audit.ts

// SPDX-FileCopyrightText: 2026 Emily <hello@emily.moe>
//
// SPDX-License-Identifier: MIT

import {
  assert,
  assertEquals,
  assertExists,
  assertObjectMatch,
} from "@std/assert";
import {
  createMessage,
  type PublicKey,
  readKey,
  readSignature,
  verify,
} from "openpgp";
import {
  type Activity,
  manuallyAuditedMergeCommits,
  manuallyAuditedNixpkgsActivities,
  manuallyAuditedNixpkgsPullRequestURLs,
  manuallyAuditedNixpkgsRefActivityPullRequestURLs,
  type NixpkgsPullRequestURL,
} from "./axioms.ts";
import { type Facts, fromJSONFacts, type ID, type JSONFacts } from "./facts.ts";
import type {
  ActorInfoFragment,
  CommitSignatureInfoFragment,
  PullRequestInfoFragment,
  RepositoryInfoFragment,
} from "./graphql/graphql.ts";

const jsonFacts: JSONFacts = JSON.parse(
  await Deno.readTextFile("./facts.json"),
);

const {
  affectedRepositories,
  affectedUser,
  webFlowUser,
  rRyantmUser,
  nixpkgsCIActor,
  githubActionsActor,
  committers,
  trustedOpenPGPPublicKeys,
  riskyPullRequests,
  riskyRepositoryActivity,
}: Facts = fromJSONFacts(jsonFacts);

const nixpkgs: RepositoryInfoFragment = (() => {
  const nixpkgs = affectedRepositories.values().find((
    { owner: { login }, name },
  ) => login === "NixOS" && name === "nixpkgs");
  assertExists(nixpkgs);
  return nixpkgs;
})();

const manuallyAuditedNixpkgsActivitiesByID: Map<ID, Omit<Activity, "actor">> =
  new Map(
    manuallyAuditedNixpkgsActivities.values().map((
      activity,
    ) => [activity.node_id, activity]),
  );

function activityWasManuallyAudited(
  { repository, activity }: {
    repository: RepositoryInfoFragment;
    activity: Activity;
  },
): boolean {
  const manuallyAuditedActivity = manuallyAuditedNixpkgsActivitiesByID.get(
    activity.node_id,
  );
  if (manuallyAuditedActivity !== undefined) {
    assertEquals(repository.id, nixpkgs.id);
    assertObjectMatch(activity, manuallyAuditedActivity);
    return true;
  } else {
    return false;
  }
}

const knownMergeCommitOids = new Set(
  riskyPullRequests.values().flatMap(({ mergeCommit }) =>
    mergeCommit === null ? [] : [mergeCommit.oid]
  ),
);

function auditAffectedRepositoryActivity(): boolean {
  return affectedRepositories.values().every((repository) => {
    const riskyActivities = riskyRepositoryActivity.get(repository.id);
    assertExists(riskyActivities);
    return riskyActivities.values().every((activity) =>
      activityWasManuallyAudited({ repository, activity }) ||
      // Harmless.
      activity.activity_type === "branch_deletion" ||
      // Pull request merges are audited separately.
      (
        activity.activity_type === "pr_merge" &&
        knownMergeCommitOids.has(activity.after)
      )
    );
  });
}

// The GitHub API signature verification likes to return
// `GPGVERIFY_ERROR` a lot, so we have to verify signatures ourselves
// to get reliable results.

const trustedOpenPGPPublicKeyObjects: Map<ID, PublicKey[]> = new Map(
  await Promise.all(
    trustedOpenPGPPublicKeys.entries().map(async ([id, armoredKeys]) =>
      [
        id,
        await Promise.all(
          armoredKeys.map((armoredKey) => readKey({ armoredKey })),
        ),
      ] as const
    ),
  ),
);

async function verifyCommitSignature(
  { commit, committer }: {
    commit: CommitSignatureInfoFragment;
    committer: ActorInfoFragment;
  },
): Promise<boolean> {
  if (commit?.signature?.__typename !== "GpgSignature") {
    return false;
  }
  const { signature: { payload, signature } } = commit;
  const verificationKeys = trustedOpenPGPPublicKeyObjects.get(committer.id);
  assertExists(verificationKeys);
  const { signatures } = await verify({
    message: await createMessage({ text: payload }),
    signature: await readSignature({ armoredSignature: signature }),
    verificationKeys,
    config: {
      // See <https://github.com/openpgpjs/openpgpjs/issues/1800> for
      // some discussion. Expiry times are somewhat fake for Git commit
      // signing to begin with anyway…
      allowInsecureVerificationWithReformattedKeys: true,
    },
  });
  return (await Promise.all(
    signatures.flatMap(({ keyID, verified }) =>
      verificationKeys.map(async (key) =>
        key.getKeyID().equals(keyID) && await verified
      )
    ),
  )).some((verified) => verified);
}

// PR merge commits signed by GitHub’s signature are trusted to not
// do any funny business (conflict resolution, “evil merges”, etc.).
async function pullRequestMergeCommitIsTrusted(
  { state, mergeCommit }: PullRequestInfoFragment,
): Promise<boolean> {
  return (
    state !== "MERGED" || (
      mergeCommit !== null &&
      (
        manuallyAuditedMergeCommits.has(mergeCommit.oid) ||
        await verifyCommitSignature({
          commit: mergeCommit,
          committer: webFlowUser,
        })
      )
    )
  );
}

const trustedCommitterIDs: Set<ID> = new Set(
  committers.values().map(({ id }) => id).filter((id) =>
    id !== affectedUser.id
  ),
);

function pullRequestHasTrustedMerger(
  { mergedBy }: PullRequestInfoFragment,
): boolean {
  return mergedBy !== null && trustedCommitterIDs.has(mergedBy?.id);
}

function pullRequestHeadCommitHasTrustedApproval(
  { headRefOid, latestOpinionatedReviews }: PullRequestInfoFragment,
): boolean {
  assertExists(latestOpinionatedReviews?.nodes);
  return latestOpinionatedReviews.nodes.some((review) => {
    assertExists(review);
    const { author, commit, state } = review;
    return author !== null &&
      trustedCommitterIDs.has(author.id) &&
      commit?.oid === headRefOid &&
      state === "APPROVED";
  });
}

async function pullRequestHeadCommitWasSignedByAffectedUser(
  { commits }: PullRequestInfoFragment,
): Promise<boolean> {
  assertExists(commits.nodes);
  const pullRequestCommit = commits.nodes.at(-1) ?? null;
  return pullRequestCommit !== null && await verifyCommitSignature({
    commit: pullRequestCommit.commit,
    committer: affectedUser,
  });
}

const trustedAutomatedAuthorIDs: Set<ID> = new Set(
  [rRyantmUser, nixpkgsCIActor, githubActionsActor].map(({ id }) => id),
);

function pullRequestHasTrustedAuthor(
  { author }: PullRequestInfoFragment,
): boolean {
  return author !== null && (
    trustedAutomatedAuthorIDs.has(author.id) ||
    trustedCommitterIDs.has(author.id)
  );
}

function parseNixpkgsPullRequestURLs(
  pullRequestURLs: Set<NixpkgsPullRequestURL>,
): Set<number> {
  return new Set(
    pullRequestURLs.values().map((url) => {
      const suffix = url.split("/").at(-1);
      assertExists(suffix);
      const number = Number.parseInt(suffix, 10);
      assert(Number.isSafeInteger(number));
      return number;
    }),
  );
}

const manuallyAuditedNixpkgsRefActivityPullRequestNumbers: Set<number> =
  parseNixpkgsPullRequestURLs(manuallyAuditedNixpkgsRefActivityPullRequestURLs);

function pullRequestHasNoRiskyRefActivities(
  { number, state, baseRepository, headRepository, headRefName }:
    PullRequestInfoFragment,
): boolean {
  if (
    baseRepository?.id === nixpkgs.id &&
    manuallyAuditedNixpkgsRefActivityPullRequestNumbers.has(number)
  ) {
    return true;
  }
  if (headRepository === null) {
    // A closed pull request with a deleted repository can never be
    // merged or reopened, so poses no risk. Otherwise, since the head
    // repository is gone, we can’t check whether there is any risky
    // activity and must return a conservative result.
    return state === "CLOSED";
  }
  const riskyActivities = riskyRepositoryActivity.get(headRepository.id);
  assertExists(riskyActivities);
  return riskyActivities.values().find(({ ref, activity_type }) =>
    ref === `refs/heads/${headRefName}` &&
    activity_type !== "branch_deletion"
  ) === undefined;
}

async function pullRequestHasTrustedHeadCommit(
  pullRequest: PullRequestInfoFragment,
): Promise<boolean> {
  return (
    // Any PR head commit in a PR that was merged by a trusted
    // committer is trusted; they are expected to have performed
    // standard due diligence before merging.
    pullRequestHasTrustedMerger(pullRequest) ||
    // Any PR head commit in a PR that was approved by a trusted
    // committer at that commit is trusted; they are expected to have
    // performed standard due diligence before approving.
    pullRequestHeadCommitHasTrustedApproval(pullRequest) ||
    // Any PR head commit signed by one of the affected user’s trusted
    // PGP keys is trusted; there is no indication that their PGP keys
    // were compromised in any way, so this compensates for our
    // inability to assume trust for GitHub actions attributed to their
    // account during the risk period.
    await pullRequestHeadCommitWasSignedByAffectedUser(pullRequest) ||
    // Any PR head commit in a PR with a trusted author, from a ref
    // with no untrusted activity, is trusted.
    (
      pullRequestHasTrustedAuthor(pullRequest) &&
      pullRequestHasNoRiskyRefActivities(pullRequest)
    )
  );
}

const manuallyAuditedNixpkgsPullRequestNumbers: Set<number> =
  parseNixpkgsPullRequestURLs(
    manuallyAuditedNixpkgsPullRequestURLs,
  );

async function auditPullRequest(
  pullRequest: PullRequestInfoFragment,
): Promise<boolean> {
  // We require merge commits, if present, to be trusted upfront, as it
  // is not practical to try and audit them through the GitHub web UI.
  assert(await pullRequestMergeCommitIsTrusted(pullRequest));
  return (
    (
      pullRequest.baseRepository?.id === nixpkgs.id &&
      manuallyAuditedNixpkgsPullRequestNumbers.has(pullRequest.number)
    ) ||
    await pullRequestHasTrustedHeadCommit(pullRequest) ||
    (
      // We don’t place trust in unmerged pull requests in general,
      // so we don’t need to audit them strictly. However, it is
      // possible that we may later want to infer trust in them
      // through various indicators in future, like the prior
      // expansion of the merge bot to pull requests authored
      // by committers. Untrusted pushes to these pull requests
      // during the risk period could undermine these inferences and
      // pose a background risk for further compromise. Therefore, we
      // require that unmerged pull requests at least have auditable
      // push activity.
      pullRequest.state !== "MERGED" &&
      pullRequestHasNoRiskyRefActivities(pullRequest)
    )
  );
}

async function daijoubu(): Promise<boolean> {
  return auditAffectedRepositoryActivity() &&
    (await Promise.all(
      riskyPullRequests.values().map(async (pullRequest) => {
        if (await auditPullRequest(pullRequest)) {
          return true;
        } else {
          console.error(
            "Could not successfully audit pull request %s",
            pullRequest.id,
          );
          return false;
        }
      }),
    )).every((success) => success);
}

if (import.meta.main) {
  assert(await daijoubu(), "Audit failed");
  console.log("Audit successful");
}