Jon Chery
9e832387c6
New CLI commands: - orca cluster seal: OIDC/CA-derived seal + Shamir 3-of-5 shards - orca cluster unseal: OIDC/CA unseal + --recovery Shamir path - orca doctor audit: VerifyChain + chain head report - orca doctor modes: EnforceFileModes across ORCA_HOME Fixes: - audit hash-chain race: Append uses BEGIN IMMEDIATE transaction (concurrent appends no longer corrupt tamper-evidence) - secrets rotate-master: re-seals to OIDC on sealed clusters (was writing raw key, docstring claimed re-seal) - key zeroing: ZeroKey helper + defer after master/namespace key use (defense-in-depth against pprof heap extraction) - store.Open: busy_timeout(5000) pragma (concurrent writers wait) Tests: 18 new test functions (seal round-trip, Shamir recovery, doctor audit tamper detection, doctor modes 0644 rejection, concurrent append chain integrity, rotate-master re-seal, key zeroing). ---ci--- project: orca phase: 5 milestone: v0.13 status: complete requirements: covered: [154] ---/ci---
41 lines
1.0 KiB
Go
41 lines
1.0 KiB
Go
package secrets
|
|
|
|
import (
|
|
"bytes"
|
|
"testing"
|
|
)
|
|
|
|
// TestZeroKey verifies that ZeroKey overwrites every byte of the slice
|
|
// with zeros (P05 T6, REQ-147).
|
|
func TestZeroKey(t *testing.T) {
|
|
key := []byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16,
|
|
17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32}
|
|
ZeroKey(key)
|
|
want := make([]byte, 32)
|
|
if !bytes.Equal(key, want) {
|
|
t.Errorf("ZeroKey did not zero the slice: got %v, want %v", key, want)
|
|
}
|
|
}
|
|
|
|
// TestZeroKey_NilAndEmpty verifies ZeroKey is safe on nil/empty slices.
|
|
func TestZeroKey_NilAndEmpty(t *testing.T) {
|
|
ZeroKey(nil) // must not panic
|
|
ZeroKey([]byte{}) // must not panic
|
|
ZeroKey([]byte{}) // must not panic
|
|
}
|
|
|
|
// TestZeroKey_PartialFill verifies zeroing works on a slice with a
|
|
// specific non-zero pattern across all bytes.
|
|
func TestZeroKey_PartialFill(t *testing.T) {
|
|
key := make([]byte, 64)
|
|
for i := range key {
|
|
key[i] = 0xFF
|
|
}
|
|
ZeroKey(key)
|
|
for i, b := range key {
|
|
if b != 0 {
|
|
t.Errorf("byte %d = 0x%02x, want 0x00", i, b)
|
|
}
|
|
}
|
|
}
|