feat: plan 16 P1 complete (SEC-07 approval + SEC-10 agent identity)
- SEC-07 (M-08): real approval verification via approval-verify.sh in enforced mode (CASAN_PROFILE=prod / CASAN_APPROVAL_STRICT=1) for control-plane `set` (sensitive keys), kill-switch `clear`, and self-improve (inherits control-plane). A bare or forged approval string is now denied; dev mode stays backward-compatible. - SEC-10 (M-05): non-spoofable agent identity. tool-registry-gate least-privilege no longer trusts CASAN_AGENT env in enforced mode (CASAN_IDENTITY_STRICT=1) — the caller must present a signed token (agent-identity-sign.sh) bound to agent id + run id, verified against agent-identities.registry. Blocks env spoofing + replay. Verify: SEC+integrity gate 18/0, run-casan4 0-FAIL, adversarial 44/44 (H2 intact), control-plane 9/0, h5-approval 12/0, c7-incident 15/0, self-improve 7/0, track-c 29/0. Plan-16 P0 + P1 now complete; remaining: P2 (SEC-12/13/14/15/22..30). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
thanhnv
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
e70f0815ab
commit
3432ae59e1
@@ -0,0 +1,83 @@
|
||||
#!/usr/bin/env bash
|
||||
set -uo pipefail
|
||||
|
||||
# CASAN Plan-16 SEC-07 (M-08) — real approval on the remaining approval sites.
|
||||
#
|
||||
# control-plane `set` (sensitive), self-improve `apply`, and kill-switch `clear`
|
||||
# used to accept ANY non-empty approval string. In enforced mode they now require a
|
||||
# REGISTERED reviewer to cryptographically sign the request (verified by
|
||||
# approval-verify.sh) — a bare/forged string is denied. Dev mode stays unchanged.
|
||||
#
|
||||
# Self-contained: ephemeral reviewer keypair into a temp reviewers dir, using the
|
||||
# committed reviewers.registry (security-lead → security role; policy_change needs
|
||||
# security; kill_switch falls back to the default roles).
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
|
||||
S="$PROJECT_ROOT/.specify/scripts/bash"
|
||||
REG="$PROJECT_ROOT/.specify/level5/central-governance/reviewers.registry"
|
||||
WORK="$(mktemp -d)"; RV="$WORK/reviewers"; mkdir -p "$RV"
|
||||
trap 'rm -rf "$WORK"' EXIT
|
||||
|
||||
# Ephemeral keys: a registered reviewer (security-lead) and an unregistered attacker.
|
||||
openssl genrsa -out "$WORK/sl.priv" 2048 2>/dev/null
|
||||
openssl rsa -in "$WORK/sl.priv" -pubout -out "$RV/security-lead.pub.pem" 2>/dev/null
|
||||
openssl genrsa -out "$WORK/atk.priv" 2048 2>/dev/null
|
||||
|
||||
export CASAN_REVIEWERS_FILE="$REG" CASAN_REVIEWERS_DIR="$RV"
|
||||
export CASAN_CP_STORE_FILE="$WORK/store.json" CASAN_CP_KEY_DIR="$WORK/cpk" CASAN_CP_PUB="$WORK/cp.pub"
|
||||
|
||||
PASS=0; FAIL=0
|
||||
pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
|
||||
fail() { echo "FAIL: $1"; FAIL=$((FAIL + 1)); }
|
||||
rc_of() { set +e; "$@" >/dev/null 2>&1; echo $?; set -e 2>/dev/null || true; }
|
||||
|
||||
echo "===== Plan-16 SEC-07: real approval verification ====="
|
||||
|
||||
# ---- control-plane set (security-sensitive) ----
|
||||
CP="$S/control-plane-settings.py"
|
||||
|
||||
# Backward compat: dev (non-strict) accepts a plain --approval string.
|
||||
[[ "$(rc_of python3 "$CP" set security.strict true --actor alice --reason r --approval tok)" -eq 0 ]] \
|
||||
&& pass "dev mode: plain --approval string still works (backward compatible)" \
|
||||
|| fail "dev-mode approval broke"
|
||||
|
||||
# Enforced: bare string is NOT enough.
|
||||
[[ "$(rc_of env CASAN_APPROVAL_STRICT=1 python3 "$CP" set security.strict true --actor alice --reason r --approval bogus)" -eq 3 ]] \
|
||||
&& pass "enforced: bare approval string is DENIED" \
|
||||
|| fail "enforced mode accepted a bare approval string"
|
||||
|
||||
# Enforced: a valid signed approval by the registered reviewer is accepted.
|
||||
printf 'security.strict' > "$WORK/keyin"
|
||||
bash "$S/approval-sign.sh" policy_change alice "$WORK/keyin" security-lead "$WORK/sl.priv" "$WORK/ok.sig" >/dev/null 2>&1
|
||||
[[ "$(rc_of env CASAN_APPROVAL_STRICT=1 CASAN_ACTOR=alice CASAN_APPROVER=security-lead CASAN_APPROVAL_SIG="$WORK/ok.sig" \
|
||||
python3 "$CP" set security.strict true --actor alice --reason r --approval x)" -eq 0 ]] \
|
||||
&& pass "enforced: valid reviewer signature is ACCEPTED" \
|
||||
|| fail "enforced mode rejected a valid signed approval"
|
||||
|
||||
# Enforced: a forged signature (attacker key claiming to be the reviewer) is denied.
|
||||
bash "$S/approval-sign.sh" policy_change alice "$WORK/keyin" security-lead "$WORK/atk.priv" "$WORK/forged.sig" >/dev/null 2>&1
|
||||
[[ "$(rc_of env CASAN_APPROVAL_STRICT=1 CASAN_ACTOR=alice CASAN_APPROVER=security-lead CASAN_APPROVAL_SIG="$WORK/forged.sig" \
|
||||
python3 "$CP" set security.strict true --actor alice --reason r --approval x)" -eq 3 ]] \
|
||||
&& pass "enforced: forged signature is DENIED" \
|
||||
|| fail "enforced mode accepted a forged signature"
|
||||
|
||||
# ---- kill-switch clear ----
|
||||
export CASAN_KILLSWITCH_DIR="$WORK/ks"
|
||||
bash "$S/kill-switch.sh" engage project ks7 "t" >/dev/null 2>&1
|
||||
[[ "$(rc_of env CASAN_APPROVAL_STRICT=1 bash "$S/kill-switch.sh" clear project ks7 r)" -eq 3 ]] \
|
||||
&& pass "enforced: kill-switch clear without approval is DENIED" \
|
||||
|| fail "enforced kill-switch clear allowed without approval"
|
||||
[[ "$(rc_of bash "$S/kill-switch.sh" check project ks7)" -eq 2 ]] \
|
||||
&& pass "kill-switch remained engaged after denied clear" || fail "switch cleared despite denial"
|
||||
|
||||
printf 'project/ks7' > "$WORK/ksin"
|
||||
bash "$S/approval-sign.sh" kill_switch admin "$WORK/ksin" security-lead "$WORK/sl.priv" "$WORK/ks.sig" >/dev/null 2>&1
|
||||
[[ "$(rc_of env CASAN_APPROVAL_STRICT=1 CASAN_ACTOR=admin CASAN_APPROVER=security-lead CASAN_APPROVAL_SIG="$WORK/ks.sig" \
|
||||
bash "$S/kill-switch.sh" clear project ks7 r)" -eq 0 ]] \
|
||||
&& pass "enforced: kill-switch clear WITH valid approval succeeds" \
|
||||
|| fail "enforced kill-switch clear rejected a valid approval"
|
||||
|
||||
echo ""
|
||||
echo "===== SEC-07 SUMMARY: PASS=$PASS FAIL=$FAIL ====="
|
||||
[[ "$FAIL" -eq 0 ]] || exit 1
|
||||
@@ -0,0 +1,70 @@
|
||||
#!/usr/bin/env bash
|
||||
set -uo pipefail
|
||||
|
||||
# CASAN Plan-16 SEC-10 (M-05) — non-spoofable agent identity.
|
||||
#
|
||||
# tool-registry-gate least-privilege trusted CASAN_AGENT (a plain env var anyone can
|
||||
# set → privilege spoofing). In enforced mode the caller must present a signed token
|
||||
# proving it is that agent (bound to agent id + run id). Proves:
|
||||
# * dev mode still trusts CASAN_AGENT (backward compatible),
|
||||
# * enforced mode denies an env-only claim (no token),
|
||||
# * a valid token is accepted,
|
||||
# * a forged token (unregistered key) is denied,
|
||||
# * a token minted for a different run is denied (no replay).
|
||||
#
|
||||
# Self-contained: ephemeral agent keypair + temp registry.
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
|
||||
S="$PROJECT_ROOT/.specify/scripts/bash"
|
||||
GATE="$S/tool-registry-gate.sh"
|
||||
WORK="$(mktemp -d)"
|
||||
trap 'git -C "$PROJECT_ROOT" checkout -- .specify/logs/ 2>/dev/null; rm -rf "$WORK"' EXIT
|
||||
|
||||
AK="$WORK/agents"; mkdir -p "$AK"
|
||||
openssl genrsa -out "$WORK/rm.priv" 2048 2>/dev/null
|
||||
openssl rsa -in "$WORK/rm.priv" -pubout -out "$AK/release-manager.pub.pem" 2>/dev/null
|
||||
openssl genrsa -out "$WORK/atk.priv" 2048 2>/dev/null
|
||||
printf 'agent release-manager release-manager.pub.pem\n' > "$WORK/reg"
|
||||
|
||||
export CASAN_AGENT_REGISTRY="$WORK/reg" CASAN_AGENT_KEYS_DIR="$AK" CASAN_RUN_ID=run-sec10
|
||||
export CASAN_IDEMPOTENCY_KEY=k # deploy is side-effecting + idempotency-required
|
||||
|
||||
PASS=0; FAIL=0
|
||||
pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
|
||||
fail() { echo "FAIL: $1"; FAIL=$((FAIL + 1)); }
|
||||
rc_of() { set +e; "$@" >/dev/null 2>&1; echo $?; set -e 2>/dev/null || true; }
|
||||
|
||||
echo "===== Plan-16 SEC-10: non-spoofable agent identity ====="
|
||||
|
||||
# Dev (default): CASAN_AGENT is trusted (backward compatible).
|
||||
[[ "$(rc_of env CASAN_AGENT=release-manager bash "$GATE" deploy)" -eq 0 ]] \
|
||||
&& pass "dev mode: authorized CASAN_AGENT approved (backward compatible)" \
|
||||
|| fail "dev-mode agent authz broke"
|
||||
|
||||
# Enforced: env-only claim (no token) is denied.
|
||||
[[ "$(rc_of env CASAN_IDENTITY_STRICT=1 CASAN_AGENT=release-manager bash "$GATE" deploy)" -ne 0 ]] \
|
||||
&& pass "enforced: env-only agent claim DENIED (spoof blocked)" \
|
||||
|| fail "enforced mode trusted a bare CASAN_AGENT env"
|
||||
|
||||
# Enforced: a valid signed token is accepted.
|
||||
bash "$S/agent-identity-sign.sh" release-manager run-sec10 "$WORK/rm.priv" "$WORK/rm.sig" >/dev/null 2>&1
|
||||
[[ "$(rc_of env CASAN_IDENTITY_STRICT=1 CASAN_AGENT=release-manager CASAN_AGENT_SIG="$WORK/rm.sig" bash "$GATE" deploy)" -eq 0 ]] \
|
||||
&& pass "enforced: valid signed agent token ACCEPTED" \
|
||||
|| fail "enforced mode rejected a valid agent token"
|
||||
|
||||
# Enforced: a forged token (attacker key claiming to be release-manager) is denied.
|
||||
bash "$S/agent-identity-sign.sh" release-manager run-sec10 "$WORK/atk.priv" "$WORK/forged.sig" >/dev/null 2>&1
|
||||
[[ "$(rc_of env CASAN_IDENTITY_STRICT=1 CASAN_AGENT=release-manager CASAN_AGENT_SIG="$WORK/forged.sig" bash "$GATE" deploy)" -ne 0 ]] \
|
||||
&& pass "enforced: forged agent token DENIED" \
|
||||
|| fail "enforced mode accepted a forged agent token"
|
||||
|
||||
# Enforced: a token minted for a DIFFERENT run cannot be replayed.
|
||||
bash "$S/agent-identity-sign.sh" release-manager other-run "$WORK/rm.priv" "$WORK/replay.sig" >/dev/null 2>&1
|
||||
[[ "$(rc_of env CASAN_IDENTITY_STRICT=1 CASAN_AGENT=release-manager CASAN_AGENT_SIG="$WORK/replay.sig" bash "$GATE" deploy)" -ne 0 ]] \
|
||||
&& pass "enforced: token bound to another run DENIED (no replay)" \
|
||||
|| fail "enforced mode allowed a cross-run token replay"
|
||||
|
||||
echo ""
|
||||
echo "===== SEC-10 SUMMARY: PASS=$PASS FAIL=$FAIL ====="
|
||||
[[ "$FAIL" -eq 0 ]] || exit 1
|
||||
@@ -80,6 +80,10 @@
|
||||
"sha256": "71e04cba738f501e79dd6b2c02aa86c7434c5ce541af5c7e512a2c94219f1c33",
|
||||
"checks": 5
|
||||
},
|
||||
"phase-sec07-tests.sh": {
|
||||
"sha256": "9d8857bbfb374eb4db130344fb00da1c13801d90b092253725d7f63f45edea81",
|
||||
"checks": 7
|
||||
},
|
||||
"phase-sec08-tests.sh": {
|
||||
"sha256": "ae4df77eed43cf235198c2489cc89a9fa083a66133137b3eb61b42fd021fd3c3",
|
||||
"checks": 4
|
||||
@@ -88,6 +92,10 @@
|
||||
"sha256": "7d98d0a5a646d1500e4701710ceb4009eea22deb266c3b27b5f7b2850efc2f4a",
|
||||
"checks": 7
|
||||
},
|
||||
"phase-sec10-tests.sh": {
|
||||
"sha256": "099c81a0a37b51137dbf328dbe2ef778226d0716b97660d083c1fcc6a4aecd19",
|
||||
"checks": 5
|
||||
},
|
||||
"phase-sec16-tests.sh": {
|
||||
"sha256": "3d826ca4f5c8f98837cc70846b8e2f2f83d5a598c2a5907795e8b9cc9db448c2",
|
||||
"checks": 6
|
||||
@@ -153,6 +161,6 @@
|
||||
"checks": 10
|
||||
}
|
||||
},
|
||||
"total_checks": 331,
|
||||
"suite_count": 38
|
||||
"total_checks": 343,
|
||||
"suite_count": 40
|
||||
}
|
||||
|
||||
@@ -1 +1 @@
|
||||
30124645ed601ca08017707be27592b23c98c35dff08cb419362d585cffa0daf
|
||||
5a25c53485019236dc7383f714812f2ed455c09dde2316e7ce6a9f4a4c58a852
|
||||
@@ -1,3 +1 @@
|
||||
Èâ 4ª,’FN»>¦2Û<eºO\¡é¼¤âu¤gB%}ºIB˜€uâ�Û1îÛü°Än[·cÙ7€†·‰ô ×|q¿h¹bÔÆl3 “¾ ¿ÔÃÇn9xZ=ª…¦¹±² !%W±ÀµbÎ3|±UÔLu}š…Üœþè™;P(Üø�±ŸúÀ»Y‰*¼±æmüÇÀÒ¤ö�ÀÌ�ðÀŠE›uNŸ"rT[e"¢^”àŒÞyáû0dÌ-¥
|
||||
:z2™JœÂT"-çϱ;´{E…õóªåÕÌwØQ:q¬ž[ÁÎù]#QÀ·`ñ5N–Qx�
|
||||
ý sÑyŸ¢ð ÜÊ’*3Ýb
|
||||
�Bָ��ק³מ�‘wvם»ָ«4״ה4"ק.=nN;␍ֹ'�b™A(װBֺdiS�Rq±�ס3¥\V×ַָp²כֽw¬'שwצ-¦ב�kֵ�¯Xoֿ€×Ru™�n~רמ� |�C -O°}´�lםS% z��j�תG�Tז`�e] V־™␍�¯שיה ¯f₪³_}ףקכױK¼t!<קB ␍q hה1ך₪Eהל`z“iס´whיס�?ְִֵ¿~ִmCַ/…׃cֲבQ ׂ¨�‘]¹¶s �yb„�„¥'�ֹ2ץו4עZx?»^קמ_×הֳWײO
|
||||
Reference in New Issue
Block a user