verify method

Future<bool> verify(Map<String, Object?> record, TrustBundle trust)

Implementation

Future<bool> verify(Map<String, Object?> record, TrustBundle trust) async {
  final signerMap = (record['signer'] as Map?)?.cast<String, Object?>();
  final signerId = signerMap?['signerId'];
  final keyId = signerMap?['keyId'];
  if (signerId is! String ||
      keyId is! String ||
      signerMap?['algorithm'] != 'Ed25519' ||
      record['kind'] != 'zuke.behavioral-assurance-release' ||
      record['body'] is! Map) {
    return false;
  }
  final digest = record['recordDigest'];
  if (digest is! String || !RegExp(r'^[a-f0-9]{64}$').hasMatch(digest)) {
    return false;
  }
  final body = Map<String, Object?>.from(record['body'] as Map);
  for (final field in const [
    'workspace',
    'repositoryState',
    'engineVersion',
    'lockDigest',
    'policyHash',
    'evidenceRequirementsHash',
    'previousRecord',
  ]) {
    if (!body.containsKey(field)) return false;
  }
  if (body['workspace'] is! String ||
      body['repositoryState'] is! String ||
      body['engineVersion'] is! String ||
      body['lockDigest'] is! String ||
      body['policyHash'] is! String ||
      body['evidenceRequirementsHash'] is! String ||
      (body['previousRecord'] != null && body['previousRecord'] is! String) ||
      body['assurance'] is! List ||
      body['evidenceDigests'] is! List) {
    return false;
  }
  if (!RegExp(r'^[a-f0-9]{64}$').hasMatch(body['lockDigest'] as String) ||
      !RegExp(
        r'^sha256:[a-f0-9]{64}$',
      ).hasMatch(body['policyHash'] as String) ||
      !RegExp(
        r'^sha256:[a-f0-9]{64}$',
      ).hasMatch(body['evidenceRequirementsHash'] as String)) {
    return false;
  }
  if (body['repositoryState'] == '0000000000000000000000000000000000000000') {
    return false;
  }
  final key = trust.find(signerId, keyId, 'release');
  if (key == null) return false;
  return signer.verify(record, trustedPublicKey: key.publicKey);
}