coreci/orca
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 91 Wiki Activity
27 Commits 3 Branches 148 Tags
a7bb00d935bd51b79f54ba06f7f4f786370d8afe
Commit Graph

3 Commits

Author SHA1 Message Date
ciagent a7bb00d935 feat(P10): security-scan shape tests + G101 fixture 
Wave B of P03. Adds Go-level tests that verify the security
configuration files have the expected shape. We don't run
gosec/govulncheck/gitleaks here (they're external binaries
installed by .coreci.yml ); instead, the tests
catch configuration drift by asserting the right tokens
are present in the config files.

- internal/security/security_scan_test.go — covers the
  shape of .gitleaks.toml (cert PEM allowlist present),
  .gitleaks-baseline.json (valid JSON, skip entries with
  Commit/File), .golangci.yml (gosec/govet/ineffassign/
  misspell enabled), scripts/security_scan.sh
  (executable, references all three tools + GOFLAGS), and
  .coreci.yml (gosec/govulncheck/gitleaks stages present,
  GOFLAGS env, go test -race wired).
- internal/security/security_gosec_g101_test.go — meta-
  tests: the .coreci.yml  pipeline installs
  gosec and runs it; GOFLAGS=-mod=mod is set for offline
  mode (REQ-027). The fixture file in testdata/ carries
  a literal G101 pattern that any future CI run will flag
  if the allowlist is misconfigured.
- internal/security/testdata/hardcoded_creds.go — the
  G101 fixture. The value is intentionally a sentinel
  prefix (GOSEC_G101_FIXTURE_VALUE_*) that does not match
  real-secret patterns; gitleaks allowlist for the path
  keeps it from being a false positive on the secret
  scanner while still triggering gosec's G101 rule.

All builds clean; tests pass with -race; gofmt -l . clean.

---ci---
project: orca
phase: 10
milestone: v0.2
status: execute
---/ci---
 2026-06-04 01:11:23 +00:00
ciagent 31ccb52114 feat(P08): mTLS daemon + transport + cert CLI + doctor 
Wave B/C/D of P01 mTLS implementation.

- internal/audit/audit.go — thin wrapper around engine.Audit for
  cert/handshake events (Action* and Result* constants; REQ-038).
- internal/certpaths/ — extracted path constants out of cli to break
  the cli<->doctor import cycle; cli re-exports the helpers for
  backward compat.
- internal/security/ca.go — public WriteCert/WriteKey helpers (0600
  for keys, 0644 for certs; REQ-033); used by the cert CLI and
  integration test.
- internal/daemon/tls.go — mTLS server with GetCertificate hot-swap
  callback. Plaintext HTTP remains the default for v0.1 compat;
  StartMTLS() flips the server into mTLS mode.
- internal/daemon/server.go — adds mtls *MTLSState field; MTLSActive()
  getter for health endpoints.
- internal/transport/mtls.go — mTLS client with VerifyPeerCertificate
  for pinned peer identity; DialContext for raw TLS.
- internal/transport/handshake_log.go — structured slog helpers for
  handshake ok/fail (REQ-038 fields: event, result, peer, cert_fp).
- internal/cli/cert.go — orca cert {ca-init,gen,show,renew,fingerprint}
  subcommands; file mode enforcement at every entry; redacted cert
  show (REQ-035).
- internal/cli/doctor.go — orca doctor {cert,network,db} subcommands
  (REQ-032); --json output supported.
- internal/cli/node.go — adds --ca-fingerprint to orca node join
  (REQ-026); fails fast on mismatch.
- internal/doctor/doctor.go — 6 checks: cert.ca, cert.server,
  cert.expiry, cert.fingerprint, network stub, db stub.
- internal/doctor/doctor_test.go — happy + sad path coverage.
- internal/security/integration_test.go — end-to-end: CA-init, CSR
  generation, mTLS handshake, mismatch failure, rotation alarm,
  redaction, file mode enforcement.

All tests pass with -race; gofmt -l . clean; go vet ./... clean.

---ci---
project: orca
phase: 8
milestone: v0.2
status: execute
---/ci---
 2026-06-03 21:33:41 +00:00
Jon Chery 181cc769e6 feat(P08): CA, CSR, fingerprint, rotation, redact, TLS config + cert repo 
Internal CA with CSR join, mTLS 1.3 config builders, rotation alarm,
PEM redaction, and cert inventory schema (REQ-033/034/035/036).

- internal/security/ca.go: CAInit/LoadCA/SignCSR, file mode enforcement
  (ca.crt 0644, ca.key 0600) per REQ-033
- internal/security/csr.go: GenerateCSR with DNS + IP SANs (REQ-036)
- internal/security/fingerprint.go: SHA-256 hex of cert DER
- internal/security/rotation.go: 30d pre-expiry alarm, history pruning
- internal/security/redact.go: PEM private key block stripping (REQ-035)
- internal/security/tls_config.go: TLS 1.3 with AEAD allowlist
- internal/security/certgen_test.go: round-trip + mode + rotation + redact
- internal/store/migrations/0004_certs.sql: cert inventory table
- internal/store/cert_repo.go: CRUD + PruneOlderThan (REQ-025)

---ci---
project: orca
phase: 8
milestone: v0.2
status: execute
---/ci---
 2026-06-03 21:18:50 +00:00