Skip to content

Commit ba53170

Browse files
committed
Prototype tooling for Claimant Models
The Claimant Model has proved itself as a useful theoretical tool for understanding and communicating about the participants in a log ecosystem. This tooling aims to make modeling & design be: a) more useful b) more interactive c) less intimidating This is still very much experimental, but I'd like other people to get involved with the experiment and hack on this tooling to advance the above goals.
1 parent 24f50ff commit ba53170

File tree

18 files changed

+726
-0
lines changed

18 files changed

+726
-0
lines changed
Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
# Claimant Model Render Tool
2+
3+
:warning: This is a prototype and has no guarantees of stability!
4+
5+
This tooling takes a definition of a Claimant Model in yaml format, and renders it in ways that are useful for evaluating the design.
6+
Once the authors are happy with the design, these rendering artefacts can be used as documentation for the project.
7+
8+
The markdown snippets that are generated will look at their best when rendered in GitHub.
9+
10+
## Prerequisites & Assumptions
11+
12+
This tooling assumes that you are using the Claimant Model as a way of describing participants in an ecosystem around logs.
13+
14+
Users are required to have an understanding of the roles in the [Claimant Model](../../../CoreModel.md) before starting to populate a custom yaml file for input into this tool.
15+
16+
## Usage
17+
18+
Start by copying the [example: CT Claimant Model](./internal/models/ct/model.yaml) into your working directory.
19+
This model is the simplest form as it has a single claim. If you know that your model has multiple claims with different verifiers, then starting with [example: Armory Drive Claimant Model](./internal/models/armorydrive/model.yaml) is a better call.
20+
21+
The first step is to turn this domain-level Claimant Model into a "full" model, i.e. one that also includes the log and its verifiers.
22+
23+
```bash
24+
go run ./docs/claimantmodel/experimental/cmd/render --domain_model_file /tmp/cmfun/model.yaml
25+
```
26+
27+
This will output some snippets to stdout. If you'd written the input file yourself, this would be a good opportunity to check that the output looked reasonable and to iterate on the input yaml file as needed.
28+
29+
Part of the output will be a complete model. Copy this and save it into another file in your working directory called `full.yaml`. If you reviewed the output you'll have seen that there are a few `TODO` entries with some guesses in this output, specifically when defining the actors for the Log Claimant and Arbiter. The Claimant and Arbiter from the base model are suggested as defaults, but it could be that a new actor (that doesn't participate in the base model) is introduced to perform either or both of these roles.
30+
31+
Edit the file to resolve the `TODO` entries, and then run the tooling again against this file:
32+
33+
```bash
34+
go run ./docs/claimantmodel/experimental/cmd/render --full_model_file /tmp/cmfun/full.yaml
35+
```
36+
37+
The rendered output will include markdown snippets for the full claimant model, and a mermaid sequence diagram.
38+
39+
## Known Issues
40+
41+
A non-exhaustive list of issues or limiting assumptions:
42+
- the sequence diagram assumes that an offline proof bundle will be generated by the Claimant and distributed to the Believer; this is a best practice, but somewhat rare. Supporting other flows should be possible.
43+
- the sequence diagram doesn't show anyone relying on the output of the witness checks; this should be included because that's the whole point of the witness countersigning checkpoints
44+
- the tool doesn't support SCTs/promises
45+
Lines changed: 279 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,279 @@
1+
// Copyright 2023 Trillian Authors. All Rights Reserved.
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
// Package claimant is a code model for the Claimant Model.
16+
package claimant
17+
18+
import (
19+
"bytes"
20+
_ "embed"
21+
"fmt"
22+
"regexp"
23+
"sort"
24+
25+
"text/template"
26+
)
27+
28+
var (
29+
// TemplateModelMarkdown is the markdown template for a model.
30+
//go:embed tmpl_model.md
31+
TemplateModelMarkdown []byte
32+
33+
// TemplateQuestions is the markdown template for a model questionnaire.
34+
//go:embed tmpl_questions.md
35+
TemplateQuestionsMarkdown []byte
36+
37+
// TemplateSequence is the markdown template for the sequence diagram.
38+
//go:embed tmpl_sequence.md
39+
TemplateSequenceMarkdown []byte
40+
)
41+
42+
// Claim represents a falsifiable statement along with an actor that can verify it.
43+
type Claim struct {
44+
// Claim is a falsifiable statement, e.g. "The number 7 is prime"
45+
Claim string `yaml:"Claim"`
46+
// Verifier is an actor that can verify the claim, e.g. "Primal Calculator"
47+
Verifier string `yaml:"Verifier"`
48+
}
49+
50+
// Model represents a Claimant Model, mapping the roles to actors.
51+
// See https://github.com/google/trillian/blob/master/docs/claimantmodel/CoreModel.md for
52+
// descriptions of these roles. Repeating the definitions here will only lead to stale
53+
// documentation.
54+
type Model struct {
55+
// System is a short upper case name that models the essence of this model, e.g. "FIRMWARE".
56+
System string `yaml:"System"`
57+
// Claimant is the actor playing the role of the Claimant.
58+
Claimant string `yaml:"Claimant"`
59+
// Statement is the concrete type that the Claimant issues, and is likely the thing that is logged.
60+
Statement string `yaml:"Statement"`
61+
62+
// Believer is the actor playing the role of the Believer.
63+
Believer string `yaml:"Believer,omitempty"`
64+
// Believers are the actor playing the roles of the Believer.
65+
// This should only be provided if there are multiple Believers, and if
66+
// provided then Believer should be left empty.
67+
Believers []string `yaml:"Believers,omitempty"`
68+
69+
// Claim is the claim made by the Claimant.
70+
Claim Claim `yaml:"Claim,omitempty"`
71+
// Claims are the claims made by the Claimant.
72+
// This should only be provided if there are multiple Claims, and if
73+
// provided then Claim should be left empty.
74+
Claims []Claim `yaml:"Claims,omitempty"`
75+
76+
// Arbiter is the actor or process that fulfills the Arbiter role.
77+
Arbiter string `yaml:"Arbiter"`
78+
}
79+
80+
// Markdown returns this Claimant Model in a definition table that renders
81+
// clearly in markdown format.
82+
func (m Model) Markdown() string {
83+
t, err := template.New("model").Parse(string(TemplateModelMarkdown))
84+
if err != nil {
85+
panic(err)
86+
}
87+
w := bytes.NewBuffer([]byte{})
88+
err = t.Execute(w, m)
89+
if err != nil {
90+
panic(err)
91+
}
92+
return w.String()
93+
}
94+
95+
// Questionnaire returns some questions to guide the designer to ensure that
96+
// the claimant model is sound.
97+
func (m Model) Questionnaire() string {
98+
t, err := template.New("questions").Parse(string(TemplateQuestionsMarkdown))
99+
if err != nil {
100+
panic(err)
101+
}
102+
w := bytes.NewBuffer([]byte{})
103+
err = t.Execute(w, m)
104+
if err != nil {
105+
panic(err)
106+
}
107+
return w.String()
108+
}
109+
110+
// ClaimTerms finds all of the terms used in the Claim that must be
111+
// present in the Statement.
112+
func (m Model) ClaimTerms() []string {
113+
re := regexp.MustCompile(`\$[\w\@]*`)
114+
115+
return re.FindAllString(m.ClaimMarkdown(), -1)
116+
}
117+
118+
// ClaimMarkdown renders the Claim(s) in markdown.
119+
func (m Model) ClaimMarkdown() string {
120+
if len(m.Claims) == 0 {
121+
return m.Claim.Claim
122+
}
123+
r := "<ol>"
124+
for _, c := range m.Claims {
125+
r += fmt.Sprintf("<li>%s</li>", c.Claim)
126+
}
127+
r += "</ol>"
128+
return r
129+
}
130+
131+
// VerifierList returns all of the verifiers mapped to the claim they verify.
132+
func (m Model) VerifierList() map[string]string {
133+
if len(m.Claim.Verifier) > 0 {
134+
return map[string]string{m.Claim.Verifier: m.Claim.Claim}
135+
}
136+
r := make(map[string]string)
137+
for _, c := range m.Claims {
138+
r[c.Verifier] = c.Claim
139+
}
140+
return r
141+
}
142+
143+
// VerifierMarkdown renders the Verifier(s) in markdown.
144+
func (m Model) VerifierMarkdown() string {
145+
if len(m.Claims) == 0 {
146+
return fmt.Sprintf("%s: <i>%s</i>", m.Claim.Verifier, m.Claim.Claim)
147+
}
148+
r := "<ul>"
149+
for _, c := range m.Claims {
150+
r += fmt.Sprintf("<li>%s: <i>%s</i></li>", c.Verifier, c.Claim)
151+
}
152+
r += "</ul>"
153+
return r
154+
}
155+
156+
// BelieverMarkdown renders the Believer(s) in markdown.
157+
func (m Model) BelieverMarkdown() string {
158+
if len(m.Believer) > 0 {
159+
return m.Believer
160+
}
161+
r := "<ul>"
162+
for _, b := range m.Believers {
163+
r += fmt.Sprintf("<li>%s</li>", b)
164+
}
165+
r += "</ul>"
166+
return r
167+
}
168+
169+
// LogModelForDomain proposes a template Claimant Model for human
170+
// editing based on a domain model provided.
171+
func LogModelForDomain(m Model) Model {
172+
verifiersString := m.Claim.Verifier
173+
if len(verifiersString) == 0 {
174+
verifiersString += "{"
175+
for _, c := range m.Claims {
176+
verifiersString += c.Verifier + "/"
177+
}
178+
verifiersString = verifiersString[:len(verifiersString)-1]
179+
verifiersString += "}"
180+
}
181+
believers := m.Believers
182+
if len(believers) == 0 {
183+
believers = append(believers, m.Believer)
184+
}
185+
if v := m.Claim.Verifier; len(v) > 0 {
186+
believers = append(believers, v)
187+
} else {
188+
for _, c := range m.Claims {
189+
believers = append(believers, c.Verifier)
190+
}
191+
}
192+
return Model{
193+
System: fmt.Sprintf("LOG_%s", m.System),
194+
Claimant: fmt.Sprintf("TODO: %s/$LogOperator", m.Claimant),
195+
Claims: []Claim{
196+
{
197+
Claim: "This data structure is append-only from any previous version",
198+
Verifier: "Witness",
199+
},
200+
{
201+
Claim: "This data structure is globally consistent",
202+
Verifier: "Witness Quorum",
203+
},
204+
{
205+
Claim: fmt.Sprintf("This data structure contains only leaves of type `%s`", m.Statement),
206+
Verifier: verifiersString,
207+
},
208+
},
209+
Statement: "Log Checkpoint",
210+
Believers: believers,
211+
Arbiter: fmt.Sprintf("TODO: %s/$LogArbiter", m.Arbiter),
212+
}
213+
}
214+
215+
// Models captures the domain model along with the log model that supports it.
216+
// This can be extended for more general model composition in the future, but
217+
// this is the most common composition and motiviation for Claimant Modelling.
218+
type Models struct {
219+
Domain Model `yaml:"Domain"`
220+
Log Model `yaml:"Log"`
221+
}
222+
223+
// Actors returns all of the actors that participate in the ecosystem of logging
224+
// the domain claims and verifying all behaviours.
225+
func (ms Models) Actors() []string {
226+
am := make(map[string]bool)
227+
for _, model := range []Model{ms.Domain, ms.Log} {
228+
am[model.Claimant] = true
229+
for v := range model.VerifierList() {
230+
am[v] = true
231+
}
232+
if len(model.Believer) > 0 {
233+
am[model.Believer] = true
234+
} else {
235+
for _, b := range model.Believers {
236+
am[b] = true
237+
}
238+
}
239+
for v := range model.VerifierList() {
240+
am[v] = true
241+
}
242+
}
243+
r := make([]string, 0, len(am))
244+
for actor, _ := range am {
245+
if len(actor) > 0 {
246+
r = append(r, actor)
247+
}
248+
}
249+
// TODO(mhutchinson): put these in a more useful order than alphabetical
250+
sort.Strings(r)
251+
return r
252+
}
253+
254+
// Markdown returns the markdown representation of both models.
255+
func (ms Models) Markdown() string {
256+
return fmt.Sprintf("%s\n%s", ms.Domain.Markdown(), ms.Log.Markdown())
257+
}
258+
259+
// SequenceDiagram returns a mermaid markdown snippet that shows the
260+
// idealized workflow for this log ecosystem. This can be changed in the
261+
// future to support other variations in the workflow, e.g. this generates
262+
// a sequence that shows the claimant awaiting an inclusion proof and then
263+
// creating an offline bundle, but not all ecosystems do this and so perhaps
264+
// this should take some kind of Options that allows these cases to vary.
265+
// For now, this is out of scope and this generated sequence diagram should
266+
// be taken to represent the current best practice, and designers can modify
267+
// it to reflect the deltas in their world.
268+
func (ms Models) SequenceDiagram() string {
269+
t, err := template.New("seq").Parse(string(TemplateSequenceMarkdown))
270+
if err != nil {
271+
panic(err)
272+
}
273+
w := bytes.NewBuffer([]byte{})
274+
err = t.Execute(w, ms)
275+
if err != nil {
276+
panic(err)
277+
}
278+
return w.String()
279+
}
Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
// Copyright 2023 Trillian Authors. All Rights Reserved.
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
package claimant_test
15+
16+
import (
17+
"fmt"
18+
"os"
19+
"strings"
20+
"testing"
21+
22+
"github.com/google/go-cmp/cmp"
23+
claimant "github.com/google/trillian/docs/claimantmodel/experimental/cmd/render/internal"
24+
"gopkg.in/yaml.v2"
25+
)
26+
27+
func TestModelAndQuestionnaire(t *testing.T) {
28+
testCases := []struct {
29+
system string
30+
terms []string
31+
}{
32+
{
33+
system: "ct",
34+
terms: []string{"$pubKey", "$domain"},
35+
},
36+
{
37+
system: "armorydrive",
38+
terms: []string{"$artifactHash", "$platform", "$revision", "$git@tag", "$tamago@tag", "$usbarmory@tag"},
39+
},
40+
}
41+
for _, tC := range testCases {
42+
t.Run(tC.system, func(t *testing.T) {
43+
saved, err := os.ReadFile(fmt.Sprintf("models/%s/model.yaml", tC.system))
44+
if err != nil {
45+
t.Fatalf("failed to read model: %v", err)
46+
}
47+
model := claimant.Model{}
48+
if err := yaml.Unmarshal(saved, &model); err != nil {
49+
t.Fatalf("failed to unmarshal model: %v", err)
50+
}
51+
if got, want := model.ClaimTerms(), tC.terms; !cmp.Equal(got, want) {
52+
t.Errorf("got != want; %v != %v", got, want)
53+
}
54+
saved, err = os.ReadFile(fmt.Sprintf("models/%s/model.md", tC.system))
55+
if err != nil {
56+
t.Fatalf("failed to read file: %v", err)
57+
}
58+
if diff := cmp.Diff(model.Markdown(), string(saved)); len(diff) != 0 {
59+
t.Errorf("unexpected diff: %v", diff)
60+
}
61+
saved, err = os.ReadFile(fmt.Sprintf("models/%s/questions.md", tC.system))
62+
if err != nil {
63+
t.Fatalf("failed to read file: %v", err)
64+
}
65+
// We allow the questions to be completed, but for the sake of diffing
66+
// we uncheck all of the boxes.
67+
unchecked := strings.ReplaceAll(string(saved), "[x]", "[ ]")
68+
if diff := cmp.Diff(model.Questionnaire(), unchecked); len(diff) != 0 {
69+
t.Errorf("unexpected diff: %v", diff)
70+
}
71+
})
72+
}
73+
}

0 commit comments

Comments
 (0)