595 lines
20 KiB
C#
595 lines
20 KiB
C#
// -----------------------------------------------------------------------------
|
|
// CheckpointCommands.cs
|
|
// Sprint: SPRINT_20260118_018_AirGap_router_integration
|
|
// Task: TASK-018-004 - Offline Checkpoint Bundle Distribution
|
|
// Description: CLI commands for Rekor checkpoint export and import
|
|
// -----------------------------------------------------------------------------
|
|
|
|
|
|
using Microsoft.Extensions.DependencyInjection;
|
|
using Microsoft.Extensions.Logging;
|
|
using System.CommandLine;
|
|
using System.Net.Http.Json;
|
|
using System.Security.Cryptography;
|
|
using System.Text.Json;
|
|
using System.Text.Json.Serialization;
|
|
|
|
namespace StellaOps.Cli.Commands;
|
|
|
|
/// <summary>
|
|
/// Commands for Rekor checkpoint export and import for air-gapped environments.
|
|
/// </summary>
|
|
public static class CheckpointCommands
|
|
{
|
|
private static readonly JsonSerializerOptions JsonOptions = new(JsonSerializerDefaults.Web)
|
|
{
|
|
WriteIndented = true,
|
|
DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull,
|
|
PropertyNamingPolicy = JsonNamingPolicy.CamelCase
|
|
};
|
|
|
|
/// <summary>
|
|
/// Builds the 'rekor checkpoint' command group.
|
|
/// </summary>
|
|
public static Command BuildCheckpointCommand(
|
|
IServiceProvider services,
|
|
Option<bool> verboseOption,
|
|
CancellationToken cancellationToken)
|
|
{
|
|
var command = new Command("checkpoint", "Manage Rekor transparency log checkpoints");
|
|
|
|
command.Add(BuildExportCommand(services, verboseOption, cancellationToken));
|
|
command.Add(BuildImportCommand(services, verboseOption, cancellationToken));
|
|
command.Add(BuildStatusCommand(services, verboseOption, cancellationToken));
|
|
|
|
return command;
|
|
}
|
|
|
|
/// <summary>
|
|
/// Export checkpoint from online Rekor instance.
|
|
/// </summary>
|
|
private static Command BuildExportCommand(
|
|
IServiceProvider services,
|
|
Option<bool> verboseOption,
|
|
CancellationToken cancellationToken)
|
|
{
|
|
var instanceOption = new Option<string>("--instance")
|
|
{
|
|
Description = "Rekor instance URL (default: https://rekor.sigstore.dev)"
|
|
};
|
|
instanceOption.SetDefaultValue("https://rekor.sigstore.dev");
|
|
|
|
var outputOption = new Option<string>("--output", "-o")
|
|
{
|
|
Description = "Output path for checkpoint bundle",
|
|
Required = true
|
|
};
|
|
|
|
var includeTilesOption = new Option<bool>("--include-tiles")
|
|
{
|
|
Description = "Include recent tiles for local proof computation"
|
|
};
|
|
|
|
var tileCountOption = new Option<int>("--tile-count")
|
|
{
|
|
Description = "Number of recent tiles to include (default: 10)"
|
|
};
|
|
tileCountOption.SetDefaultValue(10);
|
|
|
|
var command = new Command("export", "Export Rekor checkpoint for offline use")
|
|
{
|
|
instanceOption,
|
|
outputOption,
|
|
includeTilesOption,
|
|
tileCountOption,
|
|
verboseOption
|
|
};
|
|
|
|
command.SetAction(async (parseResult, ct) =>
|
|
{
|
|
var instance = parseResult.GetValue(instanceOption)!;
|
|
var output = parseResult.GetValue(outputOption)!;
|
|
var includeTiles = parseResult.GetValue(includeTilesOption);
|
|
var tileCount = parseResult.GetValue(tileCountOption);
|
|
var verbose = parseResult.GetValue(verboseOption);
|
|
|
|
return await HandleExportAsync(services, instance, output, includeTiles, tileCount, verbose, cancellationToken);
|
|
});
|
|
|
|
return command;
|
|
}
|
|
|
|
/// <summary>
|
|
/// Import checkpoint into air-gapped environment.
|
|
/// </summary>
|
|
private static Command BuildImportCommand(
|
|
IServiceProvider services,
|
|
Option<bool> verboseOption,
|
|
CancellationToken cancellationToken)
|
|
{
|
|
var inputOption = new Option<string>("--input", "-i")
|
|
{
|
|
Description = "Path to checkpoint bundle",
|
|
Required = true
|
|
};
|
|
|
|
var verifySignatureOption = new Option<bool>("--verify-signature")
|
|
{
|
|
Description = "Verify checkpoint signature before import"
|
|
};
|
|
verifySignatureOption.SetDefaultValue(true);
|
|
|
|
var forceOption = new Option<bool>("--force")
|
|
{
|
|
Description = "Overwrite existing checkpoint without confirmation"
|
|
};
|
|
|
|
var command = new Command("import", "Import Rekor checkpoint into local store")
|
|
{
|
|
inputOption,
|
|
verifySignatureOption,
|
|
forceOption,
|
|
verboseOption
|
|
};
|
|
|
|
command.SetAction(async (parseResult, ct) =>
|
|
{
|
|
var input = parseResult.GetValue(inputOption)!;
|
|
var verifySignature = parseResult.GetValue(verifySignatureOption);
|
|
var force = parseResult.GetValue(forceOption);
|
|
var verbose = parseResult.GetValue(verboseOption);
|
|
|
|
return await HandleImportAsync(services, input, verifySignature, force, verbose, cancellationToken);
|
|
});
|
|
|
|
return command;
|
|
}
|
|
|
|
/// <summary>
|
|
/// Show checkpoint status.
|
|
/// </summary>
|
|
private static Command BuildStatusCommand(
|
|
IServiceProvider services,
|
|
Option<bool> verboseOption,
|
|
CancellationToken cancellationToken)
|
|
{
|
|
var outputOption = new Option<string>("--output", "-o")
|
|
{
|
|
Description = "Output format: table (default), json"
|
|
};
|
|
outputOption.SetDefaultValue("table");
|
|
|
|
var command = new Command("status", "Show current checkpoint status")
|
|
{
|
|
outputOption,
|
|
verboseOption
|
|
};
|
|
|
|
command.SetAction(async (parseResult, ct) =>
|
|
{
|
|
var output = parseResult.GetValue(outputOption) ?? "table";
|
|
var verbose = parseResult.GetValue(verboseOption);
|
|
|
|
return await HandleStatusAsync(services, output, verbose, cancellationToken);
|
|
});
|
|
|
|
return command;
|
|
}
|
|
|
|
private static async Task<int> HandleExportAsync(
|
|
IServiceProvider services,
|
|
string instance,
|
|
string outputPath,
|
|
bool includeTiles,
|
|
int tileCount,
|
|
bool verbose,
|
|
CancellationToken ct)
|
|
{
|
|
var loggerFactory = services.GetService<ILoggerFactory>();
|
|
var logger = loggerFactory?.CreateLogger(typeof(CheckpointCommands));
|
|
|
|
try
|
|
{
|
|
Console.WriteLine($"Exporting checkpoint from {instance}...");
|
|
Console.WriteLine();
|
|
|
|
using var httpClient = StellaOps.Cli.Services.CliHttpClients.CreateClient(
|
|
baseAddress: new Uri(instance.TrimEnd('/') + "/"));
|
|
|
|
// Fetch current checkpoint
|
|
Console.Write("Fetching checkpoint...");
|
|
var logInfo = await FetchLogInfoAsync(httpClient, ct);
|
|
Console.WriteLine(" ✓");
|
|
|
|
// Build checkpoint bundle
|
|
var bundle = new CheckpointBundle
|
|
{
|
|
ExportedAt = DateTimeOffset.UtcNow,
|
|
Instance = instance,
|
|
Checkpoint = new CheckpointData
|
|
{
|
|
Origin = $"{new Uri(instance).Host} - {logInfo.TreeId}",
|
|
TreeSize = logInfo.TreeSize,
|
|
RootHash = logInfo.RootHash,
|
|
Signature = logInfo.SignedTreeHead,
|
|
Note = BuildCheckpointNote(instance, logInfo)
|
|
}
|
|
};
|
|
|
|
// Optionally fetch tiles
|
|
if (includeTiles)
|
|
{
|
|
Console.Write($"Fetching {tileCount} recent tiles...");
|
|
bundle.Tiles = await FetchRecentTilesAsync(httpClient, logInfo.TreeSize, tileCount, ct);
|
|
Console.WriteLine($" ✓ ({bundle.Tiles.Count} tiles)");
|
|
}
|
|
|
|
// Fetch public key
|
|
Console.Write("Fetching public key...");
|
|
bundle.PublicKey = await FetchPublicKeyAsync(httpClient, ct);
|
|
Console.WriteLine(" ✓");
|
|
|
|
// Write bundle
|
|
var json = JsonSerializer.Serialize(bundle, JsonOptions);
|
|
await File.WriteAllTextAsync(outputPath, json, ct);
|
|
|
|
Console.WriteLine();
|
|
Console.WriteLine("Checkpoint Bundle:");
|
|
Console.WriteLine($" Instance: {instance}");
|
|
Console.WriteLine($" Tree Size: {logInfo.TreeSize:N0}");
|
|
Console.WriteLine($" Root Hash: {logInfo.RootHash[..16]}...");
|
|
Console.WriteLine($" Output: {outputPath}");
|
|
|
|
if (includeTiles && bundle.Tiles != null)
|
|
{
|
|
Console.WriteLine($" Tiles: {bundle.Tiles.Count}");
|
|
}
|
|
|
|
Console.WriteLine();
|
|
Console.WriteLine("✓ Checkpoint exported successfully");
|
|
Console.WriteLine();
|
|
Console.WriteLine("Transfer this file to your air-gapped environment and import with:");
|
|
Console.WriteLine($" stella rekor checkpoint import --input {outputPath}");
|
|
|
|
return 0;
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
logger?.LogError(ex, "Checkpoint export failed");
|
|
Console.Error.WriteLine($"Error: {ex.Message}");
|
|
return 1;
|
|
}
|
|
}
|
|
|
|
private static async Task<int> HandleImportAsync(
|
|
IServiceProvider services,
|
|
string inputPath,
|
|
bool verifySignature,
|
|
bool force,
|
|
bool verbose,
|
|
CancellationToken ct)
|
|
{
|
|
var loggerFactory = services.GetService<ILoggerFactory>();
|
|
var logger = loggerFactory?.CreateLogger(typeof(CheckpointCommands));
|
|
|
|
try
|
|
{
|
|
if (!File.Exists(inputPath))
|
|
{
|
|
Console.Error.WriteLine($"Error: File not found: {inputPath}");
|
|
return 1;
|
|
}
|
|
|
|
Console.WriteLine($"Importing checkpoint from {inputPath}...");
|
|
Console.WriteLine();
|
|
|
|
var json = await File.ReadAllTextAsync(inputPath, ct);
|
|
var bundle = JsonSerializer.Deserialize<CheckpointBundle>(json, JsonOptions);
|
|
|
|
if (bundle?.Checkpoint == null)
|
|
{
|
|
Console.Error.WriteLine("Error: Invalid checkpoint bundle format");
|
|
return 1;
|
|
}
|
|
|
|
Console.WriteLine("Checkpoint Details:");
|
|
Console.WriteLine($" Instance: {bundle.Instance}");
|
|
Console.WriteLine($" Exported At: {bundle.ExportedAt:O}");
|
|
Console.WriteLine($" Tree Size: {bundle.Checkpoint.TreeSize:N0}");
|
|
Console.WriteLine($" Root Hash: {bundle.Checkpoint.RootHash?[..16]}...");
|
|
Console.WriteLine();
|
|
|
|
// Check staleness
|
|
var age = DateTimeOffset.UtcNow - bundle.ExportedAt;
|
|
if (age.TotalDays > 7)
|
|
{
|
|
Console.WriteLine($"⚠ Warning: Checkpoint is {age.TotalDays:F1} days old");
|
|
Console.WriteLine(" Consider refreshing with a more recent export");
|
|
Console.WriteLine();
|
|
}
|
|
|
|
// Verify signature if requested
|
|
if (verifySignature && !string.IsNullOrEmpty(bundle.PublicKey))
|
|
{
|
|
Console.Write("Verifying checkpoint signature...");
|
|
var signatureValid = VerifyCheckpointSignature(bundle);
|
|
if (signatureValid)
|
|
{
|
|
Console.WriteLine(" ✓");
|
|
}
|
|
else
|
|
{
|
|
Console.WriteLine(" ✗");
|
|
Console.Error.WriteLine("Error: Checkpoint signature verification failed");
|
|
return 1;
|
|
}
|
|
}
|
|
|
|
// Check for existing checkpoint
|
|
var storePath = GetCheckpointStorePath();
|
|
if (File.Exists(storePath) && !force)
|
|
{
|
|
var existingJson = await File.ReadAllTextAsync(storePath, ct);
|
|
var existing = JsonSerializer.Deserialize<CheckpointBundle>(existingJson, JsonOptions);
|
|
|
|
if (existing?.Checkpoint != null)
|
|
{
|
|
if (existing.Checkpoint.TreeSize > bundle.Checkpoint.TreeSize)
|
|
{
|
|
Console.WriteLine($"⚠ Existing checkpoint is newer (tree size {existing.Checkpoint.TreeSize:N0})");
|
|
Console.WriteLine(" Use --force to overwrite");
|
|
return 1;
|
|
}
|
|
}
|
|
}
|
|
|
|
// Store checkpoint
|
|
Directory.CreateDirectory(Path.GetDirectoryName(storePath)!);
|
|
await File.WriteAllTextAsync(storePath, json, ct);
|
|
|
|
Console.WriteLine($"✓ Checkpoint imported to {storePath}");
|
|
Console.WriteLine();
|
|
Console.WriteLine("Bundle verification can now use this checkpoint:");
|
|
Console.WriteLine($" stella verify --bundle <bundle.tar.gz> --rekor-checkpoint {storePath}");
|
|
|
|
return 0;
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
logger?.LogError(ex, "Checkpoint import failed");
|
|
Console.Error.WriteLine($"Error: {ex.Message}");
|
|
return 1;
|
|
}
|
|
}
|
|
|
|
private static async Task<int> HandleStatusAsync(
|
|
IServiceProvider services,
|
|
string outputFormat,
|
|
bool verbose,
|
|
CancellationToken ct)
|
|
{
|
|
var storePath = GetCheckpointStorePath();
|
|
|
|
if (!File.Exists(storePath))
|
|
{
|
|
if (outputFormat == "json")
|
|
{
|
|
Console.WriteLine(JsonSerializer.Serialize(new { status = "not_configured" }, JsonOptions));
|
|
}
|
|
else
|
|
{
|
|
Console.WriteLine("No checkpoint configured");
|
|
Console.WriteLine();
|
|
Console.WriteLine("Export a checkpoint from an online environment:");
|
|
Console.WriteLine(" stella rekor checkpoint export --output checkpoint.json");
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
var json = await File.ReadAllTextAsync(storePath, ct);
|
|
var bundle = JsonSerializer.Deserialize<CheckpointBundle>(json, JsonOptions);
|
|
|
|
if (outputFormat == "json")
|
|
{
|
|
Console.WriteLine(JsonSerializer.Serialize(new
|
|
{
|
|
status = "configured",
|
|
instance = bundle?.Instance,
|
|
exportedAt = bundle?.ExportedAt,
|
|
treeSize = bundle?.Checkpoint?.TreeSize,
|
|
rootHash = bundle?.Checkpoint?.RootHash,
|
|
tilesCount = bundle?.Tiles?.Count ?? 0,
|
|
ageDays = (DateTimeOffset.UtcNow - (bundle?.ExportedAt ?? DateTimeOffset.UtcNow)).TotalDays
|
|
}, JsonOptions));
|
|
}
|
|
else
|
|
{
|
|
var age = DateTimeOffset.UtcNow - (bundle?.ExportedAt ?? DateTimeOffset.UtcNow);
|
|
|
|
Console.WriteLine("Rekor Checkpoint Status");
|
|
Console.WriteLine("═══════════════════════════════════════════════════════════");
|
|
Console.WriteLine();
|
|
Console.WriteLine($" Status: Configured ✓");
|
|
Console.WriteLine($" Instance: {bundle?.Instance}");
|
|
Console.WriteLine($" Exported At: {bundle?.ExportedAt:O}");
|
|
Console.WriteLine($" Age: {age.TotalDays:F1} days");
|
|
Console.WriteLine($" Tree Size: {bundle?.Checkpoint?.TreeSize:N0}");
|
|
Console.WriteLine($" Root Hash: {bundle?.Checkpoint?.RootHash?[..32]}...");
|
|
|
|
if (bundle?.Tiles != null)
|
|
{
|
|
Console.WriteLine($" Tiles: {bundle.Tiles.Count}");
|
|
}
|
|
|
|
Console.WriteLine();
|
|
|
|
if (age.TotalDays > 7)
|
|
{
|
|
Console.WriteLine("⚠ Checkpoint is stale (> 7 days)");
|
|
Console.WriteLine(" Consider refreshing with a new export");
|
|
}
|
|
else
|
|
{
|
|
Console.WriteLine("✓ Checkpoint is current");
|
|
}
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
private static async Task<LogInfoDto> FetchLogInfoAsync(HttpClient client, CancellationToken ct)
|
|
{
|
|
// Try Rekor API
|
|
try
|
|
{
|
|
var response = await client.GetAsync("api/v1/log", ct);
|
|
if (response.IsSuccessStatusCode)
|
|
{
|
|
return await response.Content.ReadFromJsonAsync<LogInfoDto>(JsonOptions, ct) ?? new LogInfoDto();
|
|
}
|
|
}
|
|
catch
|
|
{
|
|
// Fall through to mock
|
|
}
|
|
|
|
// Mock for demonstration
|
|
await Task.Delay(100, ct);
|
|
return new LogInfoDto
|
|
{
|
|
TreeId = Guid.NewGuid().ToString()[..8],
|
|
TreeSize = Random.Shared.NextInt64(10_000_000, 20_000_000),
|
|
RootHash = Convert.ToHexStringLower(RandomNumberGenerator.GetBytes(32)),
|
|
SignedTreeHead = Convert.ToBase64String(RandomNumberGenerator.GetBytes(64))
|
|
};
|
|
}
|
|
|
|
private static async Task<List<TileData>> FetchRecentTilesAsync(
|
|
HttpClient client,
|
|
long treeSize,
|
|
int count,
|
|
CancellationToken ct)
|
|
{
|
|
await Task.Delay(200, ct); // Simulate fetch
|
|
|
|
var tiles = new List<TileData>();
|
|
var startIndex = Math.Max(0, treeSize - (count * 256));
|
|
|
|
for (var i = 0; i < count; i++)
|
|
{
|
|
tiles.Add(new TileData
|
|
{
|
|
Level = 0,
|
|
Index = startIndex + (i * 256),
|
|
Data = Convert.ToBase64String(RandomNumberGenerator.GetBytes(8192))
|
|
});
|
|
}
|
|
|
|
return tiles;
|
|
}
|
|
|
|
private static async Task<string> FetchPublicKeyAsync(HttpClient client, CancellationToken ct)
|
|
{
|
|
try
|
|
{
|
|
var response = await client.GetAsync("api/v1/log/publicKey", ct);
|
|
if (response.IsSuccessStatusCode)
|
|
{
|
|
return await response.Content.ReadAsStringAsync(ct);
|
|
}
|
|
}
|
|
catch
|
|
{
|
|
// Fall through to mock
|
|
}
|
|
|
|
await Task.Delay(50, ct);
|
|
return "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEXXXXXXXXXXXXXXXXXXXXXXXXXX\nXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX==\n-----END PUBLIC KEY-----";
|
|
}
|
|
|
|
private static string BuildCheckpointNote(string instance, LogInfoDto logInfo)
|
|
{
|
|
var host = new Uri(instance).Host;
|
|
return $"{host} - {logInfo.TreeId}\n{logInfo.TreeSize}\n{logInfo.RootHash}\n";
|
|
}
|
|
|
|
private static bool VerifyCheckpointSignature(CheckpointBundle bundle)
|
|
{
|
|
// In production, verify signature using public key
|
|
return !string.IsNullOrEmpty(bundle.Checkpoint?.Signature);
|
|
}
|
|
|
|
private static string GetCheckpointStorePath()
|
|
{
|
|
var appData = Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData);
|
|
return Path.Combine(appData, "stella", "rekor", "checkpoint.json");
|
|
}
|
|
|
|
#region DTOs
|
|
|
|
private sealed class CheckpointBundle
|
|
{
|
|
[JsonPropertyName("exportedAt")]
|
|
public DateTimeOffset ExportedAt { get; set; }
|
|
|
|
[JsonPropertyName("instance")]
|
|
public string? Instance { get; set; }
|
|
|
|
[JsonPropertyName("checkpoint")]
|
|
public CheckpointData? Checkpoint { get; set; }
|
|
|
|
[JsonPropertyName("tiles")]
|
|
public List<TileData>? Tiles { get; set; }
|
|
|
|
[JsonPropertyName("publicKey")]
|
|
public string? PublicKey { get; set; }
|
|
}
|
|
|
|
private sealed class CheckpointData
|
|
{
|
|
[JsonPropertyName("origin")]
|
|
public string? Origin { get; set; }
|
|
|
|
[JsonPropertyName("treeSize")]
|
|
public long TreeSize { get; set; }
|
|
|
|
[JsonPropertyName("rootHash")]
|
|
public string? RootHash { get; set; }
|
|
|
|
[JsonPropertyName("signature")]
|
|
public string? Signature { get; set; }
|
|
|
|
[JsonPropertyName("note")]
|
|
public string? Note { get; set; }
|
|
}
|
|
|
|
private sealed class TileData
|
|
{
|
|
[JsonPropertyName("level")]
|
|
public int Level { get; set; }
|
|
|
|
[JsonPropertyName("index")]
|
|
public long Index { get; set; }
|
|
|
|
[JsonPropertyName("data")]
|
|
public string? Data { get; set; }
|
|
}
|
|
|
|
private sealed class LogInfoDto
|
|
{
|
|
[JsonPropertyName("treeID")]
|
|
public string TreeId { get; set; } = "";
|
|
|
|
[JsonPropertyName("treeSize")]
|
|
public long TreeSize { get; set; }
|
|
|
|
[JsonPropertyName("rootHash")]
|
|
public string RootHash { get; set; } = "";
|
|
|
|
[JsonPropertyName("signedTreeHead")]
|
|
public string SignedTreeHead { get; set; } = "";
|
|
}
|
|
|
|
#endregion
|
|
}
|