feat(plan-01): Phase 1 — relocate harness code to packages/casan-harness (symlink facade)
Physically move the pure-code subtrees out of .specify into the package, leaving compat symlinks at the old .specify/<dir> paths so every existing reference (internal CASAN_HARNESS_ROOT + external CI/docker/mjs) keeps resolving. Runtime state stays put. Moved (git mv): scripts/ tests/ security/ templates/ config/ governance/ memory/ .specify/<dir> -> packages/casan-harness/<dir> (+ .specify/<dir> symlink) Stays in .specify (state/governance/domain, handled later): logs/ agentops/ level5/ init-options.json traceability-map.json Python `.resolve()` self-location followed the compat symlink into packages and lost the app root; generate-casan-demo-context.py, generate-agentops-dashboard.py and dashboard-server.py now walk UP for the `.specify` state marker instead of a fixed parent depth (fixes "missing trace files" in run-casan4). Full gate: PASS=64 FAIL=0 SKIP=3 (CASAN_CI_STEP_TIMEOUT_SEC=1200 — track-a ~450s runs close to the 600s default and can tip over under load; this is timing variance, not a regression — it passed cleanly with headroom). Runtime log/audit artifacts kept unstaged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
thanhnv
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
2c765c9a45
commit
664bd1f00c
@@ -0,0 +1,207 @@
|
||||
#!/usr/bin/env bash
|
||||
# CASAN H5 — HashiCorp Vault KMS helper
|
||||
#
|
||||
# Provides Vault-backed signing operations as a drop-in replacement for
|
||||
# direct openssl key-file usage. Scripts detect KMS availability via:
|
||||
# [[ -n "${VAULT_ADDR:-}" && -n "${VAULT_TOKEN:-}" ]]
|
||||
#
|
||||
# Usage (direct):
|
||||
# vault-kms.sh sign <file> <output.sig> [key_name]
|
||||
# vault-kms.sh verify <file> <sig_file> [key_name]
|
||||
# vault-kms.sh pubkey <output.pem> [key_name]
|
||||
# vault-kms.sh status
|
||||
#
|
||||
# Usage (sourced):
|
||||
# source vault-kms.sh
|
||||
# vault_kms_sign <file> <output.sig> [key_name]
|
||||
# vault_kms_pubkey <output.pem> [key_name]
|
||||
# vault_kms_status
|
||||
#
|
||||
# Environment:
|
||||
# VAULT_ADDR — e.g. http://vault:8200 or http://161.33.139.73:8200
|
||||
# VAULT_TOKEN — root token or policy token with transit/sign/* capability
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
: "${VAULT_ADDR:?VAULT_ADDR must be set}"
|
||||
: "${VAULT_TOKEN:?VAULT_TOKEN must be set}"
|
||||
|
||||
_VAULT_DEFAULT_KEY="casan-policy-key"
|
||||
_VAULT_AUDIT_KEY="casan-audit-key"
|
||||
|
||||
# ── Ensure required tools ──────────────────────────────────────────────────
|
||||
_check_deps() {
|
||||
for cmd in curl python3; do
|
||||
command -v "$cmd" >/dev/null 2>&1 || { echo "vault-kms: required: $cmd" >&2; exit 1; }
|
||||
done
|
||||
}
|
||||
|
||||
# ── Transit: ensure key exists ────────────────────────────────────────────
|
||||
vault_kms_ensure_key() {
|
||||
local key="${1:-$_VAULT_DEFAULT_KEY}"
|
||||
local status
|
||||
status=$(curl -sf \
|
||||
-H "X-Vault-Token: $VAULT_TOKEN" \
|
||||
"$VAULT_ADDR/v1/transit/keys/$key" 2>/dev/null | \
|
||||
python3 -c "import sys,json; d=json.load(sys.stdin); print('ok' if 'data' in d else 'missing')" 2>/dev/null || echo "missing")
|
||||
|
||||
if [[ "$status" != "ok" ]]; then
|
||||
curl -sf -X POST \
|
||||
-H "X-Vault-Token: $VAULT_TOKEN" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"type":"rsa-2048","exportable":false,"allow_plaintext_backup":false}' \
|
||||
"$VAULT_ADDR/v1/transit/keys/$key" >/dev/null
|
||||
echo "vault-kms: created transit key: $key" >&2
|
||||
fi
|
||||
}
|
||||
|
||||
# ── Sign a file ───────────────────────────────────────────────────────────
|
||||
# Produces a DER binary signature compatible with:
|
||||
# openssl dgst -sha256 -verify pub.pem -signature <output.sig> <file>
|
||||
vault_kms_sign() {
|
||||
local file="$1" output="$2" key="${3:-$_VAULT_DEFAULT_KEY}"
|
||||
_check_deps
|
||||
vault_kms_ensure_key "$key"
|
||||
|
||||
# Base64-encode the file content for the Vault API payload
|
||||
local input_b64
|
||||
input_b64=$(base64 -w0 < "$file" 2>/dev/null || base64 < "$file")
|
||||
|
||||
# Call Vault Transit sign — PKCS#1 v1.5 + SHA-256 (compatible with openssl verify)
|
||||
local response
|
||||
response=$(curl -sf -X POST \
|
||||
-H "X-Vault-Token: $VAULT_TOKEN" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "{\"input\":\"$input_b64\",\"hash_algorithm\":\"sha2-256\",\"signature_algorithm\":\"pkcs1v15\",\"prehashed\":false}" \
|
||||
"$VAULT_ADDR/v1/transit/sign/$key") || {
|
||||
echo "vault-kms: sign request failed (key=$key)" >&2; exit 1
|
||||
}
|
||||
|
||||
# Extract signature and strip the "vault:v1:" prefix → raw base64 DER bytes
|
||||
local sig_b64
|
||||
sig_b64=$(printf '%s' "$response" | python3 -c "
|
||||
import sys, json
|
||||
d = json.load(sys.stdin)
|
||||
sig = d['data']['signature']
|
||||
# vault:v1:<base64> → keep only base64 part
|
||||
print(sig.split(':')[-1])
|
||||
")
|
||||
|
||||
# Decode base64 → binary DER file (identical format to openssl -sign output)
|
||||
printf '%s' "$sig_b64" | base64 -d > "$output"
|
||||
echo "vault-kms: signed $file → $output (key=$key anchor=vault-kms)" >&2
|
||||
}
|
||||
|
||||
# ── Export public key ─────────────────────────────────────────────────────
|
||||
# Writes the RSA public key as PEM so openssl dgst -verify still works.
|
||||
vault_kms_pubkey() {
|
||||
local output="$1" key="${2:-$_VAULT_DEFAULT_KEY}"
|
||||
_check_deps
|
||||
vault_kms_ensure_key "$key"
|
||||
|
||||
local response
|
||||
response=$(curl -sf \
|
||||
-H "X-Vault-Token: $VAULT_TOKEN" \
|
||||
"$VAULT_ADDR/v1/transit/keys/$key") || {
|
||||
echo "vault-kms: pubkey fetch failed (key=$key)" >&2; exit 1
|
||||
}
|
||||
|
||||
local tmp_resp
|
||||
tmp_resp=$(mktemp)
|
||||
printf '%s' "$response" > "$tmp_resp"
|
||||
python3 - "$output" "$tmp_resp" <<'PY'
|
||||
import sys, json
|
||||
output = sys.argv[1]
|
||||
with open(sys.argv[2]) as f:
|
||||
d = json.loads(f.read())
|
||||
keys = d["data"]["keys"]
|
||||
# keys is a dict; pick the latest version
|
||||
latest = max(keys.keys(), key=lambda k: int(k))
|
||||
pub = keys[latest]["public_key"]
|
||||
with open(output, "w") as f:
|
||||
f.write(pub if pub.endswith("\n") else pub + "\n")
|
||||
print(f"vault-kms: public key written to {output}", file=sys.stderr)
|
||||
PY
|
||||
rm -f "$tmp_resp"
|
||||
}
|
||||
|
||||
# ── Verify a signature ────────────────────────────────────────────────────
|
||||
# Uses openssl with the public key exported from Vault.
|
||||
vault_kms_verify() {
|
||||
local file="$1" sig_file="$2" key="${3:-$_VAULT_DEFAULT_KEY}"
|
||||
local tmp_pub
|
||||
tmp_pub=$(mktemp /tmp/vault-pub-XXXXX.pem)
|
||||
trap 'rm -f "$tmp_pub"' RETURN
|
||||
vault_kms_pubkey "$tmp_pub" "$key"
|
||||
openssl dgst -sha256 -verify "$tmp_pub" -signature "$sig_file" "$file" >/dev/null
|
||||
}
|
||||
|
||||
# ── Connectivity check ────────────────────────────────────────────────────
|
||||
vault_kms_status() {
|
||||
if curl -sf "$VAULT_ADDR/v1/sys/health" >/dev/null 2>&1; then
|
||||
echo "VAULT_KMS_AVAILABLE addr=$VAULT_ADDR"
|
||||
return 0
|
||||
else
|
||||
echo "VAULT_KMS_UNAVAILABLE addr=${VAULT_ADDR:-unset}"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# ── Enable transit engine (idempotent) ────────────────────────────────────
|
||||
vault_kms_enable_transit() {
|
||||
curl -sf -X POST \
|
||||
-H "X-Vault-Token: $VAULT_TOKEN" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"type":"transit"}' \
|
||||
"$VAULT_ADDR/v1/sys/mounts/transit" >/dev/null 2>&1 || true
|
||||
}
|
||||
|
||||
# ── Rotate a transit key (new version; old versions retained) ──────────────
|
||||
# Key rotation is a core KMS/HSM property: sign future heads with a fresh key
|
||||
# version without exporting or exposing any private material.
|
||||
vault_kms_rotate() {
|
||||
local key="${1:-$_VAULT_AUDIT_KEY}"
|
||||
_check_deps
|
||||
vault_kms_ensure_key "$key"
|
||||
curl -sf -X POST \
|
||||
-H "X-Vault-Token: $VAULT_TOKEN" \
|
||||
"$VAULT_ADDR/v1/transit/keys/$key/rotate" >/dev/null 2>&1 || {
|
||||
echo "vault-kms: rotate failed (key=$key)" >&2; return 1; }
|
||||
local ver
|
||||
ver=$(curl -sf -H "X-Vault-Token: $VAULT_TOKEN" "$VAULT_ADDR/v1/transit/keys/$key" \
|
||||
| python3 -c "import sys,json; print(json.load(sys.stdin)['data'].get('latest_version','?'))" 2>/dev/null || echo "?")
|
||||
echo "VAULT_KMS_ROTATED key=$key latest_version=$ver"
|
||||
}
|
||||
|
||||
# ── Prove non-exportability: an export attempt MUST fail for a KMS key ──────
|
||||
# Returns 0 if the key is NON-exportable (export denied) — the desired state.
|
||||
vault_kms_assert_nonexportable() {
|
||||
local key="${1:-$_VAULT_AUDIT_KEY}"
|
||||
if curl -sf -H "X-Vault-Token: $VAULT_TOKEN" \
|
||||
"$VAULT_ADDR/v1/transit/export/signing-key/$key" >/dev/null 2>&1; then
|
||||
echo "VAULT_KMS_KEY_EXPORTABLE key=$key (INSECURE — key material can leave KMS)" >&2
|
||||
return 1
|
||||
fi
|
||||
echo "VAULT_KMS_KEY_NONEXPORTABLE key=$key (private material never leaves KMS)"
|
||||
return 0
|
||||
}
|
||||
|
||||
# ── CLI entrypoint ────────────────────────────────────────────────────────
|
||||
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
|
||||
CMD="${1:-status}"
|
||||
shift || true
|
||||
case "$CMD" in
|
||||
sign) vault_kms_sign "$@" ;;
|
||||
pubkey) vault_kms_pubkey "$@" ;;
|
||||
verify) vault_kms_verify "$@" ;;
|
||||
status) vault_kms_status ;;
|
||||
enable-transit) vault_kms_enable_transit ;;
|
||||
ensure-key) vault_kms_ensure_key "${1:-}" ;;
|
||||
rotate) vault_kms_rotate "${1:-}" ;;
|
||||
assert-nonexportable) vault_kms_assert_nonexportable "${1:-}" ;;
|
||||
*)
|
||||
echo "Usage: vault-kms.sh {sign|pubkey|verify|status|enable-transit|ensure-key|rotate|assert-nonexportable}" >&2
|
||||
exit 64
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
Reference in New Issue
Block a user