Skip to content

Commit 347d8ee

Browse files
JeromyStJstatiaCopilot
authored
Port AKV, MST, and AAS extension packs with zero-copy adaptation (#188)
* feat(native): Azure Key Vault extension pack with zero-copy adaptation Port cose_sign1_azure_key_vault and cose_sign1_azure_key_vault_ffi from native_ports branch, adapted for zero-copy architecture: - CoseHeaderValue::Bytes/Text use ArcSlice/ArcStr (.into() conversions) - CoseSign1Message field access via methods (.payload()/.signature()) - Clippy fix: remove redundant struct update syntax - FFI Cargo.toml: workspace edition/license, description, test = false - C/C++ headers: azure_key_vault.h and azure_key_vault.hpp - rustfmt applied to all source and test files 119 AKV tests pass, 6805 workspace total, 0 failures. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: A+ quality fixes for Azure Key Vault extension pack - Replace Mutex .unwrap() with proper error propagation in akv_signing_key.rs - Add // SAFETY: comments to all 28 unsafe blocks in FFI crate - Add description field to main Cargo.toml - Normalize FFI Cargo.toml to brace notation for workspace fields - Add @param/@return Doxygen to 4 trust policy builder C header functions Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * feat(native): MST transparency extension pack with zero-copy adaptation Port cose_sign1_transparent_mst, code_transparency_client, and cose_sign1_transparent_mst_ffi from native_ports, adapted for zero-copy: - LazyHeaderMap: .headers()?.alg()/.kid() instead of direct field access - CoseSign1Message: .payload()/.signature() method access - CoseHeaderValue::Bytes/Text use ArcSlice/ArcStr (.into() conversions) - Removed unstable str_as_str feature usage - C/C++ headers: mst.h and mst.hpp projections 3 crates added, 56 files, 499 MST tests pass, 7395 workspace total. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Port Azure Artifact Signing extension pack with clippy fixes - Port AAS crate, client sub-crate, and FFI crate from native_ports - Fix clippy: too_many_arguments, collapsible if-let, manual Default impl - Standardize all 3 Cargo.toml files (workspace edition/license, descriptions) - Add C/C++ projection headers - All AAS tests passing Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * A+ quality fixes for MST and AAS extension packs - Add SAFETY comments to all unsafe blocks in MST and AAS FFI crates - Replace .unwrap() with .expect() in non-test code (verify.rs, pack.rs, signing_service.rs) - Add @param/@return Doxygen tags to 14 MST trust policy builder functions in mst.h Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix rustfmt formatting in verify.rs Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix CI: add PqcJwk import and time to dependency allowlist - Gate PqcJwk import with #[cfg(feature = 'pqc')] in jwk_verifier.rs - Add time crate to [crate.client] in allowed-dependencies.toml Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Jeromy Statia (from Dev Box) <jstatia@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent 1c7f17c commit 347d8ee

145 files changed

Lines changed: 33438 additions & 17 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎native/c/include/cose/sign1/extension_packs/azure_artifact_signing.h‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
// Copyright (c) Microsoft Corporation.
2+
// Licensed under the MIT License.
3+
4+
/**
5+
* @file azure_artifact_signing.h
6+
* @brief Azure Artifact Signing trust pack for COSE Sign1
7+
*/
8+
9+
#ifndef COSE_SIGN1_ATS_H
10+
#define COSE_SIGN1_ATS_H
11+
12+
#include <cose/sign1/validation.h>
13+
#include <cose/sign1/trust.h>
14+
15+
#ifdef __cplusplus
16+
extern "C" {
17+
#endif
18+
19+
/**
20+
* @brief Options for Azure Artifact Signing trust pack
21+
*/
22+
typedef struct {
23+
/** AAS endpoint URL (null-terminated UTF-8) */
24+
const char* endpoint;
25+
/** AAS account name (null-terminated UTF-8) */
26+
const char* account_name;
27+
/** Certificate profile name (null-terminated UTF-8) */
28+
const char* certificate_profile_name;
29+
} cose_ats_trust_options_t;
30+
31+
/**
32+
* @brief Add Azure Artifact Signing trust pack with default options.
33+
* @param builder Validator builder handle.
34+
* @return COSE_OK on success, error code otherwise.
35+
*/
36+
cose_status_t cose_sign1_validator_builder_with_ats_pack(
37+
cose_sign1_validator_builder_t* builder
38+
);
39+
40+
/**
41+
* @brief Add Azure Artifact Signing trust pack with custom options.
42+
* @param builder Validator builder handle.
43+
* @param options Options structure (NULL for defaults).
44+
* @return COSE_OK on success, error code otherwise.
45+
*/
46+
cose_status_t cose_sign1_validator_builder_with_ats_pack_ex(
47+
cose_sign1_validator_builder_t* builder,
48+
const cose_ats_trust_options_t* options
49+
);
50+
51+
#ifdef __cplusplus
52+
}
53+
#endif
54+
55+
#endif /* COSE_SIGN1_ATS_H */

‎native/c/include/cose/sign1/extension_packs/azure_key_vault.h‎

Lines changed: 201 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,216 @@
11
// Copyright (c) Microsoft Corporation.
22
// Licensed under the MIT License.
33

4-
#ifndef COSE_SIGN1_EXTENSION_PACKS_AZURE_KEY_VAULT_H
5-
#define COSE_SIGN1_EXTENSION_PACKS_AZURE_KEY_VAULT_H
4+
/**
5+
* @file azure_key_vault.h
6+
* @brief Azure Key Vault KID validation pack for COSE Sign1
7+
*/
8+
9+
#ifndef COSE_SIGN1_AKV_H
10+
#define COSE_SIGN1_AKV_H
611

7-
#include <cose/cose.h>
812
#include <cose/sign1/validation.h>
13+
#include <cose/sign1/trust.h>
914

1015
#ifdef __cplusplus
1116
extern "C" {
1217
#endif
1318

14-
// Stub: Azure Key Vault trust pack is not yet implemented in this layer.
15-
// The COSE_HAS_AKV_PACK macro gates usage in tests.
19+
// CoseKeyHandle is available from cose.h (included transitively via validation.h)
20+
21+
/**
22+
* @brief Options for Azure Key Vault KID validation
23+
*/
24+
typedef struct {
25+
/** If true, require the KID to look like an Azure Key Vault identifier */
26+
bool require_azure_key_vault_kid;
27+
28+
/** NULL-terminated array of allowed KID pattern strings (supports wildcards * and ?).
29+
* NULL means use default patterns (*.vault.azure.net/keys/*, *.managedhsm.azure.net/keys/*). */
30+
const char* const* allowed_kid_patterns;
31+
} cose_akv_trust_options_t;
32+
33+
/**
34+
* @brief Add Azure Key Vault KID validation pack with default options
35+
*
36+
* Default options (secure-by-default):
37+
* - require_azure_key_vault_kid: true
38+
* - allowed_kid_patterns:
39+
* - https://*.vault.azure.net/keys/*
40+
* - https://*.managedhsm.azure.net/keys/*
41+
*
42+
* @param builder Validator builder handle
43+
* @return COSE_OK on success, error code otherwise
44+
*/
45+
cose_status_t cose_sign1_validator_builder_with_akv_pack(
46+
cose_sign1_validator_builder_t* builder
47+
);
48+
49+
/**
50+
* @brief Add Azure Key Vault KID validation pack with custom options
51+
*
52+
* @param builder Validator builder handle
53+
* @param options Options structure (NULL for defaults)
54+
* @return COSE_OK on success, error code otherwise
55+
*/
56+
cose_status_t cose_sign1_validator_builder_with_akv_pack_ex(
57+
cose_sign1_validator_builder_t* builder,
58+
const cose_akv_trust_options_t* options
59+
);
60+
61+
/**
62+
* @brief Trust-policy helper: require that the message `kid` looks like an Azure Key Vault key identifier.
63+
*
64+
* This API is provided by the AKV pack FFI library and extends `cose_sign1_trust_policy_builder_t`.
65+
*
66+
* @param policy_builder The trust policy builder to add the requirement to.
67+
* @return COSE_OK on success, or an error status code.
68+
*/
69+
cose_status_t cose_sign1_akv_trust_policy_builder_require_azure_key_vault_kid(
70+
cose_sign1_trust_policy_builder_t* policy_builder
71+
);
72+
73+
/**
74+
* @brief Trust-policy helper: require that the message `kid` does not look like an Azure Key Vault key identifier.
75+
*
76+
* This API is provided by the AKV pack FFI library and extends `cose_sign1_trust_policy_builder_t`.
77+
*
78+
* @param policy_builder The trust policy builder to add the requirement to.
79+
* @return COSE_OK on success, or an error status code.
80+
*/
81+
cose_status_t cose_sign1_akv_trust_policy_builder_require_not_azure_key_vault_kid(
82+
cose_sign1_trust_policy_builder_t* policy_builder
83+
);
84+
85+
/**
86+
* @brief Trust-policy helper: require that the message `kid` is allowlisted by the AKV pack configuration.
87+
*
88+
* This API is provided by the AKV pack FFI library and extends `cose_sign1_trust_policy_builder_t`.
89+
*
90+
* @param policy_builder The trust policy builder to add the requirement to.
91+
* @return COSE_OK on success, or an error status code.
92+
*/
93+
cose_status_t cose_sign1_akv_trust_policy_builder_require_azure_key_vault_kid_allowed(
94+
cose_sign1_trust_policy_builder_t* policy_builder
95+
);
96+
97+
/**
98+
* @brief Trust-policy helper: require that the message `kid` is not allowlisted by the AKV pack configuration.
99+
*
100+
* This API is provided by the AKV pack FFI library and extends `cose_sign1_trust_policy_builder_t`.
101+
*
102+
* @param policy_builder The trust policy builder to add the requirement to.
103+
* @return COSE_OK on success, or an error status code.
104+
*/
105+
cose_status_t cose_sign1_akv_trust_policy_builder_require_azure_key_vault_kid_not_allowed(
106+
cose_sign1_trust_policy_builder_t* policy_builder
107+
);
108+
109+
/**
110+
* @brief Opaque handle to an Azure Key Vault key client
111+
*/
112+
typedef struct cose_akv_key_client_handle_t cose_akv_key_client_handle_t;
113+
114+
/**
115+
* @brief Create an AKV key client using DeveloperToolsCredential (for local dev)
116+
*
117+
* @param vault_url Null-terminated UTF-8 vault URL (e.g. "https://myvault.vault.azure.net")
118+
* @param key_name Null-terminated UTF-8 key name
119+
* @param key_version Null-terminated UTF-8 key version, or NULL for latest
120+
* @param out_client Output pointer for the created client handle
121+
* @return COSE_OK on success, error code otherwise
122+
*/
123+
cose_status_t cose_akv_key_client_new_dev(
124+
const char* vault_url,
125+
const char* key_name,
126+
const char* key_version,
127+
cose_akv_key_client_handle_t** out_client
128+
);
129+
130+
/**
131+
* @brief Create an AKV key client using ClientSecretCredential
132+
*
133+
* @param vault_url Null-terminated UTF-8 vault URL (e.g. "https://myvault.vault.azure.net")
134+
* @param key_name Null-terminated UTF-8 key name
135+
* @param key_version Null-terminated UTF-8 key version, or NULL for latest
136+
* @param tenant_id Null-terminated UTF-8 Azure AD tenant ID
137+
* @param client_id Null-terminated UTF-8 Azure AD client (application) ID
138+
* @param client_secret Null-terminated UTF-8 Azure AD client secret
139+
* @param out_client Output pointer for the created client handle
140+
* @return COSE_OK on success, error code otherwise
141+
*/
142+
cose_status_t cose_akv_key_client_new_client_secret(
143+
const char* vault_url,
144+
const char* key_name,
145+
const char* key_version,
146+
const char* tenant_id,
147+
const char* client_id,
148+
const char* client_secret,
149+
cose_akv_key_client_handle_t** out_client
150+
);
151+
152+
/**
153+
* @brief Free an AKV key client
154+
*
155+
* @param client Client handle to free (NULL is safe)
156+
*/
157+
void cose_akv_key_client_free(cose_akv_key_client_handle_t* client);
158+
159+
/**
160+
* @brief Create a CoseKey (signing key handle) from an AKV key client
161+
*
162+
* The returned key can be used with the signing FFI (cose_sign1_* functions).
163+
*
164+
* @param akv_client AKV client handle (consumed - no longer valid after this call)
165+
* @param out_key Output pointer for the created signing key handle
166+
* @return COSE_OK on success, error code otherwise
167+
*
168+
* @note The akv_client is consumed by this call and must not be used or freed afterward.
169+
* The returned key must be freed with cose_key_free.
170+
*/
171+
cose_status_t cose_sign1_akv_create_signing_key(
172+
cose_akv_key_client_handle_t* akv_client,
173+
CoseKeyHandle** out_key
174+
);
175+
176+
/* ========================================================================== */
177+
/* AKV Signing Service */
178+
/* ========================================================================== */
179+
180+
/**
181+
* @brief Opaque handle to an AKV signing service
182+
*
183+
* Free with `cose_sign1_akv_signing_service_free()`.
184+
*/
185+
typedef struct cose_akv_signing_service_handle_t cose_akv_signing_service_handle_t;
186+
187+
/**
188+
* @brief Create an AKV signing service from a key client
189+
*
190+
* The signing service provides a high-level interface for COSE_Sign1 message creation
191+
* using Azure Key Vault for cryptographic operations.
192+
*
193+
* @param client AKV key client handle (consumed - no longer valid after this call)
194+
* @param out Receives the signing service handle
195+
* @return COSE_OK on success, error code otherwise
196+
*
197+
* @note The client handle is consumed by this call and must not be used or freed afterward.
198+
* The returned service must be freed with cose_sign1_akv_signing_service_free.
199+
*/
200+
cose_status_t cose_sign1_akv_create_signing_service(
201+
cose_akv_key_client_handle_t* client,
202+
cose_akv_signing_service_handle_t** out
203+
);
204+
205+
/**
206+
* @brief Free an AKV signing service handle
207+
*
208+
* @param handle Handle to free (NULL is a safe no-op)
209+
*/
210+
void cose_sign1_akv_signing_service_free(cose_akv_signing_service_handle_t* handle);
16211

17212
#ifdef __cplusplus
18213
}
19214
#endif
20215

21-
#endif /* COSE_SIGN1_EXTENSION_PACKS_AZURE_KEY_VAULT_H */
216+
#endif // COSE_SIGN1_AKV_H

0 commit comments

Comments
 (0)