revocation.hpp File Reference

Signed Revocation List (SRL) + namespaced monotonic epoch floor. More...

#include <pulp/runtime/crypto.hpp>
#include <choc/text/choc_JSON.h>
#include <algorithm>
#include <cctype>
#include <cstdint>
#include <filesystem>
#include <fstream>
#include <optional>
#include <sstream>
#include <string>
#include <string_view>
#include <system_error>
#include <vector>

Go to the source code of this file.

Classes
struct	pulp::format::reload::SignedRevocationList
	A signed revocation list. More...
struct	pulp::format::reload::SrlVerifyResult
struct	pulp::format::reload::SrlFloorState
	State of the persisted floor for a namespace. More...
class	pulp::format::reload::EpochFloorStore
	Directory-backed store of the highest SRL epoch SEEN, namespaced by (plugin_id + revocation_pubkey_fpr + update_channel). More...

Namespaces
namespace	pulp
namespace	pulp::format
	What the product grants a device: the quota table indexed by capability tier and live thermal state.
namespace	pulp::format::reload

Enumerations
enum class	pulp::format::reload::SrlVerify { pulp::format::reload::Ok = 0 , pulp::format::reload::ParseError , pulp::format::reload::UntrustedSigner , pulp::format::reload::BadSignature }
enum class	pulp::format::reload::SrlAcceptance { pulp::format::reload::Accepted = 0 , pulp::format::reload::RejectedRollback , pulp::format::reload::FloorCorrupt , pulp::format::reload::PersistError }
	Outcome of offering an SRL to the store. More...

Functions
std::string	pulp::format::reload::srl_to_lower (std::string s)
	Lowercase a hex/ASCII string for case-insensitive fingerprint/hash compares.
std::optional< std::vector< std::uint8_t > >	pulp::format::reload::srl_hex_decode (std::string_view hex)
	Decode a hex string to bytes.
std::string	pulp::format::reload::srl_hex_encode (const std::vector< std::uint8_t > &bytes)
	Encode bytes to lowercase hex.
std::vector< std::uint8_t >	pulp::format::reload::srl_signed_message (const SignedRevocationList &srl)
	Deterministic canonical payload the SRL signature covers.
std::optional< SignedRevocationList >	pulp::format::reload::parse_srl (std::string_view json, std::string &error)
	Parse an SRL from JSON.
std::string	pulp::format::reload::serialize_srl_json (const SignedRevocationList &srl)
	Serialize an SRL to a stable, canonical JSON string (fixed field order).
SrlVerifyResult	pulp::format::reload::verify_srl (const SignedRevocationList &srl, const std::vector< std::uint8_t > &trusted_revocation_pubkey)
	Verify the SRL's Ed25519 signature against trusted_revocation_pubkey.
SrlVerifyResult	pulp::format::reload::parse_and_verify_srl (std::string_view json, const std::vector< std::uint8_t > &trusted_revocation_pubkey, SignedRevocationList &out)
	Parse + verify in one fail-closed step. A parse failure maps to ParseError.
bool	pulp::format::reload::is_revoked (const SignedRevocationList &srl, std::string_view signer_key_fpr, std::string_view artifact_hash)
	True iff signer_key_fpr is a revoked signer OR artifact_hash is a revoked artifact in srl.

Detailed Description

Signed Revocation List (SRL) + namespaced monotonic epoch floor.

A swap-pack (see swap_pack.hpp) proves a pack is authentic and unmodified at install time. A revocation list is the kill switch: after a signer key is compromised or a specific artifact is found malicious, the publisher signs an SRL that names the revoked signer-key fingerprints and/or artifact hashes. The reload gate (the pack-load call site, wired separately) consults is_revoked() before honoring a pack, so a previously-trusted-but-now-revoked pack fails closed.

Two independent gates, mirroring swap_pack's layering:

1. verify_srl() — Ed25519 authenticity. Fail-closed on malformed/bad-sig.
2. EpochFloorStore::accept_srl() — monotonic anti-rollback. An SRL whose epoch is <= the highest epoch already seen for its namespace is rejected, so an attacker cannot replay an older SRL to "un-revoke" a key/artifact. The floor is namespaced by (plugin_id + revocation_pubkey_fpr + update_channel) so one plugin / channel / trust-root's floor never affects another's.

Offline-last-known: the store persists the full accepted SRL, not just its epoch. When no newer SRL can be fetched (device offline), the gate loads the last-known SRL from disk and still honors it — revocations never lapse to fail-open just because the network is down.

Reuses runtime::ed25519_verify + runtime::sha256_hex — no hand-rolled crypto. Header-only, like swap_pack. Control/main thread only (does file I/O); never call from the audio thread.