Introduce goal signing and verification

lib/api-helper/command/generator/generatorCommand.ts

@@ -52,6 +52,7 @@ import { StartingPoint } from "../../../api/registration/GeneratorRegistration";
 import { constructProvenance } from "../../goal/storeGoals";
 import {
     CommandListenerExecutionInterruptError,
+    resolveCredentialsPromise,
     toCommandListenerInvocation,
 } from "../../machine/handlerRegistrations";
 import { projectLoaderRepoLoader } from "../../machine/projectLoaderRepoLoader";
@@ -229,6 +230,7 @@ async function computeStartingPoint<P extends SeedDrivenGeneratorParameters>(par
             ...toCommandListenerInvocation(cr, ctx, params, sdmo),
             ...params,
         };
+        pi.credentials = await resolveCredentialsPromise(pi.credentials);
         // It's a function that takes the parameters and returns either a project or a RemoteRepoRef
         const rr: RemoteRepoRef | Project | Promise<Project> = (startingPoint as any)(pi);
         if (isProjectPromise(rr)) {

lib/api-helper/machine/handlerRegistrations.ts

@@ -28,6 +28,7 @@ import {
     NoParameters,
     OnCommand,
     Project,
+    ProjectOperationCredentials,
     RemoteRepoRef,
     RepoFinder,
     RepoLoader,
@@ -129,6 +130,7 @@ export function codeTransformRegistrationToCommand(sdm: MachineOrMachineOptions,
         description,
         ...ctr as CommandRegistration<any>,
         listener: async ci => {
+            ci.credentials = await resolveCredentialsPromise(ci.credentials);
             const targets = (ci.parameters as RepoTargetingParameters).targets;
             const vr = targets.bindAndValidate();
             if (isValidationError(vr)) {
@@ -182,6 +184,7 @@ export function codeInspectionRegistrationToCommand<R>(sdm: MachineOrMachineOpti
         description,
         ...cir as CommandRegistration<any>,
         listener: async ci => {
+            ci.credentials = await resolveCredentialsPromise(ci.credentials);
             const targets = (ci.parameters as RepoTargetingParameters).targets;
             const vr = targets.bindAndValidate();
             if (isValidationError(vr)) {
@@ -298,6 +301,7 @@ function toOnCommand<PARAMS>(c: CommandHandlerRegistration<any>): (sdm: MachineO
     addParametersDefinedInBuilder(c);
     return sdm => async (context, parameters) => {
         const cli = toCommandListenerInvocation(c, context, parameters, toMachineOptions(sdm));
+        cli.credentials = await resolveCredentialsPromise(cli.credentials);
         try {
             await c.listener(cli);
             return Success;
@@ -480,6 +484,7 @@ function toProjectEditor<P>(ct: CodeTransform<P>,
                             sdm: SoftwareDeliveryMachineOptions): ProjectEditor<P> {
     return async (p, ctx, params) => {
         const ci = toCommandListenerInvocation(p, ctx, params, toMachineOptions(sdm));
+        ci.credentials = await resolveCredentialsPromise(ci.credentials);
         // Mix in handler context for old style callers
         const n = await ct(p, {
                 ...ctx,
@@ -558,3 +563,12 @@ function toEditModeOrFactory<P>(ctr: CodeTransformRegistration<P>,
 function gitBranchCompatible(name: string): string {
     return name.replace(/\s+/g, "_"); // What else??
 }
+
+export async function resolveCredentialsPromise(creds: Promise<ProjectOperationCredentials> | ProjectOperationCredentials)
+    : Promise<ProjectOperationCredentials> {
+    if (!!creds) {
+        return creds;
+    } else {
+        return undefined;
+    }
+}

lib/api/machine/SigningKeys.ts

@@ -0,0 +1,47 @@
+/*
+ * Copyright © 2019 Atomist, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export interface GoalVerificationKey {
+    name: string;
+    publicKey: string;
+}
+
+/**
+ * Private/public key pair to use for SDM goal signing and verification
+ */
+export interface GoalSigningKey extends GoalVerificationKey {
+    privateKey: string;
+    passphrase?: string;
+}
+
+export interface GoalSigningConfiguration {
+
+    /**
+     * Enable goal signature verification on this SDM.
+     */
+    enabled: boolean;
+
+    /**
+     * Public/Private key pair to use for goal signing.
+     * The public key will also be used to verify incoming goals.
+     */
+    signingKey: GoalSigningKey;
+
+    /**
+     * Public keys to verify incoming goals
+     */
+    verificationKeys?: GoalVerificationKey | GoalVerificationKey[];
+}

lib/api/machine/SoftwareDeliveryMachineOptions.ts

@@ -32,6 +32,11 @@ import { PreferenceStoreFactory } from "../context/preferenceStore";
 import { EnrichGoal } from "../goal/enrichGoal";
 import { GoalScheduler } from "../goal/support/GoalScheduler";
 import { RepoTargets } from "./RepoTargets";
+import {
+    GoalSigningConfiguration,
+    GoalSigningKey,
+    GoalVerificationKey,
+} from "./SigningKeys";
 
 /**
  * Infrastructure options common to all SoftwareDeliveryMachines.
@@ -107,6 +112,12 @@ export interface SoftwareDeliveryMachineOptions {
      * Callback to enrich goal metadata before it gets persisted and planned
      */
     enrichGoal?: EnrichGoal;
+
+    /**
+     * Optional set of keys to sign and verify goals that are produced and received
+     * by this SDM.
+     */
+    goalSigning?: GoalSigningConfiguration;
 }
 
 /**

lib/graphql/fragment/SdmGoalFields.graphql

@@ -59,4 +59,5 @@ fragment SdmGoalFields on SdmGoal {
   }
   data
   version
+  signature
 }

lib/graphql/fragment/SdmGoalWithPushFields.graphql

@@ -46,4 +46,5 @@ fragment SdmGoalWithPushFields on SdmGoal {
     channelId
   }
   data
+  signature
 }

lib/graphql/query/SdmGoalsByShaAndBranch.graphql

@@ -73,5 +73,6 @@ query SdmGoalByShaAndBranch(
     }
     data
     version
+    signature
   }
 }