refactor: remove grpc api

As we added GraphQL and HTTP endpoints to download attestations the GRPC
service found itself less and less used. This is a pretty hefty refactor
of the archivist server code to pull out the GRPC service.

WIP: SPIRE mTLS with the http service

Signed-off-by: Mikhail Swift <mikhail@testifysec.com>

.gitlab-ci.yml

@@ -20,7 +20,7 @@ build-and-push-server:
     KO_DOCKER_REPO: registry.gitlab.com/testifysec/judge-platform/archivist/archivist
   stage: build
   image:
-    name: registry.gitlab.com/testifysec/docker-images/ko:0.11.2
+    name: registry.gitlab.com/testifysec/docker-images/ko:0.11.2-go1.19.2
     entrypoint: [""]
   script:
     - ko auth login -u ${CI_REGISTRY_USER} -p ${CI_REGISTRY_PASSWORD} ${CI_REGISTRY}
@@ -31,7 +31,7 @@ build-and-push-client:
     KO_DOCKER_REPO: registry.gitlab.com/testifysec/judge-platform/archivist/archivistctl
   stage: build
   image:
-    name: registry.gitlab.com/testifysec/docker-images/ko:0.11.2
+    name: registry.gitlab.com/testifysec/docker-images/ko:0.11.2-go1.19.2
     entrypoint: [""]
   script:
     - ko auth login -u ${CI_REGISTRY_USER} -p ${CI_REGISTRY_PASSWORD} ${CI_REGISTRY}

client/download.go

@@ -0,0 +1,63 @@
+// Copyright 2022 The Witness Contributors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package client
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"net/url"
+
+	"github.com/testifysec/go-witness/dsse"
+)
+
+func Download(ctx context.Context, baseUrl string, gitoid string) (dsse.Envelope, error) {
+	downloadUrl, err := url.JoinPath(baseUrl, "download", gitoid)
+	if err != nil {
+		return dsse.Envelope{}, err
+	}
+
+	req, err := http.NewRequestWithContext(ctx, "GET", downloadUrl, nil)
+	if err != nil {
+		return dsse.Envelope{}, err
+	}
+
+	req.Header.Set("Content-Type", "application/json")
+	hc := &http.Client{}
+	resp, err := hc.Do(req)
+	if err != nil {
+		return dsse.Envelope{}, nil
+	}
+
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		errMsg, err := io.ReadAll(resp.Body)
+		if err != nil {
+			return dsse.Envelope{}, err
+		}
+
+		return dsse.Envelope{}, errors.New(string(errMsg))
+	}
+
+	env := dsse.Envelope{}
+	dec := json.NewDecoder(resp.Body)
+	if err := dec.Decode(&env); err != nil {
+		return env, err
+	}
+
+	return env, nil
+}

client/graphql.go

@@ -0,0 +1,92 @@
+// Copyright 2022 The Witness Contributors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package client
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+)
+
+type graphQLError struct {
+	Message string `json:"message"`
+}
+
+type graphQLResponse[T any] struct {
+	Data   T              `json:"data,omitempty"`
+	Errors []graphQLError `json:"errors,omitempty"`
+}
+
+type graphQLRequestBody[TVars any] struct {
+	Query     string `json:"query"`
+	Variables TVars  `json:"variables,omitempty"`
+}
+
+func GraphQlQuery[TRes any, TVars any](ctx context.Context, baseUrl, query string, vars TVars) (TRes, error) {
+	var response TRes
+	queryUrl, err := url.JoinPath(baseUrl, "query")
+	if err != nil {
+		return response, err
+	}
+
+	requestBody := graphQLRequestBody[TVars]{
+		Query:     query,
+		Variables: vars,
+	}
+
+	reqBody, err := json.Marshal(requestBody)
+	if err != nil {
+		return response, err
+	}
+
+	req, err := http.NewRequestWithContext(ctx, "POST", queryUrl, bytes.NewReader(reqBody))
+	if err != nil {
+		return response, err
+	}
+
+	req.Header.Set("Content-Type", "application/json")
+	hc := &http.Client{}
+	res, err := hc.Do(req)
+	if err != nil {
+		return response, err
+	}
+
+	defer res.Body.Close()
+	if res.StatusCode != http.StatusOK {
+		errMsg, err := io.ReadAll(res.Body)
+		if err != nil {
+			return response, err
+		}
+
+		return response, errors.New(string(errMsg))
+	}
+
+	dec := json.NewDecoder(res.Body)
+	gqlRes := graphQLResponse[TRes]{}
+	if err := dec.Decode(&gqlRes); err != nil {
+		return response, err
+	}
+
+	if len(gqlRes.Errors) > 0 {
+		return response, fmt.Errorf("graph ql query failed: %v", gqlRes.Errors)
+	}
+
+	return gqlRes.Data, nil
+}

client/store.go

@@ -0,0 +1,70 @@
+// Copyright 2022 The Witness Contributors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package client
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"net/url"
+
+	"github.com/testifysec/archivist/internal/server"
+	"github.com/testifysec/go-witness/dsse"
+)
+
+func Store(ctx context.Context, baseUrl string, envelope dsse.Envelope) (string, error) {
+	uploadPath, err := url.JoinPath(baseUrl, "upload")
+	if err != nil {
+		return "", err
+	}
+
+	buf := &bytes.Buffer{}
+	enc := json.NewEncoder(buf)
+	if err := enc.Encode(envelope); err != nil {
+		return "", err
+	}
+
+	req, err := http.NewRequestWithContext(ctx, "POST", uploadPath, buf)
+	if err != nil {
+		return "", err
+	}
+
+	req.Header.Set("Content-Type", "application/json")
+	hc := &http.Client{}
+	resp, err := hc.Do(req)
+	if err != nil {
+		return "", err
+	}
+
+	defer resp.Body.Close()
+	bodyBytes, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return "", err
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return "", errors.New(string(bodyBytes))
+	}
+
+	storeResp := server.StoreResponse{}
+	if err := json.Unmarshal(bodyBytes, &storeResp); err != nil {
+		return "", err
+	}
+
+	return storeResp.Gitoid, nil
+}