Use codephrases for IDs and signatures (#12)

Author: plotnick

Cargo.lock

@@ -5,10 +5,10 @@ resolver = "2"
 [workspace.dependencies]
 async-recursion = "1"
 blake3 = "1"
-base64 = "0.22"
 bytesize = "2"
 chrono = "0.4"
 clap = { version = "4", features = ["derive", "env", "wrap_help"] }
+crypto-bigint = "0.5"
 dropshot = "0.16"
 ed25519-dalek = { version = "2", features = ["rand_core"] }
 humantime = "2"
@@ -18,19 +18,19 @@ pem-rfc7468 = { version = "0.7", features = ["std"] }
 permission-slip-client = { git = "https://github.com/oxidecomputer/permission-slip" }
 permission-slip-common = { git = "https://github.com/oxidecomputer/permission-slip" }
 progenitor = "0.11"
+rand = "0.8"
 rand_core = "0.6"
 reqwest = "0.12"
 rlimit = "0.10"
-rusqlite = { version = "0.37", features = ["blob", "chrono", "limits", "modern_sqlite", "uuid"] }
+rusqlite = { version = "0.37", features = ["blob", "chrono", "limits", "modern_sqlite"] }
 rustyline = "17"
-schemars = { version = "0.8", features = ["chrono", "preserve_order", "uuid1"] }
+schemars = { version = "0.8", features = ["chrono", "preserve_order"] }
 serde = "1"
 serde_json = "1"
 sha2 = "0.10"
 shlex = "1"
 tempfile = "3"
 thiserror = "1"
 tokio = { version = "1", features = ["macros", "process", "rt", "sync", "time"] }
-uuid = { version = "1", features = ["serde", "v4"] }
 x509-cert = { version = "0.2", features = ["std"] }
 xdg = "3"

Cargo.toml

@@ -15,8 +15,10 @@ blake3.workspace = true
 bytesize.workspace = true
 chrono.workspace = true
 clap.workspace = true
+ed25519-dalek.workspace = true
 humantime.workspace = true
 libc.workspace = true
+p256.workspace = true
 pem-rfc7468.workspace = true
 permission-slip-client.workspace = true
 permission-slip-common.workspace = true
@@ -29,6 +31,5 @@ shlex.workspace = true
 sush-common = { path = "../common" }
 thiserror.workspace = true
 tokio.workspace = true
-uuid.workspace = true
 x509-cert.workspace = true
 xdg.workspace = true

client/Cargo.toml

@@ -64,7 +64,7 @@ impl CommandContext for Cli {
             return Err(CommandError::InvalidRootCert);
         }
         let tbs = root.tbs_certificate.to_der()?;
-        Signature::new(root.signature.raw_bytes().to_vec()).verify(&tbs, root)?;
+        Signature::try_from(root)?.verify(&tbs, &root.tbs_certificate.subject_public_key_info)?;
         if matches!(self.get_output_format(), OutputFormat::Text) {
             println!(
                 "✅ Verified root certificate for subject `{}`",
@@ -75,7 +75,8 @@ impl CommandContext for Cli {
         let mut prev = root;
         for cert in rest {
             let tbs = cert.tbs_certificate.to_der()?;
-            Signature::new(cert.signature.raw_bytes().to_vec()).verify(&tbs, prev)?;
+            Signature::try_from(cert)?
+                .verify(&tbs, &prev.tbs_certificate.subject_public_key_info)?;
             prev = cert;
             if matches!(self.get_output_format(), OutputFormat::Text) {
                 println!(
@@ -117,10 +118,9 @@ impl CommandContext for Cli {
                 if reserved.is_empty() {
                     println!("✅ No reserved jobs");
                 } else {
-                    println!("✅ {} reserved jobs", reserved.len());
-                    println!("{:40}{}", "Job ID", "Time Reserved");
-                    for (job_id, time) in reserved {
-                        println!("{job_id:40}{time}");
+                    println!("✅ {} reserved jobs:", reserved.len());
+                    for job_id in reserved.keys() {
+                        println!("{job_id}");
                     }
                 }
             }
@@ -132,7 +132,7 @@ impl CommandContext for Cli {
         match self.get_output_format() {
             OutputFormat::Json => println!("{}", json!(reserved)),
             OutputFormat::Text => {
-                println!("✅ Read {} reserved job IDs", reserved.job_ids.len());
+                println!("✅ Read {} reserved jobs", reserved.job_ids.len());
             }
         }
         Ok(())
@@ -149,9 +149,9 @@ impl CommandContext for Cli {
                 let n = job_ids.len();
                 match n {
                     0 => println!("✅ No jobs reserved"),
-                    1 => println!("✅ Reserved job ID {} at {}", job_ids[0], time_reserved),
+                    1 => println!("✅ Reserved job `{}` at {}", job_ids[0], time_reserved),
                     _ => {
-                        println!("✅ Reserved {n} job IDs at {time_reserved}:");
+                        println!("✅ Reserved {n} jobs at {time_reserved}:");
                         for job_id in &reserved.job_ids {
                             println!("{job_id}");
                         }
@@ -162,17 +162,17 @@ impl CommandContext for Cli {
         Ok(())
     }
 
-    fn job_aborted(&mut self, job_id: JobId) -> Result<(), CommandError> {
+    fn job_aborted(&mut self, job_id: &JobId) -> Result<(), CommandError> {
         match self.get_output_format() {
             OutputFormat::Json => println!("{job_id}"),
-            OutputFormat::Text => println!("✅ Aborted job {job_id}"),
+            OutputFormat::Text => println!("✅ Aborted job `{job_id}`"),
         }
         Ok(())
     }
 
     fn job_stdout(
         &mut self,
-        job_id: JobId,
+        _job_id: &JobId,
         output: &[u8],
         binary: bool,
     ) -> Result<(), CommandError> {
@@ -182,7 +182,7 @@ impl CommandContext for Cli {
             OutputFormat::Text if binary => stdout().write(output).map(|_| ())?,
             OutputFormat::Text if output.is_empty() => (),
             OutputFormat::Text => {
-                println!("✅ Job {job_id} stdout:");
+                println!("✅ Job stdout:");
                 let output = String::from_utf8(output.to_vec())?;
                 if output.ends_with('\n') {
                     print!("{output}");
@@ -196,7 +196,7 @@ impl CommandContext for Cli {
 
     fn job_stderr(
         &mut self,
-        job_id: JobId,
+        _job_id: &JobId,
         errors: &[u8],
         binary: bool,
     ) -> Result<(), CommandError> {
@@ -206,7 +206,7 @@ impl CommandContext for Cli {
             OutputFormat::Text if binary => stdout().write(errors).map(|_| ())?,
             OutputFormat::Text if errors.is_empty() => (),
             OutputFormat::Text => {
-                println!("❌ Job {job_id} stderr:");
+                println!("❌ Job stderr:");
                 let errors = String::from_utf8(errors.to_vec())?;
                 if errors.ends_with('\n') {
                     print!("{errors}");
@@ -218,11 +218,11 @@ impl CommandContext for Cli {
         Ok(())
     }
 
-    fn job_status(&mut self, job_id: JobId, status: &JobStatus) -> Result<(), CommandError> {
+    fn job_status(&mut self, job_id: &JobId, status: &JobStatus) -> Result<(), CommandError> {
         match self.get_output_format() {
             OutputFormat::Json => println!("{}", json!(status)),
             OutputFormat::Text => match status {
-                JobStatus::NotFound => println!("❌ Job {job_id} not found"),
+                JobStatus::NotFound => println!("❌ Job `{job_id}` not found"),
                 JobStatus::Reserved {
                     job_id,
                     time_reserved,
@@ -291,10 +291,10 @@ impl CommandContext for Cli {
             OutputFormat::Text => {
                 let n = revoked.len();
                 match n {
-                    0 => println!("✅ No job IDs revoked"),
-                    1 => println!("✅ Revoked job ID {}", revoked[0]),
+                    0 => println!("✅ No jobs revoked"),
+                    1 => println!("✅ Revoked job `{}`", revoked[0]),
                     _ => {
-                        println!("✅ Revoked {} job IDs:", revoked.len());
+                        println!("✅ Revoked {} jobs:", revoked.len());
                         for job_id in revoked {
                             println!("{job_id}");
                         }
@@ -309,7 +309,7 @@ impl CommandContext for Cli {
         match self.get_output_format() {
             OutputFormat::Json => println!("{}", serde_json::to_string(&job)?),
             OutputFormat::Text => println!(
-                "✅ Signed request for job {}\n{}",
+                "✅ Signed request for job `{}`\n{}",
                 job.job_id(),
                 serde_json::to_string_pretty(&job)?
             ),

client/src/cli.rs

@@ -272,10 +272,10 @@ pub trait CommandContext {
     fn ack(&mut self, url: &str, time: DateTime<Utc>) -> Result<(), CommandError>;
     fn cert_chain(&mut self, key_id: KeyId, certs: &str) -> Result<(), CommandError>;
     fn cert_imported(&mut self, path: &Path, key_id: KeyId) -> Result<(), CommandError>;
-    fn job_aborted(&mut self, id: JobId) -> Result<(), CommandError>;
-    fn job_stdout(&mut self, id: JobId, output: &[u8], binary: bool) -> Result<(), CommandError>;
-    fn job_stderr(&mut self, id: JobId, errors: &[u8], binary: bool) -> Result<(), CommandError>;
-    fn job_status(&mut self, id: JobId, status: &JobStatus) -> Result<(), CommandError>;
+    fn job_aborted(&mut self, id: &JobId) -> Result<(), CommandError>;
+    fn job_stdout(&mut self, id: &JobId, output: &[u8], binary: bool) -> Result<(), CommandError>;
+    fn job_stderr(&mut self, id: &JobId, errors: &[u8], binary: bool) -> Result<(), CommandError>;
+    fn job_status(&mut self, id: &JobId, status: &JobStatus) -> Result<(), CommandError>;
     fn job_signed(&mut self, job: &SignedJob) -> Result<(), CommandError>;
     fn jobs_reserved(&mut self, reserved: &JobsReserved) -> Result<(), CommandError>;
     fn reserved_read(&mut self, reserved: &JobsReserved) -> Result<(), CommandError>;
@@ -375,19 +375,19 @@ impl ClientCommand {
             }
             (ClientCommand::JobStatus { job_id }, Some(client)) => {
                 let status = client.job_status(&job_id).await?.into_inner();
-                ctx.job_status(job_id, &status)
+                ctx.job_status(&job_id, &status)
             }
             (ClientCommand::JobStdout { job_id, binary }, Some(client)) => {
                 let stdout = client.job_stdout(&job_id).await?.into_inner();
-                ctx.job_stdout(job_id, &stdout, binary)
+                ctx.job_stdout(&job_id, &stdout, binary)
             }
             (ClientCommand::JobStderr { job_id, binary }, Some(client)) => {
                 let stderr = client.job_stderr(&job_id).await?.into_inner();
-                ctx.job_stderr(job_id, &stderr, binary)
+                ctx.job_stderr(&job_id, &stderr, binary)
             }
             (ClientCommand::JobAbort { job_id }, Some(client)) => {
                 client.job_abort(&job_id).await?;
-                ctx.job_aborted(job_id)
+                ctx.job_aborted(&job_id)
             }
             (ClientCommand::Set { args: values }, _) => {
                 ctx.set_globals(args, values);
@@ -421,16 +421,16 @@ where
         max_fsize,
     } = limits;
     let status = select! {
-        status = client.job_start(&job_id, max_cpu, max_mem, max_fsize, wait, &job) => status?.into_inner(),
+        status = client.job_start(job_id, max_cpu, max_mem, max_fsize, wait, &job) => status?.into_inner(),
         _ = ctrl_c() => {
-            client.job_abort(&job_id).await?;
-            client.job_status(&job_id).await?.into_inner()
+            client.job_abort(job_id).await?;
+            client.job_status(job_id).await?.into_inner()
         }
     };
     ctx.job_status(job_id, &status)?;
     if wait {
-        let stdout = client.job_stdout(&job_id).await?.into_inner();
-        let stderr = client.job_stderr(&job_id).await?.into_inner();
+        let stdout = client.job_stdout(job_id).await?.into_inner();
+        let stderr = client.job_stderr(job_id).await?.into_inner();
         ctx.job_stdout(job_id, &stdout, binary)?;
         ctx.job_stderr(job_id, &stderr, binary)?;
     }
@@ -471,9 +471,10 @@ fn read_reserved() -> Result<Reserved, CommandError> {
         Ok(Reserved::Batch(JobsReserved {
             job_ids: input
                 .split('\n')
+                .map(|s| s.trim())
                 .filter(|s| !s.is_empty())
-                .map(|s| s.split_whitespace().next().unwrap_or(s).parse())
-                .collect::<Result<Vec<JobId>, _>>()?,
+                .map(JobId::from)
+                .collect::<Vec<JobId>>(),
             time_reserved: Utc::now(),
         }))
     }
@@ -519,7 +520,7 @@ pub enum CommandError {
     MissingKeyName,
     #[error("❌ Command not supported in offline mode, try `--url`")]
     Offline,
-    #[error("❌ `permslip` error: {0}")]
+    #[error("❌ permslip error: {0}")]
     Permslip(#[from] PermslipError),
     #[error("👋 Goodbye!")]
     Quit,
@@ -529,8 +530,6 @@ pub enum CommandError {
     Recursive(#[from] Box<Self>),
     #[error("❌ UTF-8 error: {0}")]
     Utf8(#[from] std::string::FromUtf8Error),
-    #[error("❌ UUID error: {0}")]
-    Uuid(#[from] uuid::Error),
 }
 
 impl From<ClientError<ApiError>> for CommandError {