Add registry revocations endpoint

README.md

@@ -193,7 +193,9 @@ cargo run -p qcap-cli -- fetch demo.qcap --out /tmp/qcap-demo/fetched.qcap --reg
 cargo run -p qcap-cli -- grant /tmp/qcap-demo/fetched.qcap --issuer /tmp/qcap-demo/issuer.identity.json --audience <recipient-id> --path "reports/*" --out /tmp/qcap-demo/cap.json
 cargo run -p qcap-cli -- open /tmp/qcap-demo/fetched.qcap --cap /tmp/qcap-demo/cap.json --identity /tmp/qcap-demo/recipient.identity.json --out /tmp/qcap-demo/exported
 cargo run -p qcap-cli -- revoke --cap /tmp/qcap-demo/cap.json --issuer /tmp/qcap-demo/issuer.identity.json --out /tmp/qcap-demo/revocations.json
-cargo run -p qcap-cli -- open /tmp/qcap-demo/fetched.qcap --cap /tmp/qcap-demo/cap.json --identity /tmp/qcap-demo/recipient.identity.json --revocations /tmp/qcap-demo/revocations.json --out /tmp/qcap-demo/revoked-exported
+cargo run -p qcap-cli -- publish-revocations /tmp/qcap-demo/revocations.json --registry http://127.0.0.1:8080 --token demo-token
+cargo run -p qcap-cli -- fetch-revocations <issuer-public-key> --out /tmp/qcap-demo/fetched-revocations.json --registry http://127.0.0.1:8080
+cargo run -p qcap-cli -- open /tmp/qcap-demo/fetched.qcap --cap /tmp/qcap-demo/cap.json --identity /tmp/qcap-demo/recipient.identity.json --revocations-url http://127.0.0.1:8080/revocations/<issuer-public-key>/revocations.json --out /tmp/qcap-demo/revoked-exported
 ```
 
 This is an MVP, not a hardened security product. It uses XChaCha20-Poly1305 for file encryption, X25519-derived wrapping keys for recipients, ed25519 signatures over the Merkle root, and signed capability tokens with enforced expiry, audience, and path constraints.

core/qcap-cli/src/main.rs

@@ -88,6 +88,8 @@ enum Commands {
         identity: PathBuf,
         #[arg(long = "revocations")]
         revocations: Option<PathBuf>,
+        #[arg(long = "revocations-url", conflicts_with = "revocations")]
+        revocations_url: Option<String>,
         #[arg(short = 'o', long = "out")]
         out: PathBuf,
     },
@@ -110,6 +112,16 @@ enum Commands {
         #[arg(long = "token", env = "QCAP_REGISTRY_TOKEN")]
         token: Option<String>,
     },
+    /// Publish a signed revocations.json to a registry issuer endpoint
+    PublishRevocations {
+        file: PathBuf,
+        #[arg(long = "issuer")]
+        issuer: Option<String>,
+        #[arg(long = "registry", default_value = "http://127.0.0.1:8080")]
+        registry: String,
+        #[arg(long = "token", env = "QCAP_REGISTRY_TOKEN")]
+        token: Option<String>,
+    },
     /// Fetch a .qcap from a registry
     Fetch {
         artifact: String,
@@ -118,6 +130,14 @@ enum Commands {
         #[arg(long = "registry", default_value = "http://127.0.0.1:8080")]
         registry: String,
     },
+    /// Fetch a signed revocations.json from a registry issuer endpoint
+    FetchRevocations {
+        issuer: String,
+        #[arg(short = 'o', long = "out")]
+        out: PathBuf,
+        #[arg(long = "registry", default_value = "http://127.0.0.1:8080")]
+        registry: String,
+    },
     /// Create a tiny valid GeoPackage fixture for MVP demos and tests
     SampleGeopackage {
         #[arg(short = 'o', long = "out")]
@@ -192,8 +212,16 @@ fn run() -> Result<()> {
             cap,
             identity,
             revocations,
+            revocations_url,
             out,
-        } => open_archive(&file, &cap, &identity, revocations.as_deref(), &out)?,
+        } => open_archive(
+            &file,
+            &cap,
+            &identity,
+            revocations.as_deref(),
+            revocations_url.as_deref(),
+            &out,
+        )?,
         Commands::Revoke {
             cap,
             issuer,
@@ -205,11 +233,22 @@ fn run() -> Result<()> {
             registry,
             token,
         } => publish(&file, &registry, token.as_deref())?,
+        Commands::PublishRevocations {
+            file,
+            issuer,
+            registry,
+            token,
+        } => publish_revocations(&file, issuer.as_deref(), &registry, token.as_deref())?,
         Commands::Fetch {
             artifact,
             out,
             registry,
         } => fetch(&artifact, &out, &registry)?,
+        Commands::FetchRevocations {
+            issuer,
+            out,
+            registry,
+        } => fetch_revocations(&issuer, &out, &registry)?,
         Commands::SampleGeopackage { out } => sample_geopackage(&out)?,
     }
     Ok(())
@@ -436,14 +475,14 @@ fn open_archive(
     cap_path: &Path,
     identity_path: &Path,
     revocations_path: Option<&Path>,
+    revocations_url: Option<&str>,
     out: &Path,
 ) -> Result<()> {
     let report = verify_archive(file)?;
     let identity: Identity = read_json(identity_path)?;
     let cap: CapabilityToken = read_json(cap_path)?;
     cap.verify()?;
-    if let Some(path) = revocations_path {
-        let revocations: RevocationList = read_json(path)?;
+    if let Some(revocations) = load_revocations(revocations_path, revocations_url)? {
         revocations.verify()?;
         if revocations.revokes(&cap) {
             return Err("capability has been revoked".into());
@@ -637,6 +676,74 @@ fn fetch(artifact: &str, out: &Path, registry: &str) -> Result<()> {
     Ok(())
 }
 
+fn publish_revocations(
+    file: &Path,
+    issuer: Option<&str>,
+    registry: &str,
+    token: Option<&str>,
+) -> Result<()> {
+    let revocations: RevocationList = read_json(file)?;
+    revocations.verify()?;
+    let issuer = issuer
+        .filter(|value| !value.is_empty())
+        .map(str::to_string)
+        .unwrap_or_else(|| revocations.public_key.clone());
+    let url = revocations_url(registry, &issuer);
+    let bytes = fs::read(file)?;
+    let mut request = ureq::post(&url).set("Content-Type", "application/qcap-revocations+json");
+    if let Some(token) = token.filter(|value| !value.is_empty()) {
+        request = request.set("Authorization", &format!("Bearer {token}"));
+    }
+    let response: RevocationResponse = request.send_bytes(&bytes)?.into_json()?;
+    println!(
+        "Published revocations\n- issuer: {}\n- url: {}{}",
+        response.issuer,
+        registry.trim_end_matches('/'),
+        response.path
+    );
+    Ok(())
+}
+
+fn fetch_revocations(issuer: &str, out: &Path, registry: &str) -> Result<()> {
+    let url = revocations_url(registry, issuer);
+    let revocations = fetch_revocations_from_url(&url)?;
+    write_json(out, &revocations)?;
+    println!(
+        "Fetched revocations\n- issuer: {}\n- out: {}",
+        issuer,
+        out.display()
+    );
+    Ok(())
+}
+
+fn load_revocations(
+    revocations_path: Option<&Path>,
+    revocations_url: Option<&str>,
+) -> Result<Option<RevocationList>> {
+    match (revocations_path, revocations_url) {
+        (Some(path), None) => Ok(Some(read_json(path)?)),
+        (None, Some(url)) => Ok(Some(fetch_revocations_from_url(url)?)),
+        (None, None) => Ok(None),
+        (Some(_), Some(_)) => Err("use either --revocations or --revocations-url, not both".into()),
+    }
+}
+
+fn fetch_revocations_from_url(url: &str) -> Result<RevocationList> {
+    let response = ureq::get(url).call()?;
+    let revocations: RevocationList = response.into_json()?;
+    revocations.verify()?;
+    Ok(revocations)
+}
+
+fn revocations_url(registry: &str, issuer: &str) -> String {
+    let issuer = issuer.trim().trim_matches('/');
+    format!(
+        "{}/revocations/{}/revocations.json",
+        registry.trim_end_matches('/'),
+        issuer
+    )
+}
+
 fn sample_geopackage(out: &Path) -> Result<()> {
     if let Some(parent) = out.parent() {
         fs::create_dir_all(parent)?;
@@ -769,6 +876,12 @@ struct PublishResponse {
     path: String,
 }
 
+#[derive(Deserialize)]
+struct RevocationResponse {
+    issuer: String,
+    path: String,
+}
+
 #[derive(Debug)]
 struct Access {
     operation: String,

scripts/demo.ps1

@@ -68,6 +68,8 @@ try {
   Step "creating issuer and recipient identities"
   Run $QcapExe @("init", "--name", "issuer", "--out", $Issuer)
   Run $QcapExe @("init", "--name", "recipient", "--out", $Recipient)
+  $issuerIdentity = Get-Content -Raw $Issuer | ConvertFrom-Json
+  $issuerRevocationsUrl = "http://127.0.0.1:8080/revocations/$($issuerIdentity.signing_public_key)/revocations.json"
   $recipientIdentity = Get-Content -Raw $Recipient | ConvertFrom-Json
   $recipientAudience = $recipientIdentity.signing_public_key.Substring(0, 16)
 
@@ -121,7 +123,8 @@ try {
 
   Step "revoking capability and proving it is blocked"
   Run $QcapExe @("revoke", "--cap", $Cap, "--issuer", $Issuer, "--reason", "demo-complete", "--out", $Revocations)
-  RunExpectFailure $QcapExe @("open", $Fetched, "--cap", $Cap, "--identity", $Recipient, "--revocations", $Revocations, "--out", $RevokedExported) "OK blocked revoked capability"
+  Run $QcapExe @("publish-revocations", $Revocations, "--registry", "http://127.0.0.1:8080", "--token", "demo-token")
+  RunExpectFailure $QcapExe @("open", $Fetched, "--cap", $Cap, "--identity", $Recipient, "--revocations-url", $issuerRevocationsUrl, "--out", $RevokedExported) "OK blocked revoked capability"
 
   Step "MVP demo complete"
   Write-Host "Allowed output: $(Join-Path $Exported "reports\summary.txt")"

services/qcap-registry/README.md

@@ -1,6 +1,6 @@
 # Q-Cap Registry (MVP)
 
-A minimal registry that stores `.qcap` artifacts on disk, persists an `index.json`, and can require bearer-token auth for publishing.
+A minimal registry that stores `.qcap` artifacts on disk, persists an `index.json`, serves signed issuer revocation lists, and can require bearer-token auth for publishing.
 
 ## Endpoints
 
@@ -9,6 +9,8 @@ A minimal registry that stores `.qcap` artifacts on disk, persists an `index.jso
 - `GET /index` - HTML index listing
 - `POST /artifacts` - publish a `.qcap`
 - `GET /artifacts/<name>` - download a `.qcap`
+- `POST /revocations/<issuer>/revocations.json` - publish a signed revocation list
+- `GET /revocations/<issuer>/revocations.json` - download a signed revocation list
 
 ## Configuration
 
@@ -31,6 +33,14 @@ cargo run -p qcap-cli -- publish target/qcap-demo/demo.qcap \
   --registry http://127.0.0.1:8080 \
   --token demo-token
 
+# Publish and fetch issuer revocations
+cargo run -p qcap-cli -- publish-revocations target/qcap-demo/revocations.json \
+  --registry http://127.0.0.1:8080 \
+  --token demo-token
+cargo run -p qcap-cli -- fetch-revocations <issuer-public-key> \
+  --out target/qcap-demo/fetched-revocations.json \
+  --registry http://127.0.0.1:8080
+
 # Smoke test endpoints
 scripts/smoke-registry.sh
 ```