trees/issuancelog: Add a shared log identity configuration

Author: beautifulentropy

cmd/boulder-mtca/main.go

@@ -22,6 +22,7 @@ import (
 	"github.com/letsencrypt/boulder/issuance"
 	mtca "github.com/letsencrypt/boulder/mtca"
 	mtcapb "github.com/letsencrypt/boulder/mtca/proto"
+	"github.com/letsencrypt/boulder/trees/issuancelog"
 )
 
 type Config struct {
@@ -33,9 +34,13 @@ type Config struct {
 		DB cmd.DBConfig `validate:"required"`
 		S3 bs3.Config   `validate:"required"`
 
+		// LogID identifies the issuance log this MTCA sequences. Its CA ID must
+		// match the issuer certificate's.
+		LogID issuancelog.ID `validate:"required"`
+
 		Issuance struct {
 			CertProfiles map[string]issuance.ProfileConfig `validate:"required,dive,keys,alphanum,min=1,max=32,endkeys"`
-			// Issuers holds the configuration for a single MTCA instance with a single mtcaID.
+			// Issuers holds the configuration for a single MTCA instance with a single CA ID.
 			// We run a separate process for each issuer.
 			// TODO: the issuance package parses the CA certificate as a self-signed X.509
 			// certificate, but per MTC draft, a CA SHOULD be represented by an RFC 9925
@@ -115,6 +120,7 @@ func main() {
 	mtcaImpl, err := mtca.New(
 		issuer,
 		profiles,
+		c.MTCA.LogID,
 		c.MTCA.SequencingPeriod.Duration,
 		dbMap,
 		s3c,

cmd/boulder-mtpublisher/main.go

@@ -16,6 +16,7 @@ import (
 	"github.com/letsencrypt/boulder/mtpublisher"
 	"github.com/letsencrypt/boulder/privatekey"
 	"github.com/letsencrypt/boulder/sa"
+	"github.com/letsencrypt/boulder/trees/issuancelog"
 )
 
 type Config struct {
@@ -28,10 +29,9 @@ type Config struct {
 		// lack a mirror cosignature.
 		PollInterval config.Duration `validate:"required"`
 
-		// MTCLogID is the log this MTPublisher operates on (e.g.
-		// "44947.4.1.0.44"). Used as a guard on the `mtcLogID` column of the
-		// connected checkpoints table.
-		MTCLogID string `validate:"required"`
+		// LogID identifies the issuance log this publisher operates on. It must
+		// match the mtca's.
+		LogID issuancelog.ID `validate:"required"`
 
 		// MirrorID identifies the cosigner this publisher writes alongside each
 		// cosignature (e.g. "32473.9").
@@ -99,7 +99,7 @@ func main() {
 	pubKey, err := loadMLDSAPublicKey(c.MTPublisher.MirrorPublicKeyFile)
 	cmd.FailOnError(err, "Loading cosigner public key")
 
-	publisher, err := mtpublisher.New(dbMap, c.MTPublisher.PollInterval.Duration, c.MTPublisher.MTCLogID, c.MTPublisher.MirrorID, signer, pubKey, logger)
+	publisher, err := mtpublisher.New(dbMap, c.MTPublisher.PollInterval.Duration, c.MTPublisher.LogID, c.MTPublisher.MirrorID, signer, pubKey, logger)
 	cmd.FailOnError(err, "Failed to create MTPublisher stub")
 
 	ctx, cancel := context.WithCancel(context.Background())

mtca/mtca.go

@@ -29,6 +29,7 @@ import (
 	mtcapb "github.com/letsencrypt/boulder/mtca/proto"
 	"github.com/letsencrypt/boulder/trees/cosignature"
 	"github.com/letsencrypt/boulder/trees/entry"
+	"github.com/letsencrypt/boulder/trees/issuancelog"
 	"github.com/letsencrypt/boulder/trees/tiles"
 	"golang.org/x/mod/sumdb/tlog"
 )
@@ -42,16 +43,20 @@ var _ mtcapb.MTCAServer = &mtca{}
 func New(
 	issuer *issuance.Issuer,
 	profiles map[string]*issuance.Profile,
+	logID issuancelog.ID,
 	sequencingPeriod time.Duration,
 	dbMap *borp.DbMap,
 	s3c simpleS3,
 	logger blog.Logger,
 	clk clock.Clock,
 ) (*mtca, error) {
-	mtcaID, err := getMTCAID(issuer.Cert.Certificate)
+	certCAID, err := getCAID(issuer.Cert.Certificate)
 	if err != nil {
 		return nil, err
 	}
+	if certCAID != logID.CAID {
+		return nil, fmt.Errorf("configured CA ID %q does not match issuer certificate CA ID %q", logID.CAID, certCAID)
+	}
 
 	if sequencingPeriod == 0 {
 		return nil, errors.New("sequencingPeriod must be non-zero")
@@ -60,10 +65,8 @@ func New(
 	m := &mtca{
 		issuer:   issuer,
 		profiles: profiles,
-		mtcaID:   mtcaID,
-		// TODO: collect this from config
-		logNumber: 44,
-		pool:      &pool{maxSize: 100},
+		logID:    logID,
+		pool:     &pool{maxSize: 100},
 
 		sequencingPeriod: sequencingPeriod,
 
@@ -73,7 +76,7 @@ func New(
 		clk: clk,
 	}
 
-	cosigner, err := cosignature.NewCosigner(mtcaID, m.mtcLogID(), issuer.Signer)
+	cosigner, err := cosignature.NewCosigner(logID.CAID, logID.Origin(), issuer.Signer)
 	if err != nil {
 		return nil, fmt.Errorf("creating CA cosigner: %s", err)
 	}
@@ -83,7 +86,7 @@ func New(
 	if !ok {
 		return nil, fmt.Errorf("issuer public key is %T, must be ML-DSA-44", issuer.Signer.Public())
 	}
-	verifier, err := cosignature.NewVerifier(mtcaID, pubKey)
+	verifier, err := cosignature.NewVerifier(logID.CAID, pubKey)
 	if err != nil {
 		return nil, fmt.Errorf("creating CA verifier: %s", err)
 	}
@@ -97,12 +100,11 @@ type mtca struct {
 
 	issuer   *issuance.Issuer
 	profiles map[string]*issuance.Profile
-	mtcaID   string
+	logID    issuancelog.ID
 	cosigner *cosignature.Cosigner
 	verifier *cosignature.Verifier
 
-	logNumber uint16
-	pool      *pool
+	pool *pool
 
 	// frontier contains all the tiles on the right edge of the tree.
 	// It will be used to accumulate entries for writing to storage.
@@ -128,15 +130,15 @@ type simpleS3 interface {
 	Bucket() string
 }
 
-func getMTCAID(issuerCert *x509.Certificate) (string, error) {
+func getCAID(issuerCert *x509.Certificate) (string, error) {
 	testingTrustAnchorIDOID := asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 44363, 47, 1}
 	for _, attribute := range issuerCert.Subject.Names {
 		if attribute.Type.Equal(testingTrustAnchorIDOID) {
-			mtcaID, ok := attribute.Value.(string)
+			caID, ok := attribute.Value.(string)
 			if !ok {
 				return "", fmt.Errorf("invalid trust anchor attribute type %T", attribute.Value)
 			}
-			return mtcaID, nil
+			return caID, nil
 		}
 	}
 
@@ -165,14 +167,14 @@ func (m *mtca) InitLog(ctx context.Context) error {
 	_, err = db.WithTransaction(ctx, m.db, func(tx db.Executor) (any, error) {
 		var numLatestCheckpoints int64
 		err := tx.SelectOne(ctx, &numLatestCheckpoints, "SELECT COUNT(*) FROM latestCheckpoint WHERE mtcLogID = ?",
-			m.mtcLogID())
+			m.logID.String())
 		if err != nil {
 			return nil, fmt.Errorf("getting latestCheckpoint: %s", err)
 		}
 
 		var numCheckpoints int64
 		err = tx.SelectOne(ctx, &numCheckpoints, "SELECT COUNT(*) FROM checkpoints WHERE mtcLogID = ?",
-			m.mtcLogID())
+			m.logID.String())
 		if err != nil {
 			return nil, fmt.Errorf("getting checkpoints: %s", err)
 		}
@@ -183,11 +185,11 @@ func (m *mtca) InitLog(ctx context.Context) error {
 			}
 
 			return nil, fmt.Errorf("initializing issuance log for %s: already has %d checkpoints and %d latestCheckpoint rows",
-				m.mtcLogID(), numCheckpoints, numLatestCheckpoints)
+				m.logID.String(), numCheckpoints, numLatestCheckpoints)
 		}
 
 		firstCheckpoint := checkpoint{
-			MTCLogID: m.mtcLogID(),
+			MTCLogID: m.logID.String(),
 			TreeSize: candidate.TreeSize(),
 			RootHash: rootHash[:],
 		}
@@ -205,7 +207,7 @@ func (m *mtca) InitLog(ctx context.Context) error {
 		}
 
 		_, err = tx.ExecContext(ctx, "INSERT INTO latestCheckpoint (id, mtcLogID) VALUES (?, ?)",
-			firstCheckpoint.ID, m.mtcLogID())
+			firstCheckpoint.ID, m.logID.String())
 		if err != nil {
 			return nil, fmt.Errorf("inserting latestCheckpoint: %s", err)
 		}
@@ -224,7 +226,7 @@ func (m *mtca) InitLog(ctx context.Context) error {
 		return err
 	}
 
-	err = candidate.Publish(ctx, m.s3c, m.tileStoragePrefix())
+	err = candidate.Publish(ctx, m.s3c, m.logID.TilePrefix())
 	if err != nil {
 		return err
 	}
@@ -246,7 +248,7 @@ func (m *mtca) Preflight(ctx context.Context) error {
 	if err != nil {
 		return err
 	}
-	frontier, err := tiles.LoadFrontier(ctx, m.s3c, latest.TreeSize, m.tileStoragePrefix())
+	frontier, err := tiles.LoadFrontier(ctx, m.s3c, latest.TreeSize, m.logID.TilePrefix())
 	if err != nil {
 		return err
 	}
@@ -299,32 +301,6 @@ func (p *pool) append(e pendingEntry) error {
 	return nil
 }
 
-// mtcLogID returns the string-formatted relative OID for this log.
-// The .0. arc relative to the MTCA ID contains log numbers.
-// https://ietf-plants-wg.github.io/merkle-tree-certs/draft-ietf-plants-merkle-tree-certs.html#ca-ids
-func (m *mtca) mtcLogID() string {
-	return fmt.Sprintf("%s.0.%d", m.mtcaID, m.logNumber)
-}
-
-// tileStoragePrefix returns the path within a bucket where we will store tiles.
-//
-// https://github.com/C2SP/C2SP/blob/main/mtc-tlog.md#serving-issuance-logs
-//
-// "Each log's prefix URL is the concatenation of the CA prefix URL and the log number, encoded as an
-// ASCII decimal integer with no additional leading zeros:
-//
-// <CA prefix URL>/<log number>"
-//
-// We assume we will serve directly from tile storage (likely sync'ed somewhere), so we
-// want to store tiles compatible with that pattern, with log number as the last component
-// of the path before "tile/".
-//
-// As a matter of local convention we will put the MTCA ID as the path component right before
-// log number.
-func (m *mtca) tileStoragePrefix() string {
-	return fmt.Sprintf("%s/%d", m.mtcaID, m.logNumber)
-}
-
 // Issue requests a TBSCertificateLogEntry be issued and returns after it's been sequenced into the log
 // and a new checkpoint signed by the CA. It does not wait for a mirror cosignature.
 //
@@ -386,7 +362,7 @@ func (m *mtca) Issue(ctx context.Context, req *mtcapb.IssueRequest) (*mtcapb.Iss
 			return nil, errors.New("error during sequencing")
 		}
 		return &mtcapb.IssueResponse{
-			MtcLogID:      m.mtcLogID(),
+			MtcLogID:      m.logID.String(),
 			MtcEntryIndex: entryIndex,
 		}, nil
 	}
@@ -492,7 +468,7 @@ func (m *mtca) sequence(ctx context.Context) error {
 		m.log.AuditInfo("issuing", map[string]any{
 			"TBSCertificateLogEntry": hex.EncodeToString(e.mtcle.TBS()),
 			"entryIndex":             latest.TreeSize + int64(i),
-			"mtcLogID":               m.mtcLogID(),
+			"mtcLogID":               m.logID.String(),
 			"newRootHash":            newRootHash.String(),
 		})
 	}
@@ -501,14 +477,14 @@ func (m *mtca) sequence(ctx context.Context) error {
 	// (but before publishing a new checkpoint signed note), we will flush
 	// to the live location. This ensures we've persisted the tiles before
 	// committing to a tree hash by signing it.
-	err = candidate.Stage(ctx, m.s3c, m.tileStoragePrefix())
+	err = candidate.Stage(ctx, m.s3c, m.logID.TilePrefix())
 	if err != nil {
 		return fmt.Errorf("staging candidate tiles: %s", err)
 	}
 
 	newCheckpoint := checkpoint{
 		ID:              0,
-		MTCLogID:        m.mtcLogID(),
+		MTCLogID:        m.logID.String(),
 		MTCASignature:   nil,
 		MirrorID:        "",
 		MirrorSignature: nil,
@@ -541,7 +517,7 @@ func (m *mtca) sequence(ctx context.Context) error {
 		// https://mariadb.com/docs/server/reference/sql-statements/data-manipulation/selecting-data/for-update
 		err := tx.SelectOne(ctx, &latestID,
 			`SELECT id from latestCheckpoint WHERE mtcLogID = ? FOR UPDATE`,
-			m.mtcLogID())
+			m.logID.String())
 		if err != nil {
 			return nil, err
 		}
@@ -558,7 +534,7 @@ func (m *mtca) sequence(ctx context.Context) error {
 		}
 
 		result, err := tx.ExecContext(ctx, "UPDATE checkpoints SET mtcaSignature = ? WHERE mtcLogID = ? AND id = ?",
-			caSig, m.mtcLogID(), newCheckpoint.ID)
+			caSig, m.logID.String(), newCheckpoint.ID)
 		if err != nil {
 			return nil, fmt.Errorf("updating checkpoint: %s", err)
 		}
@@ -571,7 +547,7 @@ func (m *mtca) sequence(ctx context.Context) error {
 		}
 
 		result, err = tx.ExecContext(ctx, "UPDATE latestCheckpoint SET id = ? WHERE mtcLogID = ? AND id = ?",
-			newCheckpoint.ID, m.mtcLogID(), latestID)
+			newCheckpoint.ID, m.logID.String(), latestID)
 		if err != nil {
 			return nil, fmt.Errorf("updating latestCheckpoint: %s", err)
 		}
@@ -599,7 +575,7 @@ func (m *mtca) sequence(ctx context.Context) error {
 	// Once we add publishing of checkpoints as signed notes, publication of the signed note
 	// should come after this flush succeeds, so monitors don't try to fetch tiles that aren't
 	// yet available.
-	err = m.frontier.Publish(ctx, m.s3c, m.tileStoragePrefix())
+	err = m.frontier.Publish(ctx, m.s3c, m.logID.TilePrefix())
 	if err != nil {
 		return fmt.Errorf("publishing tiles: %s", err)
 	}
@@ -671,13 +647,13 @@ func (m *mtca) latestCheckpoint(ctx context.Context) (*checkpoint, error) {
 		 USING(id)
 		 WHERE latestCheckpoint.mtcLogID = ? AND
 		       checkpoints.mtcLogID = ?`,
-		m.mtcLogID(),
-		m.mtcLogID())
+		m.logID.String(),
+		m.logID.String())
 	if err != nil {
 		if errors.Is(err, sql.ErrNoRows) {
-			return nil, fmt.Errorf("getting latest checkpoint for %q: issuance log DB is not initialized", m.mtcLogID())
+			return nil, fmt.Errorf("getting latest checkpoint for %q: issuance log DB is not initialized", m.logID.String())
 		}
-		return nil, fmt.Errorf("getting latest checkpoint for %q: %w", m.mtcLogID(), err)
+		return nil, fmt.Errorf("getting latest checkpoint for %q: %w", m.logID.String(), err)
 	}
 
 	return &latest, nil