 Jon Chery
|
5232fcb808
|
fix(P04): wire ACL enforcement + WebAuthn reg auth + audit actor (REQ-153)
R-023: Zero-trust enforcement operationally wired.
ACL enforcement (C-45 staged rollout):
- acl.Check wired into all 5 daemon handlers (dispatch/jobs/nodes/tasks)
- health endpoints exempt (liveness probes not gated)
- ACL log-only mode default (config acl.enforce=false); enforce after
bootstrap ACL verified
- sshpush auth: ORCA_OIDC_TOKEN validated against JWKS before apply
- txn apply: Authorize hook validates OIDC token before running pull
- acl.json mode 0600 (was 0644)
- flock on acl.json for concurrent grant/revoke
- bootstrap ACL: init grants cluster-admin to orca-admins group + SVID
Audit actor identity:
- currentActor reads OIDC sub from credentials.json (was hardcoded "cli")
- threaded through all audit.Record calls via context
WebAuthn registration auth:
- BeginRegistration/FinishRegistration require authenticated session
- fail-closed 401 when no authFunc configured
New files: internal/daemon/acl.go, internal/cli/authactor.go,
internal/engine/actor.go, internal/identity/authtoken.go,
internal/sshpush/auth.go, internal/txn/auth_test.go
---ci---
project: orca
phase: 4
milestone: v0.13
status: complete
requirements:
covered: [153]
---/ci---
|
2026-08-07 20:33:39 +00:00 |
|
|
Jon Chery
|
b0158c96e9
|
fix(P01): bump go toolchain to 1.25.12 + fix pre-existing test bugs (REQ-149)
Toolchain:
- go.mod: go 1.25.0 -> 1.25.12 (closes 24 stdlib vulns: archive/tar,
crypto/tls, crypto/x509, net/http, net/url, encoding/pem, os)
- go mod tidy clean; make build + test + lint pass
Pre-existing test bugs fixed (surfaced by toolchain bump):
- acl_test.go: KindToken always denies (R-021); tests updated to KindOidc
- acl.go: parseIdentity defaults to KindOidc (was KindToken, making
acl grant/check CLI path non-functional for non-spiffe identities)
- init_test.go: migration version updated to 0008 (was 0007, stale since v0.12)
- doctor.go: CertCA now checks CA cert exists (was only checking file modes,
passing when no CA present)
- scenarios_test.go: ACL integration test uses KindOidc + acl.json 0600
---ci---
project: orca
phase: 1
milestone: v0.13
status: complete
requirements:
covered: [149]
---/ci---
|
2026-08-07 19:07:17 +00:00 |
|
|
Jon Chery
|
5a43cb8538
|
test(P26): security integration test suite (REQ-141, C-33)
---ci---
project: orca
phase: 26
milestone: v0.12
status: execute
---/ci---
tests/security_integration_test.go: umbrella test documenting the
security invariant coverage across packages (R-021, F1-F25). The
individual invariants are tested in their respective packages:
injection (runtime), traversal (ns/cli), symlink (backup),
tamper-evidence (store), ACL deny (acl), SVID chain (identity),
master key seal (seal), drift auth (drift), password rejection (cli).
This gate ensures the suite is wired (C-33). Build + test green.
|
2026-08-07 11:33:39 +00:00 |
|
|
Jon Chery
|
5f92196625
|
test(P08): integration test harness + drift-detection stubs (REQ-087)
tests/integration/harness.go: temp ORCA_HOME + mock peers + helpers.
tests/integration/scenarios_test.go: ns-create/job-submit/drain/backup/
secrets/acl/metrics scenarios. drift_scenarios_test.go: 4 stubs (auto-
remediation, NFS, cooldown, secret exclusion) skip until P10b.
scripts/tests/orca-commands_test.bash: bats for new CLI commands.
---ci---
project: orca
phase: 08
milestone: v0.11
status: execute
---/ci---
|
2026-08-07 06:04:06 +00:00 |
|