness_identities else _empty_witness_identity(),
|
|
"witness_identities": [_public_witness_identity(item) for item in witness_identities],
|
|
"external_witness_descriptors": list(state.get("external_witness_descriptors") or []),
|
|
"external_witness_source_scope": str(state.get("external_witness_source_scope", "") or "").strip().lower(),
|
|
"external_witness_source_label": str(state.get("external_witness_source_label", "") or "").strip(),
|
|
"external_witness_imported_at": _safe_int(state.get("external_witness_imported_at", 0) or 0, 0),
|
|
"external_witness_source_exported_at": _safe_int(
|
|
state.get("external_witness_source_exported_at", 0) or 0,
|
|
0,
|
|
),
|
|
"external_witness_refresh_attempted_at": _safe_int(
|
|
state.get("external_witness_refresh_attempted_at", 0) or 0,
|
|
0,
|
|
),
|
|
"external_witness_refresh_ok": bool(state.get("external_witness_refresh_ok", False)),
|
|
"external_witness_refresh_detail": str(state.get("external_witness_refresh_detail", "") or "").strip(),
|
|
"external_witness_refresh_source_path": str(
|
|
state.get("external_witness_refresh_source_path", "") or ""
|
|
).strip(),
|
|
"external_witness_refresh_source_ref": str(
|
|
state.get("external_witness_refresh_source_ref", state.get("external_witness_refresh_source_path", ""))
|
|
or ""
|
|
).strip(),
|
|
"external_witness_receipt_count": 0,
|
|
"external_witness_receipts_current": False,
|
|
**operator_status,
|
|
"witness_policy": dict(witness_policy_verified.get("policy") or witness_policy),
|
|
"witness_policy_fingerprint": str(witness_policy_verified.get("policy_fingerprint", "") or "").strip().lower(),
|
|
"witness_threshold": _safe_int(witness_policy_verified.get("threshold", 0) or 0, 0),
|
|
"witness_count": _safe_int(witness_policy_verified.get("witness_count", 0) or 0, 0),
|
|
"witness_domain_count": _safe_int(witness_verified.get("witness_domain_count", 0) or 0, 0),
|
|
"witness_independent_quorum_met": bool(witness_verified.get("witness_independent_quorum_met")),
|
|
"witness_finality_met": bool(witness_verified.get("witness_finality_met")),
|
|
"root_fingerprint": str(manifest_payload.get("root_fingerprint", "") or "").strip().lower(),
|
|
"generation": _safe_int(manifest_payload.get("generation", 0) or 0, 0),
|
|
"rotation_proven": bool(
|
|
_safe_int(manifest_payload.get("generation", 0) or 0, 0) <= 1
|
|
or str(manifest_payload.get("previous_root_cross_signature", "") or "").strip()
|
|
),
|
|
"policy_change_proven": bool(
|
|
not str(manifest_payload.get("previous_witness_policy_fingerprint", "") or "").strip()
|
|
or str(manifest_payload.get("previous_witness_policy_signature", "") or "").strip()
|
|
),
|
|
}
|
|
|
|
|
|
def _manifest_expired(manifest: dict[str, Any], *, now: int | None = None) -> bool:
|
|
payload = dict((manifest or {}).get("payload") or {})
|
|
expires_at = _safe_int(payload.get("expires_at", 0) or 0, 0)
|
|
if expires_at <= 0:
|
|
return False
|
|
current_time = _safe_int(now or time.time(), int(time.time()))
|
|
return expires_at <= current_time
|
|
|
|
|
|
def _external_witness_source_exported_at(material: dict[str, Any] | None) -> int:
|
|
return _safe_int(dict(material or {}).get("exported_at", 0) or 0, 0)
|
|
|
|
|
|
def _external_witness_source_age_s(exported_at: int, *, now: int | None = None) -> int:
|
|
if exported_at <= 0:
|
|
return 0
|
|
current_time = _safe_int(now or time.time(), int(time.time()))
|
|
return max(0, current_time - exported_at)
|
|
|
|
|
|
def _external_witness_source_stale(exported_at: int, *, now: int | None = None) -> bool:
|
|
max_age_s = _external_root_witness_max_age_s()
|
|
if max_age_s <= 0:
|
|
return False
|
|
if exported_at <= 0:
|
|
return True
|
|
return _external_witness_source_age_s(exported_at, now=now) > max_age_s
|
|
|
|
|
|
def _external_witness_operator_status(
|
|
state: dict[str, Any],
|
|
*,
|
|
manifest_fingerprint: str,
|
|
external_witnesses: list[dict[str, Any]] | None,
|
|
) -> dict[str, Any]:
|
|
source_ref = _configured_external_root_witness_source_ref()
|
|
descriptors = [dict(item or {}) for item in list(state.get("external_witness_descriptors") or []) if isinstance(item, dict)]
|
|
source_configured = bool(source_ref or descriptors)
|
|
source_refresh_configured = bool(source_ref)
|
|
attempted_at = _safe_int(state.get("external_witness_refresh_attempted_at", 0) or 0, 0)
|
|
now = int(time.time())
|
|
refresh_age_s = max(0, now - attempted_at) if attempted_at > 0 else 0
|
|
source_exported_at = _safe_int(state.get("external_witness_source_exported_at", 0) or 0, 0)
|
|
source_age_s = _external_witness_source_age_s(source_exported_at, now=now)
|
|
stored_manifest_fingerprint = str(state.get("external_witness_manifest_fingerprint", "") or "").strip().lower()
|
|
manifest_matches_current = bool(
|
|
stored_manifest_fingerprint and manifest_fingerprint and stored_manifest_fingerprint == manifest_fingerprint
|
|
)
|
|
receipts_current = bool(list(external_witnesses or []))
|
|
refresh_ok = bool(state.get("external_witness_refresh_ok", False))
|
|
refresh_detail = str(state.get("external_witness_refresh_detail", "") or "").strip().lower()
|
|
refresh_failed = bool(source_refresh_configured and attempted_at > 0 and not refresh_ok)
|
|
stale_refresh = bool(
|
|
refresh_failed
|
|
and any(
|
|
marker in refresh_detail
|
|
for marker in (
|
|
"manifest_fingerprint mismatch",
|
|
"waiting for current-manifest receipts",
|
|
"source stale",
|
|
)
|
|
)
|
|
)
|
|
if refresh_failed and not stale_refresh:
|
|
operator_state = "error"
|
|
elif stale_refresh:
|
|
operator_state = "stale"
|
|
elif receipts_current:
|
|
operator_state = "current"
|
|
elif descriptors and not stored_manifest_fingerprint and refresh_ok:
|
|
operator_state = "descriptors_only"
|
|
elif descriptors:
|
|
operator_state = "stale"
|
|
elif not source_configured:
|
|
operator_state = "not_configured"
|
|
elif not refresh_ok:
|
|
operator_state = "error"
|
|
else:
|
|
operator_state = "stale"
|
|
return {
|
|
"external_witness_source_configured": source_configured,
|
|
"external_witness_operator_state": operator_state,
|
|
"external_witness_refresh_age_s": refresh_age_s,
|
|
"external_witness_source_exported_at": source_exported_at,
|
|
"external_witness_source_age_s": source_age_s,
|
|
"external_witness_freshness_window_s": _external_root_witness_max_age_s(),
|
|
"external_witness_manifest_fingerprint": stored_manifest_fingerprint,
|
|
"external_witness_manifest_matches_current": manifest_matches_current,
|
|
"external_witness_reacquire_required": bool(
|
|
source_configured and (not receipts_current or refresh_failed or operator_state == "stale")
|
|
),
|
|
}
|
|
|
|
|
|
def get_current_root_manifest() -> dict[str, Any]:
|
|
state = read_root_distribution_state()
|
|
_refresh_external_root_witness_material_from_source(
|
|
state,
|
|
manifest=dict(state.get("published_manifest") or {}),
|
|
)
|
|
state = read_root_distribution_state()
|
|
manifest = dict(state.get("published_manifest") or {})
|
|
local_witnesses = [dict(item or {}) for item in list(state.get("published_witnesses") or []) if isinstance(item, dict)]
|
|
local_witness = dict(local_witnesses[0] or {}) if local_witnesses else dict(state.get("published_witness") or {})
|
|
current_root = _current_root_view()
|
|
current_root_fingerprint = root_identity_fingerprint_for_material(
|
|
root_node_id=str(current_root.get("root_node_id", "") or "").strip(),
|
|
root_public_key=str(current_root.get("root_public_key", "") or "").strip(),
|
|
root_public_key_algo=str(current_root.get("root_public_key_algo", "Ed25519") or "Ed25519"),
|
|
protocol_version=str(current_root.get("protocol_version", PROTOCOL_VERSION) or PROTOCOL_VERSION),
|
|
)
|
|
manifest_payload = dict(manifest.get("payload") or {})
|
|
manifest_root_fingerprint = str(manifest_payload.get("root_fingerprint", "") or "").strip().lower()
|
|
manifest_fingerprint = str(state.get("published_manifest_fingerprint", "") or "").strip().lower()
|
|
if not manifest_fingerprint and manifest:
|
|
manifest_fingerprint = manifest_fingerprint_for_envelope(manifest)
|
|
external_witnesses = _current_external_witness_receipts(
|
|
state,
|
|
manifest_fingerprint=manifest_fingerprint,
|
|
)
|
|
operator_status = _external_witness_operator_status(
|
|
state,
|
|
manifest_fingerprint=manifest_fingerprint,
|
|
external_witnesses=external_witnesses,
|
|
)
|
|
witnesses = [*local_witnesses, *external_witnesses]
|
|
witness = dict(witnesses[0] or {}) if witnesses else local_witness
|
|
manifest_verified = verify_root_manifest(manifest)
|
|
witness_verified = verify_root_manifest_witness_set(manifest, witnesses)
|
|
manifest_valid = bool(manifest_verified.get("ok")) and bool(witness_verified.get("ok"))
|
|
witness_identities, _ = _ensure_witness_identities(state)
|
|
witness_ready = bool(witness_identities)
|
|
desired_policy = _witness_policy(
|
|
_configured_witness_descriptors(state, witness_identities),
|
|
policy_version=_safe_int(manifest_payload.get("policy_version", 1) or 1, 1),
|
|
)
|
|
desired_policy_fingerprint = witness_policy_fingerprint(desired_policy)
|
|
current_policy_fingerprint = str(manifest_payload.get("witness_policy") or "")
|
|
if isinstance(manifest_payload.get("witness_policy"), dict):
|
|
current_policy_fingerprint = witness_policy_fingerprint(dict(manifest_payload.get("witness_policy") or {}))
|
|
if (
|
|
not manifest
|
|
or not witnesses
|
|
or not witness_ready
|
|
or not manifest_valid
|
|
or current_policy_fingerprint != desired_policy_fingerprint
|
|
or (
|
|
_safe_int(manifest_verified.get("generation", 0) or 0, 0) > 1
|
|
and not bool(manifest_verified.get("rotation_proven"))
|
|
)
|
|
or (
|
|
str(manifest_verified.get("previous_witness_policy_fingerprint", "") or "").strip()
|
|
and not bool(manifest_verified.get("policy_change_proven"))
|
|
)
|
|
or _manifest_expired(manifest)
|
|
or manifest_root_fingerprint != current_root_fingerprint
|
|
):
|
|
return publish_current_root_manifest()
|
|
return {
|
|
"ok": True,
|
|
"manifest": manifest,
|
|
"manifest_fingerprint": manifest_fingerprint or manifest_fingerprint_for_envelope(manifest),
|
|
"witness": witness,
|
|
"witnesses": witnesses,
|
|
"witness_identity": _public_witness_identity(witness_identities[0]) if witness_identities else _empty_witness_identity(),
|
|
"witness_identities": [_public_witness_identity(item) for item in witness_identities],
|
|
"external_witness_descriptors": list(state.get("external_witness_descriptors") or []),
|
|
"external_witness_source_scope": str(state.get("external_witness_source_scope", "") or "").strip().lower(),
|
|
"external_witness_source_label": str(state.get("external_witness_source_label", "") or "").strip(),
|
|
"external_witness_imported_at": _safe_int(state.get("external_witness_imported_at", 0) or 0, 0),
|
|
"external_witness_source_exported_at": _safe_int(
|
|
state.get("external_witness_source_exported_at", 0) or 0,
|
|
0,
|
|
),
|
|
"external_witness_refresh_attempted_at": _safe_int(
|
|
state.get("external_witness_refresh_attempted_at", 0) or 0,
|
|
0,
|
|
),
|
|
"external_witness_refresh_ok": bool(state.get("external_witness_refresh_ok", False)),
|
|
"external_witness_refresh_detail": str(state.get("external_witness_refresh_detail", "") or "").strip(),
|
|
"external_witness_refresh_source_path": str(
|
|
state.get("external_witness_refresh_source_path", "") or ""
|
|
).strip(),
|
|
"external_witness_refresh_source_ref": str(
|
|
state.get("external_witness_refresh_source_ref", state.get("external_witness_refresh_source_path", ""))
|
|
or ""
|
|
).strip(),
|
|
"external_witness_receipt_count": len(external_witnesses),
|
|
"external_witness_receipts_current": bool(external_witnesses),
|
|
**operator_status,
|
|
"witness_policy": dict(manifest_verified.get("witness_policy") or {}),
|
|
"witness_policy_fingerprint": str(manifest_verified.get("witness_policy_fingerprint", "") or "").strip().lower(),
|
|
"witness_threshold": _safe_int(manifest_verified.get("witness_threshold", 0) or 0, 0),
|
|
"witness_count": _safe_int(witness_verified.get("witness_count", 0) or 0, 0),
|
|
"witness_domain_count": _safe_int(witness_verified.get("witness_domain_count", 0) or 0, 0),
|
|
"witness_independent_quorum_met": bool(witness_verified.get("witness_independent_quorum_met")),
|
|
"witness_finality_met": bool(witness_verified.get("witness_finality_met")),
|
|
"root_fingerprint": manifest_root_fingerprint,
|
|
"generation": _safe_int(manifest_verified.get("generation", 0) or 0, 0),
|
|
"rotation_proven": bool(manifest_verified.get("rotation_proven")),
|
|
"policy_change_proven": bool(manifest_verified.get("policy_change_proven")),
|
|
}
|
|
|
|
|
|
def configure_external_root_witness_descriptors(descriptors: list[dict[str, Any]] | None) -> dict[str, Any]:
|
|
state = read_root_distribution_state()
|
|
normalized, _ = _normalize_external_witness_descriptors(descriptors)
|
|
state["external_witness_descriptors"] = normalized
|
|
state["external_witness_source_exported_at"] = 0
|
|
state["external_witness_manifest_fingerprint"] = ""
|
|
state["external_witness_receipts"] = []
|
|
written = _write_root_distribution_state(state)
|
|
return {
|
|
"ok": True,
|
|
"external_witness_descriptors": list(written.get("external_witness_descriptors") or []),
|
|
"external_witness_count": len(list(written.get("external_witness_descriptors") or [])),
|
|
}
|
|
|
|
|
|
def _configured_external_root_witness_source_ref(path: str | None = None) -> str:
|
|
from services.config import get_settings
|
|
|
|
explicit = str(path or "").strip()
|
|
if explicit:
|
|
return explicit
|
|
settings = get_settings()
|
|
configured_uri = str(getattr(settings, "MESH_DM_ROOT_EXTERNAL_WITNESS_IMPORT_URI", "") or "").strip()
|
|
if configured_uri:
|
|
return configured_uri
|
|
return str(getattr(settings, "MESH_DM_ROOT_EXTERNAL_WITNESS_IMPORT_PATH", "") or "").strip()
|
|
|
|
|
|
def _read_external_root_witness_material_package(path: str | None = None) -> dict[str, Any]:
|
|
configured_ref = _configured_external_root_witness_source_ref(path)
|
|
if "://" in configured_ref:
|
|
if not configured_ref:
|
|
return {"ok": False, "detail": "external root witness import source not configured"}
|
|
try:
|
|
with urllib.request.urlopen(configured_ref, timeout=10) as response:
|
|
raw = json.loads(response.read().decode("utf-8"))
|
|
except urllib.error.URLError:
|
|
return {
|
|
"ok": False,
|
|
"detail": "external root witness import source unreadable",
|
|
"source_ref": configured_ref,
|
|
"path": "",
|
|
}
|
|
except json.JSONDecodeError:
|
|
return {
|
|
"ok": False,
|
|
"detail": "external root witness import source invalid",
|
|
"source_ref": configured_ref,
|
|
"path": "",
|
|
}
|
|
except OSError:
|
|
return {
|
|
"ok": False,
|
|
"detail": "external root witness import source unreadable",
|
|
"source_ref": configured_ref,
|
|
"path": "",
|
|
}
|
|
if not isinstance(raw, dict):
|
|
return {
|
|
"ok": False,
|
|
"detail": "external root witness import source root must be an object",
|
|
"source_ref": configured_ref,
|
|
"path": "",
|
|
}
|
|
return {
|
|
"ok": True,
|
|
"path": "",
|
|
"source_ref": configured_ref,
|
|
"material": dict(raw or {}),
|
|
}
|
|
|
|
resolved_path = _resolve_external_material_path(configured_ref)
|
|
if resolved_path is None:
|
|
return {"ok": False, "detail": "external root witness import path not configured", "source_ref": ""}
|
|
try:
|
|
raw = json.loads(resolved_path.read_text(encoding="utf-8"))
|
|
except FileNotFoundError:
|
|
return {
|
|
"ok": False,
|
|
"detail": "external root witness import path not found",
|
|
"path": str(resolved_path),
|
|
"source_ref": str(resolved_path),
|
|
}
|
|
except json.JSONDecodeError:
|
|
return {
|
|
"ok": False,
|
|
"detail": "external root witness import file invalid",
|
|
"path": str(resolved_path),
|
|
"source_ref": str(resolved_path),
|
|
}
|
|
except OSError:
|
|
return {
|
|
"ok": False,
|
|
"detail": "external root witness import path unreadable",
|
|
"path": str(resolved_path),
|
|
"source_ref": str(resolved_path),
|
|
}
|
|
if not isinstance(raw, dict):
|
|
return {
|
|
"ok": False,
|
|
"detail": "external root witness import file root must be an object",
|
|
"path": str(resolved_path),
|
|
"source_ref": str(resolved_path),
|
|
}
|
|
return {
|
|
"ok": True,
|
|
"path": str(resolved_path),
|
|
"source_ref": str(resolved_path),
|
|
"material": dict(raw or {}),
|
|
}
|
|
|
|
|
|
def _stage_external_witness_receipts_into_state(
|
|
state: dict[str, Any],
|
|
*,
|
|
manifest: dict[str, Any],
|
|
candidate_receipts: list[dict[str, Any]] | None,
|
|
merge_existing: bool,
|
|
) -> dict[str, Any]:
|
|
current_manifest = dict(manifest or {})
|
|
current_manifest_fingerprint = manifest_fingerprint_for_envelope(current_manifest) if current_manifest else ""
|
|
if not current_manifest_fingerprint:
|
|
return {"ok": False, "detail": "stable root manifest required"}
|
|
local_witnesses = [
|
|
dict(item or {}) for item in list(state.get("published_witnesses") or []) if isinstance(item, dict)
|
|
]
|
|
existing_external = (
|
|
_current_external_witness_receipts(state, manifest_fingerprint=current_manifest_fingerprint) if merge_existing else []
|
|
)
|
|
merged_external: list[dict[str, Any]] = []
|
|
seen: set[tuple[str, str]] = set()
|
|
for receipt in [*existing_external, *list(candidate_receipts or [])]:
|
|
verified = verify_root_manifest_witness(current_manifest, dict(receipt or {}))
|
|
if not verified.get("ok"):
|
|
continue
|
|
if str(verified.get("witness_management_scope", "") or "").strip().lower() != "external":
|
|
continue
|
|
key = (
|
|
str(verified.get("witness_node_id", "") or "").strip(),
|
|
str(verified.get("witness_public_key", "") or "").strip(),
|
|
)
|
|
if not key[0] or not key[1] or key in seen:
|
|
continue
|
|
seen.add(key)
|
|
merged_external.append(dict(receipt or {}))
|
|
state["external_witness_manifest_fingerprint"] = current_manifest_fingerprint
|
|
state["external_witness_receipts"] = merged_external
|
|
_write_root_distribution_state(state)
|
|
witness_verified = verify_root_manifest_witness_set(
|
|
current_manifest,
|
|
[*local_witnesses, *merged_external],
|
|
)
|
|
return {
|
|
"ok": True,
|
|
"manifest_fingerprint": current_manifest_fingerprint,
|
|
"external_witness_count": len(merged_external),
|
|
"witness_count": _safe_int(witness_verified.get("witness_count", 0) or 0, 0),
|
|
"witness_threshold": _safe_int(witness_verified.get("witness_threshold", 0) or 0, 0),
|
|
"witness_domain_count": _safe_int(witness_verified.get("witness_domain_count", 0) or 0, 0),
|
|
"witness_independent_quorum_met": bool(witness_verified.get("witness_independent_quorum_met")),
|
|
"witness_finality_met": bool(witness_verified.get("witness_finality_met")),
|
|
}
|
|
|
|
|
|
def _refresh_external_root_witness_material_from_source(
|
|
state: dict[str, Any],
|
|
*,
|
|
manifest: dict[str, Any] | None = None,
|
|
) -> dict[str, Any]:
|
|
package = _read_external_root_witness_material_package()
|
|
attempted_at = int(time.time())
|
|
if not package.get("ok"):
|
|
_record_external_witness_refresh_status(
|
|
state,
|
|
ok=False,
|
|
detail=str(package.get("detail", "") or "external root witness import unavailable"),
|
|
source_path=str(package.get("source_ref", package.get("path", "")) or "").strip(),
|
|
attempted_at=attempted_at,
|
|
)
|
|
_write_root_distribution_state(state)
|
|
return package
|
|
|
|
material = dict(package.get("material") or {})
|
|
source_scope = str(material.get("source_scope", "external_import") or "external_import").strip().lower()
|
|
source_label = str(material.get("source_label", "") or "").strip()
|
|
source_exported_at = _external_witness_source_exported_at(material)
|
|
descriptors_present = "descriptors" in material
|
|
raw_descriptors = list(material.get("descriptors") or [])
|
|
descriptors, _ = _normalize_external_witness_descriptors(raw_descriptors)
|
|
if descriptors_present and raw_descriptors and not descriptors:
|
|
_record_external_witness_refresh_status(
|
|
state,
|
|
ok=False,
|
|
detail="external root witness descriptors invalid",
|
|
source_path=str(package.get("source_ref", package.get("path", "")) or "").strip(),
|
|
attempted_at=attempted_at,
|
|
)
|
|
_write_root_distribution_state(state)
|
|
return {
|
|
"ok": False,
|
|
"detail": "external root witness descriptors invalid",
|
|
"path": package.get("path", ""),
|
|
"source_ref": package.get("source_ref", ""),
|
|
}
|
|
if source_exported_at <= 0:
|
|
state["external_witness_source_exported_at"] = 0
|
|
_record_external_witness_refresh_status(
|
|
state,
|
|
ok=False,
|
|
detail="external root witness source exported_at required",
|
|
source_path=str(package.get("source_ref", package.get("path", "")) or "").strip(),
|
|
attempted_at=attempted_at,
|
|
)
|
|
_write_root_distribution_state(state)
|
|
return {
|
|
"ok": False,
|
|
"detail": "external root witness source exported_at required",
|
|
"path": package.get("path", ""),
|
|
"source_ref": package.get("source_ref", ""),
|
|
}
|
|
state["external_witness_source_exported_at"] = source_exported_at
|
|
if _external_witness_source_stale(source_exported_at, now=attempted_at):
|
|
_record_external_witness_refresh_status(
|
|
state,
|
|
ok=False,
|
|
detail="external root witness source stale",
|
|
source_path=str(package.get("source_ref", package.get("path", "")) or "").strip(),
|
|
attempted_at=attempted_at,
|
|
)
|
|
_write_root_distribution_state(state)
|
|
return {
|
|
"ok": False,
|
|
"detail": "external root witness source stale",
|
|
"path": package.get("path", ""),
|
|
"source_ref": package.get("source_ref", ""),
|
|
}
|
|
|
|
if descriptors_present:
|
|
previous_descriptors = list(state.get("external_witness_descriptors") or [])
|
|
state["external_witness_descriptors"] = descriptors
|
|
state["external_witness_source_scope"] = source_scope
|
|
state["external_witness_source_label"] = source_label
|
|
state["external_witness_imported_at"] = attempted_at
|
|
if previous_descriptors != descriptors:
|
|
state["external_witness_manifest_fingerprint"] = ""
|
|
state["external_witness_receipts"] = []
|
|
|
|
current_manifest = dict(manifest or {})
|
|
current_manifest_fingerprint = manifest_fingerprint_for_envelope(current_manifest) if current_manifest else ""
|
|
package_witnesses = list(material.get("witnesses") or [])
|
|
package_manifest_fingerprint = str(material.get("manifest_fingerprint", "") or "").strip().lower()
|
|
if current_manifest and package_witnesses:
|
|
if not package_manifest_fingerprint:
|
|
_record_external_witness_refresh_status(
|
|
state,
|
|
ok=False,
|
|
detail="external root witness material manifest_fingerprint required",
|
|
source_path=str(package.get("source_ref", package.get("path", "")) or "").strip(),
|
|
attempted_at=attempted_at,
|
|
)
|
|
_write_root_distribution_state(state)
|
|
return {
|
|
"ok": False,
|
|
"detail": "external root witness material manifest_fingerprint required",
|
|
"source_ref": package.get("source_ref", ""),
|
|
}
|
|
if package_manifest_fingerprint != current_manifest_fingerprint:
|
|
state["external_witness_manifest_fingerprint"] = ""
|
|
state["external_witness_receipts"] = []
|
|
_record_external_witness_refresh_status(
|
|
state,
|
|
ok=False,
|
|
detail="external root witness material manifest_fingerprint mismatch",
|
|
source_path=str(package.get("source_ref", package.get("path", "")) or "").strip(),
|
|
attempted_at=attempted_at,
|
|
)
|
|
_write_root_distribution_state(state)
|
|
return {
|
|
"ok": False,
|
|
"detail": "external root witness material manifest_fingerprint mismatch",
|
|
"source_ref": package.get("source_ref", ""),
|
|
}
|
|
staged = _stage_external_witness_receipts_into_state(
|
|
state,
|
|
manifest=current_manifest,
|
|
candidate_receipts=package_witnesses,
|
|
merge_existing=False,
|
|
)
|
|
_record_external_witness_refresh_status(
|
|
state,
|
|
ok=bool(staged.get("ok")),
|
|
detail=(
|
|
"external root witness receipts refreshed for current manifest"
|
|
if staged.get("ok")
|
|
else str(staged.get("detail", "") or "external root witness refresh failed")
|
|
),
|
|
source_path=str(package.get("source_ref", package.get("path", "")) or "").strip(),
|
|
attempted_at=attempted_at,
|
|
)
|
|
_write_root_distribution_state(state)
|
|
return {
|
|
**staged,
|
|
"path": str(package.get("path", "") or "").strip(),
|
|
"source_ref": str(package.get("source_ref", "") or "").strip(),
|
|
}
|
|
|
|
_record_external_witness_refresh_status(
|
|
state,
|
|
ok=True,
|
|
detail=(
|
|
"external root witness descriptors imported; waiting for current-manifest receipts"
|
|
if descriptors_present
|
|
else "external root witness package loaded"
|
|
),
|
|
source_path=str(package.get("source_ref", package.get("path", "")) or "").strip(),
|
|
attempted_at=attempted_at,
|
|
)
|
|
_write_root_distribution_state(state)
|
|
return {
|
|
"ok": True,
|
|
"detail": str(state.get("external_witness_refresh_detail", "") or "").strip(),
|
|
"path": str(package.get("path", "") or "").strip(),
|
|
"source_ref": str(package.get("source_ref", "") or "").strip(),
|
|
}
|
|
|
|
|
|
def import_external_root_witness_material(material: dict[str, Any] | None) -> dict[str, Any]:
|
|
current = dict(material or {})
|
|
if str(
|
|
current.get("type", STABLE_DM_ROOT_MANIFEST_EXTERNAL_WITNESS_IMPORT_TYPE)
|
|
or STABLE_DM_ROOT_MANIFEST_EXTERNAL_WITNESS_IMPORT_TYPE
|
|
) != STABLE_DM_ROOT_MANIFEST_EXTERNAL_WITNESS_IMPORT_TYPE:
|
|
return {"ok": False, "detail": "external root witness material type invalid"}
|
|
schema_version = _safe_int(current.get("schema_version", 0) or 0, 0)
|
|
if schema_version <= 0:
|
|
return {"ok": False, "detail": "external root witness material schema_version required"}
|
|
|
|
descriptors_present = "descriptors" in current
|
|
raw_descriptors = list(current.get("descriptors") or [])
|
|
descriptors, _ = _normalize_external_witness_descriptors(raw_descriptors)
|
|
if descriptors_present and raw_descriptors and not descriptors:
|
|
return {"ok": False, "detail": "external root witness descriptors invalid"}
|
|
|
|
source_scope = str(current.get("source_scope", "external_import") or "external_import").strip().lower()
|
|
source_label = str(current.get("source_label", "") or "").strip()
|
|
source_exported_at = _external_witness_source_exported_at(current)
|
|
|
|
if descriptors_present:
|
|
configured = configure_external_root_witness_descriptors(descriptors)
|
|
if not configured.get("ok"):
|
|
return configured
|
|
state = read_root_distribution_state()
|
|
state["external_witness_source_scope"] = source_scope
|
|
state["external_witness_source_label"] = source_label
|
|
state["external_witness_imported_at"] = int(time.time())
|
|
if source_exported_at > 0:
|
|
state["external_witness_source_exported_at"] = source_exported_at
|
|
_write_root_distribution_state(state)
|
|
|
|
resolved = get_current_root_manifest()
|
|
if not resolved.get("ok"):
|
|
return {"ok": False, "detail": str(resolved.get("detail", "") or "stable root manifest unavailable")}
|
|
|
|
manifest_fingerprint = str(current.get("manifest_fingerprint", "") or "").strip().lower()
|
|
witnesses = list(current.get("witnesses") or [])
|
|
staged: dict[str, Any] | None = None
|
|
if witnesses:
|
|
if not manifest_fingerprint:
|
|
return {"ok": False, "detail": "external root witness material manifest_fingerprint required"}
|
|
if manifest_fingerprint != str(resolved.get("manifest_fingerprint", "") or "").strip().lower():
|
|
return {"ok": False, "detail": "external root witness material manifest_fingerprint mismatch"}
|
|
staged = stage_external_root_manifest_witnesses(
|
|
witnesses,
|
|
manifest=dict(resolved.get("manifest") or {}),
|
|
)
|
|
if not staged.get("ok"):
|
|
return staged
|
|
state = read_root_distribution_state()
|
|
state["external_witness_source_scope"] = source_scope
|
|
state["external_witness_source_label"] = source_label
|
|
state["external_witness_imported_at"] = int(time.time())
|
|
if source_exported_at > 0:
|
|
state["external_witness_source_exported_at"] = source_exported_at
|
|
_write_root_distribution_state(state)
|
|
|
|
latest = get_current_root_manifest()
|
|
if not latest.get("ok"):
|
|
return {"ok": False, "detail": str(latest.get("detail", "") or "stable root manifest unavailable")}
|
|
return {
|
|
"ok": True,
|
|
"manifest_fingerprint": str(latest.get("manifest_fingerprint", "") or "").strip().lower(),
|
|
"external_witness_descriptors": list(latest.get("external_witness_descriptors") or []),
|
|
"external_witness_count": len(list(latest.get("external_witness_descriptors") or [])),
|
|
"external_witness_source_scope": str(latest.get("external_witness_source_scope", "") or "").strip().lower(),
|
|
"external_witness_source_label": str(latest.get("external_witness_source_label", "") or "").strip(),
|
|
"external_witness_imported_at": _safe_int(latest.get("external_witness_imported_at", 0) or 0, 0),
|
|
"external_witness_source_exported_at": _safe_int(
|
|
latest.get("external_witness_source_exported_at", 0) or 0,
|
|
0,
|
|
),
|
|
"staged_external_witness_count": _safe_int((staged or {}).get("external_witness_count", 0) or 0, 0),
|
|
"witness_count": _safe_int((staged or {}).get("witness_count", latest.get("witness_count", 0)) or 0, 0),
|
|
"witness_threshold": _safe_int((staged or {}).get("witness_threshold", latest.get("witness_threshold", 0)) or 0, 0),
|
|
"witness_independent_quorum_met": bool(
|
|
(staged or {}).get("witness_independent_quorum_met", False)
|
|
),
|
|
"witness_finality_met": bool((staged or {}).get("witness_finality_met", latest.get("witness_finality_met", False))),
|
|
}
|
|
|
|
|
|
def import_external_root_witness_material_from_file(path: str | None = None) -> dict[str, Any]:
|
|
package = _read_external_root_witness_material_package(path)
|
|
if not package.get("ok"):
|
|
detail = str(package.get("detail", "") or "external root witness import path required")
|
|
if detail == "external root witness import path not configured":
|
|
detail = "external root witness import path required"
|
|
if detail == "external root witness import source not configured":
|
|
detail = "external root witness import path required"
|
|
return {"ok": False, "detail": detail}
|
|
result = import_external_root_witness_material(dict(package.get("material") or {}))
|
|
if not result.get("ok"):
|
|
return result
|
|
return {
|
|
**result,
|
|
"source_path": str(package.get("path", "") or "").strip(),
|
|
"source_ref": str(package.get("source_ref", package.get("path", "")) or "").strip(),
|
|
}
|
|
|
|
|
|
def _witness_receipt_match_key(receipt: dict[str, Any]) -> tuple[str, str, str]:
|
|
envelope = dict(receipt or {})
|
|
return (
|
|
str(envelope.get("node_id", "") or "").strip(),
|
|
str(envelope.get("public_key", "") or "").strip(),
|
|
str(envelope.get("signature", "") or "").strip(),
|
|
)
|
|
|
|
|
|
def verify_root_manifest_witnesses_against_external_source(
|
|
manifest: dict[str, Any],
|
|
witnesses: list[dict[str, Any]] | None,
|
|
*,
|
|
source_ref: str | None = None,
|
|
) -> dict[str, Any]:
|
|
configured_ref = _configured_external_root_witness_source_ref(source_ref)
|
|
if not configured_ref:
|
|
return {
|
|
"ok": True,
|
|
"configured": False,
|
|
"detail": "external root witness source not configured",
|
|
"source_ref": "",
|
|
}
|
|
|
|
package = _read_external_root_witness_material_package(configured_ref)
|
|
if not package.get("ok"):
|
|
return {
|
|
"ok": False,
|
|
"configured": True,
|
|
"detail": str(package.get("detail", "") or "external root witness source unreadable"),
|
|
"source_ref": str(package.get("source_ref", configured_ref) or configured_ref).strip(),
|
|
}
|
|
|
|
material = dict(package.get("material") or {})
|
|
if str(
|
|
material.get("type", STABLE_DM_ROOT_MANIFEST_EXTERNAL_WITNESS_IMPORT_TYPE)
|
|
or STABLE_DM_ROOT_MANIFEST_EXTERNAL_WITNESS_IMPORT_TYPE
|
|
) != STABLE_DM_ROOT_MANIFEST_EXTERNAL_WITNESS_IMPORT_TYPE:
|
|
return {
|
|
"ok": False,
|
|
"configured": True,
|
|
"detail": "external root witness source type invalid",
|
|
"source_ref": str(package.get("source_ref", configured_ref) or configured_ref).strip(),
|
|
}
|
|
if _safe_int(material.get("schema_version", 0) or 0, 0) <= 0:
|
|
return {
|
|
"ok": False,
|
|
"configured": True,
|
|
"detail": "external root witness source schema_version required",
|
|
"source_ref": str(package.get("source_ref", configured_ref) or configured_ref).strip(),
|
|
}
|
|
source_exported_at = _external_witness_source_exported_at(material)
|
|
if source_exported_at <= 0:
|
|
return {
|
|
"ok": False,
|
|
"configured": True,
|
|
"detail": "external root witness source exported_at required",
|
|
"source_ref": str(package.get("source_ref", configured_ref) or configured_ref).strip(),
|
|
}
|
|
if _external_witness_source_stale(source_exported_at):
|
|
return {
|
|
"ok": False,
|
|
"configured": True,
|
|
"detail": "external root witness source stale",
|
|
"source_ref": str(package.get("source_ref", configured_ref) or configured_ref).strip(),
|
|
"source_exported_at": source_exported_at,
|
|
}
|
|
|
|
manifest_fingerprint = manifest_fingerprint_for_envelope(dict(manifest or {}))
|
|
source_manifest_fingerprint = str(material.get("manifest_fingerprint", "") or "").strip().lower()
|
|
if not manifest_fingerprint or not source_manifest_fingerprint:
|
|
return {
|
|
"ok": False,
|
|
"configured": True,
|
|
"detail": "external root witness source manifest_fingerprint required",
|
|
"source_ref": str(package.get("source_ref", configured_ref) or configured_ref).strip(),
|
|
}
|
|
if source_manifest_fingerprint != manifest_fingerprint:
|
|
return {
|
|
"ok": False,
|
|
"configured": True,
|
|
"detail": "external root witness source manifest_fingerprint mismatch",
|
|
"source_ref": str(package.get("source_ref", configured_ref) or configured_ref).strip(),
|
|
}
|
|
|
|
raw_descriptors = list(material.get("descriptors") or [])
|
|
descriptors, _ = _normalize_external_witness_descriptors(raw_descriptors)
|
|
if raw_descriptors and not descriptors:
|
|
return {
|
|
"ok": False,
|
|
"configured": True,
|
|
"detail": "external root witness source descriptors invalid",
|
|
"source_ref": str(package.get("source_ref", configured_ref) or configured_ref).strip(),
|
|
}
|
|
descriptor_keys = {
|
|
(
|
|
str(item.get("node_id", "") or "").strip(),
|
|
str(item.get("public_key", "") or "").strip(),
|
|
)
|
|
for item in descriptors
|
|
}
|
|
|
|
source_receipts = [dict(item or {}) for item in list(material.get("witnesses") or []) if isinstance(item, dict)]
|
|
if not source_receipts:
|
|
return {
|
|
"ok": False,
|
|
"configured": True,
|
|
"detail": "external root witness source receipts required",
|
|
"source_ref": str(package.get("source_ref", configured_ref) or configured_ref).strip(),
|
|
}
|
|
|
|
provided_keys = {
|
|
_witness_receipt_match_key(dict(item or {}))
|
|
for item in list(witnesses or [])
|
|
if isinstance(item, dict)
|
|
}
|
|
matched_receipts: list[dict[str, Any]] = []
|
|
for receipt in source_receipts:
|
|
verified = verify_root_manifest_witness(manifest, receipt)
|
|
if not verified.get("ok"):
|
|
return {
|
|
"ok": False,
|
|
"configured": True,
|
|
"detail": "external root witness source receipt invalid",
|
|
"source_ref": str(package.get("source_ref", configured_ref) or configured_ref).strip(),
|
|
}
|
|
if str(verified.get("witness_management_scope", "") or "").strip().lower() != "external":
|
|
return {
|
|
"ok": False,
|
|
"configured": True,
|
|
"detail": "external root witness source receipt must be externally managed",
|
|
"source_ref": str(package.get("source_ref", configured_ref) or configured_ref).strip(),
|
|
}
|
|
signer_key = (
|
|
str(verified.get("witness_node_id", "") or "").strip(),
|
|
str(verified.get("witness_public_key", "") or "").strip(),
|
|
)
|
|
if descriptor_keys and signer_key not in descriptor_keys:
|
|
return {
|
|
"ok": False,
|
|
"configured": True,
|
|
"detail": "external root witness source receipt signer not declared",
|
|
"source_ref": str(package.get("source_ref", configured_ref) or configured_ref).strip(),
|
|
}
|
|
if _witness_receipt_match_key(receipt) not in provided_keys:
|
|
return {
|
|
"ok": False,
|
|
"configured": True,
|
|
"detail": "external root witness source receipt set mismatch",
|
|
"source_ref": str(package.get("source_ref", configured_ref) or configured_ref).strip(),
|
|
}
|
|
matched_receipts.append(receipt)
|
|
|
|
return {
|
|
"ok": True,
|
|
"configured": True,
|
|
"source_ref": str(package.get("source_ref", configured_ref) or configured_ref).strip(),
|
|
"source_exported_at": source_exported_at,
|
|
"external_witness_count": len(matched_receipts),
|
|
"external_witness_descriptor_count": len(descriptors),
|
|
}
|
|
|
|
|
|
def stage_external_root_manifest_witnesses(
|
|
witnesses: list[dict[str, Any]] | None,
|
|
*,
|
|
manifest: dict[str, Any] | None = None,
|
|
) -> dict[str, Any]:
|
|
current = get_current_root_manifest()
|
|
if not current.get("ok"):
|
|
return {"ok": False, "detail": str(current.get("detail", "") or "stable root manifest unavailable")}
|
|
current_manifest = dict(manifest or current.get("manifest") or {})
|
|
current_manifest_fingerprint = manifest_fingerprint_for_envelope(current_manifest) if current_manifest else ""
|
|
if not current_manifest_fingerprint:
|
|
return {"ok": False, "detail": "stable root manifest required"}
|
|
if current_manifest_fingerprint != str(current.get("manifest_fingerprint", "") or "").strip().lower():
|
|
return {"ok": False, "detail": "external witness receipts must target the current published manifest"}
|
|
|
|
state = read_root_distribution_state()
|
|
return _stage_external_witness_receipts_into_state(
|
|
state,
|
|
manifest=current_manifest,
|
|
candidate_receipts=list(witnesses or []),
|
|
merge_existing=True,
|
|
)
|
|
|
|
|
|
def verify_root_manifest(manifest: dict[str, Any]) -> dict[str, Any]:
|
|
envelope = dict(manifest or {})
|
|
if str(envelope.get("type", STABLE_DM_ROOT_MANIFEST_TYPE) or STABLE_DM_ROOT_MANIFEST_TYPE) != STABLE_DM_ROOT_MANIFEST_TYPE:
|
|
return {"ok": False, "detail": "stable root manifest type invalid"}
|
|
if str(envelope.get("event_type", "") or "").strip() != STABLE_DM_ROOT_MANIFEST_EVENT_TYPE:
|
|
return {"ok": False, "detail": "stable root manifest event_type invalid"}
|
|
node_id = str(envelope.get("node_id", "") or "").strip()
|
|
public_key = str(envelope.get("public_key", "") or "").strip()
|
|
public_key_algo = str(envelope.get("public_key_algo", "Ed25519") or "Ed25519")
|
|
protocol_version = str(envelope.get("protocol_version", PROTOCOL_VERSION) or PROTOCOL_VERSION)
|
|
sequence = _safe_int(envelope.get("sequence", 0) or 0, 0)
|
|
signature = str(envelope.get("signature", "") or "").strip()
|
|
payload = dict(envelope.get("payload") or {})
|
|
if not node_id or not public_key or sequence <= 0 or not signature:
|
|
return {"ok": False, "detail": "stable root manifest incomplete"}
|
|
if protocol_version != str(payload.get("protocol_version", PROTOCOL_VERSION) or PROTOCOL_VERSION):
|
|
return {"ok": False, "detail": "stable root manifest protocol mismatch"}
|
|
if node_id != str(payload.get("root_node_id", "") or "").strip():
|
|
return {"ok": False, "detail": "stable root manifest signer mismatch"}
|
|
if public_key != str(payload.get("root_public_key", "") or "").strip():
|
|
return {"ok": False, "detail": "stable root manifest signer mismatch"}
|
|
if public_key_algo != str(payload.get("root_public_key_algo", "Ed25519") or "Ed25519"):
|
|
return {"ok": False, "detail": "stable root manifest signer mismatch"}
|
|
generation = _safe_int(payload.get("generation", 0) or 0, 0)
|
|
if generation <= 0:
|
|
return {"ok": False, "detail": "stable root manifest generation required"}
|
|
if _safe_int(payload.get("issued_at", 0) or 0, 0) <= 0:
|
|
return {"ok": False, "detail": "stable root manifest issued_at required"}
|
|
if _safe_int(payload.get("expires_at", 0) or 0, 0) <= _safe_int(payload.get("issued_at", 0) or 0, 0):
|
|
return {"ok": False, "detail": "stable root manifest expires_at invalid"}
|
|
if not verify_node_binding(node_id, public_key):
|
|
return {"ok": False, "detail": "stable root manifest node binding invalid"}
|
|
signed_payload = build_signature_payload(
|
|
event_type=STABLE_DM_ROOT_MANIFEST_EVENT_TYPE,
|
|
node_id=node_id,
|
|
sequence=sequence,
|
|
payload=payload,
|
|
)
|
|
if not verify_signature(
|
|
public_key_b64=public_key,
|
|
public_key_algo=public_key_algo,
|
|
signature_hex=signature,
|
|
payload=signed_payload,
|
|
):
|
|
return {"ok": False, "detail": "stable root manifest invalid"}
|
|
witness_policy_verified = _verify_witness_policy(dict(payload.get("witness_policy") or {}))
|
|
if not witness_policy_verified.get("ok"):
|
|
return {
|
|
"ok": False,
|
|
"detail": str(witness_policy_verified.get("detail", "") or "stable root manifest witness policy invalid"),
|
|
}
|
|
if _safe_int(payload.get("policy_version", 1) or 1, 1) != _safe_int(
|
|
witness_policy_verified.get("policy", {}).get("policy_version", 1) or 1,
|
|
1,
|
|
):
|
|
return {"ok": False, "detail": "stable root manifest witness policy version mismatch"}
|
|
root_fingerprint = root_identity_fingerprint_for_material(
|
|
root_node_id=node_id,
|
|
root_public_key=public_key,
|
|
root_public_key_algo=public_key_algo,
|
|
protocol_version=protocol_version,
|
|
)
|
|
payload_root_fingerprint = str(payload.get("root_fingerprint", "") or "").strip().lower()
|
|
if payload_root_fingerprint and payload_root_fingerprint != root_fingerprint:
|
|
return {"ok": False, "detail": "stable root manifest fingerprint mismatch"}
|
|
previous_root_fingerprint = str(payload.get("previous_root_fingerprint", "") or "").strip().lower()
|
|
previous_root_node_id = str(payload.get("previous_root_node_id", "") or "").strip()
|
|
previous_root_public_key = str(payload.get("previous_root_public_key", "") or "").strip()
|
|
previous_root_public_key_algo = str(payload.get("previous_root_public_key_algo", "Ed25519") or "Ed25519").strip()
|
|
previous_root_protocol_version = str(
|
|
payload.get("previous_root_protocol_version", protocol_version) or protocol_version
|
|
).strip()
|
|
previous_root_cross_sequence = _safe_int(payload.get("previous_root_cross_sequence", 0) or 0, 0)
|
|
previous_root_cross_signature = str(payload.get("previous_root_cross_signature", "") or "").strip()
|
|
current_witness_policy_fingerprint = str(
|
|
witness_policy_verified.get("policy_fingerprint", "") or ""
|
|
).strip().lower()
|
|
previous_witness_policy_fingerprint = str(
|
|
payload.get("previous_witness_policy_fingerprint", "") or ""
|
|
).strip().lower()
|
|
previous_witness_policy_sequence = _safe_int(payload.get("previous_witness_policy_sequence", 0) or 0, 0)
|
|
previous_witness_policy_signature = str(
|
|
payload.get("previous_witness_policy_signature", "") or ""
|
|
).strip()
|
|
rotation_proven = generation <= 1
|
|
policy_change_proven = not previous_witness_policy_fingerprint
|
|
if generation > 1:
|
|
if not previous_root_fingerprint:
|
|
return {"ok": False, "detail": "stable root manifest previous root required"}
|
|
previous_root_fields_present = bool(previous_root_node_id or previous_root_public_key)
|
|
proof_signature_present = bool(previous_root_cross_sequence > 0 or previous_root_cross_signature)
|
|
if previous_root_fields_present:
|
|
if not previous_root_node_id or not previous_root_public_key:
|
|
return {"ok": False, "detail": "stable root manifest previous root proof incomplete"}
|
|
if not verify_node_binding(previous_root_node_id, previous_root_public_key):
|
|
return {"ok": False, "detail": "stable root manifest previous root binding invalid"}
|
|
derived_previous_root_fingerprint = root_identity_fingerprint_for_material(
|
|
root_node_id=previous_root_node_id,
|
|
root_public_key=previous_root_public_key,
|
|
root_public_key_algo=previous_root_public_key_algo,
|
|
protocol_version=previous_root_protocol_version,
|
|
)
|
|
if derived_previous_root_fingerprint != previous_root_fingerprint:
|
|
return {"ok": False, "detail": "stable root manifest previous root fingerprint mismatch"}
|
|
if proof_signature_present:
|
|
if not previous_root_node_id or not previous_root_public_key or previous_root_cross_sequence <= 0 or not previous_root_cross_signature:
|
|
return {"ok": False, "detail": "stable root manifest previous root proof incomplete"}
|
|
previous_signed_payload = build_signature_payload(
|
|
event_type=STABLE_DM_ROOT_MANIFEST_PREVIOUS_ROOT_EVENT_TYPE,
|
|
node_id=previous_root_node_id,
|
|
sequence=previous_root_cross_sequence,
|
|
payload=_previous_root_cross_payload(payload),
|
|
)
|
|
if not verify_signature(
|
|
public_key_b64=previous_root_public_key,
|
|
public_key_algo=previous_root_public_key_algo,
|
|
signature_hex=previous_root_cross_signature,
|
|
payload=previous_signed_payload,
|
|
):
|
|
return {"ok": False, "detail": "stable root manifest previous root proof invalid"}
|
|
rotation_proven = True
|
|
if previous_witness_policy_fingerprint:
|
|
if previous_witness_policy_fingerprint == current_witness_policy_fingerprint:
|
|
return {"ok": False, "detail": "stable root manifest previous witness policy fingerprint invalid"}
|
|
proof_signature_present = bool(
|
|
previous_witness_policy_sequence > 0 or previous_witness_policy_signature
|
|
)
|
|
if proof_signature_present:
|
|
if previous_witness_policy_sequence <= 0 or not previous_witness_policy_signature:
|
|
return {"ok": False, "detail": "stable root manifest witness policy change proof incomplete"}
|
|
previous_policy_signed_payload = build_signature_payload(
|
|
event_type=STABLE_DM_ROOT_MANIFEST_POLICY_CHANGE_EVENT_TYPE,
|
|
node_id=node_id,
|
|
sequence=previous_witness_policy_sequence,
|
|
payload=_previous_witness_policy_change_payload(payload),
|
|
)
|
|
if not verify_signature(
|
|
public_key_b64=public_key,
|
|
public_key_algo=public_key_algo,
|
|
signature_hex=previous_witness_policy_signature,
|
|
payload=previous_policy_signed_payload,
|
|
):
|
|
return {"ok": False, "detail": "stable root manifest witness policy change proof invalid"}
|
|
policy_change_proven = True
|
|
elif previous_witness_policy_sequence > 0 or previous_witness_policy_signature:
|
|
return {"ok": False, "detail": "stable root manifest witness policy change proof invalid"}
|
|
return {
|
|
"ok": True,
|
|
"manifest_fingerprint": manifest_fingerprint_for_envelope(envelope),
|
|
"root_fingerprint": root_fingerprint,
|
|
"root_node_id": node_id,
|
|
"root_public_key": public_key,
|
|
"root_public_key_algo": public_key_algo,
|
|
"generation": generation,
|
|
"issued_at": _safe_int(payload.get("issued_at", 0) or 0, 0),
|
|
"expires_at": _safe_int(payload.get("expires_at", 0) or 0, 0),
|
|
"policy_version": _safe_int(payload.get("policy_version", 1) or 1, 1),
|
|
"witness_policy": dict(witness_policy_verified.get("policy") or {}),
|
|
"witness_policy_fingerprint": str(witness_policy_verified.get("policy_fingerprint", "") or "").strip().lower(),
|
|
"witness_threshold": _safe_int(witness_policy_verified.get("threshold", 0) or 0, 0),
|
|
"witness_policy_count": _safe_int(witness_policy_verified.get("witness_count", 0) or 0, 0),
|
|
"rotation_proven": rotation_proven,
|
|
"policy_change_proven": policy_change_proven,
|
|
"previous_root_fingerprint": previous_root_fingerprint,
|
|
"previous_root_node_id": previous_root_node_id,
|
|
"previous_root_public_key": previous_root_public_key,
|
|
"previous_root_public_key_algo": previous_root_public_key_algo,
|
|
"previous_root_protocol_version": previous_root_protocol_version,
|
|
"previous_witness_policy_fingerprint": previous_witness_policy_fingerprint,
|
|
}
|
|
|
|
|
|
def verify_root_manifest_witness(manifest: dict[str, Any], witness: dict[str, Any]) -> dict[str, Any]:
|
|
manifest_verified = verify_root_manifest(manifest)
|
|
if not manifest_verified.get("ok"):
|
|
return {"ok": False, "detail": str(manifest_verified.get("detail", "") or "stable root manifest invalid")}
|
|
envelope = dict(witness or {})
|
|
if str(envelope.get("type", STABLE_DM_ROOT_MANIFEST_WITNESS_TYPE) or STABLE_DM_ROOT_MANIFEST_WITNESS_TYPE) != STABLE_DM_ROOT_MANIFEST_WITNESS_TYPE:
|
|
return {"ok": False, "detail": "stable root manifest witness type invalid"}
|
|
if str(envelope.get("event_type", "") or "").strip() != STABLE_DM_ROOT_MANIFEST_WITNESS_EVENT_TYPE:
|
|
return {"ok": False, "detail": "stable root manifest witness event_type invalid"}
|
|
node_id = str(envelope.get("node_id", "") or "").strip()
|
|
public_key = str(envelope.get("public_key", "") or "").strip()
|
|
public_key_algo = str(envelope.get("public_key_algo", "Ed25519") or "Ed25519")
|
|
sequence = _safe_int(envelope.get("sequence", 0) or 0, 0)
|
|
signature = str(envelope.get("signature", "") or "").strip()
|
|
payload = dict(envelope.get("payload") or {})
|
|
expected_payload = _witness_payload(manifest)
|
|
if not node_id or not public_key or sequence <= 0 or not signature:
|
|
return {"ok": False, "detail": "stable root manifest witness incomplete"}
|
|
if payload != expected_payload:
|
|
return {"ok": False, "detail": "stable root manifest witness payload mismatch"}
|
|
allowed_witnesses = {
|
|
(
|
|
str(item.get("node_id", "") or "").strip(),
|
|
str(item.get("public_key", "") or "").strip(),
|
|
): dict(item or {})
|
|
for item in list(manifest_verified.get("witness_policy", {}).get("witnesses") or [])
|
|
if isinstance(item, dict)
|
|
}
|
|
matched_witness = allowed_witnesses.get((node_id, public_key))
|
|
if not matched_witness:
|
|
return {"ok": False, "detail": "stable root manifest witness not allowed by policy"}
|
|
if not verify_node_binding(node_id, public_key):
|
|
return {"ok": False, "detail": "stable root manifest witness node binding invalid"}
|
|
signed_payload = build_signature_payload(
|
|
event_type=STABLE_DM_ROOT_MANIFEST_WITNESS_EVENT_TYPE,
|
|
node_id=node_id,
|
|
sequence=sequence,
|
|
payload=expected_payload,
|
|
)
|
|
if not verify_signature(
|
|
public_key_b64=public_key,
|
|
public_key_algo=public_key_algo,
|
|
signature_hex=signature,
|
|
payload=signed_payload,
|
|
):
|
|
return {"ok": False, "detail": "stable root manifest witness invalid"}
|
|
return {
|
|
"ok": True,
|
|
"manifest_fingerprint": str(expected_payload.get("manifest_fingerprint", "") or "").strip().lower(),
|
|
"root_fingerprint": str(expected_payload.get("root_fingerprint", "") or "").strip().lower(),
|
|
"witness_node_id": node_id,
|
|
"witness_public_key": public_key,
|
|
"witness_public_key_algo": public_key_algo,
|
|
"generation": _safe_int(expected_payload.get("generation", 0) or 0, 0),
|
|
"issued_at": _safe_int(expected_payload.get("issued_at", 0) or 0, 0),
|
|
"expires_at": _safe_int(expected_payload.get("expires_at", 0) or 0, 0),
|
|
"policy_version": _safe_int(expected_payload.get("policy_version", 1) or 1, 1),
|
|
"witness_policy_fingerprint": str(expected_payload.get("witness_policy_fingerprint", "") or "").strip().lower(),
|
|
"witness_threshold": _safe_int(expected_payload.get("witness_threshold", 0) or 0, 0),
|
|
"witness_management_scope": _normalize_witness_management_scope(matched_witness.get("management_scope")),
|
|
"witness_independence_group": _normalize_witness_independence_group(
|
|
matched_witness.get("independence_group"),
|
|
management_scope=_normalize_witness_management_scope(matched_witness.get("management_scope")),
|
|
),
|
|
"rotation_proven": bool(manifest_verified.get("rotation_proven")),
|
|
"policy_change_proven": bool(manifest_verified.get("policy_change_proven")),
|
|
"previous_root_fingerprint": str(manifest_verified.get("previous_root_fingerprint", "") or "").strip().lower(),
|
|
"previous_witness_policy_fingerprint": str(
|
|
manifest_verified.get("previous_witness_policy_fingerprint", "") or ""
|
|
).strip().lower(),
|
|
}
|
|
|
|
|
|
def verify_root_manifest_witness_set(manifest: dict[str, Any], witnesses: list[dict[str, Any]] | None) -> dict[str, Any]:
|
|
manifest_verified = verify_root_manifest(manifest)
|
|
if not manifest_verified.get("ok"):
|
|
return {"ok": False, "detail": str(manifest_verified.get("detail", "") or "stable root manifest invalid")}
|
|
validated: list[dict[str, Any]] = []
|
|
seen: set[tuple[str, str]] = set()
|
|
independence_groups: set[str] = set()
|
|
for witness in list(witnesses or []):
|
|
verified = verify_root_manifest_witness(manifest, dict(witness or {}))
|
|
if not verified.get("ok"):
|
|
continue
|
|
witness_key = (
|
|
str(verified.get("witness_node_id", "") or "").strip(),
|
|
str(verified.get("witness_public_key", "") or "").strip(),
|
|
)
|
|
if witness_key in seen:
|
|
continue
|
|
seen.add(witness_key)
|
|
validated.append(verified)
|
|
group = str(verified.get("witness_independence_group", "") or "").strip().lower()
|
|
if group:
|
|
independence_groups.add(group)
|
|
threshold = _safe_int(manifest_verified.get("witness_threshold", 0) or 0, 0)
|
|
if not validated:
|
|
return {
|
|
"ok": False,
|
|
"detail": "stable root manifest witness receipts required",
|
|
"witness_threshold": threshold,
|
|
"witness_count": 0,
|
|
}
|
|
if threshold <= 0 or len(validated) < threshold:
|
|
return {
|
|
"ok": False,
|
|
"detail": "stable root manifest witness threshold not met",
|
|
"witness_threshold": threshold,
|
|
"witness_count": len(validated),
|
|
}
|
|
witness_independent_quorum_met = threshold > 0 and len(independence_groups) >= threshold
|
|
return {
|
|
"ok": True,
|
|
"manifest_fingerprint": str(manifest_verified.get("manifest_fingerprint", "") or "").strip().lower(),
|
|
"root_fingerprint": str(manifest_verified.get("root_fingerprint", "") or "").strip().lower(),
|
|
"witness_policy_fingerprint": str(manifest_verified.get("witness_policy_fingerprint", "") or "").strip().lower(),
|
|
"witness_threshold": threshold,
|
|
"witness_count": len(validated),
|
|
"witness_domain_count": len(independence_groups),
|
|
"witness_independent_quorum_met": witness_independent_quorum_met,
|
|
"witness_finality_met": root_witness_finality_met(
|
|
witness_threshold=threshold,
|
|
witness_quorum_met=True,
|
|
witness_independent_quorum_met=witness_independent_quorum_met,
|
|
),
|
|
"rotation_proven": bool(manifest_verified.get("rotation_proven")),
|
|
"policy_change_proven": bool(manifest_verified.get("policy_change_proven")),
|
|
"validated_witnesses": validated,
|
|
}
|