| | | 1 | | using System.Collections.ObjectModel; |
| | | 2 | | |
| | | 3 | | namespace AsiBackbone.Core.Signing; |
| | | 4 | | |
| | | 5 | | /// <summary> |
| | | 6 | | /// Represents provider-neutral signing metadata that can be carried by audit receipts, emission records, or provider ad |
| | | 7 | | /// </summary> |
| | | 8 | | /// <remarks> |
| | | 9 | | /// The metadata stores key references and signature descriptors only. It must not contain raw signing secrets, private |
| | | 10 | | /// </remarks> |
| | | 11 | | public sealed class SigningMetadata |
| | | 12 | | { |
| | 4 | 13 | | private static readonly IReadOnlyDictionary<string, string> EmptyMetadata = |
| | 4 | 14 | | new ReadOnlyDictionary<string, string>( |
| | 4 | 15 | | new Dictionary<string, string>(StringComparer.Ordinal)); |
| | | 16 | | |
| | 588 | 17 | | private SigningMetadata( |
| | 588 | 18 | | string? signingHash, |
| | 588 | 19 | | string? hashAlgorithm, |
| | 588 | 20 | | string? signature, |
| | 588 | 21 | | string? signatureAlgorithm, |
| | 588 | 22 | | string? keyId, |
| | 588 | 23 | | string? keyVersion, |
| | 588 | 24 | | string? provider, |
| | 588 | 25 | | DateTimeOffset? signedUtc, |
| | 588 | 26 | | IReadOnlyDictionary<string, string> metadata) |
| | | 27 | | { |
| | 588 | 28 | | SigningHash = NormalizeOptional(signingHash); |
| | 588 | 29 | | HashAlgorithm = NormalizeOptional(hashAlgorithm); |
| | 588 | 30 | | Signature = NormalizeOptional(signature); |
| | 588 | 31 | | SignatureAlgorithm = NormalizeOptional(signatureAlgorithm); |
| | 588 | 32 | | KeyId = NormalizeOptional(keyId); |
| | 588 | 33 | | KeyVersion = NormalizeOptional(keyVersion); |
| | 588 | 34 | | Provider = NormalizeOptional(provider); |
| | 588 | 35 | | SignedUtc = signedUtc?.ToUniversalTime(); |
| | 588 | 36 | | Metadata = metadata; |
| | 588 | 37 | | } |
| | | 38 | | |
| | | 39 | | /// <summary> |
| | | 40 | | /// Gets metadata with no hash, key reference, signature, provider, or signed timestamp. |
| | | 41 | | /// </summary> |
| | | 42 | | public static SigningMetadata NoSignature { get; } = new( |
| | | 43 | | null, |
| | | 44 | | null, |
| | | 45 | | null, |
| | | 46 | | null, |
| | | 47 | | null, |
| | | 48 | | null, |
| | | 49 | | null, |
| | | 50 | | null, |
| | | 51 | | EmptyMetadata); |
| | | 52 | | |
| | | 53 | | /// <summary> |
| | | 54 | | /// Gets the hash that was signed or is intended to be signed, when supplied by the host or signing provider. |
| | | 55 | | /// </summary> |
| | | 56 | | public string? SigningHash { get; } |
| | | 57 | | |
| | | 58 | | /// <summary> |
| | | 59 | | /// Gets the hash algorithm or hash descriptor associated with <see cref="SigningHash" />, when supplied. |
| | | 60 | | /// </summary> |
| | | 61 | | public string? HashAlgorithm { get; } |
| | | 62 | | |
| | | 63 | | /// <summary> |
| | | 64 | | /// Gets the provider-neutral signature value or encoded signature reference, when supplied. |
| | | 65 | | /// </summary> |
| | | 66 | | public string? Signature { get; } |
| | | 67 | | |
| | | 68 | | /// <summary> |
| | | 69 | | /// Gets the provider-neutral signature algorithm descriptor, when supplied. |
| | | 70 | | /// </summary> |
| | | 71 | | public string? SignatureAlgorithm { get; } |
| | | 72 | | |
| | | 73 | | /// <summary> |
| | | 74 | | /// Gets the signing key identifier, when supplied by a host or signing provider. |
| | | 75 | | /// </summary> |
| | | 76 | | public string? KeyId { get; } |
| | | 77 | | |
| | | 78 | | /// <summary> |
| | | 79 | | /// Gets the signing key version, when supplied by a host or signing provider. |
| | | 80 | | /// </summary> |
| | | 81 | | public string? KeyVersion { get; } |
| | | 82 | | |
| | | 83 | | /// <summary> |
| | | 84 | | /// Gets the provider or key-management system descriptor, when supplied. |
| | | 85 | | /// </summary> |
| | | 86 | | public string? Provider { get; } |
| | | 87 | | |
| | | 88 | | /// <summary> |
| | | 89 | | /// Gets the UTC timestamp when the signature was produced, when supplied. |
| | | 90 | | /// </summary> |
| | | 91 | | public DateTimeOffset? SignedUtc { get; } |
| | | 92 | | |
| | | 93 | | /// <summary> |
| | | 94 | | /// Gets additional provider-neutral signing metadata. |
| | | 95 | | /// </summary> |
| | | 96 | | public IReadOnlyDictionary<string, string> Metadata { get; } |
| | | 97 | | |
| | | 98 | | /// <summary> |
| | | 99 | | /// Gets a value indicating whether a signature value or signature reference is present. |
| | | 100 | | /// </summary> |
| | 152 | 101 | | public bool HasSignature => Signature is not null; |
| | | 102 | | |
| | | 103 | | /// <summary> |
| | | 104 | | /// Gets a value indicating whether any signing key reference is present. |
| | | 105 | | /// </summary> |
| | 3 | 106 | | public bool HasKeyReference => KeyId is not null || KeyVersion is not null; |
| | | 107 | | |
| | | 108 | | /// <summary> |
| | | 109 | | /// Gets a value indicating whether this metadata represents a signed artifact. |
| | | 110 | | /// </summary> |
| | 83 | 111 | | public bool IsSigned => Signature is not null && SignatureAlgorithm is not null && KeyId is not null; |
| | | 112 | | |
| | | 113 | | /// <summary> |
| | | 114 | | /// Gets a value indicating whether additional signing metadata is present. |
| | | 115 | | /// </summary> |
| | 2 | 116 | | public bool HasMetadata => Metadata.Count > 0; |
| | | 117 | | |
| | | 118 | | /// <summary> |
| | | 119 | | /// Creates provider-neutral signing metadata. |
| | | 120 | | /// </summary> |
| | | 121 | | public static SigningMetadata Create( |
| | | 122 | | string? signingHash = null, |
| | | 123 | | string? hashAlgorithm = null, |
| | | 124 | | string? signature = null, |
| | | 125 | | string? signatureAlgorithm = null, |
| | | 126 | | string? keyId = null, |
| | | 127 | | string? keyVersion = null, |
| | | 128 | | string? provider = null, |
| | | 129 | | DateTimeOffset? signedUtc = null, |
| | | 130 | | IReadOnlyDictionary<string, string>? metadata = null) |
| | | 131 | | { |
| | 584 | 132 | | return new SigningMetadata( |
| | 584 | 133 | | signingHash, |
| | 584 | 134 | | hashAlgorithm, |
| | 584 | 135 | | signature, |
| | 584 | 136 | | signatureAlgorithm, |
| | 584 | 137 | | keyId, |
| | 584 | 138 | | keyVersion, |
| | 584 | 139 | | provider, |
| | 584 | 140 | | signedUtc, |
| | 584 | 141 | | NormalizeMetadata(metadata)); |
| | | 142 | | } |
| | | 143 | | |
| | | 144 | | private static string? NormalizeOptional(string? value) |
| | | 145 | | { |
| | 4116 | 146 | | return string.IsNullOrWhiteSpace(value) |
| | 4116 | 147 | | ? null |
| | 4116 | 148 | | : value.Trim(); |
| | | 149 | | } |
| | | 150 | | |
| | | 151 | | private static IReadOnlyDictionary<string, string> NormalizeMetadata( |
| | | 152 | | IReadOnlyDictionary<string, string>? metadata) |
| | | 153 | | { |
| | 584 | 154 | | if (metadata is null || metadata.Count == 0) |
| | | 155 | | { |
| | 160 | 156 | | return EmptyMetadata; |
| | | 157 | | } |
| | | 158 | | |
| | 424 | 159 | | Dictionary<string, string> normalizedMetadata = new(StringComparer.Ordinal); |
| | | 160 | | |
| | 5736 | 161 | | foreach (KeyValuePair<string, string> item in metadata) |
| | | 162 | | { |
| | 2444 | 163 | | if (string.IsNullOrWhiteSpace(item.Key)) |
| | | 164 | | { |
| | | 165 | | continue; |
| | | 166 | | } |
| | | 167 | | |
| | 2443 | 168 | | normalizedMetadata[item.Key.Trim()] = item.Value?.Trim() ?? string.Empty; |
| | | 169 | | } |
| | | 170 | | |
| | 424 | 171 | | return normalizedMetadata.Count == 0 |
| | 424 | 172 | | ? EmptyMetadata |
| | 424 | 173 | | : new ReadOnlyDictionary<string, string>(normalizedMetadata); |
| | | 174 | | } |
| | | 175 | | } |