| | | 1 | | namespace AsiBackbone.Core.Signing; |
| | | 2 | | |
| | | 3 | | /// <summary> |
| | | 4 | | /// Evaluates provider-neutral signature verification results against host verification policy. |
| | | 5 | | /// </summary> |
| | | 6 | | public static class VerificationPolicyEvaluator |
| | | 7 | | { |
| | 2 | 8 | | private static readonly CategoryRule[] FailureCodeCategoryRules = |
| | 2 | 9 | | [ |
| | 2 | 10 | | new(SignatureVerificationCategory.MissingSignature, ["missing"]), |
| | 2 | 11 | | new(SignatureVerificationCategory.HashMismatch, ["hash"]), |
| | 2 | 12 | | new(SignatureVerificationCategory.CanonicalizationMismatch, ["canonicalization", "payload-schema", "artifact"]), |
| | 2 | 13 | | new(SignatureVerificationCategory.UnsupportedAlgorithm, ["unsupported", "algorithm"]), |
| | 2 | 14 | | new(SignatureVerificationCategory.RevokedKey, ["revoked", "disabled"]), |
| | 2 | 15 | | new( |
| | 2 | 16 | | SignatureVerificationCategory.UnknownKeyVersion, |
| | 2 | 17 | | ["key-version", "key.mismatch", "key-mismatch"], |
| | 2 | 18 | | ["unknown", "key"]), |
| | 2 | 19 | | new(SignatureVerificationCategory.ProviderUnavailable, ["provider-unavailable", "unavailable", "timeout", "netwo |
| | 2 | 20 | | new(SignatureVerificationCategory.InvalidSignature, ["invalid", "malformed", "signature"]) |
| | 2 | 21 | | ]; |
| | | 22 | | |
| | | 23 | | /// <summary> |
| | | 24 | | /// Evaluates a signed governance artifact and verification result against verification policy. |
| | | 25 | | /// </summary> |
| | | 26 | | public static VerificationPolicyOutcome Evaluate<TArtifact>( |
| | | 27 | | SignedGovernanceArtifact<TArtifact> artifact, |
| | | 28 | | SignatureVerificationResult verificationResult, |
| | | 29 | | VerificationPolicyOptions? options = null) |
| | | 30 | | { |
| | 72 | 31 | | ArgumentNullException.ThrowIfNull(artifact); |
| | 72 | 32 | | ArgumentNullException.ThrowIfNull(verificationResult); |
| | | 33 | | |
| | 72 | 34 | | return VerificationPolicyOutcome.CreateCore( |
| | 72 | 35 | | artifact.ArtifactType, |
| | 72 | 36 | | artifact.ArtifactId, |
| | 72 | 37 | | artifact.SigningHash, |
| | 72 | 38 | | artifact.HashAlgorithm, |
| | 72 | 39 | | artifact.SigningMetadata, |
| | 72 | 40 | | verificationResult, |
| | 72 | 41 | | options); |
| | | 42 | | } |
| | | 43 | | |
| | | 44 | | /// <summary> |
| | | 45 | | /// Maps a provider-neutral verification result to a stable verification category. |
| | | 46 | | /// </summary> |
| | | 47 | | public static SignatureVerificationCategory Categorize(SignatureVerificationResult verificationResult) |
| | | 48 | | { |
| | 150 | 49 | | ArgumentNullException.ThrowIfNull(verificationResult); |
| | | 50 | | |
| | 148 | 51 | | if (verificationResult.IsValid) |
| | | 52 | | { |
| | 14 | 53 | | return SignatureVerificationCategory.Valid; |
| | | 54 | | } |
| | | 55 | | |
| | 134 | 56 | | if (Matches(verificationResult.Status, "MissingSignature")) |
| | | 57 | | { |
| | 12 | 58 | | return SignatureVerificationCategory.MissingSignature; |
| | | 59 | | } |
| | | 60 | | |
| | 122 | 61 | | string failureCode = verificationResult.FailureCode ?? string.Empty; |
| | | 62 | | |
| | 1420 | 63 | | foreach (CategoryRule rule in FailureCodeCategoryRules) |
| | | 64 | | { |
| | 646 | 65 | | if (rule.IsMatch(failureCode)) |
| | | 66 | | { |
| | 116 | 67 | | return rule.Category; |
| | | 68 | | } |
| | | 69 | | } |
| | | 70 | | |
| | 6 | 71 | | return SignatureVerificationCategory.Failed; |
| | | 72 | | } |
| | | 73 | | |
| | | 74 | | private static bool Matches(string value, string pattern) |
| | | 75 | | { |
| | 1378 | 76 | | return value.Contains(pattern, StringComparison.OrdinalIgnoreCase); |
| | | 77 | | } |
| | | 78 | | |
| | | 79 | | private readonly record struct CategoryRule( |
| | 116 | 80 | | SignatureVerificationCategory Category, |
| | 646 | 81 | | string[] AnyPatterns, |
| | 590 | 82 | | string[]? AllPatterns = null) |
| | | 83 | | { |
| | | 84 | | public bool IsMatch(string failureCode) |
| | | 85 | | { |
| | 3552 | 86 | | foreach (string pattern in AnyPatterns) |
| | | 87 | | { |
| | 1186 | 88 | | if (Matches(failureCode, pattern)) |
| | | 89 | | { |
| | 112 | 90 | | return true; |
| | | 91 | | } |
| | | 92 | | } |
| | | 93 | | |
| | 534 | 94 | | if (AllPatterns is null) |
| | | 95 | | { |
| | 482 | 96 | | return false; |
| | | 97 | | } |
| | | 98 | | |
| | 172 | 99 | | foreach (string pattern in AllPatterns) |
| | | 100 | | { |
| | 58 | 101 | | if (!Matches(failureCode, pattern)) |
| | | 102 | | { |
| | 48 | 103 | | return false; |
| | | 104 | | } |
| | | 105 | | } |
| | | 106 | | |
| | 4 | 107 | | return AllPatterns.Length > 0; |
| | | 108 | | } |
| | | 109 | | } |
| | | 110 | | } |