Experimental contract code/build linking command

[leighmcculloch]

What

Add a contract verify command that implements a subset of @orbitlens proposal:

• Contract Source Validation SEP stellar-protocol#1573

Try it out

cargo install --locked stellar-cli --git https://github.com/stellar/stellar-cli --branch contract-verify

Example

The leighmcculloch/exp-stellar-expert-verified-builds repo contains a contract that has been built by the stellar-expert/soroban-build-workflow as well as a custom workflow that uses the attestation principles but not the stellar-expert build process.

Contract built with stellar-expert/soroban-build-workflow deployed to CBLB:

$ stellar contract verify --id CBLBYGNUMGOYZWQE7NHE3CA7SQVZXCD4PKGJRRARHVXE6DML25PIOFN4
ℹ️ Loading wasm...
ℹ️ Wasm Hash: d751fee773a7461aef2451bb16674b8d9b67de6a9d5312c3f9a146189e011af5
ℹ️ Source Repo: github:leighmcculloch/exp-stellar-expert-verified-builds
ℹ️ Collecting GitHub attestation from https://api.github.com/repos/leighmcculloch/exp-stellar-expert-verified-builds/attestations/sha256:d751fee773a7461aef2451bb16674b8d9b67de6a9d5312c3f9a146189e011af5...
✅ Attestation found linked to GitHub Actions Workflow Run:
✅  • Repository: https://github.com/leighmcculloch/exp-stellar-expert-verified-builds
✅  • Ref:        refs/tags/v1.0.0
✅  • Path:       .github/workflows/stellar-expert-release.yml
✅  • Git Commit: 713de53640b5e6b698740623db7911bfec7b918f
✅  • Runner:     github-hosted
✅  • Run:        https://github.com/leighmcculloch/exp-stellar-expert-verified-builds/actions/runs/12158347810/attempts/1
🌎 View the workflow at https://github.com/leighmcculloch/exp-stellar-expert-verified-builds/blob/713de53640b5e6b698740623db7911bfec7b918f/.github/workflows/stellar-expert-release.yml
🌎 View the repo at https://github.com/leighmcculloch/exp-stellar-expert-verified-builds/tree/713de53640b5e6b698740623db7911bfec7b918f

Contract built with custom-release.yml deployed to CCDI:

$ stellar contract verify --id CCDIEKA4RTIG4PL6HP5M5RR5KL3V7AIVQIPULHHQMNFHWX63J43APBX3
ℹ️ Loading wasm...
ℹ️ Wasm Hash: 938f6ea8c74844846742a57eeeed7e8aa15391bac56151f415aa7ab1c73e090f
ℹ️ Source Repo: github:leighmcculloch/exp-stellar-expert-verified-builds
ℹ️ Collecting GitHub attestation from https://api.github.com/repos/leighmcculloch/exp-stellar-expert-verified-builds/attestations/sha256:938f6ea8c74844846742a57eeeed7e8aa15391bac56151f415aa7ab1c73e090f...
✅ Attestation found linked to GitHub Actions Workflow Run:
✅  • Repository: https://github.com/leighmcculloch/exp-stellar-expert-verified-builds
✅  • Ref:        refs/tags/v1.0.0
✅  • Path:       .github/workflows/custom-release.yml
✅  • Git Commit: 713de53640b5e6b698740623db7911bfec7b918f
✅  • Runner:     github-hosted
✅  • Run:        https://github.com/leighmcculloch/exp-stellar-expert-verified-builds/actions/runs/12158347774/attempts/1
🌎 View the workflow at https://github.com/leighmcculloch/exp-stellar-expert-verified-builds/blob/713de53640b5e6b698740623db7911bfec7b918f/.github/workflows/custom-release.yml
🌎 View the repo at https://github.com/leighmcculloch/exp-stellar-expert-verified-builds/tree/713de53640b5e6b698740623db7911bfec7b918f

Why

This change is an experimental implementation of a subset of the proposal to explore how other tooling might use the data and attestations published to confirm what code was the source of deployed wasm contracts.

The proposal includes principles for how to use GitHub's Attestation feature, based on Sigstore, to confidently link source code in a repository and a workflow run that builds an artifact, to a hash of the artifact. These principles are what's implemented in this change.

The proposal also includes details for how to use a third party GitHub Action stellar-expert/soroban-build-workflow workflow and build process to build contracts in a specific docker container and using specific actions, but the verification logic in this command at this time does not depend on those aspects of the proposal.

For more details on why this change implements only a subset, see the discussion here:

• Contract Source Validation SEP stellar-protocol#1573 (comment)

Known Limitations

The verification logic was hacked together quickly and a final implementation should involve a thorough understanding and review of https://in-toto.io/Statement/v1 payloads and all the edge cases that could arise and should be caught.

Additionally it would be ideal if the payload signature was verified in Sigstore Rekor (transparency log), and that the payload could be optionally provided on the command line instead of downloaded via GitHub, because that would theoretically allow any sigstore in-toto attestation to be verified, not only GitHub's.

Status

As this change is an experiment it is not intended to be merged, not at least without significant additional work. It will remain in a draft state to be used to drive discussion.

[fnando]

Closed in favor of #1957