| | | 1 | | namespace AsiBackbone.Core.Signing; |
| | | 2 | | |
| | | 3 | | /// <summary> |
| | | 4 | | /// Evaluates provider-neutral signature verification results against host verification policy. |
| | | 5 | | /// </summary> |
| | | 6 | | public static class VerificationPolicyEvaluator |
| | | 7 | | { |
| | | 8 | | /// <summary> |
| | | 9 | | /// Evaluates a signed governance artifact and verification result against verification policy. |
| | | 10 | | /// </summary> |
| | | 11 | | public static VerificationPolicyOutcome Evaluate<TArtifact>( |
| | | 12 | | SignedGovernanceArtifact<TArtifact> artifact, |
| | | 13 | | SignatureVerificationResult verificationResult, |
| | | 14 | | VerificationPolicyOptions? options = null) |
| | | 15 | | { |
| | 32 | 16 | | ArgumentNullException.ThrowIfNull(artifact); |
| | 32 | 17 | | ArgumentNullException.ThrowIfNull(verificationResult); |
| | | 18 | | |
| | 32 | 19 | | return VerificationPolicyOutcome.CreateCore( |
| | 32 | 20 | | artifact.ArtifactType, |
| | 32 | 21 | | artifact.ArtifactId, |
| | 32 | 22 | | artifact.SigningHash, |
| | 32 | 23 | | artifact.HashAlgorithm, |
| | 32 | 24 | | artifact.SigningMetadata, |
| | 32 | 25 | | verificationResult, |
| | 32 | 26 | | options); |
| | | 27 | | } |
| | | 28 | | |
| | | 29 | | /// <summary> |
| | | 30 | | /// Maps a provider-neutral verification result to a stable verification category. |
| | | 31 | | /// </summary> |
| | | 32 | | public static SignatureVerificationCategory Categorize(SignatureVerificationResult verificationResult) |
| | | 33 | | { |
| | 56 | 34 | | ArgumentNullException.ThrowIfNull(verificationResult); |
| | | 35 | | |
| | 56 | 36 | | if (verificationResult.IsValid) |
| | | 37 | | { |
| | 4 | 38 | | return SignatureVerificationCategory.Valid; |
| | | 39 | | } |
| | | 40 | | |
| | 52 | 41 | | string failureCode = verificationResult.FailureCode ?? string.Empty; |
| | 52 | 42 | | string status = verificationResult.Status ?? string.Empty; |
| | | 43 | | |
| | 52 | 44 | | return Matches(status, "MissingSignature") || Matches(failureCode, "missing") |
| | 52 | 45 | | ? SignatureVerificationCategory.MissingSignature |
| | 52 | 46 | | : Matches(failureCode, "hash") |
| | 52 | 47 | | ? SignatureVerificationCategory.HashMismatch |
| | 52 | 48 | | : Matches(failureCode, "canonicalization") || Matches(failureCode, "payload-schema") || Matches(failureCode, |
| | 52 | 49 | | ? SignatureVerificationCategory.CanonicalizationMismatch |
| | 52 | 50 | | : Matches(failureCode, "unsupported") || Matches(failureCode, "algorithm") |
| | 52 | 51 | | ? SignatureVerificationCategory.UnsupportedAlgorithm |
| | 52 | 52 | | : Matches(failureCode, "revoked") || Matches(failureCode, "disabled") |
| | 52 | 53 | | ? SignatureVerificationCategory.RevokedKey |
| | 52 | 54 | | : (Matches(failureCode, "unknown") && Matches(failureCode, "key")) |
| | 52 | 55 | | || Matches(failureCode, "key-version") |
| | 52 | 56 | | || Matches(failureCode, "key.mismatch") |
| | 52 | 57 | | || Matches(failureCode, "key-mismatch") |
| | 52 | 58 | | ? SignatureVerificationCategory.UnknownKeyVersion |
| | 52 | 59 | | : Matches(failureCode, "provider-unavailable") |
| | 52 | 60 | | || Matches(failureCode, "unavailable") |
| | 52 | 61 | | || Matches(failureCode, "timeout") |
| | 52 | 62 | | || Matches(failureCode, "network") |
| | 52 | 63 | | ? SignatureVerificationCategory.ProviderUnavailable |
| | 52 | 64 | | : Matches(failureCode, "invalid") || Matches(failureCode, "malformed") || Matches(failureCode, "signature") |
| | 52 | 65 | | ? SignatureVerificationCategory.InvalidSignature |
| | 52 | 66 | | : SignatureVerificationCategory.Failed; |
| | | 67 | | } |
| | | 68 | | |
| | | 69 | | private static bool Matches(string value, string pattern) |
| | | 70 | | { |
| | 516 | 71 | | return value.Contains(pattern, StringComparison.OrdinalIgnoreCase); |
| | | 72 | | } |
| | | 73 | | } |