Add CLI tool to signature crate to check Balrog results

Author: oskirby

signature/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "signature"
 version = "0.2.0"
-edition = "2021"
+edition = "2024"
 
 [dependencies]
 asn1-rs = { version = "0.7.2", features=["datetime"] }
@@ -13,7 +13,14 @@ hex = "0.4"
 ring = "0.17.14"
 x509-parser = { version = "0.18.1", features = ["verify", "validate"] }
 
+[dev-dependencies]
+clap = { version = "4.6", features=["derive"] }
+ureq = "3.3.0"
+
+[[example]]
+name = "balrog-cli"
+
 [lib]
 name = "signature"
 path = "src/lib.rs"
-crate-type = ["staticlib"]
+crate-type = ["staticlib", "rlib"]

signature/examples/balrog-cli.rs

@@ -0,0 +1,128 @@
+use clap::Parser;
+use ureq;
+use std::{io, process};
+use std::io::Write;
+use x509_parser::time::ASN1Time;
+
+use signature::{Balrog, BalrogError, parse_pem_chain};
+
+const PROD_ROOT_HASH: &str = "97e8ba9cf12fb3de53cc42a4e6577ed64df493c247b414fea036818d3823560e";
+
+/// Program arguments
+#[derive(Parser, Debug)]
+#[command(version, about, long_about = None)]
+struct Args {
+    /// Balrog update URL
+    url: String,
+
+    /// Root certificate hash
+    #[arg(short, long, default_value_t = PROD_ROOT_HASH.to_string())]
+    root: String,
+}
+
+struct BalrogData {
+    x5u: String,
+    signature: String,
+    payload: Vec<u8>,
+    chain: Vec<u8>,
+}
+
+fn fetch(args: &Args) -> Result<BalrogData, ureq::Error> {
+    // Step 1: Fetch the Balrog update details
+    let mut response = ureq::get(args.url.clone()).call()?;
+    let body = response.body_mut().read_to_vec()?;
+    let signature = match response.headers().get("Content-Signature") {
+        Some(x) => x.to_str().unwrap(),
+        None => return Err(ureq::Error::StatusCode(404)),
+    };
+
+    // We should be able to split the content signature on semicolons to get name=value pairs.
+    let mut x5u = String::new();
+    let mut sigdata = String::new();
+    for entry in signature.split(";") {
+        let Some((name, value)) = entry.split_once("=") else {
+            continue;
+        };
+        let name = name.trim();
+        let value = value.trim();
+        if name == "x5u" {
+            x5u = value.to_string();
+        }
+        if name == "p384ecdsa" {
+            sigdata = value.to_string();
+        }
+    }
+
+    // Step 2: Fetch the certificate chain.
+    let chain = ureq::get(x5u.clone())
+        .call()?
+        .body_mut()
+        .read_to_vec()?;
+
+    Ok(BalrogData{
+        x5u: String::from(x5u),
+        payload: body.clone(),
+        chain: chain.clone(),
+        signature: String::from(sigdata),
+    })
+}
+
+fn run(args: &Args, data: &BalrogData) -> Result<(), BalrogError> {
+    let chain = parse_pem_chain(data.chain.as_slice())?;
+    let balrog = Balrog::new(&chain)?;
+
+    // Print some details about the certificate chain.
+    if let Some(leaf) = balrog.chain.first() {
+        for cn in leaf.subject().iter_common_name() {
+            let name = cn.as_str()?;
+            eprintln!("Leaf hostname: {}", name);
+        }
+
+        if let Some(ext) = leaf.subject_alternative_name()? {
+            for san in ext.value.general_names.iter() {
+                eprintln!("Leaf alternative name: {}", san);
+            }
+        }
+    }
+
+    //let roothash = hex::decode(args.root.as_str()).unwrap();
+
+    balrog.verify(
+        data.payload.as_slice(),
+        data.signature.as_str(),
+        ASN1Time::now().timestamp(),
+        "aus.content-signature.mozilla.org",
+    )
+}
+
+fn main() {
+    let args = Args::parse();
+
+    // Fetch the Balrog update details
+    let data = match fetch(&args) {
+        Ok(x) => {
+            eprintln!("Balrog fetch successful");
+            eprintln!("Chain: {}", x.x5u);
+            eprintln!("Signature: {}", x.signature);
+            eprintln!("");
+            x
+        },
+        Err(e) => {
+            eprintln!("Balrog fetch failed: {}", e);
+            process::exit(1);
+        }
+    };
+
+    // Run the cryptographic validation
+    let result = run(&args, &data);
+
+    // Write the payload data to stdout.
+    let _ = io::stdout().write_all(data.payload.as_slice());
+
+    if result.is_ok() {
+        eprintln!("Verification successful");
+    } else {
+        eprintln!("Verification failed: {}", result.unwrap_err());
+        process::exit(1);
+    }
+}