Add offline signed-update verification and checkpoint codec

desktop/scripts/verify-release-assets.ts

@@ -11,9 +11,10 @@
  * version and commit before it uploads anything, so publication can only ever
  * consume the verified bundle.
  */
-import { createHash, createPublicKey, verify as ed25519Verify, type KeyObject } from "node:crypto";
+import { createHash, type KeyObject } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
+import { decodePublicKey, verifyLegacyMinisignBytes } from "../../src/update/minisign.mjs";
 import {
   standaloneArchiveName,
   standaloneTargets as sharedStandaloneTargets,
@@ -122,8 +123,6 @@ export function verifyChecksums(dir: string): number {
   return checksumFiles.length;
 }
 
-const ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
-
 export interface MinisignPublicKey {
   keyId: string;
   publicKey: KeyObject;
@@ -146,31 +145,10 @@ function decodeBox(text: string, what: string): string {
   return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(payload);
 }
 
-function boxLines(text: string): string[] {
-  // Accept minisign text with LF or CRLF and an optional terminal newline;
-  // signatures authenticate decoded bytes/comments, not transport line endings.
-  return text.replace(/\r\n/g, "\n").replace(/\n$/, "").split("\n");
-}
-
 /** minisign public key: base64 of algorithm ("Ed") || key id (8) || raw key (32). */
 export function parseMinisignPublicKey(text: string): MinisignPublicKey {
-  const lines = boxLines(text);
-  if (lines.length !== 2 || !lines[0]!.startsWith("untrusted comment: ")) {
-    throw new Error("Malformed minisign public key box");
-  }
-  const payload = decodeBase64(lines[1]!, "minisign public key", 42);
-  const algorithm = payload.subarray(0, 2).toString("utf8");
-  if (algorithm !== "Ed") {
-    throw new Error(`Unsupported minisign public key algorithm: ${JSON.stringify(algorithm)}`);
-  }
-  return {
-    keyId: payload.subarray(2, 10).toString("hex"),
-    publicKey: createPublicKey({
-      key: Buffer.concat([ED25519_SPKI_PREFIX, payload.subarray(10, 42)]),
-      format: "der",
-      type: "spki",
-    }),
-  };
+  const { keyId, publicKey } = decodePublicKey(text);
+  return { keyId, publicKey };
 }
 
 /** The updater public key pinned in the Tauri configuration. */
@@ -187,34 +165,10 @@ export function loadUpdaterPublicKey(tauriConfPath: string): MinisignPublicKey {
 export function verifyUpdaterSignature(filePath: string, key: MinisignPublicKey): void {
   const signaturePath = `${filePath}.sig`;
   if (!existsSync(signaturePath)) throw new Error(`Missing signature: ${signaturePath}`);
-  const lines = boxLines(decodeBox(readFileSync(signaturePath, "utf8"), "Tauri signature"));
-  const trustedPrefix = "trusted comment: ";
-  if (lines.length !== 4 || !lines[0]!.startsWith("untrusted comment: ")
-    || !lines[2]!.startsWith(trustedPrefix)) {
-    throw new Error(`Malformed signature box in ${signaturePath}`);
-  }
-  const payload = decodeBase64(lines[1]!, "signature packet", 74);
-  const globalSignature = decodeBase64(lines[3]!, "comment signature", 64);
-  const algorithm = payload.subarray(0, 2).toString("utf8");
-  if (algorithm !== "ED") {
-    throw new Error(`Unsupported signature algorithm in ${signaturePath}: ${JSON.stringify(algorithm)}`);
-  }
-  const keyId = payload.subarray(2, 10).toString("hex");
-  if (keyId !== key.keyId) {
-    throw new Error(`Signature ${signaturePath} was made by key ${keyId}, not the pinned updater key ${key.keyId}`);
-  }
-  const signature = payload.subarray(10, 74);
-  // ED is ordinary Ed25519 over the BLAKE2b-512 digest, not Ed25519ph.
-  const digest = createHash("blake2b512").update(readFileSync(filePath)).digest();
-  if (!ed25519Verify(null, digest, key.publicKey, signature)) {
-    throw new Error(`Signature verification failed for ${filePath}`);
-  }
-  // minisign signs the raw signature + trimmed trusted comment, without its
-  // prefix or line terminator. The original filename may differ after collection.
-  const trustedComment = lines[2]!.slice(trustedPrefix.length).trim();
-  const message = Buffer.concat([signature, Buffer.from(trustedComment, "utf8")]);
-  if (!ed25519Verify(null, message, key.publicKey, globalSignature)) {
-    throw new Error(`Comment signature verification failed for ${filePath}`);
+  try {
+    verifyLegacyMinisignBytes(readFileSync(filePath), readFileSync(signaturePath, "utf8"), key);
+  } catch (error) {
+    throw new Error(`${error instanceof Error ? error.message : String(error)}: ${filePath}`);
   }
 }
 

desktop/src-tauri/update-trust-root.json

@@ -0,0 +1,38 @@
+{
+  "schema": "ocx.update.root/1",
+  "revision": 1,
+  "expiresAt": "2028-11-07T00:00:00Z",
+  "rootKeys": [
+    {
+      "keyId": "eae4c0180e8ca39a844b3c0e1ec28842261e85628d6dee77ceff5dd081853799",
+      "algorithm": "minisign-ed25519-blake2b512/1",
+      "publicKey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IEFDNzZCMDg0NkVCRUJGODEKUldTQnY3NXVoTEIyckhRUXJMOXJRUDR0aHQ2L3pLVHVweXFSc1lzS24vWDNiSUJ5MXJIZmpyb2sK"
+    }
+  ],
+  "rootThreshold": 1,
+  "releaseKeys": [
+    {
+      "keyId": "eae4c0180e8ca39a844b3c0e1ec28842261e85628d6dee77ceff5dd081853799",
+      "algorithm": "minisign-ed25519-blake2b512/1",
+      "publicKey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IEFDNzZCMDg0NkVCRUJGODEKUldTQnY3NXVoTEIyckhRUXJMOXJRUDR0aHQ2L3pLVHVweXFSc1lzS24vWDNiSUJ5MXJIZmpyb2sK",
+      "channels": [
+        "latest",
+        "preview",
+        "nightly"
+      ],
+      "roles": [
+        "release",
+        "tree",
+        "desktop-artifact",
+        "standalone-artifact",
+        "guardian-artifact"
+      ]
+    }
+  ],
+  "releaseThreshold": 1,
+  "channels": [
+    "latest",
+    "preview",
+    "nightly"
+  ]
+}

scripts/generate-update-trust-root.ts

@@ -0,0 +1,62 @@
+/** Generate the offline update root from the already-pinned Tauri public key. */
+import { readFileSync, renameSync, writeFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { decodePublicKey } from "../src/update/minisign.mjs";
+
+const repo = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const configPath = resolve(repo, "desktop/src-tauri/tauri.conf.json");
+const rootOutputs = [
+  resolve(repo, "src/update/trust-root.json"),
+  resolve(repo, "desktop/src-tauri/update-trust-root.json"),
+];
+const channels = ["latest", "preview", "nightly"];
+const roles = ["release", "tree", "desktop-artifact", "standalone-artifact", "guardian-artifact"];
+
+export function generateUpdateTrustRoot(config: unknown): string {
+  const box = (config as { plugins?: { updater?: { pubkey?: unknown } } })?.plugins?.updater?.pubkey;
+  if (typeof box !== "string" || !box || box.length > 4096) throw new Error("Invalid pinned updater public key");
+  const encoded = Buffer.from(box, "base64");
+  if (encoded.toString("base64") !== box) throw new Error("Updater public key must be canonical base64");
+  const text = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(encoded);
+  const key = decodePublicKey(text);
+  const entry = { keyId: key.fingerprint, algorithm: "minisign-ed25519-blake2b512/1", publicKey: box };
+  return `${JSON.stringify({
+    schema: "ocx.update.root/1",
+    revision: 1,
+    expiresAt: "2028-11-07T00:00:00Z",
+    rootKeys: [entry],
+    rootThreshold: 1,
+    releaseKeys: [{ ...entry, channels, roles }],
+    releaseThreshold: 1,
+    channels,
+  }, null, 2)}\n`;
+}
+
+function main(): void {
+  const expected = generateUpdateTrustRoot(JSON.parse(readFileSync(configPath, "utf8")));
+  const fingerprint = createHash("sha256").update(expected, "utf8").digest("hex");
+  const outputs = [
+    ...rootOutputs.map((path) => ({ path, contents: expected })),
+    { path: resolve(repo, "src/update/update-trust-anchor.mjs"), contents: `// Generated by scripts/generate-update-trust-root.ts.\nexport const EMBEDDED_ROOT_SHA256 = "${fingerprint}";\n` },
+  ];
+  if (process.argv.slice(2).some((arg) => arg !== "--check") || process.argv.slice(2).length > 1) {
+    throw new Error("Usage: generate-update-trust-root.ts [--check]");
+  }
+  if (process.argv[2] === "--check") {
+    for (const output of outputs) {
+      if (readFileSync(output.path, "utf8") !== output.contents) throw new Error("Generated update trust root is out of date");
+    }
+    process.stdout.write("Generated update trust roots match the pinned public key\n");
+    return;
+  }
+  for (const output of outputs) {
+    const temporary = `${output.path}.${process.pid}.tmp`;
+    writeFileSync(temporary, output.contents, { flag: "wx" });
+    renameSync(temporary, output.path);
+  }
+  process.stdout.write("Generated update trust roots\n");
+}
+
+if (import.meta.main) main();

scripts/test-layout/layout.json

@@ -1837,7 +1837,7 @@
     "umans-provider.test.ts": "providers",
     "uninstall.test.ts": "cli",
     "update-async-routes.test.ts": "server",
-    "update-badge.test.ts": "update", "update-bun-ownership-lease.test.ts": "update",
+    "update-badge.test.ts": "update", "update-bounded-json.test.ts": "update", "update-checkpoint-codec.test.ts": "update", "update-contracts.test.ts": "update", "update-candidate-id.test.ts": "update", "update-external-metadata.test.ts": "update", "update-minisign.test.ts": "update", "update-root-snapshot.test.ts": "update", "update-signed-supply.test.ts": "update", "update-signed-version.test.ts": "update", "update-trust-root.test.ts": "update", "update-bun-ownership-lease.test.ts": "update",
     "update-desktop-badge.test.ts": "update", "update-desktop-owner.test.ts": "update", "update-supervised-recovery.test.ts": "update",
     "update-job.test.ts": "update", "update-recovery-host-free.test.ts": "update", "update-job-supervised-restart.test.ts": "update", "update-standalone.test.ts": "update", "update-worker-launch.test.ts": "update",
     "update-notify.test.ts": "update", "update-npm-cache-preflight.test.ts": "update",

src/update/minisign.d.mts

@@ -0,0 +1,17 @@
+import type { KeyObject } from "node:crypto";
+
+export interface MinisignKey {
+  keyId: string;
+  publicKey: KeyObject;
+  fingerprint: string;
+}
+
+export interface MinisignVerification {
+  keyId: string;
+  fingerprint: string;
+  trustedComment: string;
+}
+
+export function decodePublicKey(text: string): MinisignKey;
+export function verifyMinisignBytes(bytes: Uint8Array, signatureBox: string, key: MinisignKey): MinisignVerification;
+export function verifyLegacyMinisignBytes(bytes: Uint8Array, signatureBox: string, key: Pick<MinisignKey, "keyId" | "publicKey">): Omit<MinisignVerification, "fingerprint">;

src/update/minisign.mjs

@@ -0,0 +1,88 @@
+// Offline minisign primitives. These results prove only cryptographic validity;
+// update authority is assigned separately by the signed-supply policy.
+import { createHash, createPublicKey, verify } from "node:crypto";
+import { snapshotUpdateBytes } from "./update-bytes.mjs";
+
+const ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+const TRUSTED_PREFIX = "trusted comment: ";
+
+function decodeBase64(text, what, expectedBytes) {
+  const payload = Buffer.from(text, "base64");
+  if (!text || payload.toString("base64") !== text
+      || (expectedBytes !== undefined && payload.length !== expectedBytes)) {
+    throw new Error(`Malformed ${what}: invalid base64 or decoded length`);
+  }
+  return payload;
+}
+
+function boxLines(text) {
+  return text.replace(/\r\n/g, "\n").replace(/\n$/, "").split("\n");
+}
+
+/** Decode the text form of a minisign public key; this does not establish trust. */
+export function decodePublicKey(text) {
+  const lines = boxLines(text);
+  if (lines.length !== 2 || !lines[0].startsWith("untrusted comment: ")) {
+    throw new Error("Malformed minisign public key box");
+  }
+  const packet = decodeBase64(lines[1], "minisign public key", 42);
+  const algorithm = packet.subarray(0, 2).toString("utf8");
+  if (algorithm !== "Ed") {
+    throw new Error(`Unsupported minisign public key algorithm: ${JSON.stringify(algorithm)}`);
+  }
+  const raw = packet.subarray(10);
+  return Object.freeze({
+    keyId: packet.subarray(2, 10).toString("hex"),
+    publicKey: createPublicKey({ key: Buffer.concat([ED25519_SPKI_PREFIX, raw]), format: "der", type: "spki" }),
+    fingerprint: createHash("sha256").update(raw).digest("hex"),
+  });
+}
+
+function verifyBox(bytes, signatureBox, key, legacy) {
+  // The historical release adapter accepts surrounding transport whitespace.
+  const outer = legacy ? signatureBox.trim() : signatureBox;
+  if (!legacy && outer.length > 5464) throw new Error("Malformed Tauri signature: box exceeds limit");
+  const encoded = decodeBase64(outer, "Tauri signature");
+  if (!legacy && encoded.length > 4096) throw new Error("Malformed Tauri signature: box exceeds limit");
+  const text = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(encoded);
+  const lines = boxLines(text);
+  if (lines.length !== 4 || !lines[0].startsWith("untrusted comment: ")
+      || !lines[2].startsWith(TRUSTED_PREFIX)) {
+    throw new Error("Malformed signature box");
+  }
+  const packet = decodeBase64(lines[1], "signature packet", 74);
+  const commentSignature = decodeBase64(lines[3], "comment signature", 64);
+  const algorithm = packet.subarray(0, 2).toString("utf8");
+  if (algorithm !== "ED") throw new Error(`Unsupported signature algorithm: ${JSON.stringify(algorithm)}`);
+  const keyId = packet.subarray(2, 10).toString("hex");
+  const expectedKeyId = key.keyId;
+  if (keyId !== expectedKeyId) throw new Error(`Signature was made by key ${keyId}, not the pinned updater key ${expectedKeyId}`);
+  // Capture one public-key representation, then reconstruct a private verifier
+  // so caller-controlled accessors cannot change the signer between checks.
+  let publicKeyDer;
+  try { publicKeyDer = snapshotUpdateBytes(key.publicKey.export({ format: "der", type: "spki" }), 44); }
+  catch { throw new Error("Malformed minisign public key"); }
+  if (publicKeyDer.length !== 44 || !Buffer.from(publicKeyDer.subarray(0, 12)).equals(ED25519_SPKI_PREFIX)) {
+    throw new Error("Malformed minisign public key");
+  }
+  const publicKey = createPublicKey({ key: Buffer.from(publicKeyDer), format: "der", type: "spki" });
+  const signature = packet.subarray(10);
+  const digest = createHash("blake2b512").update(bytes).digest();
+  if (!verify(null, digest, publicKey, signature)) throw new Error("Signature verification failed");
+  const exactComment = lines[2].slice(TRUSTED_PREFIX.length);
+  const trustedComment = legacy ? exactComment.trim() : exactComment;
+  const message = Buffer.concat([signature, Buffer.from(trustedComment, "utf8")]);
+  if (!verify(null, message, publicKey, commentSignature)) throw new Error("Comment signature verification failed");
+  const fingerprint = createHash("sha256").update(publicKeyDer.subarray(-32)).digest("hex");
+  return { keyId, fingerprint, trustedComment };
+}
+
+/** Verify both signatures using the exact trusted-comment bytes. */
+export function verifyMinisignBytes(bytes, signatureBox, key) {
+  return verifyBox(bytes, signatureBox, key, false);
+}
+
+/** Compatibility-only adapter for the existing release verifier's trimmed comment. */
+export function verifyLegacyMinisignBytes(bytes, signatureBox, key) {
+  return verifyBox(bytes, signatureBox, key, true);
+}