FAB-2958 create and sign chaincode package

https://jira.hyperledger.org/browse/FAB-2958

CLI is enhanced
  . create a chaincode package (extenstion to "package")
  . sign a previously created package (new "signpackage" subcommand)

The main files affected are "package.go" and "signpackage.go". Rest
of the changes to chaincode CLI files are just for API adjustment.

Also added tests and cc-packaging-and-signing.rst.

Change-Id: Ieb55334d33d5f03bd315f7722b02badc2010675f
Signed-off-by: Srinivasan Muralidharan <muralisr@us.ibm.com>

Author: Srinivasan Muralidharan

core/common/ccpackage/ccpackage.go

@@ -28,6 +28,28 @@ import (
 	"github.com/hyperledger/fabric/protos/utils"
 )
 
+// extractSignedCCDepSpec extracts the messages from the envelope
+func extractSignedCCDepSpec(env *common.Envelope) (*common.ChannelHeader, *peer.SignedChaincodeDeploymentSpec, error) {
+	p := &common.Payload{}
+	err := proto.Unmarshal(env.Payload, p)
+	if err != nil {
+		return nil, nil, err
+	}
+	ch := &common.ChannelHeader{}
+	err = proto.Unmarshal(p.Header.ChannelHeader, ch)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	sp := &peer.SignedChaincodeDeploymentSpec{}
+	err = proto.Unmarshal(p.Data, sp)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return ch, sp, nil
+}
+
 // This file provides functions for helping with the chaincode install
 // package workflow. In particular
 //     OwnerCreateSignedCCDepSpec - each owner creates signs the package using the same deploy
@@ -185,3 +207,39 @@ func OwnerCreateSignedCCDepSpec(cds *peer.ChaincodeDeploymentSpec, instPolicy *c
 
 	return createSignedCCDepSpec(cdsbytes, instpolicybytes, endorsements)
 }
+
+// SignExistingPackage adds a signature to a signed package.
+func SignExistingPackage(env *common.Envelope, owner msp.SigningIdentity) (*common.Envelope, error) {
+	if owner == nil {
+		return nil, fmt.Errorf("owner not provided")
+	}
+
+	ch, sdepspec, err := extractSignedCCDepSpec(env)
+	if err != nil {
+		return nil, err
+	}
+
+	if ch == nil {
+		return nil, fmt.Errorf("channel header not found in the envelope")
+	}
+
+	if sdepspec == nil || sdepspec.ChaincodeDeploymentSpec == nil || sdepspec.InstantiationPolicy == nil || sdepspec.OwnerEndorsements == nil {
+		return nil, fmt.Errorf("invalid signed deployment spec")
+	}
+
+	// serialize the signing identity
+	endorser, err := owner.Serialize()
+	if err != nil {
+		return nil, fmt.Errorf("Could not serialize the signing identity for %s, err %s", owner.GetIdentifier(), err)
+	}
+
+	// sign the concatenation of cds, instpolicy and the serialized endorser identity with this endorser's key
+	signature, err := owner.Sign(append(sdepspec.ChaincodeDeploymentSpec, append(sdepspec.InstantiationPolicy, endorser...)...))
+	if err != nil {
+		return nil, fmt.Errorf("Could not sign the ccpackage, err %s", err)
+	}
+
+	endorsements := append(sdepspec.OwnerEndorsements, &peer.Endorsement{Signature: signature, Endorser: endorser})
+
+	return createSignedCCDepSpec(sdepspec.ChaincodeDeploymentSpec, sdepspec.InstantiationPolicy, endorsements)
+}

core/common/ccpackage/ccpackage_test.go

@@ -64,6 +64,45 @@ func TestOwnerCreateSignedCCDepSpec(t *testing.T) {
 	}
 }
 
+func TestAddSignature(t *testing.T) {
+	mspid, _ := localmsp.GetIdentifier()
+	sigpolicy := createInstantiationPolicy(mspid, mspprotos.MSPRole_ADMIN)
+	env, err := ownerCreateCCDepSpec([]byte("codepackage"), sigpolicy, signer)
+	if err != nil || env == nil {
+		t.Fatalf("error owner creating package %s", err)
+		return
+	}
+	//add one more with the same signer (we don't have another signer to test with)
+	env, err = SignExistingPackage(env, signer)
+	if err != nil || env == nil {
+		t.Fatalf("error signing existing package %s", err)
+		return
+	}
+	//...and sign aother for luck
+	env, err = SignExistingPackage(env, signer)
+	if err != nil || env == nil {
+		t.Fatalf("error signing existing package %s", err)
+		return
+	}
+
+	p := &common.Payload{}
+	if err = proto.Unmarshal(env.Payload, p); err != nil {
+		t.Fatalf("fatal error unmarshal payload")
+		return
+	}
+
+	sigdepspec := &peer.SignedChaincodeDeploymentSpec{}
+	if err = proto.Unmarshal(p.Data, sigdepspec); err != nil || sigdepspec == nil {
+		t.Fatalf("fatal error unmarshal sigdepspec")
+		return
+	}
+
+	if len(sigdepspec.OwnerEndorsements) != 3 {
+		t.Fatalf("invalid number of endorsements %d", len(sigdepspec.OwnerEndorsements))
+		return
+	}
+}
+
 func TestMissingSigaturePolicy(t *testing.T) {
 	env, err := ownerCreateCCDepSpec([]byte("codepackage"), nil, signer)
 	if err == nil || env != nil {

docs/source/cc-packaging-and-signing.rst

@@ -0,0 +1,73 @@
+Chaincode Packaging and Signing
+===============================
+
+Introduction
+------------
+
+A chaincode will be placed on the file system of the peer on
+installation simply as a file with name
+``<chaincode name>.<chaincode version``. The contents of that file is
+called a chaincode package.
+
+This document describes how a chaincode package can be created and
+signed from CLI. The package is used for install using the usual install
+procedures and not covered in this document.
+
+What’s in the package ?
+-----------------------
+
+The package consists of 3 parts \* the chaincode as defined by
+``ChaincodeDeploymentSpec``. This defines the code and other meta
+properties such as name and version \* an instantiation policy which can
+be syntactically described by the same policy used for endorsement and
+described in ``endorsement-policies.rst`` \* a set of signatures by the
+entities that “own” the chaincode.
+
+The signatures serve the following purposes \* establish an ownership of
+the chaincode \* allows verification that the signatures are over the
+same content \* allows detection of package tampering
+
+The creator of the instantiation of the chaincode on a channel is
+validated against the instantiation policy of the chaincode.
+
+Chaincode Packaging
+-------------------
+
+The package is created and signed using the command
+
+::
+
+    peer chaincode package -n mycc -p github.com/hyperledger/fabric/examples/chaincode/go/chaincode_example02 -v 0 -s -S ccpack.out
+
+where ``-s`` specifies creating the package as opposed to generating raw
+ChaincodeDeploymentSpec ``-S`` specifies instructs to sign the package
+using the Local MSP (as defined by ``localMspid`` property in
+``core.yaml``)
+
+The ``-S`` option is optional. However if a package is created without a
+signature, it cannot be signed by any other owner using the
+``signpackage`` command in the next section.
+
+Package signing
+---------------
+
+A package can be handed over to other owners for inspection and signing.
+The workflow supports out of band signing of package.
+
+A previously created package can be signed using the command
+
+::
+
+    peer chaincode signpackage ccpack.out signedccpack.out
+
+where ``ccpack.out`` and ``signedccpack.out`` are input and output
+packages respectively. ``signedccpack.out`` contains an additional
+signature over the package signed using the Local MSP.
+
+Conclusion
+----------
+
+The peer will support use of both raw ChaincodeDeploymentSpec and the
+package structure described in this document. This will allow existing
+commands and workflows to work which is especially useful in development
+and test phases.

peer/chaincode/chaincode.go

@@ -69,8 +69,9 @@ func Cmd(cf *ChaincodeCmdFactory) *cobra.Command {
 	chaincodeCmd.AddCommand(invokeCmd(cf))
 	chaincodeCmd.AddCommand(queryCmd(cf))
 	chaincodeCmd.AddCommand(upgradeCmd(cf))
-	chaincodeCmd.AddCommand(packageCmd(cf))
+	chaincodeCmd.AddCommand(packageCmd(cf, nil))
 	chaincodeCmd.AddCommand(installCmd(cf))
+	chaincodeCmd.AddCommand(signpackageCmd(cf))
 
 	return chaincodeCmd
 }

peer/chaincode/common.go

@@ -133,7 +133,7 @@ func checkChaincodeCmdParams(cmd *cobra.Command) error {
 		return fmt.Errorf("Must supply value for %s name parameter.", chainFuncName)
 	}
 
-	if cmd.Name() == instantiate_cmdname || cmd.Name() == install_cmdname || cmd.Name() == upgrade_cmdname {
+	if cmd.Name() == instantiate_cmdname || cmd.Name() == install_cmdname || cmd.Name() == upgrade_cmdname || cmd.Name() == package_cmdname {
 		if chaincodeVersion == common.UndefinedParamValue {
 			return fmt.Errorf("Chaincode version is not provided for %s", cmd.Name())
 		}
@@ -198,7 +198,7 @@ func checkChaincodeCmdParams(cmd *cobra.Command) error {
 			return errors.New("Non-empty JSON chaincode parameters must contain the following keys: 'Args' or 'Function' and 'Args'")
 		}
 	} else {
-		if cmd == nil || cmd != chaincodeInstallCmd {
+		if cmd == nil || (cmd != chaincodeInstallCmd && cmd != chaincodePackageCmd) {
 			return errors.New("Empty JSON chaincode parameters must contain the following keys: 'Args' or 'Function' and 'Args'")
 		}
 	}
@@ -214,10 +214,14 @@ type ChaincodeCmdFactory struct {
 }
 
 // InitCmdFactory init the ChaincodeCmdFactory with default clients
-func InitCmdFactory(isOrdererRequired bool) (*ChaincodeCmdFactory, error) {
-	endorserClient, err := common.GetEndorserClient()
-	if err != nil {
-		return nil, fmt.Errorf("Error getting endorser client %s: %s", chainFuncName, err)
+func InitCmdFactory(isEndorserRequired, isOrdererRequired bool) (*ChaincodeCmdFactory, error) {
+	var err error
+	var endorserClient pb.EndorserClient
+	if isEndorserRequired {
+		endorserClient, err = common.GetEndorserClient()
+		if err != nil {
+			return nil, fmt.Errorf("Error getting endorser client %s: %s", chainFuncName, err)
+		}
 	}
 
 	signer, err := common.GetDefaultSigner()

peer/chaincode/install.go

@@ -88,7 +88,7 @@ func chaincodeInstall(cmd *cobra.Command, args []string, cf *ChaincodeCmdFactory
 
 	var err error
 	if cf == nil {
-		cf, err = InitCmdFactory(false)
+		cf, err = InitCmdFactory(true, false)
 		if err != nil {
 			return err
 		}

peer/chaincode/instantiate.go

@@ -99,7 +99,7 @@ func instantiate(cmd *cobra.Command, cf *ChaincodeCmdFactory) (*protcommon.Envel
 func chaincodeDeploy(cmd *cobra.Command, args []string, cf *ChaincodeCmdFactory) error {
 	var err error
 	if cf == nil {
-		cf, err = InitCmdFactory(true)
+		cf, err = InitCmdFactory(true, true)
 		if err != nil {
 			return err
 		}

peer/chaincode/invoke.go

@@ -42,7 +42,7 @@ func invokeCmd(cf *ChaincodeCmdFactory) *cobra.Command {
 func chaincodeInvoke(cmd *cobra.Command, args []string, cf *ChaincodeCmdFactory) error {
 	var err error
 	if cf == nil {
-		cf, err = InitCmdFactory(true)
+		cf, err = InitCmdFactory(true, true)
 		if err != nil {
 			return err
 		}