Cmprehensive Supply Chain Security with In-Toto Attestations

In-Toto provides a framework to secure software supply chains by cryptographically attesting to each step. This article covers comprehensive In-Toto attestation generation, verification, and management in Java with advanced features like policy enforcement, SLSA compliance, and automated provenance.

Core In-Toto Implementation

package com.titliel.intoto; import java.io.*; import java.nio.file.*; import java.security.*; import java.time.Instant; import java.util.*; import java.util.stream.Collectors; import com.fasterxml.jackson.databind.ObjectMapper; import com.fasterxml.jackson.databind.SerializationFeature; /** * Titliel In-Toto Attestation Framework * Comprehensive supply chain security with SLSA compliance */ public class TitlielInToto { private final InTotoConfig config; private final KeyManager keyManager; private final AttestationGenerator attestationGenerator; private final AttestationVerifier attestationVerifier; private final PolicyEngine policyEngine; private final ObjectMapper objectMapper; public TitlielInToto() { this.config = InTotoConfig.getInstance(); this.keyManager = new KeyManager(); this.attestationGenerator = new AttestationGenerator(); this.attestationVerifier = new AttestationVerifier(); this.policyEngine = new PolicyEngine(); this.objectMapper = new ObjectMapper() .configure(SerializationFeature.INDENT_OUTPUT, true) .configure(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS, false); initialize(); } private void initialize() { try { // Initialize key management keyManager.initialize(); // Load policies policyEngine.loadPolicies(); SecurityLogger.info("Titliel In-Toto framework initialized successfully"); } catch (Exception e) { SecurityLogger.error("Failed to initialize In-Toto framework", e); throw new InTotoException("Initialization failed", e); } } /** * Generate comprehensive attestation for a build step */ public AttestationResult generateAttestation(BuildContext context) { long startTime = System.currentTimeMillis(); AttestationResult result = new AttestationResult(context); try { // Validate build context validateBuildContext(context); // Generate step attestation StepAttestation stepAttestation = generateStepAttestation(context); // Generate material attestation MaterialAttestation materialAttestation = generateMaterialAttestation(context); // Generate product attestation ProductAttestation productAttestation = generateProductAttestation(context); // Generate provenance attestation ProvenanceAttestation provenance = generateProvenanceAttestation( context, stepAttestation, materialAttestation, productAttestation); // Generate link metadata LinkMetadata link = generateLinkMetadata(context, provenance); // Sign the attestation SignedAttestation signedAttestation = signAttestation(link); // Verify the attestation VerificationResult verification = verifyAttestation(signedAttestation); // Check policy compliance PolicyCompliance compliance = checkPolicyCompliance(signedAttestation, context); // Build result result.setStepAttestation(stepAttestation); result.setMaterialAttestation(materialAttestation); result.setProductAttestation(productAttestation); result.setProvenanceAttestation(provenance); result.setLinkMetadata(link); result.setSignedAttestation(signedAttestation); result.setVerificationResult(verification); result.setPolicyCompliance(compliance); result.setSuccess(true); // Store attestation storeAttestation(signedAttestation, context); SecurityLogger.info("Attestation generated successfully for build: {}", context.getBuildId()); } catch (Exception e) { result.setSuccess(false); result.setError(e.getMessage()); SecurityLogger.error("Failed to generate attestation", e); } finally { result.setGenerationTime(System.currentTimeMillis() - startTime); } return result; } /** * Generate step attestation */ private StepAttestation generateStepAttestation(BuildContext context) { StepAttestation attestation = new StepAttestation(); attestation.setStepName(context.getStepName()); attestation.setStepType(context.getStepType()); attestation.setCommand(context.getCommand()); attestation.setEnvironment(context.getEnvironment()); attestation.setWorkingDir(context.getWorkingDirectory()); attestation.setStartTime(Instant.now()); attestation.setEndTime(Instant.now()); // Will be updated // Capture environment details attestation.setEnvVars(System.getenv()); attestation.setSystemProperties(System.getProperties()); // Capture runtime information attestation.setJavaVersion(System.getProperty("java.version")); attestation.setOsName(System.getProperty("os.name")); attestation.setOsVersion(System.getProperty("os.version")); // Capture user information attestation.setUsername(System.getProperty("user.name")); attestation.setUserHome(System.getProperty("user.home")); return attestation; } /** * Generate material attestation */ private MaterialAttestation generateMaterialAttestation(BuildContext context) { MaterialAttestation attestation = new MaterialAttestation(); for (Path material : context.getMaterials()) { try { MaterialInfo materialInfo = createMaterialInfo(material); attestation.addMaterial(material, materialInfo); } catch (IOException e) { SecurityLogger.warn("Failed to process material: {}", material, e); attestation.addError(material, e.getMessage()); } } return attestation; } /** * Create material information with cryptographic hashes */ private MaterialInfo createMaterialInfo(Path material) throws IOException { MaterialInfo info = new MaterialInfo(); // Basic file information info.setPath(material.toString()); info.setSize(Files.size(material)); info.setLastModified(Files.getLastModifiedTime(material).toMillis()); // Calculate cryptographic hashes byte[] content = Files.readAllBytes(material); for (String algorithm : config.getHashAlgorithms()) { String hash = calculateHash(content, algorithm); info.addHash(algorithm, hash); } // Additional metadata if (Files.isSymbolicLink(material)) { info.setSymlinkTarget(Files.readSymbolicLink(material).toString()); } info.setPermissions(getFilePermissions(material)); info.setOwner(getFileOwner(material)); return info; } /** * Generate product attestation */ private ProductAttestation generateProductAttestation(BuildContext context) { ProductAttestation attestation = new ProductAttestation(); for (Path product : context.getProducts()) { try { ProductInfo productInfo = createProductInfo(product); attestation.addProduct(product, productInfo); } catch (IOException e) { SecurityLogger.warn("Failed to process product: {}", product, e); attestation.addError(product, e.getMessage()); } } return attestation; } /** * Create product information */ private ProductInfo createProductInfo(Path product) throws IOException { ProductInfo info = new ProductInfo(); // Basic file information info.setPath(product.toString()); info.setSize(Files.size(product)); info.setLastModified(Files.getLastModifiedTime(product).toMillis()); // Calculate cryptographic hashes byte[] content = Files.readAllBytes(product); for (String algorithm : config.getHashAlgorithms()) { String hash = calculateHash(content, algorithm); info.addHash(algorithm, hash); } // Additional metadata info.setPermissions(getFilePermissions(product)); info.setOwner(getFileOwner(product)); // Generate artifact URI info.setArtifactUri(generateArtifactUri(product)); return info; } /** * Generate provenance attestation */ private ProvenanceAttestation generateProvenanceAttestation(BuildContext context, StepAttestation step, MaterialAttestation materials, ProductAttestation products) { ProvenanceAttestation provenance = new ProvenanceAttestation(); provenance.setBuildId(context.getBuildId()); provenance.setBuildType(context.getBuildType()); provenance.setBuilder(context.getBuilder()); provenance.setInvocationId(context.getInvocationId()); provenance.setStartedAt(step.getStartTime()); provenance.setFinishedAt(Instant.now()); // Build configuration provenance.setBuildConfig(context.getBuildConfig()); // Materials and products provenance.setMaterials(materials.getMaterials()); provenance.setProducts(products.getProducts()); // Build steps provenance.setSteps(context.getBuildSteps()); // Metadata provenance.setMetadata(createProvenanceMetadata(context)); // SLSA compliance provenance.setSlsaLevel(calculateSlsaLevel(context, materials, products)); return provenance; } /** * Generate link metadata (in-toto link format) */ private LinkMetadata generateLinkMetadata(BuildContext context, ProvenanceAttestation provenance) { LinkMetadata link = new LinkMetadata(); link.setName(context.getStepName()); link.setMaterials(provenance.getMaterials()); link.setProducts(provenance.getProducts()); link.setByProducts(collectByProducts(context)); link.setCommand(context.getCommand()); link.setEnvironment(context.getEnvironment()); link.setWorkingDir(context.getWorkingDirectory()); return link; } /** * Sign the attestation */ private SignedAttestation signAttestation(LinkMetadata link) { try { // Serialize link metadata String json = objectMapper.writeValueAsString(link); byte[] data = json.getBytes(); // Sign with private key Signature signature = keyManager.sign(data); // Create signed attestation SignedAttestation signed = new SignedAttestation(); signed.setLinkMetadata(link); signed.setSignature(signature); signed.setKeyId(keyManager.getKeyId()); signed.setSigningTime(Instant.now()); return signed; } catch (Exception e) { throw new InTotoException("Failed to sign attestation", e); } } /** * Verify attestation signature and integrity */ private VerificationResult verifyAttestation(SignedAttestation attestation) { VerificationResult result = new VerificationResult(); try { // Verify signature boolean signatureValid = keyManager.verify( attestation.getLinkMetadata(), attestation.getSignature() ); result.setSignatureValid(signatureValid); // Verify link integrity result.setLinkIntegrity(verifyLinkIntegrity(attestation.getLinkMetadata())); // Verify material-product relationships result.setMaterialProductConsistency( verifyMaterialProductConsistency(attestation.getLinkMetadata())); // Calculate overall verification score result.calculateScore(); } catch (Exception e) { result.setError(e.getMessage()); SecurityLogger.error("Attestation verification failed", e); } return result; } /** * Check policy compliance */ private PolicyCompliance checkPolicyCompliance(SignedAttestation attestation, BuildContext context) { return policyEngine.evaluateCompliance(attestation, context); } /** * Store attestation for later verification */ private void storeAttestation(SignedAttestation attestation, BuildContext context) { try { // Create attestation directory Path attestationDir = getAttestationDirectory(context); Files.createDirectories(attestationDir); // Generate filename String filename = String.format("%s-%s.json", context.getBuildId(), Instant.now().toString().replace(":", "-")); Path attestationFile = attestationDir.resolve(filename); // Write attestation objectMapper.writeValue(attestationFile.toFile(), attestation); // Generate accompanying metadata storeAttestationMetadata(attestation, context, attestationFile); SecurityLogger.info("Attestation stored at: {}", attestationFile); } catch (Exception e) { SecurityLogger.error("Failed to store attestation", e); } } /** * Verify a complete supply chain */ public SupplyChainVerification verifySupplyChain(List<SignedAttestation> attestations, SupplyChainPolicy policy) { SupplyChainVerification result = new SupplyChainVerification(); try { // Verify individual attestations for (SignedAttestation attestation : attestations) { VerificationResult verification = verifyAttestation(attestation); result.addVerificationResult(attestation, verification); } // Verify chain continuity result.setChainContinuity(verifyChainContinuity(attestations)); // Verify policy compliance across chain result.setPolicyCompliance(verifyChainPolicyCompliance(attestations, policy)); // Calculate overall chain integrity result.calculateChainIntegrity(); } catch (Exception e) { result.setError(e.getMessage()); SecurityLogger.error("Supply chain verification failed", e); } return result; } /** * Generate SLSA provenance statement */ public SLSAProvenance generateSlsaProvenance(BuildContext context) { SLSAProvenance provenance = new SLSAProvenance(); provenance.setBuilder(context.getBuilder()); provenance.setBuildType(context.getBuildType()); provenance.setInvocation(context.getBuildInvocation()); provenance.setBuildConfig(context.getBuildConfig()); provenance.setMetadata(context.getBuildMetadata()); provenance.setMaterials(context.getMaterials().stream() .map(this::createSlsaMaterial) .collect(Collectors.toList())); provenance.setProducts(context.getProducts().stream() .map(this::createSlsaProduct) .collect(Collectors.toList())); return provenance; } /** * Verify SLSA provenance */ public SLSAVerification verifySlsaProvenance(SLSAProvenance provenance, SLSAPolicy policy) { SLSAVerification result = new SLSAVerification(); try { // Verify builder identity result.setBuilderVerified(verifyBuilderIdentity(provenance.getBuilder())); // Verify build invocation result.setInvocationVerified(verifyBuildInvocation(provenance.getInvocation())); // Verify materials result.setMaterialsVerified(verifyMaterials(provenance.getMaterials())); // Verify products result.setProductsVerified(verifyProducts(provenance.getProducts())); // Check SLSA level result.setSlsaLevel(calculateSlsaCompliance(provenance, policy)); } catch (Exception e) { result.setError(e.getMessage()); } return result; } // Utility methods private void validateBuildContext(BuildContext context) { List<String> errors = new ArrayList<>(); if (context.getBuildId() == null || context.getBuildId().isEmpty()) { errors.add("Build ID is required"); } if (context.getStepName() == null || context.getStepName().isEmpty()) { errors.add("Step name is required"); } if (context.getMaterials().isEmpty()) { errors.add("At least one material is required"); } if (context.getProducts().isEmpty()) { errors.add("At least one product is required"); } if (!errors.isEmpty()) { throw new InTotoException("Invalid build context: " + String.join(", ", errors)); } } private String calculateHash(byte[] data, String algorithm) { try { MessageDigest digest = MessageDigest.getInstance(algorithm); byte[] hash = digest.digest(data); return bytesToHex(hash); } catch (NoSuchAlgorithmException e) { throw new InTotoException("Unsupported hash algorithm: " + algorithm, e); } } private String bytesToHex(byte[] bytes) { StringBuilder result = new StringBuilder(); for (byte b : bytes) { result.append(String.format("%02x", b)); } return result.toString(); } private String getFilePermissions(Path path) { try { return PosixFilePermissions.toString(Files.getPosixFilePermissions(path)); } catch (Exception e) { return "unknown"; } } private String getFileOwner(Path path) { try { return Files.getOwner(path).getName(); } catch (Exception e) { return "unknown"; } } private String generateArtifactUri(Path product) { // Generate artifact URI based on configuration String baseUri = config.getArtifactBaseUri(); String relativePath = product.toString().replace(config.getBuildDirectory(), ""); return baseUri + relativePath; } private Map<String, Object> createProvenanceMetadata(BuildContext context) { Map<String, Object> metadata = new HashMap<>(); metadata.put("generatedAt", Instant.now().toString()); metadata.put("generator", "Titliel-InToto-Java"); metadata.put("version", "1.0.0"); metadata.put("buildTool", context.getBuildTool()); metadata.put("buildSystem", context.getBuildSystem()); return metadata; } private SLSALevel calculateSlsaLevel(BuildContext context, MaterialAttestation materials, ProductAttestation products) { // Implement SLSA level calculation based on requirements // This is a simplified implementation boolean hasProvenance = true; boolean hasHermeticBuild = context.isHermetic(); boolean hasReproducibleBuild = context.isReproducible(); boolean hasIsolatedBuild = context.isIsolated(); if (hasIsolatedBuild && hasReproducibleBuild && hasHermeticBuild) { return SLSALevel.LEVEL_4; } else if (hasHermeticBuild && hasReproducibleBuild) { return SLSALevel.LEVEL_3; } else if (hasProvenance) { return SLSALevel.LEVEL_2; } else { return SLSALevel.LEVEL_1; } } private Map<String, Object> collectByProducts(BuildContext context) { Map<String, Object> byProducts = new HashMap<>(); // Capture stdout/stderr if available if (context.getStdout() != null) { byProducts.put("stdout", context.getStdout()); } if (context.getStderr() != null) { byProducts.put("stderr", context.getStderr()); } // Capture return code byProducts.put("return-value", context.getReturnCode()); return byProducts; } private Path getAttestationDirectory(BuildContext context) { return Paths.get(config.getAttestationStore(), context.getBuildId(), context.getStepName()); } private void storeAttestationMetadata(SignedAttestation attestation, BuildContext context, Path attestationFile) throws IOException { AttestationMetadata metadata = new AttestationMetadata(); metadata.setBuildId(context.getBuildId()); metadata.setStepName(context.getStepName()); metadata.setAttestationFile(attestationFile.toString()); metadata.setGeneratedAt(Instant.now()); metadata.setSignatureKeyId(attestation.getKeyId()); Path metadataFile = attestationFile.getParent() .resolve(attestationFile.getFileName() + ".metadata.json"); objectMapper.writeValue(metadataFile.toFile(), metadata); } private boolean verifyLinkIntegrity(LinkMetadata link) { // Verify that materials and products actually exist // and match their hashes return true; // Implementation depends on actual verification logic } private boolean verifyMaterialProductConsistency(LinkMetadata link) { // Verify that all materials were consumed // and all products were produced return true; // Implementation depends on actual verification logic } private boolean verifyChainContinuity(List<SignedAttestation> attestations) { // Verify that each step's products become the next step's materials if (attestations.size() < 2) return true; for (int i = 0; i < attestations.size() - 1; i++) { SignedAttestation current = attestations.get(i); SignedAttestation next = attestations.get(i + 1); // Check product-material continuity if (!verifyStepContinuity(current, next)) { return false; } } return true; } private boolean verifyStepContinuity(SignedAttestation current, SignedAttestation next) { // Verify that next step's materials include current step's products // This is a simplified check return true; } private PolicyCompliance verifyChainPolicyCompliance(List<SignedAttestation> attestations, SupplyChainPolicy policy) { PolicyCompliance compliance = new PolicyCompliance(); for (SignedAttestation attestation : attestations) { // Check each attestation against policy // This would involve checking step types, commands, environments, etc. } return compliance; } private SLSAProvenance.Material createSlsaMaterial(Path material) { SLSAProvenance.Material slsaMaterial = new SLSAProvenance.Material(); try { byte[] content = Files.readAllBytes(material); String hash = calculateHash(content, "sha256"); slsaMaterial.setUri(generateArtifactUri(material)); slsaMaterial.setDigest(Map.of("sha256", hash)); } catch (IOException e) { SecurityLogger.warn("Failed to create SLSA material for: {}", material, e); } return slsaMaterial; } private SLSAProvenance.Product createSlsaProduct(Path product) { SLSAProvenance.Product slsaProduct = new SLSAProvenance.Product(); try { byte[] content = Files.readAllBytes(product); String hash = calculateHash(content, "sha256"); slsaProduct.setUri(generateArtifactUri(product)); slsaProduct.setDigest(Map.of("sha256", hash)); } catch (IOException e) { SecurityLogger.warn("Failed to create SLSA product for: {}", product, e); } return slsaProduct; } private boolean verifyBuilderIdentity(SLSAProvenance.Builder builder) { // Verify builder identity against trusted builders return config.getTrustedBuilders().contains(builder.getId()); } private boolean verifyBuildInvocation(SLSAProvenance.Invocation invocation) { // Verify build invocation parameters return true; // Implementation depends on policy } private boolean verifyMaterials(List<SLSAProvenance.Material> materials) { // Verify all materials are from trusted sources return materials.stream().allMatch(this::isTrustedMaterial); } private boolean verifyProducts(List<SLSAProvenance.Product> products) { // Verify all products have valid signatures/hashes return products.stream().allMatch(this::hasValidDigest); } private SLSALevel calculateSlsaCompliance(SLSAProvenance provenance, SLSAPolicy policy) { // Calculate SLSA compliance level based on policy return SLSALevel.LEVEL_3; // Simplified } private boolean isTrustedMaterial(SLSAProvenance.Material material) { // Check if material URI is from trusted source return material.getUri().startsWith(config.getTrustedSourcePrefix()); } private boolean hasValidDigest(SLSAProvenance.Product product) { // Verify product digest is present and valid return product.getDigest() != null && !product.getDigest().isEmpty(); } }

Data Models and Attestation Structures

package com.titliel.intoto; import java.nio.file.Path; import java.time.Instant; import java.util.*; /** * Build context for attestation generation */ public class BuildContext { private String buildId; private String stepName; private StepType stepType; private List<Path> materials; private List<Path> products; private String command; private Map<String, String> environment; private Path workingDirectory; private String buildType; private String builder; private String invocationId; private Map<String, Object> buildConfig; private List<BuildStep> buildSteps; private Map<String, Object> buildMetadata; private String stdout; private String stderr; private int returnCode; private boolean hermetic; private boolean reproducible; private boolean isolated; private String buildTool; private String buildSystem; // Getters and setters public String getBuildId() { return buildId; } public void setBuildId(String buildId) { this.buildId = buildId; } public String getStepName() { return stepName; } public void setStepName(String stepName) { this.stepName = stepName; } public StepType getStepType() { return stepType; } public void setStepType(StepType stepType) { this.stepType = stepType; } public List<Path> getMaterials() { return materials; } public void setMaterials(List<Path> materials) { this.materials = materials; } public List<Path> getProducts() { return products; } public void setProducts(List<Path> products) { this.products = products; } public String getCommand() { return command; } public void setCommand(String command) { this.command = command; } public Map<String, String> getEnvironment() { return environment; } public void setEnvironment(Map<String, String> environment) { this.environment = environment; } public Path getWorkingDirectory() { return workingDirectory; } public void setWorkingDirectory(Path workingDirectory) { this.workingDirectory = workingDirectory; } public String getBuildType() { return buildType; } public void setBuildType(String buildType) { this.buildType = buildType; } public String getBuilder() { return builder; } public void setBuilder(String builder) { this.builder = builder; } public String getInvocationId() { return invocationId; } public void setInvocationId(String invocationId) { this.invocationId = invocationId; } public Map<String, Object> getBuildConfig() { return buildConfig; } public void setBuildConfig(Map<String, Object> buildConfig) { this.buildConfig = buildConfig; } public List<BuildStep> getBuildSteps() { return buildSteps; } public void setBuildSteps(List<BuildStep> buildSteps) { this.buildSteps = buildSteps; } public Map<String, Object> getBuildMetadata() { return buildMetadata; } public void setBuildMetadata(Map<String, Object> buildMetadata) { this.buildMetadata = buildMetadata; } public String getStdout() { return stdout; } public void setStdout(String stdout) { this.stdout = stdout; } public String getStderr() { return stderr; } public void setStderr(String stderr) { this.stderr = stderr; } public int getReturnCode() { return returnCode; } public void setReturnCode(int returnCode) { this.returnCode = returnCode; } public boolean isHermetic() { return hermetic; } public void setHermetic(boolean hermetic) { this.hermetic = hermetic; } public boolean isReproducible() { return reproducible; } public void setReproducible(boolean reproducible) { this.reproducible = reproducible; } public boolean isIsolated() { return isolated; } public void setIsolated(boolean isolated) { this.isolated = isolated; } public String getBuildTool() { return buildTool; } public void setBuildTool(String buildTool) { this.buildTool = buildTool; } public String getBuildSystem() { return buildSystem; } public void setBuildSystem(String buildSystem) { this.buildSystem = buildSystem; } } /** * Step types in supply chain */ public enum StepType { FETCH, BUILD, TEST, PACKAGE, SIGN, DEPLOY, VERIFY, CUSTOM } /** * Build step information */ public class BuildStep { private String name; private String type; private String command; private Map<String, String> environment; private Instant startTime; private Instant endTime; // Getters and setters public String getName() { return name; } public void setName(String name) { this.name = name; } public String getType() { return type; } public void setType(String type) { this.type = type; } public String getCommand() { return command; } public void setCommand(String command) { this.command = command; } public Map<String, String> getEnvironment() { return environment; } public void setEnvironment(Map<String, String> environment) { this.environment = environment; } public Instant getStartTime() { return startTime; } public void setStartTime(Instant startTime) { this.startTime = startTime; } public Instant getEndTime() { return endTime; } public void setEndTime(Instant endTime) { this.endTime = endTime; } } /** * Step attestation */ public class StepAttestation { private String stepName; private StepType stepType; private String command; private Map<String, String> environment; private Path workingDir; private Instant startTime; private Instant endTime; private Map<String, String> envVars; private Properties systemProperties; private String javaVersion; private String osName; private String osVersion; private String username; private String userHome; // Getters and setters public String getStepName() { return stepName; } public void setStepName(String stepName) { this.stepName = stepName; } public StepType getStepType() { return stepType; } public void setStepType(StepType stepType) { this.stepType = stepType; } public String getCommand() { return command; } public void setCommand(String command) { this.command = command; } public Map<String, String> getEnvironment() { return environment; } public void setEnvironment(Map<String, String> environment) { this.environment = environment; } public Path getWorkingDir() { return workingDir; } public void setWorkingDir(Path workingDir) { this.workingDir = workingDir; } public Instant getStartTime() { return startTime; } public void setStartTime(Instant startTime) { this.startTime = startTime; } public Instant getEndTime() { return endTime; } public void setEndTime(Instant endTime) { this.endTime = endTime; } public Map<String, String> getEnvVars() { return envVars; } public void setEnvVars(Map<String, String> envVars) { this.envVars = envVars; } public Properties getSystemProperties() { return systemProperties; } public void setSystemProperties(Properties systemProperties) { this.systemProperties = systemProperties; } public String getJavaVersion() { return javaVersion; } public void setJavaVersion(String javaVersion) { this.javaVersion = javaVersion; } public String getOsName() { return osName; } public void setOsName(String osName) { this.osName = osName; } public String getOsVersion() { return osVersion; } public void setOsVersion(String osVersion) { this.osName = osVersion; } public String getUsername() { return username; } public void setUsername(String username) { this.username = username; } public String getUserHome() { return userHome; } public void setUserHome(String userHome) { this.userHome = userHome; } } /** * Material attestation */ public class MaterialAttestation { private final Map<Path, MaterialInfo> materials; private final Map<Path, String> errors; public MaterialAttestation() { this.materials = new HashMap<>(); this.errors = new HashMap<>(); } public void addMaterial(Path path, MaterialInfo info) { materials.put(path, info); } public void addError(Path path, String error) { errors.put(path, error); } // Getters public Map<Path, MaterialInfo> getMaterials() { return Collections.unmodifiableMap(materials); } public Map<Path, String> getErrors() { return Collections.unmodifiableMap(errors); } public boolean hasErrors() { return !errors.isEmpty(); } } /** * Material information */ public class MaterialInfo { private String path; private long size; private long lastModified; private Map<String, String> hashes; private String symlinkTarget; private String permissions; private String owner; public MaterialInfo() { this.hashes = new HashMap<>(); } // Getters and setters public String getPath() { return path; } public void setPath(String path) { this.path = path; } public long getSize() { return size; } public void setSize(long size) { this.size = size; } public long getLastModified() { return lastModified; } public void setLastModified(long lastModified) { this.lastModified = lastModified; } public Map<String, String> getHashes() { return Collections.unmodifiableMap(hashes); } public void addHash(String algorithm, String hash) { hashes.put(algorithm, hash); } public String getSymlinkTarget() { return symlinkTarget; } public void setSymlinkTarget(String symlinkTarget) { this.symlinkTarget = symlinkTarget; } public String getPermissions() { return permissions; } public void setPermissions(String permissions) { this.permissions = permissions; } public String getOwner() { return owner; } public void setOwner(String owner) { this.owner = owner; } } /** * Product attestation */ public class ProductAttestation { private final Map<Path, ProductInfo> products; private final Map<Path, String> errors; public ProductAttestation() { this.products = new HashMap<>(); this.errors = new HashMap<>(); } public void addProduct(Path path, ProductInfo info) { products.put(path, info); } public void addError(Path path, String error) { errors.put(path, error); } // Getters public Map<Path, ProductInfo> getProducts() { return Collections.unmodifiableMap(products); } public Map<Path, String> getErrors() { return Collections.unmodifiableMap(errors); } public boolean hasErrors() { return !errors.isEmpty(); } } /** * Product information */ public class ProductInfo { private String path; private long size; private long lastModified; private Map<String, String> hashes; private String permissions; private String owner; private String artifactUri; public ProductInfo() { this.hashes = new HashMap<>(); } // Getters and setters public String getPath() { return path; } public void setPath(String path) { this.path = path; } public long getSize() { return size; } public void setSize(long size) { this.size = size; } public long getLastModified() { return lastModified; } public void setLastModified(long lastModified) { this.lastModified = lastModified; } public Map<String, String> getHashes() { return Collections.unmodifiableMap(hashes); } public void addHash(String algorithm, String hash) { hashes.put(algorithm, hash); } public String getPermissions() { return permissions; } public void setPermissions(String permissions) { this.permissions = permissions; } public String getOwner() { return owner; } public void setOwner(String owner) { this.owner = owner; } public String getArtifactUri() { return artifactUri; } public void setArtifactUri(String artifactUri) { this.artifactUri = artifactUri; } } /** * Provenance attestation */ public class ProvenanceAttestation { private String buildId; private String buildType; private String builder; private String invocationId; private Instant startedAt; private Instant finishedAt; private Map<String, Object> buildConfig; private Map<Path, MaterialInfo> materials; private Map<Path, ProductInfo> products; private List<BuildStep> steps; private Map<String, Object> metadata; private SLSALevel slsaLevel; // Getters and setters public String getBuildId() { return buildId; } public void setBuildId(String buildId) { this.buildId = buildId; } public String getBuildType() { return buildType; } public void setBuildType(String buildType) { this.buildType = buildType; } public String getBuilder() { return builder; } public void setBuilder(String builder) { this.builder = builder; } public String getInvocationId() { return invocationId; } public void setInvocationId(String invocationId) { this.invocationId = invocationId; } public Instant getStartedAt() { return startedAt; } public void setStartedAt(Instant startedAt) { this.startedAt = startedAt; } public Instant getFinishedAt() { return finishedAt; } public void setFinishedAt(Instant finishedAt) { this.finishedAt = finishedAt; } public Map<String, Object> getBuildConfig() { return buildConfig; } public void setBuildConfig(Map<String, Object> buildConfig) { this.buildConfig = buildConfig; } public Map<Path, MaterialInfo> getMaterials() { return materials; } public void setMaterials(Map<Path, MaterialInfo> materials) { this.materials = materials; } public Map<Path, ProductInfo> getProducts() { return products; } public void setProducts(Map<Path, ProductInfo> products) { this.products = products; } public List<BuildStep> getSteps() { return steps; } public void setSteps(List<BuildStep> steps) { this.steps = steps; } public Map<String, Object> getMetadata() { return metadata; } public void setMetadata(Map<String, Object> metadata) { this.metadata = metadata; } public SLSALevel getSlsaLevel() { return slsaLevel; } public void setSlsaLevel(SLSALevel slsaLevel) { this.slsaLevel = slsaLevel; } } /** * Link metadata (in-toto link format) */ public class LinkMetadata { private String name; private Map<Path, MaterialInfo> materials; private Map<Path, ProductInfo> products; private Map<String, Object> byProducts; private String command; private Map<String, String> environment; private Path workingDir; // Getters and setters public String getName() { return name; } public void setName(String name) { this.name = name; } public Map<Path, MaterialInfo> getMaterials() { return materials; } public void setMaterials(Map<Path, MaterialInfo> materials) { this.materials = materials; } public Map<Path, ProductInfo> getProducts() { return products; } public void setProducts(Map<Path, ProductInfo> products) { this.products = products; } public Map<String, Object> getByProducts() { return byProducts; } public void setByProducts(Map<String, Object> byProducts) { this.byProducts = byProducts; } public String getCommand() { return command; } public void setCommand(String command) { this.command = command; } public Map<String, String> getEnvironment() { return environment; } public void setEnvironment(Map<String, String> environment) { this.environment = environment; } public Path getWorkingDir() { return workingDir; } public void setWorkingDir(Path workingDir) { this.workingDir = workingDir; } } /** * Signed attestation */ public class SignedAttestation { private LinkMetadata linkMetadata; private Signature signature; private String keyId; private Instant signingTime; // Getters and setters public LinkMetadata getLinkMetadata() { return linkMetadata; } public void setLinkMetadata(LinkMetadata linkMetadata) { this.linkMetadata = linkMetadata; } public Signature getSignature() { return signature; } public void setSignature(Signature signature) { this.signature = signature; } public String getKeyId() { return keyId; } public void setKeyId(String keyId) { this.keyId = keyId; } public Instant getSigningTime() { return signingTime; } public void setSigningTime(Instant signingTime) { this.signingTime = signingTime; } } /** * Attestation result */ public class AttestationResult { private final BuildContext context; private StepAttestation stepAttestation; private MaterialAttestation materialAttestation; private ProductAttestation productAttestation; private ProvenanceAttestation provenanceAttestation; private LinkMetadata linkMetadata; private SignedAttestation signedAttestation; private VerificationResult verificationResult; private PolicyCompliance policyCompliance; private boolean success; private String error; private long generationTime; public AttestationResult(BuildContext context) { this.context = context; } // Getters and setters public BuildContext getContext() { return context; } public StepAttestation getStepAttestation() { return stepAttestation; } public void setStepAttestation(StepAttestation stepAttestation) { this.stepAttestation = stepAttestation; } public MaterialAttestation getMaterialAttestation() { return materialAttestation; } public void setMaterialAttestation(MaterialAttestation materialAttestation) { this.materialAttestation = materialAttestation; } public ProductAttestation getProductAttestation() { return productAttestation; } public void setProductAttestation(ProductAttestation productAttestation) { this.productAttestation = productAttestation; } public ProvenanceAttestation getProvenanceAttestation() { return provenanceAttestation; } public void setProvenanceAttestation(ProvenanceAttestation provenanceAttestation) { this.provenanceAttestation = provenanceAttestation; } public LinkMetadata getLinkMetadata() { return linkMetadata; } public void setLinkMetadata(LinkMetadata linkMetadata) { this.linkMetadata = linkMetadata; } public SignedAttestation getSignedAttestation() { return signedAttestation; } public void setSignedAttestation(SignedAttestation signedAttestation) { this.signedAttestation = signedAttestation; } public VerificationResult getVerificationResult() { return verificationResult; } public void setVerificationResult(VerificationResult verificationResult) { this.verificationResult = verificationResult; } public PolicyCompliance getPolicyCompliance() { return policyCompliance; } public void setPolicyCompliance(PolicyCompliance policyCompliance) { this.policyCompliance = policyCompliance; } public boolean isSuccess() { return success; } public void setSuccess(boolean success) { this.success = success; } public String getError() { return error; } public void setError(String error) { this.error = error; } public long getGenerationTime() { return generationTime; } public void setGenerationTime(long generationTime) { this.generationTime = generationTime; } } /** * SLSA provenance model */ public class SLSAProvenance { private Builder builder; private String buildType; private Invocation invocation; private Map<String, Object> buildConfig; private Map<String, Object> metadata; private List<Material> materials; private List<Product> products; // Inner classes public static class Builder { private String id; private Map<String, String> builderDependencies; private String version; // Getters and setters public String getId() { return id; } public void setId(String id) { this.id = id; } public Map<String, String> getBuilderDependencies() { return builderDependencies; } public void setBuilderDependencies(Map<String, String> builderDependencies) { this.builderDependencies = builderDependencies; } public String getVersion() { return version; } public void setVersion(String version) { this.version = version; } } public static class Invocation { private Map<String, Object> configSource; private Map<String, Object> parameters; private Map<String, Object> environment; // Getters and setters public Map<String, Object> getConfigSource() { return configSource; } public void setConfigSource(Map<String, Object> configSource) { this.configSource = configSource; } public Map<String, Object> getParameters() { return parameters; } public void setParameters(Map<String, Object> parameters) { this.parameters = parameters; } public Map<String, Object> getEnvironment() { return environment; } public void setEnvironment(Map<String, Object> environment) { this.environment = environment; } } public static class Material { private String uri; private Map<String, String> digest; private Map<String, Object> annotations; // Getters and setters public String getUri() { return uri; } public void setUri(String uri) { this.uri = uri; } public Map<String, String> getDigest() { return digest; } public void setDigest(Map<String, String> digest) { this.digest = digest; } public Map<String, Object> getAnnotations() { return annotations; } public void setAnnotations(Map<String, Object> annotations) { this.annotations = annotations; } } public static class Product { private String uri; private Map<String, String> digest; private String name; // Getters and setters public String getUri() { return uri; } public void setUri(String uri) { this.uri = uri; } public Map<String, String> getDigest() { return digest; } public void setDigest(Map<String, String> digest) { this.digest = digest; } public String getName() { return name; } public void setName(String name) { this.name = name; } } // Getters and setters public Builder getBuilder() { return builder; } public void setBuilder(Builder builder) { this.builder = builder; } public String getBuildType() { return buildType; } public void setBuildType(String buildType) { this.buildType = buildType; } public Invocation getInvocation() { return invocation; } public void setInvocation(Invocation invocation) { this.invocation = invocation; } public Map<String, Object> getBuildConfig() { return buildConfig; } public void setBuildConfig(Map<String, Object> buildConfig) { this.buildConfig = buildConfig; } public Map<String, Object> getMetadata() { return metadata; } public void setMetadata(Map<String, Object> metadata) { this.metadata = metadata; } public List<Material> getMaterials() { return materials; } public void setMaterials(List<Material> materials) { this.materials = materials; } public List<Product> getProducts() { return products; } public void setProducts(List<Product> products) { this.products = products; } } /** * SLSA levels */ public enum SLSALevel { LEVEL_0, LEVEL_1, LEVEL_2, LEVEL_3, LEVEL_4 }

Key Management and Signing

package com.titliel.intoto; import java.security.*; import java.security.spec.*; import java.util.*; /** * Key management for attestation signing and verification */ public class KeyManager { private PrivateKey privateKey; private PublicKey publicKey; private String keyId; private String keyAlgorithm; public void initialize() { try { // Load or generate keys loadKeys(); // Generate key ID keyId = generateKeyId(); SecurityLogger.info("Key manager initialized with key ID: {}", keyId); } catch (Exception e) { throw new InTotoException("Failed to initialize key manager", e); } } private void loadKeys() throws Exception { // Try to load existing keys if (!tryLoadExistingKeys()) { // Generate new keys generateKeys(); saveKeys(); } } private boolean tryLoadExistingKeys() { try { Path privateKeyPath = getPrivateKeyPath(); Path publicKeyPath = getPublicKeyPath(); if (Files.exists(privateKeyPath) && Files.exists(publicKeyPath)) { // Load existing keys loadKeysFromFiles(privateKeyPath, publicKeyPath); return true; } } catch (Exception e) { SecurityLogger.warn("Failed to load existing keys", e); } return false; } private void generateKeys() throws Exception { // Generate RSA key pair KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA"); keyGen.initialize(4096); KeyPair keyPair = keyGen.generateKeyPair(); privateKey = keyPair.getPrivate(); publicKey = keyPair.getPublic(); keyAlgorithm = "rsa"; SecurityLogger.info("Generated new RSA 4096-bit key pair"); } private void saveKeys() throws Exception { // Save private key Path privateKeyPath = getPrivateKeyPath(); Files.createDirectories(privateKeyPath.getParent()); byte[] privateKeyBytes = privateKey.getEncoded(); Files.write(privateKeyPath, privateKeyBytes); // Save public key Path publicKeyPath = getPublicKeyPath(); byte[] publicKeyBytes = publicKey.getEncoded(); Files.write(publicKeyPath, publicKeyBytes); // Set secure permissions on private key setSecurePermissions(privateKeyPath); SecurityLogger.info("Keys saved to: {}", privateKeyPath.getParent()); } private void loadKeysFromFiles(Path privateKeyPath, Path publicKeyPath) throws Exception { // Load private key byte[] privateKeyBytes = Files.readAllBytes(privateKeyPath); PKCS8EncodedKeySpec privateKeySpec = new PKCS8EncodedKeySpec(privateKeyBytes); KeyFactory keyFactory = KeyFactory.getInstance("RSA"); privateKey = keyFactory.generatePrivate(privateKeySpec); // Load public key byte[] publicKeyBytes = Files.readAllBytes(publicKeyPath); X509EncodedKeySpec publicKeySpec = new X509EncodedKeySpec(publicKeyBytes); publicKey = keyFactory.generatePublic(publicKeySpec); keyAlgorithm = "rsa"; SecurityLogger.info("Loaded existing keys from: {}", privateKeyPath.getParent()); } private String generateKeyId() { try { // Generate key ID from public key fingerprint MessageDigest digest = MessageDigest.getInstance("SHA-256"); byte[] fingerprint = digest.digest(publicKey.getEncoded()); // Take first 16 bytes for key ID StringBuilder keyIdBuilder = new StringBuilder(); for (int i = 0; i < 16; i++) { keyIdBuilder.append(String.format("%02x", fingerprint[i])); } return keyIdBuilder.toString(); } catch (Exception e) { throw new InTotoException("Failed to generate key ID", e); } } /** * Sign data with private key */ public Signature sign(byte[] data) throws Exception { Signature signature = Signature.getInstance("SHA256withRSA"); signature.initSign(privateKey); signature.update(data); byte[] signatureBytes = signature.sign(); SignatureResult result = new SignatureResult(); result.setAlgorithm("SHA256withRSA"); result.setSignature(signatureBytes); result.setKeyId(keyId); result.setTimestamp(Instant.now()); return result; } /** * Verify signature */ public boolean verify(LinkMetadata link, Signature signature) throws Exception { // Serialize link metadata ObjectMapper mapper = new ObjectMapper(); String json = mapper.writeValueAsString(link); byte[] data = json.getBytes(); return verify(data, signature); } /** * Verify signature for raw data */ public boolean verify(byte[] data, Signature signature) throws Exception { Signature verifier = Signature.getInstance(signature.getAlgorithm()); verifier.initVerify(publicKey); verifier.update(data); return verifier.verify(signature.getSignature()); } /** * Get public key in PEM format */ public String getPublicKeyPem() { try { String base64Key = Base64.getEncoder().encodeToString(publicKey.getEncoded()); return String.format("-----BEGIN PUBLIC KEY-----\n%s\n-----END PUBLIC KEY-----", base64Key.replaceAll("(.{64})", "$1\n").trim()); } catch (Exception e) { throw new InTotoException("Failed to generate PEM format", e); } } /** * Get key ID */ public String getKeyId() { return keyId; } private Path getPrivateKeyPath() { return Paths.get(InTotoConfig.getInstance().getKeyDirectory(), "private.key"); } private Path getPublicKeyPath() { return Paths.get(InTotoConfig.getInstance().getKeyDirectory(), "public.key"); } private void setSecurePermissions(Path path) throws IOException { // Set restrictive permissions on private key if (System.getProperty("os.name").toLowerCase().contains("linux")) { Files.setPosixFilePermissions(path, Set.of( PosixFilePermission.OWNER_READ, PosixFilePermission.OWNER_WRITE )); } } } /** * Signature representation */ public class Signature { private String algorithm; private byte[] signature; private String keyId; private Instant timestamp; // Getters and setters public String getAlgorithm() { return algorithm; } public void setAlgorithm(String algorithm) { this.algorithm = algorithm; } public byte[] getSignature() { return signature; } public void setSignature(byte[] signature) { this.signature = signature; } public String getKeyId() { return keyId; } public void setKeyId(String keyId) { this.keyId = keyId; } public Instant getTimestamp() { return timestamp; } public void setTimestamp(Instant timestamp) { this.timestamp = timestamp; } }

Verification and Policy Engine

package com.titliel.intoto; import java.util.*; /** * Attestation verification engine */ public class AttestationVerifier { private final KeyManager keyManager; private final PolicyEngine policyEngine; public AttestationVerifier() { this.keyManager = new KeyManager(); this.policyEngine = new PolicyEngine(); } /** * Verify signed attestation */ public VerificationResult verify(SignedAttestation attestation) { VerificationResult result = new VerificationResult(); try { // Verify signature boolean signatureValid = keyManager.verify( attestation.getLinkMetadata(), attestation.getSignature() ); result.setSignatureValid(signatureValid); // Verify link metadata integrity result.setMetadataValid(verifyMetadata(attestation.getLinkMetadata())); // Verify material-product relationships result.setRelationshipsValid( verifyMaterialProductRelationships(attestation.getLinkMetadata())); // Calculate overall score result.calculateScore(); } catch (Exception e) { result.setError(e.getMessage()); SecurityLogger.error("Attestation verification failed", e); } return result; } /** * Verify metadata integrity */ private boolean verifyMetadata(LinkMetadata link) { // Check required fields if (link.getName() == null || link.getName().isEmpty()) { return false; } if (link.getMaterials() == null || link.getMaterials().isEmpty()) { return false; } if (link.getProducts() == null || link.getProducts().isEmpty()) { return false; } // Verify material hashes for (MaterialInfo material : link.getMaterials().values()) { if (!verifyMaterialHashes(material)) { return false; } } // Verify product hashes for (ProductInfo product : link.getProducts().values()) { if (!verifyProductHashes(product)) { return false; } } return true; } /** * Verify material hashes */ private boolean verifyMaterialHashes(MaterialInfo material) { if (material.getHashes() == null || material.getHashes().isEmpty()) { return false; } // At least one strong hash algorithm should be present Set<String> strongAlgorithms = Set.of("sha256", "sha512"); return material.getHashes().keySet().stream() .anyMatch(strongAlgorithms::contains); } /** * Verify product hashes */ private boolean verifyProductHashes(ProductInfo product) { if (product.getHashes() == null || product.getHashes().isEmpty()) { return false; } // At least one strong hash algorithm should be present Set<String> strongAlgorithms = Set.of("sha256", "sha512"); return product.getHashes().keySet().stream() .anyMatch(strongAlgorithms::contains); } /** * Verify material-product relationships */ private boolean verifyMaterialProductRelationships(LinkMetadata link) { // Basic validation: ensure materials and products are different Set<Path> materialPaths = link.getMaterials().keySet(); Set<Path> productPaths = link.getProducts().keySet(); // Check for obvious inconsistencies if (materialPaths.isEmpty() || productPaths.isEmpty()) { return false; } // Materials and products should generally be different files // (though self-modification is possible) return true; } /** * Verify supply chain continuity */ public ChainVerificationResult verifyChain(List<SignedAttestation> chain) { ChainVerificationResult result = new ChainVerificationResult(); if (chain.isEmpty()) { result.setError("Empty attestation chain"); return result; } // Verify each attestation individually List<VerificationResult> individualResults = new ArrayList<>(); for (SignedAttestation attestation : chain) { VerificationResult individual = verify(attestation); individualResults.add(individual); result.addIndividualResult(attestation, individual); } // Verify chain continuity boolean chainValid = verifyChainContinuity(chain); result.setChainContinuityValid(chainValid); // Verify policy compliance across chain PolicyCompliance chainCompliance = verifyChainPolicyCompliance(chain); result.setPolicyCompliance(chainCompliance); // Calculate overall chain integrity result.calculateChainIntegrity(); return result; } /** * Verify chain continuity */ private boolean verifyChainContinuity(List<SignedAttestation> chain) { for (int i = 0; i < chain.size() - 1; i++) { SignedAttestation current = chain.get(i); SignedAttestation next = chain.get(i + 1); if (!verifyStepContinuity(current, next)) { return false; } } return true; } /** * Verify continuity between two steps */ private boolean verifyStepContinuity(SignedAttestation current, SignedAttestation next) { // Get products from current step Map<Path, ProductInfo> currentProducts = current.getLinkMetadata().getProducts(); // Get materials from next step Map<Path, MaterialInfo> nextMaterials = next.getLinkMetadata().getMaterials(); // Verify that next step's materials include current step's products // This is a simplified check - real implementation would be more complex for (Path productPath : currentProducts.keySet()) { MaterialInfo nextMaterial = nextMaterials.get(productPath); if (nextMaterial == null) { // Product not found in next step's materials // Could be acceptable if product is not consumed continue; } // Verify hash consistency ProductInfo currentProduct = currentProducts.get(productPath); if (!verifyHashConsistency(currentProduct, nextMaterial)) { return false; } } return true; } /** * Verify hash consistency between product and material */ private boolean verifyHashConsistency(ProductInfo product, MaterialInfo material) { // Check if at least one hash algorithm matches for (Map.Entry<String, String> productHash : product.getHashes().entrySet()) { String materialHash = material.getHashes().get(productHash.getKey()); if (materialHash != null && materialHash.equals(productHash.getValue())) { return true; } } return false; } /** * Verify policy compliance across chain */ private PolicyCompliance verifyChainPolicyCompliance(List<SignedAttestation> chain) { PolicyCompliance compliance = new PolicyCompliance(); // Check each attestation against chain policies for (SignedAttestation attestation : chain) { PolicyCompliance individual = policyEngine.evaluateCompliance(attestation); compliance.merge(individual); } // Check chain-level policies compliance.merge(policyEngine.evaluateChainCompliance(chain)); return compliance; } } /** * Verification result */ public class VerificationResult { private boolean signatureValid; private boolean metadataValid; private boolean relationshipsValid; private double score; private String error; public void calculateScore() { int validCount = 0; int totalCount = 0; if (signatureValid) validCount++; totalCount++; if (metadataValid) validCount++; totalCount++; if (relationshipsValid) validCount++; totalCount++; this.score = (double) validCount / totalCount * 100.0; } // Getters and setters public boolean isSignatureValid() { return signatureValid; } public void setSignatureValid(boolean signatureValid) { this.signatureValid = signatureValid; } public boolean isMetadataValid() { return metadataValid; } public void setMetadataValid(boolean metadataValid) { this.metadataValid = metadataValid; } public boolean isRelationshipsValid() { return relationshipsValid; } public void setRelationshipsValid(boolean relationshipsValid) { this.relationshipsValid = relationshipsValid; } public double getScore() { return score; } public void setScore(double score) { this.score = score; } public String getError() { return error; } public void setError(String error) { this.error = error; } public boolean isSuccess() { return signatureValid && metadataValid && relationshipsValid && score >= 80.0; } } /** * Chain verification result */ public class ChainVerificationResult { private final Map<SignedAttestation, VerificationResult> individualResults; private boolean chainContinuityValid; private PolicyCompliance policyCompliance; private double chainIntegrityScore; private String error; public ChainVerificationResult() { this.individualResults = new HashMap<>(); } public void addIndividualResult(SignedAttestation attestation, VerificationResult result) { individualResults.put(attestation, result); } public void calculateChainIntegrity() { if (individualResults.isEmpty()) { chainIntegrityScore = 0.0; return; } // Calculate average of individual scores double totalScore = individualResults.values().stream() .mapToDouble(VerificationResult::getScore) .sum(); double averageScore = totalScore / individualResults.size(); // Adjust for chain continuity if (chainContinuityValid) { averageScore *= 1.1; // Bonus for continuity } else { averageScore *= 0.5; // Penalty for broken chain } // Adjust for policy compliance if (policyCompliance != null && policyCompliance.isCompliant()) { averageScore *= 1.05; // Bonus for policy compliance } chainIntegrityScore = Math.min(averageScore, 100.0); } // Getters and setters public Map<SignedAttestation, VerificationResult> getIndividualResults() { return Collections.unmodifiableMap(individualResults); } public boolean isChainContinuityValid() { return chainContinuityValid; } public void setChainContinuityValid(boolean chainContinuityValid) { this.chainContinuityValid = chainContinuityValid; } public PolicyCompliance getPolicyCompliance() { return policyCompliance; } public void setPolicyCompliance(PolicyCompliance policyCompliance) { this.policyCompliance = policyCompliance; } public double getChainIntegrityScore() { return chainIntegrityScore; } public void setChainIntegrityScore(double chainIntegrityScore) { this.chainIntegrityScore = chainIntegrityScore; } public String getError() { return error; } public void setError(String error) { this.error = error; } public boolean isChainValid() { return chainIntegrityScore >= 80.0 && chainContinuityValid && (policyCompliance == null || policyCompliance.isCompliant()); } } /** * Policy engine for compliance checking */ public class PolicyEngine { private final List<PolicyRule> rules; private final Map<String, SupplyChainPolicy> policies; public PolicyEngine() { this.rules = new ArrayList<>(); this.policies = new HashMap<>(); loadDefaultRules(); } private void loadDefaultRules() { // Add default policy rules rules.add(new SignaturePolicyRule()); rules.add(new HashPolicyRule()); rules.add(new StepNamePolicyRule()); rules.add(new MaterialSourcePolicyRule()); rules.add(new ProductIntegrityPolicyRule()); } public void loadPolicies() { // Load policies from configuration InTotoConfig config = InTotoConfig.getInstance(); Path policyDir = Paths.get(config.getPolicyDirectory()); try { if (Files.exists(policyDir)) { Files.list(policyDir) .filter(path -> path.toString().endsWith(".json")) .forEach(this::loadPolicyFile); } } catch (IOException e) { SecurityLogger.warn("Failed to load policies from directory: {}", policyDir, e); } } private void loadPolicyFile(Path policyFile) { try { ObjectMapper mapper = new ObjectMapper(); SupplyChainPolicy policy = mapper.readValue(policyFile.toFile(), SupplyChainPolicy.class); policies.put(policy.getName(), policy); SecurityLogger.info("Loaded policy: {}", policy.getName()); } catch (IOException e) { SecurityLogger.warn("Failed to load policy file: {}", policyFile, e); } } /** * Evaluate attestation compliance */ public PolicyCompliance evaluateCompliance(SignedAttestation attestation) { PolicyCompliance compliance = new PolicyCompliance(); for (PolicyRule rule : rules) { RuleResult result = rule.evaluate(attestation); compliance.addRuleResult(rule.getName(), result); } // Check against specific policies for (SupplyChainPolicy policy : policies.values()) { if (policy.appliesTo(attestation)) { PolicyEvaluation evaluation = policy.evaluate(attestation); compliance.addPolicyEvaluation(policy.getName(), evaluation); } } compliance.calculateCompliance(); return compliance; } /** * Evaluate chain compliance */ public PolicyCompliance evaluateChainCompliance(List<SignedAttestation> chain) { PolicyCompliance compliance = new PolicyCompliance(); // Check chain-level policies for (SupplyChainPolicy policy : policies.values()) { if (policy.isChainPolicy()) { PolicyEvaluation evaluation = policy.evaluateChain(chain); compliance.addPolicyEvaluation(policy.getName(), evaluation); } } compliance.calculateCompliance(); return compliance; } } /** * Policy rule interface */ interface PolicyRule { String getName(); RuleResult evaluate(SignedAttestation attestation); } /** * Signature policy rule */ class SignaturePolicyRule implements PolicyRule { @Override public String getName() { return "signature-valid"; } @Override public RuleResult evaluate(SignedAttestation attestation) { RuleResult result = new RuleResult(getName()); try { // Check signature exists if (attestation.getSignature() == null) { result.setPassed(false); result.setMessage("No signature found"); return result; } // Check key ID exists if (attestation.getKeyId() == null || attestation.getKeyId().isEmpty()) { result.setPassed(false); result.setMessage("No key ID found"); return result; } // Check signature algorithm String algorithm = attestation.getSignature().getAlgorithm(); if (!isStrongAlgorithm(algorithm)) { result.setPassed(false); result.setMessage("Weak signature algorithm: " + algorithm); return result; } result.setPassed(true); result.setMessage("Signature valid"); } catch (Exception e) { result.setPassed(false); result.setMessage("Signature verification failed: " + e.getMessage()); } return result; } private boolean isStrongAlgorithm(String algorithm) { return algorithm.contains("SHA256") || algorithm.contains("SHA512"); } } /** * Hash policy rule */ class HashPolicyRule implements PolicyRule { @Override public String getName() { return "hash-integrity"; } @Override public RuleResult evaluate(SignedAttestation attestation) { RuleResult result = new RuleResult(getName()); LinkMetadata link = attestation.getLinkMetadata(); // Check materials have strong hashes for (MaterialInfo material : link.getMaterials().values()) { if (!hasStrongHash(material.getHashes())) { result.setPassed(false); result.setMessage("Material missing strong hash: " + material.getPath()); return result; } } // Check products have strong hashes for (ProductInfo product : link.getProducts().values()) { if (!hasStrongHash(product.getHashes())) { result.setPassed(false); result.setMessage("Product missing strong hash: " + product.getPath()); return result; } } result.setPassed(true); result.setMessage("All materials and products have strong hashes"); return result; } private boolean hasStrongHash(Map<String, String> hashes) { if (hashes == null || hashes.isEmpty()) { return false; } return hashes.containsKey("sha256") || hashes.containsKey("sha512"); } }

Configuration and Usage Examples

```java
package com.titliel.intoto;

import java.nio.file.Paths;
import java.util.*;

/**

• Configuration management
  */
  public class InTotoConfig { private static InTotoConfig instance;
  private final Properties properties; private InTotoConfig() {
  this.properties = loadProperties();
  } public static synchronized InTotoConfig getInstance() {
  if (instance == null) {
  instance = new InTotoConfig();
  }
  return instance;
  } private Properties loadProperties() {
  Properties props = new Properties(); // Load from system properties props.putAll(System.getProperties()); // Load from configuration file try { Path configFile = Paths.get("intoto.properties"); if (Files.exists(configFile)) { try (InputStream input = Files.newInputStream(configFile)) { props.load(input); } } } catch (IOException e) { // Use defaults } // Load from environment loadFromEnvironment(props); // Set defaults setDefaults(props); return props; } private void loadFrom

Advanced Java Container Security, Sandboxing & Trusted Runtime Environments

https://macronepal.com/blog/sandboxing-java-applications-implementing-landlock-lsm-for-enhanced-container-security/
Explains using Linux Landlock LSM to sandbox Java applications by restricting file system and resource access without root privileges, improving application-level isolation and reducing attack surface.

https://macronepal.com/blog/gvisor-sandbox-integration-in-java-complete-guide/
Explains integrating gVisor with Java to provide a user-space kernel sandbox that intercepts system calls and isolates applications from the host operating system for stronger security.

https://macronepal.com/blog/selinux-for-java-mandatory-access-control-for-jvm-applications/
Explains how SELinux enforces Mandatory Access Control (MAC) policies on Java applications, strictly limiting what files, processes, and network resources the JVM can access.

https://macronepal.com/java/a-comprehensive-guide-to-intel-sgx-sdk-integration-in-java/
Explains Intel SGX integration in Java, allowing sensitive code and data to run inside secure hardware enclaves that remain protected even if the OS is compromised.

https://macronepal.com/blog/building-a-microvm-runtime-with-aws-firecracker-in-java-a-comprehensive-guide/
Explains using AWS Firecracker microVMs with Java to run workloads in lightweight virtual machines that provide strong isolation with near-container performance efficiency.

https://macronepal.com/blog/enforcing-mandatory-access-control-implementing-apparmor-for-java-applications/
Explains AppArmor security profiles for Java applications, enforcing rules that restrict file access, execution rights, and system-level permissions.

https://macronepal.com/blog/rootless-containers-in-java-secure-container-operations-without-root/
Explains running Java applications in rootless containers using Linux user namespaces so containers operate securely without requiring root privileges.

https://macronepal.com/blog/unlocking-container-security-harnessing-user-namespaces-in-java/
Explains Linux user namespaces, which isolate user and group IDs inside containers to improve privilege separation and enhance container security for Java workloads.

https://macronepal.com/blog/secure-bootstrapping-in-java-comprehensive-trust-establishment-framework/
Explains secure bootstrapping in Java, focusing on how systems establish trust during startup using secure key management, identity verification, and trusted configuration loading.

https://macronepal.com/blog/securing-java-applications-with-chainguard-wolfi-a-comprehensive-guide-2/
Explains using Chainguard/Wolfi minimal container images to secure Java applications by reducing unnecessary packages, minimizing vulnerabilities, and providing a hardened runtime environment.