Jon Chery
fc94326b0e
P00 — Re-architecture Foundation (deprecation/migration/test-infra/persona/docs). Deprecation sweep (REQ-068, REQ-072, REQ-089): - Add // Deprecated: doc comments to internal/daemon (R-001), internal/transport (REQ-073), internal/security/ca.go+csr.go (D-101/REQ-076), internal/engine/ dispatcher.go+peer.go (CLI-side scheduler), internal/cli/daemon.go. - orca daemon emits slog.Warn deprecation banner on every run (ungated); fires R-001 + v0.10-P05 drain-and-stop + v0.10-P14 deletion. - orca cert and orca node join (mTLS path) emit deprecation warnings; proxmox SSH path (the v0.9 replacement) does not warn. - Add --no-deprecation-warnings global flag on root command (PersistentPreRunE) for orca upgrade migrations. - 12 new daemon/cert/node deprecation tests in internal/cli/daemon_test.go (cli coverage 81.9%, warnDeprecated 100%). - Add DEPRECATED banners to v0.8 sections of ARCHITECTURE.md (verified the v0.9 supersession section + Supersession Table from prior turn are present). Bash tooling gate (grill C-06, C-15, C-16, C-17, C-18): - scripts/tests/test_helper.bash + example_test.bash — bats framework + helpers. - scripts/lib/orca-log.sh — slog-compatible JSON logging to syslog (C-17). - scripts/orca-verify-render.sh — render-contract validator skeleton (C-16). - scripts/tests/orca-log_test.bash + orca-verify-render_test.bash — 20 bats tests total (happy + failure paths per C-15). - .shellcheckrc — project shellcheck config. - Makefile: test-bash + lint-bash targets (graceful skip if tools missing); wired into test + lint targets. - internal/emit/contract.go + contract_test.go — versioned JSON render contract (orca.emit/v1) between Go emitters and bash appliers (C-16). - .ciagent/BASH_CAPABILITY_MAP_v0.9.md — maps shipped internal/transport capabilities to bash-side equivalents or accepted drops (C-18). - D-186 recorded in PROJECT.md: bash exempt from Go coverage gate; compensating control is bats + shellcheck + shfmt (C-06). verify-reqs: 90 requirements consistent. Build/test/lint/fmt all green. 20 bats tests pass. Go tests pass. No v0.8 code deleted — only marked deprecated (deletion deferred to v0.10-P14 per REQ-090 dual-write window). ---ci--- project: orca phase: P00 milestone: v0.9 status: execute ---/ci---
81 lines
2.7 KiB
Go
81 lines
2.7 KiB
Go
package security
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"crypto/rsa"
|
|
"crypto/x509"
|
|
"crypto/x509/pkix"
|
|
"encoding/pem"
|
|
"errors"
|
|
"fmt"
|
|
"net"
|
|
)
|
|
|
|
// GenerateCSR mints a new RSA private key, builds a CSR with the given
|
|
// commonName and SANs (DNS or IP entries), and returns the key + CSR in
|
|
// PEM form. The private key is RSA 3072 (matches CAKeySize).
|
|
//
|
|
// REQ-036: server certs MUST have at least one DNS or IP SAN. This function
|
|
// enforces that constraint — calling with empty sans returns an error.
|
|
//
|
|
// Validation: dns entries must be syntactically valid hostnames; ip entries
|
|
// must be parseable by net.ParseIP. Bad inputs are rejected up-front so
|
|
// the operator gets a clear error before signing.
|
|
//
|
|
// Deprecated: v0.9 re-architecture replaces the internal CA with step-ca
|
|
// (D-101/REQ-076). GenerateCSR is retained for the dual-write window and
|
|
// scheduled for deletion in v0.10-P14. See .ciagent/PRD_v0.9.md.
|
|
func GenerateCSR(commonName string, sans []string) (keyPEM, csrPEM []byte, err error) {
|
|
if commonName == "" {
|
|
return nil, nil, errors.New("GenerateCSR: commonName is required")
|
|
}
|
|
if len(sans) == 0 {
|
|
return nil, nil, errors.New("GenerateCSR: at least one DNS or IP SAN is required (REQ-036)")
|
|
}
|
|
|
|
dnsNames := make([]string, 0, len(sans))
|
|
ipAddrs := make([]net.IP, 0, len(sans))
|
|
for _, s := range sans {
|
|
if s == "" {
|
|
return nil, nil, errors.New("GenerateCSR: empty SAN entry")
|
|
}
|
|
if ip := net.ParseIP(s); ip != nil {
|
|
ipAddrs = append(ipAddrs, ip)
|
|
continue
|
|
}
|
|
// Treat as a DNS name. Validate it parses and is not a host:port form.
|
|
if _, _, err := net.SplitHostPort(s); err == nil {
|
|
return nil, nil, fmt.Errorf("GenerateCSR: SAN %q looks like host:port; use a bare hostname or IP", s)
|
|
}
|
|
dnsNames = append(dnsNames, s)
|
|
}
|
|
if len(dnsNames) == 0 && len(ipAddrs) == 0 {
|
|
return nil, nil, errors.New("GenerateCSR: at least one valid DNS or IP SAN is required (REQ-036)")
|
|
}
|
|
|
|
key, err := rsa.GenerateKey(rand.Reader, CAKeySize)
|
|
if err != nil {
|
|
return nil, nil, fmt.Errorf("GenerateCSR: generate key: %w", err)
|
|
}
|
|
csr := &x509.CertificateRequest{
|
|
Subject: pkix.Name{
|
|
CommonName: commonName,
|
|
Organization: []string{"orca"},
|
|
},
|
|
DNSNames: dnsNames,
|
|
IPAddresses: ipAddrs,
|
|
}
|
|
csrDER, err := x509.CreateCertificateRequest(rand.Reader, csr, key)
|
|
if err != nil {
|
|
return nil, nil, fmt.Errorf("GenerateCSR: create CSR: %w", err)
|
|
}
|
|
|
|
keyDER, err := x509.MarshalPKCS8PrivateKey(key)
|
|
if err != nil {
|
|
return nil, nil, fmt.Errorf("GenerateCSR: marshal key: %w", err)
|
|
}
|
|
keyPEM = pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: keyDER})
|
|
csrPEM = pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE REQUEST", Bytes: csrDER})
|
|
return keyPEM, csrPEM, nil
|
|
}
|