3a3ea74d76
fix(P08): transport + SSH safety — typed errors, IPv6, timeouts, signal (REQ-157)
...
- transport.IsTransient: typed sentinels (ErrTransient/ErrPermanent) +
standard net.Error/io errors.Is; substring matching removed
- sshpush.isTransient: same typed-error classification
- rotateSSHKeys: 2-phase atomic swap (stage peers -> swap local ->
verify -> cleanup old); no more partial-result window
- known_hosts: dial() reads stored field (was reading v0.8 path directly)
- IPv6: net.JoinHostPort in proxmox SSH dial + drain splitHostPort
- SSH timeouts: context.WithTimeout on peer-setup, drift, txn rollback,
job restart (default 2m)
- verifyCutover: orca CA pool TLS config (was default http.Client)
- OIDC callback: ReadHeaderTimeout 5s (slowloris defense)
- root Execute: signal.NotifyContext for SIGINT/SIGTERM (clean exit
for non-watch commands)
Tests: typed-error classification table, IPv6 JoinHostPort, signal
handler context cancellation.
---ci---
project: orca
phase: 8
milestone: v0.13
status: complete
requirements:
covered: [157]
---/ci---
2026-08-10 13:11:07 +00:00
0358efe95b
fix(P07): concurrency safety — SQLite, flock, cache, atomic writes (REQ-156)
...
- SQLite busy_timeout(5000) + SetMaxOpenConns(1) on all 4 DSNs
- secrets file flock (concurrent set on same ns no longer loses data)
- upgrade lock file (refuse concurrent orca upgrade)
- backup lock file (refuse concurrent backup)
- cache invalidation by writes (read-after-write consistency)
- Executor.Run mutex scope fix (hold only for DB inserts)
- ns create/inherit/set-constraint atomic writeNSMdAtomic
- writeCurrentLead + rotateSSHKeys atomic
- consolidate 3 writeAtomic impls onto security.WriteAtomic
- WebAuthn session stores guarded with sync.Mutex
Tests: concurrent secrets set, upgrade lock rejection, cache
read-after-write, WebAuthn session thread-safety (pass under -race).
---ci---
project: orca
phase: 7
milestone: v0.13
status: complete
requirements:
covered: [156]
---/ci---
2026-08-10 12:27:05 +00:00
5232fcb808
fix(P04): wire ACL enforcement + WebAuthn reg auth + audit actor (REQ-153)
...
R-023: Zero-trust enforcement operationally wired.
ACL enforcement (C-45 staged rollout):
- acl.Check wired into all 5 daemon handlers (dispatch/jobs/nodes/tasks)
- health endpoints exempt (liveness probes not gated)
- ACL log-only mode default (config acl.enforce=false); enforce after
bootstrap ACL verified
- sshpush auth: ORCA_OIDC_TOKEN validated against JWKS before apply
- txn apply: Authorize hook validates OIDC token before running pull
- acl.json mode 0600 (was 0644)
- flock on acl.json for concurrent grant/revoke
- bootstrap ACL: init grants cluster-admin to orca-admins group + SVID
Audit actor identity:
- currentActor reads OIDC sub from credentials.json (was hardcoded "cli")
- threaded through all audit.Record calls via context
WebAuthn registration auth:
- BeginRegistration/FinishRegistration require authenticated session
- fail-closed 401 when no authFunc configured
New files: internal/daemon/acl.go, internal/cli/authactor.go,
internal/engine/actor.go, internal/identity/authtoken.go,
internal/sshpush/auth.go, internal/txn/auth_test.go
---ci---
project: orca
phase: 4
milestone: v0.13
status: complete
requirements:
covered: [153]
---/ci---
2026-08-07 20:33:39 +00:00
0d5ff663b4
fix(P13): step-ca /tmp hardening (REQ-128, F10)
...
---ci---
project: orca
phase: 13
milestone: v0.12
status: execute
---/ci---
step-ca cert/key temp files moved from world-readable /tmp/orca-* to
/etc/orca/step-tmp/orca-* (0700). mkdir + chmod 700 before writing.
Fixes both stepca.go and spiffe.go. All tests updated + pass.
2026-08-07 11:22:07 +00:00
d7dc2d2aad
fix(P11): SVID chain validation (REQ-126, F9)
...
---ci---
project: orca
phase: 11
milestone: v0.12
status: execute
---/ci---
VerifySVIDWithChain: validates the full cert chain against the CA pool
+ checks the SPIFFE URI SAN. Rejects certs from unknown CAs even with
correct URI (F9). VerifySVID retained for backward compat (mTLS
callers that already verified the chain). 2 new tests. Build + vet green.
2026-08-07 11:20:10 +00:00
20523ac045
fix(P07): remove all password/token paths (REQ-146, R-021, C-34) -- BREAKING
...
---ci---
project: orca
phase: 7
milestone: v0.12
status: execute
---/ci---
R-021 invariant: no passwords, no Orca-issued tokens, no CA-key
passphrases anywhere in the system.
Removed:
- proxmox/bootstrap.go: ssh.Password auth -> ssh.PublicKeys (key-based).
--password/ removed from node join; replaced
with --ssh-key (default: orca SSH key). Pre-staged key required.
- stepca/stepca.go: --password-file /dev/stdin removed from Init and
issueCert. Provisioner changed to 'orca-oidc' (OIDC provisioner).
- identity/spiffe.go: --password-file removed from MintSVID. Provisioner
changed to 'orca-oidc'.
Tests: all proxmox, stepca, identity, cli tests updated + pass. 3 new
password-rejection regression tests. Fake SSH server gains
PublicKeyCallback. go vet clean. Full build green.
2026-08-07 11:12:18 +00:00
5429da1f87
feat(P04): OIDC client + auth CLI (REQ-144, D-239, D-242, D-246)
...
---ci---
project: orca
phase: 4
milestone: v0.12
status: execute
---/ci---
internal/identity/oidc.go: OIDC client (provider discovery, JWKS,
auth-code+PKCE+local-loopback redirect flow, device-code headless
fallback, token verification, credentials store at ~/.orca/credentials.json
0600, refresh). VerifyIDTokenStatic for SSH-push applier.
internal/cli/auth.go: orca auth login/logout/status/init-idp commands.
Dependencies: github.com/coreos/go-oidc/v3, github.com/go-webauthn/webauthn
(pre-added for P05).
Bundled Dex deploy (init-idp) stubs to P05 (WebAuthn connector ships
the full systemd unit + Traefik route).
9 tests pass (5 identity + 4 CLI). go vet clean. Full build green.
2026-08-07 10:59:55 +00:00
734c9fa0fa
feat(P01.5): SPIFFE SVID minting spike (REQ-076, gate C-08) — PASSES
...
internal/identity/spiffe.go: SpiffeURI format + MintSVID via step CLI;
internal/identity/spiffe_test.go: mock-transport tests with self-signed
SPIFFE URI SAN cert. Spike passes: step CLI supports --san with URI SANs.
Fallback to mTLS identity NOT needed.
---ci---
project: orca
phase: 01.5
milestone: v0.11
status: execute
---/ci---
2026-08-07 04:30:43 +00:00
Jon Chery