Add fused device details (#208)

devices/README.md

@@ -0,0 +1,38 @@
+# Device IDs
+
+The files contained in [ci](ci) and [prod](prod) directories hold identity information about witness devices.
+`ci` devices are _fused_ and receieve firmware builds at each commit, and `prod` devices are _fused_ witness devices
+which receive only release tagged firmware builds.
+
+End-users are not expected to use these files, they're just being stored here.
+
+## Files
+
+File names are based on the unique and immutable serial number assigned at time of manufacturing of the SoC
+which lies at the core of the device.
+
+The `.pub` file contains a public key which represents the _device_ with the corresponding serial number.
+
+The `.witness.0` file contains a signed note, verifiable with the device's `pub` key, which commits to the
+initial witness identity used by the device to cosign checkpoints.
+
+The body of this note is formed of 4 lines:
+
+1. A line with the text "ArmoredWitness ID attestation v1".
+2. The ASCII encoded HEX representation of the device serial number whose witness public key is below.
+3. The ASCII encoded decimal number, with no leading zeroes, representing the number of times the witness has rolled its identity. Currently this is always "0".
+4. A note Verifier string representing the witness public key which will be used by this device.
+
+The note is signed by the _device_ key corresponding to the serial number on line 2.
+
+The `.bastion.0` file contains a signed note, verifiable with the device's `pub` key, which commits to the
+initial bastion identity used by the device to register with bastion hosts for performing synchronous witnessing.
+
+The body of this note is formed of 4 lines:
+
+1. A line with the text "ArmoredWitness BastionID attestation v1".
+2. The ASCII encoded HEX representation of the device serial number whose bastion ID is below.
+3. The ASCII encoded decimal, with no leading zeroes, representing the number of times the witness has rolled its bastion identity. Currently this is always "0".
+4. A 64 character ASCII HEX representation of the device's bastion ID.
+
+The note is signed by the _device_ key corresponding to the serial number on line 2.

devices/ci/720A9DEAD4390330.bastion.0

@@ -0,0 +1,6 @@
+ArmoredWitness BastionID attestation v1
+720A9DEAD4390330
+0
+76d180a9d59ea2165ba4417d96ff26f79f938116129519ec85f2a39473c65cb9
+
+— AW-ID-Attestation-720A9DEAD4390330 8IYt880nPv51OVCfSo2XlT3o3UeAANCAlFXjfEUbPepAzXaueb6m35eDCBwynOcBkYKd1WyjaQMlchS3iXC3XviCewg=

devices/ci/720A9DEAD4390330.pub

@@ -0,0 +1 @@
+AW-ID-Attestation-720A9DEAD4390330+f0862df3+AUkbXcjaok7rTjKu7DTJ4iIqENz0tlJcnoCRR7fcWIZr

devices/ci/720A9DEAD4390330.witness.0

@@ -0,0 +1,6 @@
+ArmoredWitness ID attestation v1
+720A9DEAD4390330
+0
+ArmoredWitness-black-paper+2098422d+AReXvQmqY5qnUZQCsds1Pk90VuOb9a5iDaqLxHiTsW4o
+
+— AW-ID-Attestation-720A9DEAD4390330 8IYt879y4TIR3n6yf0o7nWBowT2S6s6psspPKJWDoU3n5bdp0+rjCjE3NFg+OWy6oj734H5n9WpSL5Sgi9WqG9Eq6QA=

devices/ci/720A9DEAD4390A2E.pub

@@ -0,0 +1 @@
+AW-ID-Attestation-720A9DEAD4390A2E+8c757dfd+AWkrw39Z9Nff1RXLQkyEg38f/oXEWSl1Dn+FsMlfF4t2

devices/ci/720A9DEAD4390A2E.witness.0

@@ -0,0 +1,6 @@
+ArmoredWitness ID attestation v1
+720A9DEAD4390A2E
+0
+ArmoredWitness-still-dawn+5d4e9d88+AUEEuc7Njgqec07UfvBgunkhtk2vEsqnfrJ4BOpZtz/v
+
+— AW-ID-Attestation-720A9DEAD4390A2E jHV9/dRWW/sAgPlJYFcOZqLxH8DOixnwe/bH+Lzqw1AylNFZe0lc56otuEqodJqy4499ObVdftgHkHPi2M6YM8TR1g0=

devices/ci/720A9DEAD4391F4A.bastion.0

@@ -0,0 +1,6 @@
+ArmoredWitness BastionID attestation v1
+720A9DEAD4391F4A
+0
+1decd179ab5784e3f8ee689af2d3b353ca8ce4d1e25abe8b50b9376af32233b7
+
+— AW-ID-Attestation-720A9DEAD4391F4A a66jx2CwKaUkJpvPZ6okGnErXhzDm4tUlh3c5LZXhd6xA41InD/m1w48Pi4sTvb1u3xnbsWnNQDyAhe1yofho5jrcwU=

devices/ci/720A9DEAD4391F4A.pub

@@ -0,0 +1 @@
+AW-ID-Attestation-720A9DEAD4391F4A+6baea3c7+AcRoDdbbX9p5UJzn2wWPmTqIs7S1UYAbVHwzak3ArTR4

devices/ci/720A9DEAD4391F4A.witness.0

@@ -0,0 +1,6 @@
+ArmoredWitness ID attestation v1
+720A9DEAD4391F4A
+0
+ArmoredWitness-icy-snowflake+257719dd+AS3Cx/VuOKOlhn8XYvYOAgyLZ9Xu6UqeT7baPZ56nDp4
+
+— AW-ID-Attestation-720A9DEAD4391F4A a66jx5/AoAe9Q6HB/uIVdJN3cM6VWCkjDb5FHe4STkjAzW4FK5X0+lABnIzmPAXfQ93XPyaXjWnCgrqptABzKgF47gU=

devices/ci/720A9DEAD4392220.bastion.0

@@ -0,0 +1,6 @@
+ArmoredWitness BastionID attestation v1
+720A9DEAD4392220
+0
+66cea1a2e93c90692a697c4f36418f38d72287f65c842b883f3343bb0e27ab44
+
+— AW-ID-Attestation-720A9DEAD4392220 T38fbYv8f3qa7KvkNvCiNLHfgPOAjHlA8E9nCwDb8ml3QLTbbXVexmH4P/tqWZCXDAEY5RuJ+gcw3NgTwDcxo+WQIwM=

devices/ci/720A9DEAD4392220.pub

@@ -0,0 +1 @@
+AW-ID-Attestation-720A9DEAD4392220+4f7f1f6d+AS0jg+HmlH50UkwdDBGRIZCon4tUsXsFIZcG54wbdxMk

devices/ci/720A9DEAD4392220.witness.0

@@ -0,0 +1,6 @@
+ArmoredWitness ID attestation v1
+720A9DEAD4392220
+0
+ArmoredWitness-holy-frog+e66f71d4+AfGeqx8rOiK1WIPz3bEOT7tNRHigUAFLTdvTZ9IPT8m3
+
+— AW-ID-Attestation-720A9DEAD4392220 T38fbdWn1gtd8lW0PqanIy0r+bRDFeMaesjPbkW+fmeHDhByZsk4xtZe705FBxAtGdzM6r9U/4X7yG8L5UqbBfpaYAc=

devices/ci/720A9DEAD4394411.bastion.0

@@ -0,0 +1,6 @@
+ArmoredWitness BastionID attestation v1
+720A9DEAD4394411
+0
+60be39b9426e7777190bc89af9b568021c1610cb9067cac15a1c30f188042a52
+
+— AW-ID-Attestation-720A9DEAD4394411 /IUVVay7xqucCRFt2i9ciWQzOdHleR7trqYSYWVVsLLhq6yncoCGj7zn/xGW6DBJMpebO0qRt41P8H0rxWcHP8AOCQU=

devices/ci/720A9DEAD4394411.pub

@@ -0,0 +1 @@
+AW-ID-Attestation-720A9DEAD4394411+fc851555+AdP/46yY/OP1vdTXSz3C/SDQcixHdZBakWDbR9MdwxK6

devices/ci/720A9DEAD4394411.witness.0

@@ -0,0 +1,6 @@
+ArmoredWitness ID attestation v1
+720A9DEAD4394411
+0
+ArmoredWitness-morning-surf+82bc63bd+AUylOFW/NW4Y3ooygtklaXswvD8NQ6ET8guBTdCcBwt3
+
+— AW-ID-Attestation-720A9DEAD4394411 /IUVVd4SW1ydG0y2NstaSjTMmmzA+ozb7D7wJ078adm4Aq1+qOYNf5xJiNyoVMyojGAPVTLt6EO+tH9AhlSybTqmZw4=

devices/ci/CA6B65D9D4992516.bastion.0

@@ -0,0 +1,6 @@
+ArmoredWitness BastionID attestation v1
+CA6B65D9D4992516
+0
+ea8a7b22bb1a6420464bab7a01f768f120cf237bb399b46d0973109059175264
+
+— AW-ID-Attestation-CA6B65D9D4992516 frjTaSoZusCJcy7VCQINdC9TGtMfpuryfMe/7bpqUMrkBy6I9IF1pv7xiNvAHwKoMjtDxI2PHvU4+aLjCX/ER8kgBAo=

devices/ci/CA6B65D9D4992516.pub

@@ -0,0 +1 @@
+AW-ID-Attestation-CA6B65D9D4992516+7eb8d369+ATWcbyKw4qQ+8s7WPwdaDpSB3RlDFw9Ja+d48z5Qsjx2

devices/ci/CA6B65D9D4992516.witness.0

@@ -0,0 +1,6 @@
+ArmoredWitness ID attestation v1
+CA6B65D9D4992516
+0
+ArmoredWitness-wispy-snow+834b82b1+ASho7B13t7PhXoLr43ppVFCHEpTSajIybNRYMSi8XR1Q
+
+— AW-ID-Attestation-CA6B65D9D4992516 frjTabuAin+geejJ3AShNmeyaivFrv7J8hL+eNqJkp2YgZGQ5jZStLLTWUl/orretpYtWg5pgcgzJF2lLRIqR/bpDAg=

devices/devices.go

@@ -0,0 +1,132 @@
+package devices
+
+import (
+	"embed"
+	"errors"
+	"fmt"
+	"io/fs"
+	"log"
+	"strings"
+
+	"golang.org/x/mod/sumdb/note"
+)
+
+const (
+	AttestWitnessID = "ArmoredWitness ID attestation v1"
+	AttestBastionID = "ArmoredWitness BastionID attestation v1"
+)
+
+var (
+	//go:embed ci/*
+	ci embed.FS
+	//go:embed prod/*
+	prod embed.FS
+
+	CI   map[string]Device
+	Prod map[string]Device
+)
+
+func init() {
+	var err error
+	if CI, err = parseFS(ci); err != nil {
+		panic(err)
+	}
+	if Prod, err = parseFS(prod); err != nil {
+		panic(err)
+	}
+}
+
+// Device represents an ArmoredWitness device and its various attested identities.
+type Device struct {
+	ID            string
+	BastionID     string
+	WitnessPubkey string
+}
+
+type entry struct {
+	pubKey       string
+	attestations [][]byte
+}
+
+func parseFS(f embed.FS) (map[string]Device, error) {
+	entries := make(map[string]entry)
+	errs := []error{}
+	err := fs.WalkDir(f, ".", func(path string, d fs.DirEntry, _ error) error {
+		if d.IsDir() {
+			return nil
+		}
+
+		n := d.Name()
+		parts := strings.SplitN(n, ".", 2)
+		if len(parts) != 2 {
+			errs = append(errs, fmt.Errorf("badly named file %q", n))
+			return nil
+		}
+		body, err := f.ReadFile(path)
+		if err != nil {
+			errs = append(errs, fmt.Errorf("failed to read %q: %v", n, err))
+			return nil
+		}
+		e := entries[parts[0]]
+		if parts[1] == "pub" {
+			e.pubKey = string(body)
+
+		} else {
+			e.attestations = append(e.attestations, body)
+		}
+
+		entries[parts[0]] = e
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	r := make(map[string]Device)
+	for _, v := range entries {
+		d, err := new(v.pubKey, v.attestations)
+		if err != nil {
+			errs = append(errs, err)
+			continue
+		}
+		r[d.ID] = *d
+	}
+	if len(errs) > 0 {
+		return nil, errors.Join(errs...)
+	}
+	return r, nil
+}
+
+func new(attestPub string, attestations [][]byte) (*Device, error) {
+	v, err := note.NewVerifier(attestPub)
+	if err != nil {
+		return nil, fmt.Errorf("%s: %v", attestPub, err)
+	}
+
+	d := &Device{ID: v.Name()}
+
+	for _, a := range attestations {
+		n, err := note.Open(a, note.VerifierList(v))
+		if err != nil {
+			return nil, fmt.Errorf("couldn't open %q: %v", a, err)
+
+		}
+		lines := strings.Split(n.Text, "\n")
+		switch lines[0] {
+		case AttestWitnessID:
+			if len(lines) < 4 {
+				return nil, fmt.Errorf("%s: invalid ID attestation", v.Name())
+			}
+			d.WitnessPubkey = lines[3]
+		case AttestBastionID:
+			if len(lines) < 4 {
+				log.Printf("%q", n.Text)
+				return nil, fmt.Errorf("%s: invalid bastion attestation (%d)", v.Name(), len(lines))
+			}
+			d.BastionID = lines[3]
+		default:
+			continue
+		}
+	}
+	return d, nil
+}

devices/devices_test.go

@@ -0,0 +1,32 @@
+package devices
+
+import (
+	"testing"
+)
+
+func checkDevices(t *testing.T, d map[string]Device) {
+	t.Helper()
+	for k, v := range d {
+		t.Logf("Checking %v", k)
+		if v.ID == "" {
+			t.Errorf("%s: Empty ID", v.ID)
+		}
+		if k != v.ID {
+			t.Errorf("%s: ID mismatch: %v", k, v.ID)
+		}
+		if v.BastionID == "" {
+			t.Logf("%s: Warning, no BastionID present", k)
+		}
+		if v.WitnessPubkey == "" {
+			t.Errorf("%s: no witness pubkey present", k)
+		}
+	}
+}
+
+func TestCIFiles(t *testing.T) {
+	checkDevices(t, CI)
+}
+
+func TestProdFiles(t *testing.T) {
+	checkDevices(t, Prod)
+}

devices/prod/720A9DEAD4391341.bastion.0

@@ -0,0 +1,6 @@
+ArmoredWitness BastionID attestation v1
+720A9DEAD4391341
+0
+c664d70dc8cd2cbe40469224c66dd705d6eb67615c406b61a2579966127d0c7e
+
+— AW-ID-Attestation-720A9DEAD4391341 hOrmIu4XcnE6jIUw+L+f2mu/yUQzfUbGhPSCo8dZBD1B5tUddAAXRLejdmSVZNVBFTlwz0jVwnIZ4rHV+VVqKsWqoAg=

devices/prod/720A9DEAD4391341.pub

@@ -0,0 +1 @@
+AW-ID-Attestation-720A9DEAD4391341+84eae622+AVLSeDbG2T7RfgR2vHHC6aq4XhOWHY/hBkZUQWm+tIFK

devices/prod/720A9DEAD4391341.witness.0

@@ -0,0 +1,6 @@
+ArmoredWitness ID attestation v1
+720A9DEAD4391341
+0
+ArmoredWitness-weathered-rain+ea3d386d+AWLblKp5JuiyrgRh6ev2nNJ5XAd+sc/mM2D2HW/b4d5S
+
+— AW-ID-Attestation-720A9DEAD4391341 hOrmIm8IGhDrnCh4lLaavKD4x95IaDVauhIlF5ccDSXJvQAbVd2j1oZLoYrz2OmqGCgwMEStZUUlLjKzWrighEFcSgk=

devices/prod/720A9DEAD4391509.bastion.0

@@ -0,0 +1,6 @@
+ArmoredWitness BastionID attestation v1
+720A9DEAD4391509
+0
+395c4b740cfbb722a66cbb1790bb9e70100e35518c8101b3dacf579765e4d220
+
+— AW-ID-Attestation-720A9DEAD4391509 ALzFbKBPm1aHu2HqXzAnhLJH/01xHZn3J+TuJ6ZvMpvDqCK5ARYP2AgKSOeCjNY6YqjIkccwdE/IcvENvNL6qoVMAA4=

devices/prod/720A9DEAD4391509.pub

@@ -0,0 +1 @@
+AW-ID-Attestation-720A9DEAD4391509+00bcc56c+AZyGm+7xCplZpYIqJZQACgEazyMhCkIF6PfAG8hrFmiB

devices/prod/720A9DEAD4391509.witness.0

@@ -0,0 +1,6 @@
+ArmoredWitness ID attestation v1
+720A9DEAD4391509
+0
+ArmoredWitness-wispy-wood+90626287+AUVvZZ4LDvpljjooleJ3WnxnVK4J1YQiQbtgPWSVFwaP
+
+— AW-ID-Attestation-720A9DEAD4391509 ALzFbOpnWaaHImNvFUZuEiQwFWa9tJFcyqtFTsmB2zLniT3onPs43XWUTJidTq8DS7qqTmfWk2IHZTTD6sJ2WbGmHwU=

devices/prod/720A9DEAD4391737.bastion.0

@@ -0,0 +1,6 @@
+ArmoredWitness BastionID attestation v1
+720A9DEAD4391737
+0
+2867895f07dfc47299cf7d2ced88ed5230a822a7f62d54f8402d6daf11520131
+
+— AW-ID-Attestation-720A9DEAD4391737 LwCAcXIiJinSPvqCOqODTY6L1w9krYI0MHgzkt2ccTbeYZ1bFUVj8Rg5ZDNaKAv3DqzcC64jrB3pqswNQAV/PsSs0wM=

devices/prod/720A9DEAD4391737.pub

@@ -0,0 +1 @@
+AW-ID-Attestation-720A9DEAD4391737+2f008071+ARa8g49Anj+op8IBReuNLXJtkjGoB2WzOb5ytUaOEheH

devices/prod/720A9DEAD4391737.witness.0

@@ -0,0 +1,6 @@
+ArmoredWitness ID attestation v1
+720A9DEAD4391737
+0
+ArmoredWitness-small-breeze+7b3ada3a+AQAWYpUjfGGPQiWOgt6sLWap0P9rVOe+Ofu2uNZbO4FD
+
+— AW-ID-Attestation-720A9DEAD4391737 LwCAcSPENAsE+KSQpeGr9Z/N3vWgeE5h7LWQLy0BDWQJj2LHZOin8Tz79a3fymhHFXPjXoDfJxZrmbbs8xARmUGm1w4=

devices/prod/720A9DEAD4391942.pub

@@ -0,0 +1 @@
+AW-ID-Attestation-720A9DEAD4391942+224191fa+AaO1Uam79GmXzbYKTRfUm+MYfh8JL0DOCX/qdL8T4cpu

devices/prod/720A9DEAD4391942.witness.0

@@ -0,0 +1,6 @@
+ArmoredWitness ID attestation v1
+720A9DEAD4391942
+0
+ArmoredWitness-quiet-wood+6a554a5d+AZtxeZvnMbFf6bVPN81vIvlJnT4zCdq8tYi/guI0hEkT
+
+— AW-ID-Attestation-720A9DEAD4391942 IkGR+kxNsS+pl1UOHgYRw/ExADwlfWwDktcH6FdN0pgamL47quEZSXQvCrs1EUNBQatittsOwCZ5l0ELztP203OfKAA=

devices/prod/720A9DEAD4391E28.pub

@@ -0,0 +1 @@
+AW-ID-Attestation-720A9DEAD4391E28+91734bf6+AdmR700zfCueXABsCLLW7Ftt4QzMdvzd1CISVOJRr9of

devices/prod/720A9DEAD4391E28.witness.0

@@ -0,0 +1,6 @@
+ArmoredWitness ID attestation v1
+720A9DEAD4391E28
+0
+ArmoredWitness-morning-darkness+2a654a97+AXugA2VGdDmLYt1wqzaaP3UKSGcDVNZveRJYJ1FKC5+9
+
+— AW-ID-Attestation-720A9DEAD4391E28 kXNL9t/eFmMpUHOm3Ss8KWupXmKuR+unKL3KDlNqpN7H1HMM2yKSZjbexmsCk11NVcYLGdytNT3F/C1IhGQVZzsNOQo=

devices/prod/720A9DEAD4392019.bastion.0

@@ -0,0 +1,6 @@
+ArmoredWitness BastionID attestation v1
+720A9DEAD4392019
+0
+92c1c586ab85db6af4c27fc714c49a080366eb5e4d7f5b696eadb7e845e78362
+
+— AW-ID-Attestation-720A9DEAD4392019 QxDCB3NG4KSA44JoKeBoIgtD0AfETeV8x/2hnwwjMkfmdHpuuBmAzfpsqAKdPRC1cH6QfIm30zoOa8Q4QNk4Om2zcQo=

devices/prod/720A9DEAD4392019.pub

@@ -0,0 +1 @@
+AW-ID-Attestation-720A9DEAD4392019+4310c207+AbtF3hnI4vMN0MhN5bi4NsNdtEYEwMZP8a2kTbCxatub

devices/prod/720A9DEAD4392019.witness.0

@@ -0,0 +1,6 @@
+ArmoredWitness ID attestation v1
+720A9DEAD4392019
+0
+ArmoredWitness-shy-wind+e76ed9ec+ARmL7SaHvPYPwkbq41g/KpdkKH7OZaoaqfK2sEoWKL4d
+
+— AW-ID-Attestation-720A9DEAD4392019 QxDCB7btq8RNb99Hce2t8DlapELVXu1Iv20UZVItsCu/PY+T9WOhr+H3UlchBjs8JmFJGTWJna/fw04ZnPTEz6bc0QA=

devices/prod/720A9DEAD4392030.bastion.0

@@ -0,0 +1,6 @@
+ArmoredWitness BastionID attestation v1
+720A9DEAD4392030
+0
+b6d4eee9d6165e01a756bd4590ab29bc34265e2e83b580f54a19f4a458778cbc
+
+— AW-ID-Attestation-720A9DEAD4392030 8vMhNQ/6Xq8mDEGmtmSC0LyHWXfktbpmuaKnDnBrT+LuuFuK9YMp3eEDCyFCVv1Kg/BHxsr0voUAFSFtOHPSeo2QHwo=

devices/prod/720A9DEAD4392030.pub

@@ -0,0 +1 @@
+AW-ID-Attestation-720A9DEAD4392030+f2f32135+AWxEblgSRKUgSPXC8NQn68+v9UxA6sfqX+MwKqSwMLps

devices/prod/720A9DEAD4392030.witness.0

@@ -0,0 +1,6 @@
+ArmoredWitness ID attestation v1
+720A9DEAD4392030
+0
+ArmoredWitness-hidden-river+45a41ba7+AdrpNMfMH0W6iYo9/hJl1JKmxYQF3ewUP8FvhKD1iOOl
+
+— AW-ID-Attestation-720A9DEAD4392030 8vMhNUA586o1pZ7ZqalEGIGp0F/s3HjcRmsavwvFjdPVGviZmNCxvuNPdP/h2orTzUwAT18fh5wX6qRivMAY7pztOwk=

devices/prod/720A9DEAD439211E.bastion.0

@@ -0,0 +1,6 @@
+ArmoredWitness BastionID attestation v1
+720A9DEAD439211E
+0
+9e18b190f219d9a9d3032d8b00807aa0c014948fb324d543057d82afa00ad15c
+
+— AW-ID-Attestation-720A9DEAD439211E fojp1OboK4pY0l8OgWao2l/onkwW26yhW1j/PxCQJT+jlXvJY44TEvgKtbRg/kQxJwD9h85v53HshkEB80JCZVi5jwk=