Jon Chery
9e832387c6
New CLI commands: - orca cluster seal: OIDC/CA-derived seal + Shamir 3-of-5 shards - orca cluster unseal: OIDC/CA unseal + --recovery Shamir path - orca doctor audit: VerifyChain + chain head report - orca doctor modes: EnforceFileModes across ORCA_HOME Fixes: - audit hash-chain race: Append uses BEGIN IMMEDIATE transaction (concurrent appends no longer corrupt tamper-evidence) - secrets rotate-master: re-seals to OIDC on sealed clusters (was writing raw key, docstring claimed re-seal) - key zeroing: ZeroKey helper + defer after master/namespace key use (defense-in-depth against pprof heap extraction) - store.Open: busy_timeout(5000) pragma (concurrent writers wait) Tests: 18 new test functions (seal round-trip, Shamir recovery, doctor audit tamper detection, doctor modes 0644 rejection, concurrent append chain integrity, rotate-master re-seal, key zeroing). ---ci--- project: orca phase: 5 milestone: v0.13 status: complete requirements: covered: [154] ---/ci---
44 lines
1.2 KiB
Go
44 lines
1.2 KiB
Go
package store
|
|
|
|
import (
|
|
"database/sql"
|
|
"fmt"
|
|
"os"
|
|
"path/filepath"
|
|
|
|
_ "modernc.org/sqlite"
|
|
|
|
"git.cloudinit.dev/coreci/orca/internal/certpaths"
|
|
)
|
|
|
|
func Open(path string) (*sql.DB, error) {
|
|
if path == "" {
|
|
path = certpaths.DBPath()
|
|
}
|
|
if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
|
|
return nil, fmt.Errorf("create db dir: %w", err)
|
|
}
|
|
db, err := sql.Open("sqlite", path+"?_pragma=journal_mode(WAL)&_pragma=foreign_keys(ON)&_pragma=busy_timeout(5000)")
|
|
if err != nil {
|
|
return nil, fmt.Errorf("open sqlite: %w", err)
|
|
}
|
|
if err := db.Ping(); err != nil {
|
|
_ = db.Close()
|
|
return nil, fmt.Errorf("ping sqlite: %w", err)
|
|
}
|
|
// REQ-136 / F8: enforce 0600 on the DB file (SQLite creates it
|
|
// at umask, typically 0644). We chmod after open+ping (the file
|
|
// exists at this point). Non-fatal if chmod fails (e.g. the DB
|
|
// is at a path we don't own); the caller is warned via vet.
|
|
if err := os.Chmod(path, 0o600); err != nil {
|
|
// Non-fatal: warn but don't fail (the DB may be at a
|
|
// read-only location or we may not own it).
|
|
_ = err
|
|
}
|
|
if err := migrate(db); err != nil {
|
|
_ = db.Close()
|
|
return nil, fmt.Errorf("migrate: %w", err)
|
|
}
|
|
return db, nil
|
|
}
|