20523ac045
fix(P07): remove all password/token paths (REQ-146, R-021, C-34) -- BREAKING
...
---ci---
project: orca
phase: 7
milestone: v0.12
status: execute
---/ci---
R-021 invariant: no passwords, no Orca-issued tokens, no CA-key
passphrases anywhere in the system.
Removed:
- proxmox/bootstrap.go: ssh.Password auth -> ssh.PublicKeys (key-based).
--password/ removed from node join; replaced
with --ssh-key (default: orca SSH key). Pre-staged key required.
- stepca/stepca.go: --password-file /dev/stdin removed from Init and
issueCert. Provisioner changed to 'orca-oidc' (OIDC provisioner).
- identity/spiffe.go: --password-file removed from MintSVID. Provisioner
changed to 'orca-oidc'.
Tests: all proxmox, stepca, identity, cli tests updated + pass. 3 new
password-rejection regression tests. Fake SSH server gains
PublicKeyCallback. go vet clean. Full build green.
2026-08-07 11:12:18 +00:00
437aab39b4
feat(P0a1): multi-namespace path resolver + config demotion + known_hosts flock + CA migration spec (v0.9 P0a1)
...
P0a1 — Re-architecture Foundation (path resolver + config demotion).
Path resolver (REQ-070, R-002):
- internal/paths/paths.go: 23 functions for the multi-namespace layout
(Root/ClusterDir/NamespaceDir/NS*/DefaultNamespace/CA/MasterKey/CacheDB/
Txn/Peers/KnownHosts/SSH/Server/Config). Honors $ORCA_HOME. 100% coverage.
- internal/certpaths/certpaths.go: refactored as thin shim delegating to
paths, preserving the v0.8 flat-layout API for backward compat during
the dual-write window (REQ-090). Package doc explains the v0.10-P14
migration plan. certpaths deleted after v0.10-P14. 100% coverage.
Config demotion (REQ-069, R-014):
- internal/config/markdown.go: minimal hand-rolled YAML frontmatter parser
(no new dep — yaml.v3 not in go.mod). Returns same *Config struct as HCL.
- internal/config/config.go: renamed Load body to LoadHCL (// Deprecated
per R-013), added dispatcher Load() routing on extension (.hcl->HCL,
.md->Markdown, .yaml->Markdown). Signature preserved so root.go unchanged.
- dispatch_test.go + markdown_test.go: 89.8% coverage on config package.
Known_hosts flock (REQ-063, deferred P1 from REVIEW_v0.8 A2):
- internal/security/flock.go: stdlib syscall.Flock advisory lock helper.
- internal/proxmox/bootstrap.go: TOFUHostKeyCallback capture + ResetHostKey
both acquire the flock before read-modify-write on known_hosts. Prevents
concurrent writers under v0.9 parallel SSH fan-out. 3 flock tests.
CA migration spec (grill C-07):
- .ciagent/CA_MIGRATION_SPEC_v0.9.md: Option A (preserve trust root,
RECOMMENDED) vs Option B (forced re-bootstrap). Pre-flight checks,
migration steps, rollback, post-migration invariants, spike plan.
Verification: build pass, 17/17 Go packages pass, 20/20 bats pass, gofmt
clean, go vet clean, verify-reqs 90 consistent. Coverage: paths 100%,
certpaths 100%, config 89.8%, emit covered.
---ci---
project: orca
phase: P0a1
milestone: v0.9
status: execute
---/ci---
2026-08-05 16:38:26 +00:00
d66b3b9a0a
test(proxmox,cli): end-to-end trust-surface integration tests (T02.10, REQ-058, REQ-059)
...
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
2026-08-04 12:04:24 +00:00
2dcb14377a
fix(doctor): TOFU capture-fix parity with bootstrap — v0.6 ship-defect (T02.9)
...
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
2026-08-04 11:56:45 +00:00
13e6762f0f
feat(cli): orca node key-reset <node> — local known_hosts reset (T02.8, REQ-059)
...
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
2026-08-04 11:51:47 +00:00
325a5662f4
feat(proxmox): populate Result.HostKeyFingerprint (T02.7, REQ-058)
...
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
2026-08-04 11:48:00 +00:00
8b0cbe10ae
fix(proxmox): TOFU capture bug — v0.6 ship-defect first-connect join always failed (T02.6)
...
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
2026-08-04 11:46:38 +00:00
bd17e6e114
feat(proxmox): pinnedHostKeyCallback for --host-key-fingerprint (T02.5, REQ-058)
...
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
2026-08-04 11:45:53 +00:00
7cb12c52ce
feat(proxmox): HostKeyFingerprint field on Options (T02.4, REQ-058)
...
---ci---
project: orca
phase: 2
milestone: v0.8
status: execute
---/ci---
2026-08-04 11:38:39 +00:00
7a834357ec
test(proxmox): coverage uplift to ≥70% (T01.5, REQ-057)
...
Extend bootstrap_test.go with FullFlow_IdempotentReRun (two
sequential bootstraps on the same fake SSH server — verifies the
idempotent no-op path end-to-end), FullFlow_NoPasswordInLogs
(asserts the SSH password never appears in slog output, D-031),
FullFlow_ValidateSudoersFails (forceSudoersInvalid flag →
wrapped 'validate sudoers' error), FullFlow_CreateLinuxUserFails
(ProxmoxUser=root exercises the /root home branch in deployPubKey),
DefaultSSHDialer_DialContext_ConnectionRefused (covers the real
defaultSSHDialer.DialContext concrete path), and
SSHSessionRunner_CombinedOutput_NewSessionError (closed-client →
'new session' error branch). Add forceSudoersInvalid knob +
funcDialer helper to ssh_session_test.go.
Coverage: 83.2% → 87.1%. go test -race PASS. No production code
changed (T01.1 sessionRunner seam already in place).
---ci---
project: orca
phase: 1
milestone: v0.8
status: execute
---/ci---
2026-08-04 01:05:12 +00:00
2786de166d
refactor(proxmox): extract sessionRunner seam for testability (T01.1, REQ-057)
...
---ci---
project: orca
phase: 1
milestone: v0.8
status: execute
---/ci---
2026-08-04 00:51:15 +00:00
d9d0beda3b
test(P03): coverage uplift — engine/transport/proxmox/audit ≥50% + dispatch.go EOF fix (REQ-055)
...
94 new tests across 4 packages. Coverage: engine 8.3%→65.1%, transport
26.3%→84.6%, proxmox 5.1%→82.7%, audit 0%→100%. Bug fix: dispatch.go
bytesReadCloser.Read returned fmt.Errorf("EOF") instead of io.EOF —
broke HTTP request body transmission (latent since v0.2 P02).
---ci---
project: orca
phase: 3
milestone: v0.7
status: verify
requirements:
covered: [REQ-055]
partial: []
---/ci---
2026-08-04 00:18:58 +00:00
797bc2f412
feat(P02): Proxmox SSH join + OrcaOperator role + sudoers
...
orca node join --type proxmox bootstraps a remote Proxmox VE 8/9 host
via SSH (REQ-050, REQ-051). The password is used only for initial auth;
subsequent access uses the deployed orca SSH key (D-031).
Changes:
- go.mod: add golang.org/x/crypto v0.54.0 (ssh + ssh/knownhosts + ed25519)
bump x/sys to v0.47.0, add x/term (indirect)
- internal/certpaths: SSHKeyPath, SSHPubPath, KnownHostsPath (D-037)
- internal/security/sshkey.go: GenerateOrLoadSSHKey (Ed25519, PKCS8 PEM,
0600/0644 modes, idempotent load per D-036)
- internal/proxmox/bootstrap.go: BootstrapProxmox SSH dance:
1. Generate/load SSH key
2. SSH dial (password + knownhosts.New TOFU per D-035)
3. Deploy pubkey to ~orca/.ssh/authorized_keys (idempotent)
4. useradd -m orca (idempotent)
5. pveum role add OrcaOperator --privs 'VM.Audit Datastore.AllocateSpace SDN.Use'
6. pveum user add orca@pam (AD-019: PAM realm, not @pve)
7. pveum acl modify / -user orca@pam -role OrcaOperator
8. Write /etc/sudoers.d/orca (AD-020: NOEXEC on pct/qm, no NOEXEC on
apt-get/dpkg, pvesh EXCLUDED — API execute bypasses NOEXEC)
9. visudo -cf validation (abort on failure)
All steps idempotent; audit-logged.
- internal/cli/node.go: --type/--host/--ssh-user/--password/--ssh-port/
--proxmox-user/--proxmox-role flags; joinProxmox() wires to
proxmox.BootstrapProxmox + registers node with kind=proxmox, os=pve.
Password zeroed after use (D-031).
- tests: sshkey generate/load round-trip, idempotency, file modes;
proxmox sudoers content (NOEXEC/NOPASSWD/pvesh-excluded),
privilege set, validation; node join flag wiring
---ci---
project: orca
phase: 2
milestone: v0.6
status: execute
---/ci---
2026-08-03 19:55:14 +00:00
Jon Chery