feat(rust/signed-doc): CBOR encoder using minicbor

rust/signed_doc/Cargo.toml

@@ -12,12 +12,13 @@ workspace = true
 
 [dependencies]
 catalyst-types = { version = "0.0.3", path = "../catalyst-types" }
+cbork-utils = { version = "0.0.1", path = "../cbork-utils" }
 
 anyhow = "1.0.95"
 serde = { version = "1.0.217", features = ["derive"] }
 serde_json = "1.0.134"
-coset = "0.3.8"
-minicbor = { version = "0.25.1", features = ["half"] }
+coset = { version = "0.3.8", features = ["std"] }
+minicbor = { version = "0.25.1", features = ["std", "half"] }
 brotli = "7.0.0"
 ed25519-dalek = { version = "2.1.1", features = ["rand_core", "pem"] }
 hex = "0.4.3"
@@ -29,6 +30,7 @@ futures = "0.3.31"
 ed25519-bip32 = "0.4.1" # used by the `mk_signed_doc` cli tool
 tracing = "0.1.40"
 thiserror = "2.0.11"
+indexmap = "2.9.0"
 
 [dev-dependencies]
 base64-url = "3.0.0"

rust/signed_doc/bins/mk_signed_doc.rs

@@ -9,7 +9,7 @@ use std::{
 };
 
 use anyhow::Context;
-use catalyst_signed_doc::{Builder, CatalystId, CatalystSignedDocument};
+use catalyst_signed_doc::{CatalystId, CatalystSignedDocument, CoseSignBuilder};
 use clap::Parser;
 
 fn main() {
@@ -66,7 +66,7 @@ impl Cli {
                 // Possibly encode if Metadata has an encoding set.
                 let payload = serde_json::to_vec(&json_doc)?;
                 // Start with no signatures.
-                let signed_doc = Builder::new()
+                let signed_doc = CoseSignBuilder::new()
                     .with_decoded_content(payload)
                     .with_json_metadata(metadata)?
                     .build();

rust/signed_doc/src/cose_sign/helpers.rs

@@ -0,0 +1,101 @@
+use minicbor::{
+    bytes::{ByteArray, ByteSlice},
+    data::Tagged,
+    Encode as _,
+};
+
+use super::VecEncodeError;
+
+/// Encode headers using the provided cbor-encoded key-value pairs,
+/// conforming to the [RFC 8152 specification](https://datatracker.ietf.org/doc/html/rfc8152#autoid-8).
+pub fn encode_headers<'a, I>(iter: I) -> Vec<u8>
+where I: IntoIterator<Item = (&'a [u8], &'a [u8]), IntoIter: ExactSizeIterator> {
+    let mut encoder = minicbor::Encoder::new(vec![]);
+
+    let iter = iter.into_iter();
+    let map_len = u64::try_from(iter.len()).unwrap_or(u64::MAX);
+    encoder.map(map_len);
+
+    for (encoded_key, encoded_v) in iter {
+        // Writing a pre-encoded field of the map.
+        encoder.writer_mut().extend_from_slice(encoded_key);
+        encoder.writer_mut().extend_from_slice(encoded_v);
+    }
+
+    encoder.into_writer()
+}
+
+/// Encode a single protected `kid` header for the COSE Signature.
+///
+/// # Errors
+///
+/// - If encoding of the `kid` fails.
+pub fn encoed_kid_header(kid: &[u8]) -> Result<Vec<u8>, VecEncodeError> {
+    /// The KID label as per [RFC 8152 3.1 section](https://datatracker.ietf.org/doc/html/rfc8152#section-3.1).
+    pub const KID_LABEL: u8 = 4;
+
+    let mut encoder = minicbor::Encoder::new(vec![]);
+    // A map with a single `kid` field.
+    encoder.map(1u64)?.u8(KID_LABEL)?.bytes(kid)?;
+    Ok(encoder.into_writer())
+}
+
+/// Create a binary blob that will be signed. No support for unprotected headers.
+///
+/// Described in [section 2 of RFC 8152](https://datatracker.ietf.org/doc/html/rfc8152#section-2).
+pub fn encode_tbs_data(
+    protected_headers: &[u8], signature_header: &[u8], content: Option<&[u8]>,
+) -> Result<Vec<u8>, VecEncodeError> {
+    /// The context string as per [RFC 8152 section 4.4](https://datatracker.ietf.org/doc/html/rfc8152#section-4.4).
+    const SIGNATURE_CONTEXT: &str = "Signature";
+
+    minicbor::to_vec((
+        SIGNATURE_CONTEXT,
+        <&ByteSlice>::from(protected_headers),
+        <&ByteSlice>::from(signature_header),
+        ByteArray::from([]),                        // no aad.
+        <&ByteSlice>::from(content.unwrap_or(&[])), // allowing no payload (i.e. no content).
+    ))
+}
+
+/// Encode COSE signature.
+///
+/// Signature bytes should represent a cryptographic signature.
+pub fn encode_cose_signature(
+    protected_header: &[u8], signature_bytes: &[u8],
+) -> Result<Vec<u8>, VecEncodeError> {
+    minicbor::to_vec([
+        <&ByteSlice>::from(protected_header),
+        <&ByteSlice>::from(signature_bytes),
+    ])
+}
+
+/// Encode an array from an iterator of pre-encoded COSE Signature items.
+fn encode_cose_signature_array<S>(signatures: S) -> Result<Vec<u8>, VecEncodeError>
+where S: IntoIterator<Item: AsRef<[u8]>, IntoIter: ExactSizeIterator> {
+    let iter = signatures.into_iter();
+    let array_len = u64::try_from(iter.len().saturating_add(1)).unwrap_or(u64::MAX);
+    let mut encoder = minicbor::Encoder::new(vec![]);
+    encoder.array(array_len)?;
+    for signature in iter {
+        encoder.bytes(signature.as_ref())?;
+    }
+    Ok(encoder.into_writer())
+}
+
+/// Make cbor-encoded tagged [RFC9052-CoseSign](https://datatracker.ietf.org/doc/html/rfc9052).
+pub fn encode_cose_sign<W: minicbor::encode::Write, S>(
+    e: &mut minicbor::encode::Encoder<W>, protected: &[u8], payload: Option<&[u8]>, signatures: S,
+) -> Result<(), minicbor::encode::Error<W::Error>>
+where S: IntoIterator<Item: AsRef<[u8]>, IntoIter: ExactSizeIterator> {
+    /// From the table in [section 2 of RFC 8152](https://datatracker.ietf.org/doc/html/rfc8152#section-2).
+    const COSE_SIGN_TAG: u64 = 98;
+
+    let tagged_array = Tagged::<COSE_SIGN_TAG, _>::new((
+        <&ByteSlice>::from(protected),
+        ByteArray::from([]),             // unprotected.
+        payload.map(<&ByteSlice>::from), // allowing `NULL`.
+        encode_cose_signature_array(signatures).map_err(minicbor::encode::Error::custom)?,
+    ));
+    tagged_array.encode(e, &mut ())
+}