trestle.core.commands.verify

class VerifyCmd(CommandBase):
    """Verify a JSON file against a detached DSSE provenance envelope.

    Verification performs two checks. First, it verifies the DSSE signature
    over the DSSE pre-authentication encoding for the in-toto Statement payload
    using the provided PEM public key. Second, it canonicalizes the input JSON
    using RFC 8785, computes its digest with the signed algorithm, and confirms that the
    digest matches the subject digest recorded in the signed Statement.

    Both checks are required: the digest proves the file matches the signed
    subject, and the DSSE signature proves the Statement was signed by the
    corresponding private key. If the envelope was signed with a custom subject
    name, pass that same value with --subject-name.
    """

    name = 'verify'

    def _init_arguments(self) -> None:
        self.add_argument('-f', '--file', help='Path to the JSON file to verify.', required=True, type=pathlib.Path)
        self.add_argument('--signature', help='Path to the detached DSSE envelope.', required=True, type=pathlib.Path)
        self.add_argument(
            '--public-key', help='Path to the PEM public key for verification.', required=True, type=pathlib.Path
        )
        self.add_argument(
            '--digest-algorithm',
            choices=[algorithm.value for algorithm in Algorithm],
            help='Require this artifact digest algorithm. By default, detect it from the signed Statement.',
        )
        self.add_argument(
            '--subject-name',
            help='Subject name expected in the in-toto Statement. Defaults to the input file name.',
            default=None,
        )

    @beta_feature('json-signing')
    def _run(self, args: argparse.Namespace) -> int:
        """Verify a JSON file."""
        try:
            log.set_log_level_from_args(args)
            self.verify(
                args.file,
                args.signature,
                args.public_key,
                args.subject_name,
                digest_algorithm=Algorithm(args.digest_algorithm) if args.digest_algorithm else None,
            )
            return CmdReturnCodes.SUCCESS.value
        except Exception as e:  # pragma: no cover
            return handle_generic_command_exception(e, logger, 'Error while verifying JSON signature')

    @classmethod
    def verify(
        cls,
        input_path: pathlib.Path,
        signature_path: pathlib.Path,
        public_key_path: pathlib.Path,
        subject_name: Optional[str] = None,
        digest_algorithm: Optional[Algorithm] = None,
    ) -> None:
        """Verify a detached DSSE provenance envelope for a JSON file."""
        public_key = load_pem_public_key(public_key_path.resolve())
        envelope = load_dsse_envelope(signature_path.resolve())
        verify_oscal_provenance_envelope(input_path.resolve(), envelope, public_key, subject_name, digest_algorithm)