Demonstrate hosting signature agent card and registry on Cloudflare Workers (cloudflare#65)

* Support Workers with `time` crate instead of `std::time`

Cloudflare Workers does not expose a system clock. This isn't caught by
our Github compilation tests because `std::time` compiles in
`wasm32-unknown-unknown` just fine, but throws a runtime panic in that
environment.

The standard advice is to use `time` crate instead per public Cloudflare
documentation with `wasm-bindgen` feature enabled. The main difference
is that calls to `SystemTime::now()` and `Instant::elapsed()`, both of
which require a running clock, have now been replaced with
`UtcTimeOffset::now()` and raw `time::Duration` calculations. As a nice
side effect, we can also remove an entire category of errors thrown by
`std::time` from those thrown by `web-bot-auth`.

* Create an example of how to host a signature agent card and a registry
on Cloudflare workers

This change adds a single Worker that:

1. Generates a brand new SAC and persists it in Workers KV, accessible
   on visiting a message directory.
2. Generates a registry linking to that SAC.

It is set up in such a way that attaching multiple custom routes will
automatically expand the number of registry items - for example, every
new subdomain will trigger a new SAC. This makes it useful for e.g.
end-to-end tests.

* Fix registry and http-signature-directory to work with spec

The registry should point to `/well-known/http-message-signature` path, not
just the domain of the host. This change amends that.

`http-signature-directory` has been assuming responses from the
directory will be signed with just the `@authority` component - however, this
is wrong, both per the spec and logically. The correct component should
be `"@authority";req`, indicating that the response is signing the
derived component from the request. This change adds a log line to the
same.

It also adds a better error message for the case when signature
verification fails. This is based on real challenges experienced by the
community e.g. in https://community.cloudflare.com/t/web-bot-auth-signature-validation-failure/854577
during parsing.

* fixup! Fix registry and http-signature-directory to work with spec

Author: AkshatM

Cargo.lock

@@ -1,7 +1,8 @@
 [workspace]
 members = [
     "crates/*",
-    "examples/rust"
+    "examples/rust",
+    "examples/signature-agent-card-and-registry"
 ]
 resolver = "2"
 
@@ -31,6 +32,7 @@ base64 = "0.22.1"
 serde_json = "1.0.140"
 data-url = "0.3.1"
 regex = "1.12.2"
+time = { version = "0.3.44" }
 
 # workspace dependencies
 web-bot-auth = { version = "0.5.1", path = "./crates/web-bot-auth" }

Cargo.toml

@@ -3,7 +3,7 @@
 //     https://opensource.org/licenses/Apache-2.0
 
 use clap::Parser;
-use log::{debug, info};
+use log::{debug, error, info};
 use reqwest::{
     Url,
     blocking::Client,
@@ -70,7 +70,10 @@ struct SignedDirectory {
 impl SignedMessage for SignedDirectory {
     fn lookup_component(&self, name: &CoveredComponent) -> Vec<String> {
         match name {
-            CoveredComponent::Derived(DerivedComponent::Authority { .. }) => {
+            CoveredComponent::Derived(DerivedComponent::Authority { req: true }) => {
+                error!(
+                    "Expected `@authority`;req in signature input components, but did not find it"
+                );
                 vec![self.authority.clone()]
             }
             CoveredComponent::HTTP(HTTPField { name, .. }) => {
@@ -129,7 +132,7 @@ fn main() -> Result<(), String> {
 
     let authority = url.authority();
     debug!(
-        "Extracted the following @authority component: {:?}",
+        "Assumed the following @authority component: {:?}",
         authority
     );
 
@@ -328,7 +331,7 @@ fn main() -> Result<(), String> {
                                     }
                                     Err(err) => {
                                         key_info.error = Some(format!(
-                                            "Signature verification failed: {:?}",
+                                            "Generated signature was incorrect, leading to verification failure, because: {:?}",
                                             err
                                         ));
                                     }

crates/http-signature-directory/src/main.rs

@@ -21,4 +21,8 @@ serde = { workspace = true }
 serde_json = { workspace = true }
 sha2 = { workspace = true }
 base64 = { workspace = true }
-data-url = { workspace = true }
+data-url = { workspace = true }
+time = { workspace = true }
+
+[target.'cfg(target_arch = "wasm32")'.dependencies]
+time = { workspace = true, features = ["wasm-bindgen"] }

crates/web-bot-auth/Cargo.toml

@@ -30,7 +30,6 @@ use message_signatures::{MessageVerifier, ParsedLabel, SignatureTiming, SignedMe
 
 use data_url::DataUrl;
 use keyring::{Algorithm, JSONWebKeySet, KeyRing};
-use std::time::SystemTimeError;
 
 use crate::components::{HTTPField, HTTPFieldParameters};
 
@@ -78,10 +77,6 @@ pub enum ImplementationError {
     /// This is considered "impossible" as invalid values should not be present in the structure
     /// containing those values.
     SignatureParamsSerialization,
-    /// Verification of `created` or `expires` component parameter requires use of a system clock.
-    /// This error is thrown if the system clock is configured in ways that prevent adequate time
-    /// resolution, such as the clock believes the start of Unix time is in the future.
-    TimeError(SystemTimeError),
     /// A wrapper around `WebBotAuthError`
     WebBotAuth(WebBotAuthError),
 }
@@ -319,8 +314,8 @@ mod tests {
         assert!(advisory.is_expired.unwrap_or(true));
         assert!(!advisory.nonce_is_invalid.unwrap_or(true));
         let timing = verifier.verify(&keyring, None).unwrap();
-        assert!(timing.generation.as_nanos() > 0);
-        assert!(timing.verification.as_nanos() > 0);
+        assert!(timing.generation.whole_nanoseconds() > 0);
+        assert!(timing.verification.whole_nanoseconds() > 0);
     }
 
     #[test]
@@ -402,7 +397,7 @@ mod tests {
         signer
             .generate_signature_headers_content(
                 &mut mytest,
-                std::time::Duration::from_secs(10),
+                time::Duration::seconds(10),
                 Algorithm::Ed25519,
                 &private_key.to_vec(),
             )
@@ -419,8 +414,8 @@ mod tests {
         assert!(!advisory.nonce_is_invalid.unwrap_or(true));
 
         let timing = verifier.verify(&keyring, None).unwrap();
-        assert!(timing.generation.as_nanos() > 0);
-        assert!(timing.verification.as_nanos() > 0);
+        assert!(timing.generation.whole_nanoseconds() > 0);
+        assert!(timing.verification.whole_nanoseconds() > 0);
     }
 
     #[test]

crates/web-bot-auth/src/lib.rs

@@ -6,7 +6,7 @@ use regex::bytes::Regex;
 use sfv::SerializeValue;
 use std::fmt::Write as _;
 use std::sync::LazyLock;
-use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
+use time::{Duration, UtcDateTime};
 static OBSOLETE_LINE_FOLDING: LazyLock<Regex> =
     LazyLock::new(|| Regex::new(r"\s*\r\n\s+").unwrap());
 
@@ -108,16 +108,12 @@ impl ParameterDetails {
     {
         SecurityAdvisory {
             is_expired: self.expires.map(|expires| {
-                if expires <= 0 {
-                    return true;
+                if let Ok(expiry) = UtcDateTime::from_unix_timestamp(expires) {
+                    let now = UtcDateTime::now();
+                    return now >= expiry;
                 }
 
-                match SystemTime::now().duration_since(UNIX_EPOCH) {
-                    Ok(duration) => i64::try_from(duration.as_secs())
-                        .map(|dur| dur >= expires)
-                        .unwrap_or(true),
-                    Err(_) => true,
-                }
+                true
             }),
             nonce_is_invalid: self.nonce.as_ref().map(nonce_validator),
         }
@@ -329,31 +325,17 @@ impl MessageSigner {
             ),
         );
 
-        let created = SystemTime::now()
-            .duration_since(UNIX_EPOCH)
-            .map_err(ImplementationError::TimeError)?;
+        let created = UtcDateTime::now();
         let expiry = created + expires;
 
-        let created_as_i64 = i64::try_from(created.as_secs()).map_err(|_| {
-            ImplementationError::ParsingError(
-                "Clock time does not fit in i64, verfy your clock is set correctly".into(),
-            )
-        })?;
-        let expires_as_i64 = i64::try_from(expiry.as_secs()).map_err(|_| {
-            ImplementationError::ParsingError(
-                "Clcok time + `expires` value does not fit in i64, verfy your duration is valid"
-                    .into(),
-            )
-        })?;
-
         sfv_parameters.insert(
             sfv::KeyRef::constant("created").to_owned(),
-            sfv::BareItem::Integer(sfv::Integer::constant(created_as_i64)),
+            sfv::BareItem::Integer(sfv::Integer::constant(created.unix_timestamp())),
         );
 
         sfv_parameters.insert(
             sfv::KeyRef::constant("expires").to_owned(),
-            sfv::BareItem::Integer(sfv::Integer::constant(expires_as_i64)),
+            sfv::BareItem::Integer(sfv::Integer::constant(expiry.unix_timestamp())),
         );
 
         let (signature_base, signature_params_content) = SignatureBase {
@@ -529,9 +511,9 @@ impl MessageVerifier {
                 .and_then(|key| keyring.get(key)),
         })
         .ok_or(ImplementationError::NoSuchKey)?;
-        let generation = Instant::now();
+        let generation = UtcDateTime::now();
         let (base_representation, _) = self.parsed.base.into_ascii()?;
-        let generation = generation.elapsed();
+        let generation = UtcDateTime::now() - generation;
         match &keying_material.0 {
             Algorithm::Ed25519 => {
                 use ed25519_dalek::{Signature, Verifier, VerifyingKey};
@@ -541,13 +523,13 @@ impl MessageVerifier {
                 let sig = Signature::try_from(self.parsed.signature.as_slice())
                     .map_err(|_| ImplementationError::InvalidSignatureLength)?;
 
-                let verification = Instant::now();
+                let verification = UtcDateTime::now();
                 verifying_key
                     .verify(base_representation.as_bytes(), &sig)
                     .map_err(ImplementationError::FailedToVerify)
                     .map(|()| SignatureTiming {
                         generation,
-                        verification: verification.elapsed(),
+                        verification: UtcDateTime::now() - verification,
                     })
             }
             other => Err(ImplementationError::UnsupportedAlgorithm(other.clone())),
@@ -615,8 +597,8 @@ mod tests {
         );
         let verifier = MessageVerifier::parse(&test, |(_, _)| true).unwrap();
         let timing = verifier.verify(&keyring, None).unwrap();
-        assert!(timing.generation.as_nanos() > 0);
-        assert!(timing.verification.as_nanos() > 0);
+        assert!(timing.generation.whole_nanoseconds() > 0);
+        assert!(timing.verification.whole_nanoseconds() > 0);
     }
 
     #[test]
@@ -669,7 +651,7 @@ mod tests {
             signer
                 .generate_signature_headers_content(
                     &mut test,
-                    Duration::from_secs(10),
+                    Duration::seconds(10),
                     Algorithm::Ed25519,
                     &private_key.to_vec()
                 )

crates/web-bot-auth/src/message_signatures.rs

@@ -25,6 +25,7 @@ path = "verify.rs"
 
 [dependencies]
 indexmap = { workspace = true }
+time = { workspace = true }
 
 # workspace dependencies
 web-bot-auth = { workspace = true }

examples/rust/Cargo.toml

@@ -13,7 +13,7 @@
 // limitations under the License.
 
 use indexmap::IndexMap;
-use std::{time::Duration, vec};
+use time::Duration;
 use web_bot_auth::{
     components::{
         CoveredComponent, DerivedComponent, HTTPField, HTTPFieldParameters, HTTPFieldParametersSet,
@@ -71,7 +71,7 @@ fn main() {
     signer
         .generate_signature_headers_content(
             &mut headers,
-            Duration::from_secs(10),
+            Duration::seconds(10),
             Algorithm::Ed25519,
             &private_key,
         )

examples/rust/signing.rs

@@ -0,0 +1,2 @@
+build/
+.wrangler/