2026年SCS評価制度（星3〜星5）とソフトウェア・サプライチェーン防衛のための
SBOM・Ed25519 ハッシュチェーン監査証跡基盤

#![no_std]
#![forbid(unsafe_code)]

pub const RFC6962_LEAF_PREFIX: u8 = 0x00;
pub const RFC6962_NODE_PREFIX: u8 = 0x01;

/// 256-bit cryptographic digest (SHA-256 / Blake3) used in the audit tree.
pub type Digest256 = [u8; 32];

/// Trait abstracting the underlying 256-bit cryptographic hash function.
pub trait Hash256Engine {
    fn hash_leaf(payload: &[u8]) -> Digest256;
    fn hash_interior(left: &Digest256, right: &Digest256) -> Digest256;
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum AuditVerifyError {
    InvalidLeafIndex { leaf_index: u64, tree_size: u64 },
    EmptyTreeSize,
    ProofLengthMismatch,
    RootHashMismatch,
    SbomDependencyDigestMismatch { crate_index: usize },
}

/// Constant-time 32-byte digest comparison to prevent side-channel leakage.
#[inline]
pub const fn ct_digest_eq(a: &Digest256, b: &Digest256) -> bool {
    let mut diff: u8 = 0;
    let mut i = 0;
    while i < 32 {
        diff |= a[i] ^ b[i];
        i += 1;
    }
    diff == 0
}

/// Verifies an RFC 6962 Section 2.1.3 Merkle Inclusion Proof (`audit_path`)
/// for `leaf_index` (m) in an append-only tree of `tree_size` (n) leaves,
/// handling non-power-of-two unbalanced right subtrees per exact RFC 6962 bit-decomposition.
pub fn verify_rfc6962_inclusion_proof<H: Hash256Engine>(
    leaf_hash: &Digest256,
    leaf_index: u64,
    tree_size: u64,
    audit_path: &[Digest256],
    expected_root: &Digest256,
) -> Result<(), AuditVerifyError> {
    if tree_size == 0 {
        return Err(AuditVerifyError::EmptyTreeSize);
    }
    if leaf_index >= tree_size {
        return Err(AuditVerifyError::InvalidLeafIndex {
            leaf_index,
            tree_size,
        });
    }

    let mut fn_idx = leaf_index;
    let mut sn_idx = tree_size - 1;
    let mut running_hash = *leaf_hash;
    let mut path_cursor = 0usize;

    while sn_idx > 0 {
        if (fn_idx & 1) == 1 || fn_idx == sn_idx {
            if path_cursor >= audit_path.len() {
                return Err(AuditVerifyError::ProofLengthMismatch);
            }
            // Sibling is on the left: Hash(0x01 || sibling || running_hash)
            running_hash = H::hash_interior(&audit_path[path_cursor], &running_hash);
            path_cursor += 1;
            while (fn_idx & 1) == 0 && fn_idx != 0 {
                fn_idx >>= 1;
                sn_idx >>= 1;
            }
        } else {
            if path_cursor >= audit_path.len() {
                return Err(AuditVerifyError::ProofLengthMismatch);
            }
            // Sibling is on the right: Hash(0x01 || running_hash || sibling)
            running_hash = H::hash_interior(&running_hash, &audit_path[path_cursor]);
            path_cursor += 1;
        }
        fn_idx >>= 1;
        sn_idx >>= 1;
    }

    if path_cursor != audit_path.len() {
        return Err(AuditVerifyError::ProofLengthMismatch);
    }
    if !ct_digest_eq(&running_hash, expected_root) {
        return Err(AuditVerifyError::RootHashMismatch);
    }
    Ok(())
}

/// Verifies that every locked SBOM dependency digest matches the expected lockfile manifest.
pub const fn verify_sbom_lockfile_digests(
    compiled_crates: &[Digest256],
    locked_manifest: &[Digest256],
) -> Result<usize, AuditVerifyError> {
    if compiled_crates.len() != locked_manifest.len() {
        return Err(AuditVerifyError::ProofLengthMismatch);
    }
    let mut i = 0;
    while i < compiled_crates.len() {
        if !ct_digest_eq(&compiled_crates[i], &locked_manifest[i]) {
            return Err(AuditVerifyError::SbomDependencyDigestMismatch { crate_index: i });
        }
        i += 1;
    }
    Ok(compiled_crates.len())
}