オープンソースのサプライチェーン攻撃（悪意あるパッケージ混入）をどう防ぐか？
SBOM（ソフトウェア部品表）と暗号学的ロック検証

#![forbid(unsafe_code)]

#[derive(Debug, Clone)]
pub struct SbomComponent {
    pub name: String,
    pub version: String,
    pub registry_url: String,
    pub expected_sha256: [u8; 32],
    pub actual_archive_sha256: [u8; 32],
    pub is_internal_namespace: bool,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub enum SupplyChainAlert {
    Sha256DigestMismatch { package: String, version: String },
    DependencyConfusionRisk { package: String, registry: String },
    SuspectedTyposquatting { package: String, similar_to: String },
}

/// Computes bounded Levenshtein edit distance between two ASCII package names.
pub fn levenshtein_ascii(a: &str, b: &str) -> usize {
    let a_bytes = a.as_bytes();
    let b_bytes = b.as_bytes();
    let m = a_bytes.len();
    let n = b_bytes.len();
    let mut prev: Vec<usize> = (0..=n).collect();
    let mut curr = vec![0usize; n + 1];

    for i in 1..=m {
        curr[0] = i;
        for j in 1..=n {
            let cost = usize::from(a_bytes[i - 1] != b_bytes[j - 1]);
            let del = prev[j] + 1;
            let ins = curr[j - 1] + 1;
            let sub = prev[j - 1] + cost;
            curr[j] = del.min(ins).min(sub);
        }
        std::mem::swap(&mut prev, &mut curr);
    }
    prev[n]
}

/// Verifies all components in a locked dependency graph against hash integrity,
/// namespace pinning, and typosquatting distance against canonical packages.
pub fn verify_sbom_lock_graph(
    components: &[SbomComponent],
    canonical_popular_crates: &[&str],
    trusted_internal_registry: &str,
) -> Vec<SupplyChainAlert> {
    let mut alerts = Vec::new();

    for comp in components {
        // 1. Cryptographic SHA-256 lockfile verification
        let mut diff = 0u8;
        for i in 0..32 {
            diff |= comp.expected_sha256[i] ^ comp.actual_archive_sha256[i];
        }
        if diff != 0 {
            alerts.push(SupplyChainAlert::Sha256DigestMismatch {
                package: comp.name.clone(),
                version: comp.version.clone(),
            });
        }

        // 2. Dependency Confusion guard: internal packages must never resolve from public registries
        if comp.is_internal_namespace && comp.registry_url != trusted_internal_registry {
            alerts.push(SupplyChainAlert::DependencyConfusionRisk {
                package: comp.name.clone(),
                registry: comp.registry_url.clone(),
            });
        }

        // 3. Typosquatting guard: flag distance-1 lookalikes of canonical crates
        if !comp.is_internal_namespace {
            for &trusted in canonical_popular_crates {
                if comp.name != trusted && levenshtein_ascii(&comp.name, trusted) == 1 {
                    alerts.push(SupplyChainAlert::SuspectedTyposquatting {
                        package: comp.name.clone(),
                        similar_to: trusted.to_string(),
                    });
                }
            }
        }
    }

    alerts
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn catches_typosquat_and_hash_tampering() {
        let popular = ["serde", "tokio", "axum", "sqlx"];
        let components = vec![SbomComponent {
            name: "serd".to_string(),
            version: "1.0.0".to_string(),
            registry_url: "https://crates.io".to_string(),
            expected_sha256: [0x11; 32],
            actual_archive_sha256: [0x22; 32],
            is_internal_namespace: false,
        }];
        let alerts = verify_sbom_lock_graph(&components, &popular, "https://cargo.internal");
        assert_eq!(alerts.len(), 2);
    }
}