Using OpenChainGraph with in-toto Envelopes

{
  "@context": "https://ainumbers.co/chaingraph/context/v0.3",
  "tool_id": "var_frtb_ima_calculator_v1",
  "mandate_type": "market_risk",
  "policy_parameters": {
    "confidence_level": 0.99,
    "holding_period_days": 10,
    "portfolio_id": "FX-DESK-Q3"
  },
  "output_payload": {
    "var_10d_99": 2847300,
    "es_97_5": 3190500,
    "breaches_250d": 4
  },
  "execution_hash": "sha256:f3a91e4b2c87d650...",
  "buildType": "https://ainumbers.co/chaingraph/context/v0.2#WebCryptoSHA256",
  "chain": {
    "parent_hashes": ["sha256:a4c2f8e1b7d93..."],
    "depth": 1,
    "chain_name": "q3_market_risk_review"
  },
  "audit_signature": {
    "payloadType": "application/vnd.openchain.graph+json;version=0.2",
    "payload": "eyJAY29udGV4dCI6Imh0dHBzOi8vb3Bl...",  // base64url of canonical artifact body
    "signatures": [
      {
        "keyid": "sha256:8f3a2b1c94e7d60f5a8e...",  // fingerprint of signing Ed25519 pubkey
        "sig":   "ZXhhbXBsZXNpZ25hdHVyZWJ5dGVzNjQ..."   // base64url Ed25519 sig over PAE(payloadType, payload)
      }
    ]
  }
}

PAE(type, body) =
    "DSSEv1" + SP + LEN(type) + SP + type + SP + LEN(body) + SP + body

Where:
    SP     = 0x20 (ASCII space)
    LEN(x) = ASCII decimal encoding of len(x) in bytes
    type   = UTF-8 encoded payloadType string
    body   = raw bytes of the base64url-decoded payload

Example for an OCG artifact:
    PAE("application/vnd.openchain.graph+json;version=0.2", <canonical_bytes>)
    = "DSSEv1 46 application/vnd.openchain.graph+json;version=0.2 <N> <canonical_bytes>"
      where 46 = len("application/vnd.openchain.graph+json;version=0.2")
      and N  = byte length of the canonical artifact JSON

// Construct the PAE byte sequence from payloadType and canonical payload bytes
function buildPae(payloadType, payloadBytes) {
  const enc = new TextEncoder();
  const typeBytes  = enc.encode(payloadType);
  const typeLen    = enc.encode(String(typeBytes.length));
  const bodyLen    = enc.encode(String(payloadBytes.length));
  const prefix     = enc.encode("DSSEv1 ");
  const sp         = enc.encode(" ");

  // Concatenate: "DSSEv1 " + typeLen + " " + typeBytes + " " + bodyLen + " " + payloadBytes
  const total = prefix.length + typeLen.length + 1 + typeBytes.length + 1 + bodyLen.length + 1 + payloadBytes.length;
  const pae = new Uint8Array(total);
  let offset = 0;
  for (const chunk of [prefix, typeLen, sp, typeBytes, sp, bodyLen, sp, payloadBytes]) {
    pae.set(chunk, offset);
    offset += chunk.length;
  }
  return pae;
}

// Canonical payload: artifact minus audit_signature, keys sorted, UTF-8
function canonicalize(artifact) {
  const body = { ...artifact };
  delete body.audit_signature;
  return new TextEncoder().encode(sortedStringify(body));
}

function sortedStringify(obj) {
  if (obj === null || typeof obj !== 'object' || Array.isArray(obj)) {
    return JSON.stringify(obj);
  }
  const sorted = {};
  for (const key of Object.keys(obj).sort()) {
    sorted[key] = JSON.parse(sortedStringify(obj[key]));
  }
  return JSON.stringify(sorted);
}

/**
 * Produce a DSSE in-toto audit_signature envelope for an OCG v0.3 artifact.
 *
 * @param {object}    artifact  - OCG artifact object (must NOT already have audit_signature)
 * @param {CryptoKey} privateKey - Ed25519 private key (WebCrypto CryptoKey, "sign" usage)
 * @param {CryptoKey} publicKey  - Ed25519 public key (for keyid derivation)
 * @returns {Promise<object>}   - The envelope object to assign to artifact.audit_signature
 */
async function produceEnvelope(artifact, privateKey, publicKey) {
  const PAYLOAD_TYPE = "application/vnd.openchain.graph+json;version=0.2";

  // 1. Canonical payload bytes (artifact without audit_signature, keys sorted)
  const payloadBytes = canonicalize(artifact);

  // 2. base64url-encode the payload (no padding)
  const payloadB64 = base64urlEncode(payloadBytes);

  // 3. Construct PAE byte sequence
  const pae = buildPae(PAYLOAD_TYPE, payloadBytes);

  // 4. Sign PAE with Ed25519 private key
  const sigBytes = new Uint8Array(
    await crypto.subtle.sign("Ed25519", privateKey, pae)
  );

  // 5. Derive keyid: SHA-256 of raw 32-byte public key, hex-encoded
  const pubKeyRaw = new Uint8Array(await crypto.subtle.exportKey("raw", publicKey));
  const keyidHash  = new Uint8Array(await crypto.subtle.digest("SHA-256", pubKeyRaw));
  const keyid = "sha256:" + Array.from(keyidHash).map(b => b.toString(16).padStart(2, "0")).join("");

  // 6. Return the complete envelope
  return {
    payloadType: PAYLOAD_TYPE,
    payload:    payloadB64,
    signatures: [{
      keyid: keyid,
      sig:   base64urlEncode(sigBytes)
    }]
  };
}

// Utility: base64url encode (RFC 4648 §5, no padding)
function base64urlEncode(bytes) {
  return btoa(String.fromCharCode(...bytes))
    .replace(/\+/g, "-")
    .replace(/\//g, "_")
    .replace(/=/g, "");
}

// Usage
const keyPair = await crypto.subtle.generateKey(
  { name: "Ed25519" }, true, ["sign", "verify"]
);
const envelope = await produceEnvelope(artifact, keyPair.privateKey, keyPair.publicKey);
artifact.audit_signature = envelope;

/**
 * Verify the audit_signature envelope of an OCG v0.3 artifact.
 *
 * @param {object}    artifact  - Complete OCG artifact including audit_signature
 * @param {CryptoKey} publicKey - Ed25519 public key of the expected signer
 * @returns {Promise<{valid: boolean, keyid: string, payloadMatch: boolean, details: object}>}
 */
async function verifyEnvelope(artifact, publicKey) {
  const env = artifact.audit_signature;
  if (!env || !env.payloadType || !env.payload || !env.signatures?.length) {
    return { valid: false, details: { error: "Missing or malformed envelope" } };
  }

  // 1. Check payloadType
  if (env.payloadType !== "application/vnd.openchain.graph+json;version=0.2") {
    return { valid: false, details: { error: "Unexpected payloadType: " + env.payloadType } };
  }

  // 2. Decode payload bytes from base64url
  const payloadBytes = base64urlDecode(env.payload);

  // 3. Reconstruct PAE
  const pae = buildPae(env.payloadType, payloadBytes);

  // 4. Derive expected keyid from supplied public key
  const pubKeyRaw  = new Uint8Array(await crypto.subtle.exportKey("raw", publicKey));
  const keyidHash  = new Uint8Array(await crypto.subtle.digest("SHA-256", pubKeyRaw));
  const expectedKeyid = "sha256:" + Array.from(keyidHash).map(b => b.toString(16).padStart(2, "0")).join("");

  // 5. Find matching signature entry
  const sigEntry = env.signatures.find(s => s.keyid === expectedKeyid);
  if (!sigEntry) {
    return { valid: false, keyid: expectedKeyid, details: { error: "No signature entry matches supplied public key" } };
  }

  // 6. Verify Ed25519 signature over PAE
  const sigBytes = base64urlDecode(sigEntry.sig);
  const sigValid = await crypto.subtle.verify("Ed25519", publicKey, sigBytes, pae);

  // 7. Confirm decoded payload matches artifact body (without audit_signature)
  const expectedBytes  = canonicalize(artifact);
  const payloadMatch   = bytesEqual(payloadBytes, expectedBytes);

  return {
    valid:        sigValid && payloadMatch,
    keyid:        expectedKeyid,
    payloadMatch: payloadMatch,
    sigValid:     sigValid,
    details: {
      payloadLengthBytes: payloadBytes.length,
      sigLengthBytes:     sigBytes.length
    }
  };
}

// Utility: base64url decode
function base64urlDecode(str) {
  const b64 = str.replace(/-/g, "+").replace(/_/g, "/").padEnd(str.length + ((4 - str.length % 4) % 4), "=");
  return Uint8Array.from(atob(b64), c => c.charCodeAt(0));
}

function bytesEqual(a, b) {
  if (a.length !== b.length) return false;
  for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return false;
  return true;
}

// Usage
const result = await verifyEnvelope(artifact, vendorPublicKey);
console.log(result.valid ? "✓ Valid signature" : "✗ Invalid: " + JSON.stringify(result.details));

import json, hashlib, base64
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey

def sorted_stringify(obj):
    """Deterministic canonical JSON — sort keys recursively."""
    if not isinstance(obj, dict):
        return json.dumps(obj, separators=(',', ':'))
    sorted_obj = {k: json.loads(sorted_stringify(obj[k])) for k in sorted(obj)}
    return json.dumps(sorted_obj, separators=(',', ':'))

def build_pae(payload_type: str, payload_bytes: bytes) -> bytes:
    """Construct PAE(type, body) per DSSE spec."""
    t = payload_type.encode()
    return (
        b"DSSEv1 "
        + str(len(t)).encode() + b" " + t
        + b" " + str(len(payload_bytes)).encode() + b" "
        + payload_bytes
    )

def verify_ocg_envelope(artifact: dict, public_key: Ed25519PublicKey) -> dict:
    """
    Verify the audit_signature DSSE envelope of an OCG v0.3 artifact.
    Returns dict with keys: valid, sig_valid, payload_match, keyid, error (if any).
    """
    env = artifact.get("audit_signature", {})
    if not env or env.get("payloadType") != "application/vnd.openchain.graph+json;version=0.2":
        return {"valid": False, "error": "Missing or wrong payloadType"}

    # 1. Decode payload
    payload_bytes = base64.urlsafe_b64decode(env["payload"] + "==")

    # 2. Build PAE
    pae = build_pae(env["payloadType"], payload_bytes)

    # 3. Derive expected keyid from public key
    pub_raw   = public_key.public_bytes_raw()
    keyid     = "sha256:" + hashlib.sha256(pub_raw).hexdigest()

    # 4. Find matching signature entry
    sig_entry = next((s for s in env.get("signatures", []) if s["keyid"] == keyid), None)
    if not sig_entry:
        return {"valid": False, "keyid": keyid, "error": "No matching keyid in signatures[]"}

    # 5. Verify Ed25519 signature
    sig_bytes = base64.urlsafe_b64decode(sig_entry["sig"] + "==")
    sig_valid = False
    try:
        public_key.verify(sig_bytes, pae)
        sig_valid = True
    except Exception:
        pass

    # 6. Confirm payload matches artifact body (without audit_signature)
    body = {k: v for k, v in artifact.items() if k != "audit_signature"}
    expected_bytes = sorted_stringify(body).encode()
    payload_match  = (payload_bytes == expected_bytes)

    return {
        "valid":         sig_valid and payload_match,
        "sig_valid":     sig_valid,
        "payload_match": payload_match,
        "keyid":         keyid,
    }

# Example usage
import json
artifact = json.load(open("artifact.json"))
# public_key loaded from PEM or raw bytes via cryptography library
result = verify_ocg_envelope(artifact, public_key)
print("✓ Valid" if result["valid"] else f"✗ Invalid: {result}")

/**
 * Add a co-signer's signature to an existing audit_signature envelope.
 * The original signatures[] entries are preserved unchanged.
 */
async function coSign(artifact, coSignerPrivateKey, coSignerPublicKey) {
  const env = artifact.audit_signature;
  if (!env) throw new Error("No envelope to co-sign");

  // Payload bytes are already encoded in the envelope — decode and re-sign
  const payloadBytes = base64urlDecode(env.payload);
  const pae          = buildPae(env.payloadType, payloadBytes);

  const sigBytes = new Uint8Array(await crypto.subtle.sign("Ed25519", coSignerPrivateKey, pae));

  const pubKeyRaw = new Uint8Array(await crypto.subtle.exportKey("raw", coSignerPublicKey));
  const keyidHash = new Uint8Array(await crypto.subtle.digest("SHA-256", pubKeyRaw));
  const keyid     = "sha256:" + Array.from(keyidHash).map(b => b.toString(16).padStart(2, "0")).join("");

  // Append — do not replace existing signatures
  env.signatures.push({ keyid, sig: base64urlEncode(sigBytes) });
  return artifact;
}

/**
 * Extract the audit_signature envelope as a cosign-compatible in-toto bundle.
 * The resulting file can be passed to `cosign attest --predicate` or
 * submitted to Rekor as a `hashedrekord` entry.
 */
function extractIntotoBundle(artifact) {
  const env = artifact.audit_signature;
  if (!env) throw new Error("No audit_signature envelope present");

  // in-toto v1 Statement wrapped around the envelope
  return {
    "_type":         "https://in-toto.io/Statement/v1",
    "predicateType": "application/vnd.openchain.graph+json;version=0.2",
    "subject": [{
      "name":   artifact.tool_id,
      "digest": {
        "sha256": artifact.execution_hash.replace(/^sha256:/, "")
      }
    }],
    "predicate": {
      "envelope":   env,
      "buildType":  artifact.buildType,
      "toolId":     artifact.tool_id,
      "mandateType": artifact.mandate_type,
      "chainDepth": artifact.chain?.depth ?? 0
    }
  };
}

// Write to file for cosign / Rekor submission
const bundle  = extractIntotoBundle(artifact);
const bundleJSON = JSON.stringify(bundle, null, 2);
// Node: fs.writeFileSync("bundle.intoto.json", bundleJSON)
// Browser: trigger download via Blob/createObjectURL

# Submit the extracted bundle as a Rekor hashedrekord entry
rekor-cli upload \
  --type intoto \
  --artifact bundle.intoto.json \
  --pki-format x509 \
  --public-key cosign.pub

# Verify via cosign
cosign verify-attestation \
  --type intoto \
  --certificate-identity-regexp ".*ainumbers.co.*" \
  --rekor-url https://rekor.sigstore.dev \
  "${ARTIFACT_URI}"

# Or: verify the local file directly against a known public key
cosign verify-blob \
  --key cosign.pub \
  --signature <(jq -r '.predicate.envelope.signatures[0].sig' bundle.intoto.json | base64 -d) \
  bundle.intoto.json