Bind approval evidence after package verification

Author: bigboateng

boatstack/flow/softwaredelivery/workpackage/package.go

@@ -171,6 +171,15 @@ type Result struct {
 
 type CurrentProgram struct{ ProgramFingerprint, WorkContractFingerprint string }
 
+// VerifiedApproval is the exact portable approval evidence read after full
+// package verification. Raw contains the canonical approval bytes validated
+// against Manifest.
+type VerifiedApproval struct {
+	Manifest Manifest
+	Approval Approval
+	Raw      []byte
+}
+
 func Encode(value any) ([]byte, error) {
 	raw, err := json.MarshalIndent(value, "", "  ")
 	if err != nil {
@@ -443,6 +452,59 @@ func Verify(repository, deliveryID, packageFingerprint string, current *CurrentP
 	return result
 }
 
+// ReadVerifiedApproval rereads and validates the current manifest and
+// approval together. Callers use it after Verify when durable or transferred
+// state must bind the exact approval bytes that remain present.
+func ReadVerifiedApproval(repository, deliveryID, packageFingerprint string) (VerifiedApproval, error) {
+	if !ValidSegment(deliveryID) || !ValidFingerprint(packageFingerprint) {
+		return VerifiedApproval{}, fmt.Errorf("package path identity is invalid")
+	}
+	root, err := filepath.Abs(repository)
+	if err != nil {
+		return VerifiedApproval{}, err
+	}
+	info, err := os.Lstat(root)
+	if err != nil || !info.IsDir() {
+		return VerifiedApproval{}, fmt.Errorf("repository root is unavailable")
+	}
+	packageRoot := filepath.Join(root, ".boatstack", "work-packages", deliveryID, packageFingerprint)
+	if info, err = os.Lstat(packageRoot); err != nil || !info.IsDir() || info.Mode()&os.ModeSymlink != 0 {
+		return VerifiedApproval{}, fmt.Errorf("package directory is unavailable or unsafe")
+	}
+	manifestRaw, err := readRegular(filepath.Join(packageRoot, "manifest.json"), maxPackageMetadataBytes)
+	if err != nil {
+		return VerifiedApproval{}, err
+	}
+	var manifest Manifest
+	if err := StrictDecode(manifestRaw, &manifest); err != nil {
+		return VerifiedApproval{}, fmt.Errorf("manifest: %w", err)
+	}
+	if !canonicalEncoding(manifestRaw, manifest) || !outputsSorted(manifest.Outputs) {
+		return VerifiedApproval{}, fmt.Errorf("manifest encoding or output order is non-canonical")
+	}
+	manifestIdentity := manifest
+	manifestIdentity.Fingerprint = ""
+	identityRaw, err := Encode(manifestIdentity)
+	if err != nil {
+		return VerifiedApproval{}, err
+	}
+	if err := validateManifestIdentity(manifest, deliveryID, packageFingerprint, Digest(identityRaw)); err != nil {
+		return VerifiedApproval{}, fmt.Errorf("manifest identity is invalid: %w", err)
+	}
+	approvalRaw, err := readRegular(filepath.Join(packageRoot, "approval.json"), maxPackageMetadataBytes)
+	if err != nil {
+		return VerifiedApproval{}, err
+	}
+	var approval Approval
+	if err := StrictDecode(approvalRaw, &approval); err != nil {
+		return VerifiedApproval{}, fmt.Errorf("approval: %w", err)
+	}
+	if err := ValidateApproval(approvalRaw, approval, manifest, deliveryID, packageFingerprint); err != nil {
+		return VerifiedApproval{}, fmt.Errorf("approval identity is invalid: %w", err)
+	}
+	return VerifiedApproval{Manifest: manifest, Approval: approval, Raw: approvalRaw}, nil
+}
+
 func validateManifestIdentity(manifest Manifest, deliveryID, packageFingerprint, identityFingerprint string) error {
 	switch {
 	case manifest.SchemaVersion != ManifestSchemaVersion:

boatstack/internal/softwaredelivery/effects/artifacts.go

@@ -553,6 +553,7 @@ func prepareArtifacts(layout ports.ControllerLayout, admission protocol.Admissio
 }
 
 var verifyWorkPackage = workpackage.Verify
+var prepareWorkspaceWorkPackageTransferFn = prepareWorkspaceWorkPackageTransfer
 
 func capturePinnedWorkPackage(root *os.Root, deliveryID, fingerprint string) (string, func(), error) {
 	repository, err := os.MkdirTemp("", "boatstack-work-package-snapshot-")
@@ -647,7 +648,7 @@ func prepareWorkspacePlanTransfer(repositoryRoot, workspacePath, deliveryID, exp
 	mutations := []ports.ResourceMutation{planMutation, approvalMutation}
 	var promotion planPromotionReceipt
 	if decodeStrictArtifact(approvalRaw, &promotion) == nil && promotion.SchemaVersion == 2 {
-		packageMutations, packageErr := prepareWorkspaceWorkPackageTransfer(repositoryRoot, workspacePath, deliveryID, promotion.WorkPackageFingerprint)
+		packageMutations, packageErr := prepareWorkspaceWorkPackageTransferFn(repositoryRoot, workspacePath, deliveryID, promotion.WorkPackageFingerprint, promotion.WorkPackageApprovalFingerprint)
 		if packageErr != nil {
 			return nil, packageErr
 		}
@@ -656,7 +657,7 @@ func prepareWorkspacePlanTransfer(repositoryRoot, workspacePath, deliveryID, exp
 	return mutations, nil
 }
 
-func prepareWorkspaceWorkPackageTransfer(repositoryRoot, workspacePath, deliveryID, packageFingerprint string) ([]ports.ResourceMutation, error) {
+func prepareWorkspaceWorkPackageTransfer(repositoryRoot, workspacePath, deliveryID, packageFingerprint, expectedApprovalFingerprint string) ([]ports.ResourceMutation, error) {
 	sourcePath := filepath.Join(repositoryRoot, ".boatstack", "work-packages", deliveryID, packageFingerprint)
 	root, err := os.OpenRoot(sourcePath)
 	if err != nil {
@@ -680,6 +681,10 @@ func prepareWorkspaceWorkPackageTransfer(repositoryRoot, workspacePath, delivery
 	if verified.Integrity != workpackage.Valid || verified.Contract != workpackage.Valid || verified.Approval != workpackage.Valid {
 		return nil, fmt.Errorf("workspace work package verification failed: %s", strings.Join(verified.Diagnostics, "; "))
 	}
+	verifiedApproval, err := workpackage.ReadVerifiedApproval(snapshotRepository, deliveryID, packageFingerprint)
+	if err != nil || verifiedApproval.Approval.Fingerprint != expectedApprovalFingerprint {
+		return nil, fmt.Errorf("workspace work package approval does not bind promotion lineage")
+	}
 	snapshotRoot := filepath.Join(snapshotRepository, ".boatstack", "work-packages", deliveryID, packageFingerprint)
 	destinationRoot := filepath.Join(workspacePath, ".boatstack", "work-packages", deliveryID, packageFingerprint)
 	destinationExists := false
@@ -707,6 +712,12 @@ func prepareWorkspaceWorkPackageTransfer(repositoryRoot, workspacePath, delivery
 		if err != nil {
 			return err
 		}
+		if filepath.ToSlash(relative) == "approval.json" {
+			if !bytes.Equal(raw, verifiedApproval.Raw) {
+				return fmt.Errorf("workspace work package approval changed after verification")
+			}
+			raw = verifiedApproval.Raw
+		}
 		mutation, err := immutableWorkPackageMutation(filepath.Join(destinationRoot, relative), raw)
 		if err != nil {
 			return err
@@ -754,18 +765,11 @@ func validateWorkspaceApproval(repositoryRoot, deliveryID, expectedPlanFingerpri
 		if verified.Integrity != workpackage.Valid || verified.Contract != workpackage.Valid || verified.Approval != workpackage.Valid {
 			return fmt.Errorf("schema-2 promotion package is invalid")
 		}
-		packageRoot := filepath.Join(repositoryRoot, ".boatstack", "work-packages", deliveryID, promotion.WorkPackageFingerprint)
-		approvalRaw, err := os.ReadFile(filepath.Join(packageRoot, "approval.json"))
-		var approval workpackage.Approval
-		if err != nil || workpackage.StrictDecode(approvalRaw, &approval) != nil || approval.Fingerprint != promotion.WorkPackageApprovalFingerprint {
+		verifiedApproval, err := workpackage.ReadVerifiedApproval(repositoryRoot, deliveryID, promotion.WorkPackageFingerprint)
+		if err != nil || verifiedApproval.Approval.Fingerprint != promotion.WorkPackageApprovalFingerprint {
 			return fmt.Errorf("schema-2 promotion approval lineage is invalid")
 		}
-		manifestRaw, err := os.ReadFile(filepath.Join(packageRoot, "manifest.json"))
-		var manifest workpackage.Manifest
-		if err != nil || workpackage.StrictDecode(manifestRaw, &manifest) != nil {
-			return fmt.Errorf("schema-2 promotion manifest is invalid")
-		}
-		for _, output := range manifest.Outputs {
+		for _, output := range verifiedApproval.Manifest.Outputs {
 			if output.ID == promotion.PlanOutputID && output.Required && output.SHA256 == expectedPlanFingerprint {
 				return nil
 			}

boatstack/internal/softwaredelivery/effects/work_package_test.go

@@ -214,6 +214,22 @@ func TestWorkPackageAdmitApprovePromoteUsesExactGenericSnapshot(t *testing.T) {
 		t.Fatalf("promoted plan=%q", current)
 	}
 	workspace := t.TempDir()
+	originalTransfer := prepareWorkspaceWorkPackageTransferFn
+	t.Cleanup(func() { prepareWorkspaceWorkPackageTransferFn = originalTransfer })
+	prepareWorkspaceWorkPackageTransferFn = func(repositoryRoot, workspacePath, deliveryID, packageFingerprint, expectedApprovalFingerprint string) ([]ports.ResourceMutation, error) {
+		if err := os.WriteFile(filepath.Join(packageRoot, "approval.json"), substitutedApprovalRaw, 0o644); err != nil {
+			t.Fatal(err)
+		}
+		return originalTransfer(repositoryRoot, workspacePath, deliveryID, packageFingerprint, expectedApprovalFingerprint)
+	}
+	_, transferSubstitutionErr := prepareWorkspacePlanTransfer(repository, workspace, "delivery", state.PlanFingerprint, state.ApprovalFingerprint)
+	prepareWorkspaceWorkPackageTransferFn = originalTransfer
+	if err := os.WriteFile(filepath.Join(packageRoot, "approval.json"), originalApproval, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if transferSubstitutionErr == nil || !strings.Contains(transferSubstitutionErr.Error(), "promotion lineage") {
+		t.Fatalf("workspace transfer accepted substituted package approval: %v", transferSubstitutionErr)
+	}
 	transfers, err := prepareWorkspacePlanTransfer(repository, workspace, "delivery", state.PlanFingerprint, state.ApprovalFingerprint)
 	if err != nil {
 		t.Fatal(err)

boatstack/internal/softwaredelivery/plant/observer.go

@@ -702,28 +702,20 @@ func observeWorkPackage(layout ports.ControllerLayout, state durable.State, now
 	if err != nil || !exists {
 		return evidence, false, err
 	}
-	manifestRaw, err := os.ReadFile(manifestPath)
-	if err != nil {
-		return evidence, false, err
-	}
-	var manifest workpackage.Manifest
-	if workpackage.StrictDecode(manifestRaw, &manifest) != nil {
-		return evidence, false, nil
-	}
-	result := workpackage.Verify(layout.RepositoryRoot, state.Objective.DeliveryID, state.WorkPackageFingerprint, nil)
+	result := verifyObservedWorkPackage(layout.RepositoryRoot, state.Objective.DeliveryID, state.WorkPackageFingerprint, nil)
 	valid := result.Integrity == workpackage.Valid && result.Contract == workpackage.Valid
 	if state.WorkPackage == model.WorkPackageApproved {
 		valid = valid && result.Approval == workpackage.Valid
 		if valid {
-			raw, _ := os.ReadFile(filepath.Join(root, "approval.json"))
-			var approval workpackage.Approval
-			_ = workpackage.StrictDecode(raw, &approval)
-			valid = approval.Fingerprint == state.WorkPackageApprovalFingerprint
+			verified, approvalErr := workpackage.ReadVerifiedApproval(layout.RepositoryRoot, state.Objective.DeliveryID, state.WorkPackageFingerprint)
+			valid = approvalErr == nil && verified.Approval.Fingerprint == state.WorkPackageApprovalFingerprint
 		}
 	}
 	return evidence, valid, nil
 }
 
+var verifyObservedWorkPackage = workpackage.Verify
+
 type pendingJournalHeader struct {
 	SchemaVersion     int    `json:"schema_version"`
 	TransitionID      string `json:"transition_id"`

boatstack/internal/softwaredelivery/plant/observer_test.go

@@ -66,6 +66,35 @@ func TestObserverValidatesAdmittedWorkPackageWithoutPrematurePlanPromotion(t *te
 	if _, err := os.Stat(filepath.Join(repository, ".boatstack", "plans", deliveryID+".source")); !os.IsNotExist(err) {
 		t.Fatalf("admission prematurely created a canonical plan: %v", err)
 	}
+	approval, approvalRaw, err := workpackage.SealApproval(workpackage.Approval{
+		DeliveryID: deliveryID, PackageFingerprint: manifest.Fingerprint, ManifestFingerprint: manifest.Fingerprint,
+		AdmissionID: "adm-approve", Actor: "reviewer", IdentityRole: "developer", IdentityProviderFingerprint: strings.Repeat("9", 64), ApprovedAt: time.Unix(99, 0).UTC(),
+		AuthoritySources: []workpackage.AuthoritySource{{ID: "human", Class: "human", Subject: "reviewer", Fingerprint: "authority-proof"}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(root, "approval.json"), approvalRaw, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	state.WorkPackage = model.WorkPackageApproved
+	state.WorkPackageApprovalFingerprint = approval.Fingerprint
+	originalVerify := verifyObservedWorkPackage
+	t.Cleanup(func() { verifyObservedWorkPackage = originalVerify })
+	verifyObservedWorkPackage = func(repository, deliveryID, packageFingerprint string, current *workpackage.CurrentProgram) workpackage.Result {
+		result := originalVerify(repository, deliveryID, packageFingerprint, current)
+		if err := os.WriteFile(filepath.Join(root, "approval.json"), append(append([]byte(nil), approvalRaw...), '\n'), 0o644); err != nil {
+			t.Fatal(err)
+		}
+		return result
+	}
+	if _, valid, err := observeWorkPackage(ports.ControllerLayout{RepositoryRoot: repository}, state, time.Unix(100, 0).UTC()); err != nil || valid {
+		t.Fatalf("post-verification approval substitution valid=%t err=%v", valid, err)
+	}
+	verifyObservedWorkPackage = originalVerify
+	if err := os.WriteFile(filepath.Join(root, "approval.json"), approvalRaw, 0o644); err != nil {
+		t.Fatal(err)
+	}
 	if err := os.WriteFile(filepath.Join(root, "plan.md"), []byte("tampered"), 0o644); err != nil {
 		t.Fatal(err)
 	}