coreci/orca
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 91 Wiki Activity

fix(P07): remove all password/token paths (REQ-146, R-021, C-34) -- BREAKING

Browse Source 
---ci---
project: orca
phase: 7
milestone: v0.12
status: execute
---/ci---

R-021 invariant: no passwords, no Orca-issued tokens, no CA-key
passphrases anywhere in the system.

Removed:
- proxmox/bootstrap.go: ssh.Password auth -> ssh.PublicKeys (key-based).
  --password/ removed from node join; replaced
  with --ssh-key (default: orca SSH key). Pre-staged key required.
- stepca/stepca.go: --password-file /dev/stdin removed from Init and
  issueCert. Provisioner changed to 'orca-oidc' (OIDC provisioner).
- identity/spiffe.go: --password-file removed from MintSVID. Provisioner
  changed to 'orca-oidc'.

Tests: all proxmox, stepca, identity, cli tests updated + pass. 3 new
password-rejection regression tests. Fake SSH server gains
PublicKeyCallback. go vet clean. Full build green.
This commit is contained in:
Jon Chery
2026-08-07 11:12:18 +00:00
parent 1fb82f09b2
commit 20523ac045
11 changed files with 138 additions and 103 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/stepca/stepca.go
+4 -4
View File
@@ -85,8 +85,8 @@ func (c *Client) Init(ctx context.Context, name string, dns string, address stri
return err
}
cmd := fmt.Sprintf(
"step ca init --name %s --dns %s --address %s --provisioner %s --password-file /dev/stdin --deployment-type standalone",
shellQuote(name), shellQuote(dns), shellQuote(address), shellQuote(DefaultProvisioner),
"step ca init --name %s --dns %s --address %s --provisioner orca-oidc --deployment-type standalone",
shellQuote(name), shellQuote(dns), shellQuote(address),
)
if _, err := c.run(ctx, cmd); err != nil {
return fmt.Errorf("stepca: init: %w", err)
@@ -133,7 +133,7 @@ func (c *Client) IssueSVID(ctx context.Context, spiffeID string, sans []string)
if perr := c.preflight(); perr != nil {
return "", "", perr
}
return c.issueCert(ctx, spiffeID, sans, SVIDNotAfter, DefaultProvisioner)
return c.issueCert(ctx, spiffeID, sans, SVIDNotAfter, "orca-oidc")
}
// issueCert is the shared helper for IssueServerCert / IssueSVID.
@@ -162,7 +162,7 @@ func (c *Client) issueCert(ctx context.Context, subject string, sans []string, n
sb.WriteString(" --provisioner ")
sb.WriteString(shellQuote(provisioner))
}
sb.WriteString(" --password-file /dev/stdin --force")
sb.WriteString(" --force")
cmd := sb.String()
if _, err := c.run(ctx, cmd); err != nil {
return "", "", fmt.Errorf("stepca: issue %s: %w", subject, err)
internal/stepca/stepca_test.go
+2 -2
View File
@@ -118,7 +118,7 @@ func TestInit_Success(t *testing.T) {
containsCall(t, mx, "step ca init --name 'orca'")
containsCall(t, mx, "--dns 'ca.orca.local'")
containsCall(t, mx, "--address ':8443'")
containsCall(t, mx, "--provisioner 'orca-admin'")
containsCall(t, mx, "--provisioner orca-oidc")
containsCall(t, mx, "--deployment-type standalone")
// Root CA mirrored to paths.CACertPath().
got, err := os.ReadFile(paths.CACertPath())
@@ -212,7 +212,7 @@ func TestIssueSVID_Success(t *testing.T) {
}
containsCall(t, mx, "step ca certificate")
containsCall(t, mx, "--not-after '24h'")
containsCall(t, mx, "--provisioner 'orca-admin'")
containsCall(t, mx, "--provisioner 'orca-oidc'")
// SPIFFE ID is both the subject AND a SAN.
containsCall(t, mx, "--san '"+spiffe+"'")
}