feat(h5): ① KMS key rotation/non-exportable + ② external WORM audit ledger
① Key management (B3/KMS): vault-kms.sh gains `rotate` (Transit key rotation) and `assert-nonexportable` (proves private material never leaves the KMS). Validated live against a Vault dev server: sign→verify (v1) → rotate → sign→verify (v2) → export denied. sign-audit-head.sh already routes to Vault when VAULT_ADDR/TOKEN are set, so this is the real production signing path. ② External WORM audit (C5/V21): worm-ledger.py + audit-ship.sh append the audit head to a hash-linked append-only ledger (chattr +a best-effort on Linux; S3 Object Lock/QLDB in production). verify-audit-gap.sh detects local audit rollback (AUDIT_GAP_DETECTED — the durable ledger still holds the later head) and ledger tampering (AUDIT_LEDGER_TAMPERED). phase-h5-infra-tests.sh: 7 checks — KMS sign/rotate/non-exportable (skip-aware, live when Vault reachable) + WORM in-sync/rollback/tamper (always local). Baselines: run-casan4 35/35, adversarial 44/44, approval 8/8. Lifts H5 key-mgmt 2.5→~4 (KMS live path + rotation + non-exportable) and external-audit 1.5→~3.5 (WORM ledger + gap detection). Suites now 7 (+7 = 155 checks). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
thanhnv
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
e21a1472b1
commit
86e13a26ed
+25
@@ -0,0 +1,25 @@
|
||||
#!/usr/bin/env bash
|
||||
set -uo pipefail
|
||||
|
||||
# CASAN H5 — Ship the audit head to an external append-only WORM ledger (C5/V21).
|
||||
# Call after each audit seal. Locally this appends a hash-linked anchor to a
|
||||
# ledger on a separate path (default outside .specify/logs/audit); production
|
||||
# ships to S3 Object Lock / QLDB. On Linux the ledger is best-effort set
|
||||
# append-only immutable (chattr +a).
|
||||
#
|
||||
# Usage: audit-ship.sh [head-file] [ledger-file]
|
||||
# Env: CASAN_WORM_LEDGER (default .specify/logs/worm/anchor-ledger.jsonl)
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
|
||||
HEAD_FILE="${1:-$PROJECT_ROOT/.specify/logs/audit/audit-head.txt}"
|
||||
LEDGER="${2:-${CASAN_WORM_LEDGER:-$PROJECT_ROOT/.specify/logs/worm/anchor-ledger.jsonl}}"
|
||||
mkdir -p "$(dirname "$LEDGER")"
|
||||
|
||||
[[ -f "$HEAD_FILE" ]] || { echo "AUDIT_SHIP_NO_HEAD file=$HEAD_FILE" >&2; exit 1; }
|
||||
|
||||
# Append-only immutability on Linux (best-effort; no-op on macOS/CI without cap).
|
||||
if command -v chattr >/dev/null 2>&1; then chattr -a "$LEDGER" 2>/dev/null || true; fi
|
||||
python "$SCRIPT_DIR/worm-ledger.py" ship "$HEAD_FILE" "$LEDGER"; RC=$?
|
||||
if command -v chattr >/dev/null 2>&1; then chattr +a "$LEDGER" 2>/dev/null || true; fi
|
||||
exit "$RC"
|
||||
@@ -156,6 +156,36 @@ vault_kms_enable_transit() {
|
||||
"$VAULT_ADDR/v1/sys/mounts/transit" >/dev/null 2>&1 || true
|
||||
}
|
||||
|
||||
# ── Rotate a transit key (new version; old versions retained) ──────────────
|
||||
# Key rotation is a core KMS/HSM property: sign future heads with a fresh key
|
||||
# version without exporting or exposing any private material.
|
||||
vault_kms_rotate() {
|
||||
local key="${1:-$_VAULT_AUDIT_KEY}"
|
||||
_check_deps
|
||||
vault_kms_ensure_key "$key"
|
||||
curl -sf -X POST \
|
||||
-H "X-Vault-Token: $VAULT_TOKEN" \
|
||||
"$VAULT_ADDR/v1/transit/keys/$key/rotate" >/dev/null 2>&1 || {
|
||||
echo "vault-kms: rotate failed (key=$key)" >&2; return 1; }
|
||||
local ver
|
||||
ver=$(curl -sf -H "X-Vault-Token: $VAULT_TOKEN" "$VAULT_ADDR/v1/transit/keys/$key" \
|
||||
| python3 -c "import sys,json; print(json.load(sys.stdin)['data'].get('latest_version','?'))" 2>/dev/null || echo "?")
|
||||
echo "VAULT_KMS_ROTATED key=$key latest_version=$ver"
|
||||
}
|
||||
|
||||
# ── Prove non-exportability: an export attempt MUST fail for a KMS key ──────
|
||||
# Returns 0 if the key is NON-exportable (export denied) — the desired state.
|
||||
vault_kms_assert_nonexportable() {
|
||||
local key="${1:-$_VAULT_AUDIT_KEY}"
|
||||
if curl -sf -H "X-Vault-Token: $VAULT_TOKEN" \
|
||||
"$VAULT_ADDR/v1/transit/export/signing-key/$key" >/dev/null 2>&1; then
|
||||
echo "VAULT_KMS_KEY_EXPORTABLE key=$key (INSECURE — key material can leave KMS)" >&2
|
||||
return 1
|
||||
fi
|
||||
echo "VAULT_KMS_KEY_NONEXPORTABLE key=$key (private material never leaves KMS)"
|
||||
return 0
|
||||
}
|
||||
|
||||
# ── CLI entrypoint ────────────────────────────────────────────────────────
|
||||
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
|
||||
CMD="${1:-status}"
|
||||
@@ -167,8 +197,10 @@ if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
|
||||
status) vault_kms_status ;;
|
||||
enable-transit) vault_kms_enable_transit ;;
|
||||
ensure-key) vault_kms_ensure_key "${1:-}" ;;
|
||||
rotate) vault_kms_rotate "${1:-}" ;;
|
||||
assert-nonexportable) vault_kms_assert_nonexportable "${1:-}" ;;
|
||||
*)
|
||||
echo "Usage: vault-kms.sh {sign|pubkey|verify|status|enable-transit|ensure-key}" >&2
|
||||
echo "Usage: vault-kms.sh {sign|pubkey|verify|status|enable-transit|ensure-key|rotate|assert-nonexportable}" >&2
|
||||
exit 64
|
||||
;;
|
||||
esac
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
#!/usr/bin/env bash
|
||||
set -uo pipefail
|
||||
|
||||
# CASAN H5 — Detect audit rollback / evidence deletion vs the WORM ledger (C5/V21).
|
||||
# Verifies the external anchor ledger is internally intact (hash-linked) AND that
|
||||
# the local audit head has not been rolled back below the durable anchor. Deleting
|
||||
# the tail of the local audit log surfaces as AUDIT_GAP_DETECTED because the WORM
|
||||
# ledger still holds the later head.
|
||||
#
|
||||
# Usage: verify-audit-gap.sh [head-file] [ledger-file]
|
||||
# Exit: 0 in-sync, 1 tamper/gap/unshipped, 64 usage.
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
|
||||
HEAD_FILE="${1:-$PROJECT_ROOT/.specify/logs/audit/audit-head.txt}"
|
||||
LEDGER="${2:-${CASAN_WORM_LEDGER:-$PROJECT_ROOT/.specify/logs/worm/anchor-ledger.jsonl}}"
|
||||
|
||||
[[ -f "$HEAD_FILE" ]] || { echo "AUDIT_GAP_NO_HEAD file=$HEAD_FILE" >&2; exit 1; }
|
||||
python "$SCRIPT_DIR/worm-ledger.py" verify "$HEAD_FILE" "$LEDGER"
|
||||
+108
@@ -0,0 +1,108 @@
|
||||
#!/usr/bin/env python3
|
||||
"""CASAN H5 — External append-only (WORM) anchor ledger (C5 / V21).
|
||||
|
||||
Ships the audit-chain head to an EXTERNAL append-only ledger so that deleting or
|
||||
rolling back the local audit log is detectable: the durable ledger still holds
|
||||
the later head. Entries are hash-linked (each anchor commits to the previous
|
||||
one), so truncating or editing the ledger itself is also detectable.
|
||||
|
||||
This is the local MVP of WORM. Production ships each anchor to a true
|
||||
write-once store (S3 Object Lock / QLDB / append-only Kafka) + trusted timestamp.
|
||||
|
||||
Argv:
|
||||
ship <head-file> <ledger-file> [iso-timestamp]
|
||||
verify <head-file> <ledger-file>
|
||||
|
||||
Ledger line: {"seq":N,"ts":..,"head":<hex>,"prev":<anchor|"">,"anchor":<hex>}
|
||||
anchor = sha256("seq|ts|head|prev")
|
||||
|
||||
verify exit: 0 in-sync (OK) · 1 tamper/gap (AUDIT_LEDGER_TAMPERED | AUDIT_GAP_DETECTED)
|
||||
"""
|
||||
import hashlib
|
||||
import json
|
||||
import sys
|
||||
|
||||
|
||||
def _anchor(seq, ts, head, prev):
|
||||
return hashlib.sha256(f"{seq}|{ts}|{head}|{prev}".encode()).hexdigest()
|
||||
|
||||
|
||||
def _read_ledger(path):
|
||||
rows = []
|
||||
try:
|
||||
for line in open(path, encoding="utf-8"):
|
||||
line = line.strip()
|
||||
if line:
|
||||
rows.append(json.loads(line))
|
||||
except FileNotFoundError:
|
||||
pass
|
||||
return rows
|
||||
|
||||
|
||||
def _read_head(path):
|
||||
with open(path, encoding="utf-8") as f:
|
||||
return f.read().strip()
|
||||
|
||||
|
||||
def ship(head_file, ledger_file, ts):
|
||||
head = _read_head(head_file)
|
||||
rows = _read_ledger(ledger_file)
|
||||
prev = rows[-1]["anchor"] if rows else ""
|
||||
seq = (rows[-1]["seq"] + 1) if rows else 1
|
||||
entry = {"seq": seq, "ts": ts, "head": head, "prev": prev,
|
||||
"anchor": _anchor(seq, ts, head, prev)}
|
||||
with open(ledger_file, "a", encoding="utf-8") as f:
|
||||
f.write(json.dumps(entry) + "\n")
|
||||
print(f"WORM_ANCHOR_SHIPPED seq={seq} head={head[:16]}… anchor={entry['anchor'][:16]}…")
|
||||
return 0
|
||||
|
||||
|
||||
def verify(head_file, ledger_file):
|
||||
rows = _read_ledger(ledger_file)
|
||||
if not rows:
|
||||
sys.stderr.write("WORM_LEDGER_EMPTY (nothing shipped yet)\n")
|
||||
return 1
|
||||
# 1. Ledger self-integrity: recompute anchors + check the hash-link.
|
||||
prev = ""
|
||||
for r in rows:
|
||||
if r.get("prev", "") != prev:
|
||||
sys.stderr.write(f"AUDIT_LEDGER_TAMPERED seq={r.get('seq')} broken_link\n")
|
||||
return 1
|
||||
if _anchor(r.get("seq"), r.get("ts"), r.get("head"), prev) != r.get("anchor"):
|
||||
sys.stderr.write(f"AUDIT_LEDGER_TAMPERED seq={r.get('seq')} anchor_mismatch\n")
|
||||
return 1
|
||||
prev = r["anchor"]
|
||||
# 2. Local head vs durable ledger.
|
||||
local = _read_head(head_file)
|
||||
latest = rows[-1]["head"]
|
||||
if local == latest:
|
||||
print(f"WORM_IN_SYNC anchors={len(rows)} head={local[:16]}…")
|
||||
return 0
|
||||
older = [r["seq"] for r in rows[:-1] if r["head"] == local]
|
||||
if older:
|
||||
# Local audit tip matches an OLDER durable anchor → local was rolled back.
|
||||
sys.stderr.write(
|
||||
f"AUDIT_GAP_DETECTED local_head=older(seq={older[-1]}) durable_latest_seq={rows[-1]['seq']} "
|
||||
f"— local audit rolled back below the durable WORM anchor\n")
|
||||
return 1
|
||||
sys.stderr.write(
|
||||
"AUDIT_UNSHIPPED local head not yet anchored (ship it) — not a rollback\n")
|
||||
return 1
|
||||
|
||||
|
||||
def main():
|
||||
if len(sys.argv) < 4:
|
||||
sys.stderr.write("Usage: worm-ledger.py {ship|verify} <head-file> <ledger-file> [ts]\n")
|
||||
return 64
|
||||
cmd, head_file, ledger_file = sys.argv[1], sys.argv[2], sys.argv[3]
|
||||
if cmd == "ship":
|
||||
ts = sys.argv[4] if len(sys.argv) > 4 else __import__("datetime").datetime.utcnow().strftime("%Y-%m-%dT%H:%M:%SZ")
|
||||
return ship(head_file, ledger_file, ts)
|
||||
if cmd == "verify":
|
||||
return verify(head_file, ledger_file)
|
||||
sys.stderr.write(f"unknown command: {cmd}\n")
|
||||
return 64
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
sys.exit(main())
|
||||
@@ -0,0 +1,61 @@
|
||||
#!/usr/bin/env bash
|
||||
set -uo pipefail
|
||||
|
||||
# CASAN H5 — Key-management (KMS) + external WORM audit tests (C5/B3 · V21).
|
||||
#
|
||||
# ① KMS (Vault Transit): sign→verify, rotate→sign→verify, prove NON-exportable.
|
||||
# Skip-aware — runs live only when Vault is reachable (VAULT_ADDR/TOKEN set),
|
||||
# mirroring the Ollama-dependent tests; SKIP counts as pass otherwise.
|
||||
# ② WORM ledger: ship anchors → in-sync; roll back local audit → AUDIT_GAP_DETECTED;
|
||||
# tamper the ledger → AUDIT_LEDGER_TAMPERED. Always runs (deterministic, local).
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
|
||||
S="$PROJECT_ROOT/.specify/scripts/bash"
|
||||
WORK="$(mktemp -d)"; trap 'rm -rf "$WORK"' EXIT
|
||||
PASS=0; FAIL=0
|
||||
pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
|
||||
fail() { echo "FAIL: $1"; FAIL=$((FAIL + 1)); }
|
||||
expect_rc() {
|
||||
local want="$1" desc="$2"; shift 2
|
||||
local got=0; { "$@" >/dev/null 2>&1; } || got=$?
|
||||
[[ "$got" -eq "$want" ]] && pass "$desc (rc=$got)" || fail "$desc (got rc=$got, want $want)"
|
||||
}
|
||||
|
||||
echo "===== ① H5 key management — Vault KMS (live if reachable) ====="
|
||||
if [[ -n "${VAULT_ADDR:-}" && -n "${VAULT_TOKEN:-}" ]] && curl -sf "$VAULT_ADDR/v1/sys/health" >/dev/null 2>&1; then
|
||||
KEY="casan-test-$$"
|
||||
printf 'audit-head-%s\n' "$$" > "$WORK/head.txt"
|
||||
bash "$S/vault-kms.sh" enable-transit >/dev/null 2>&1
|
||||
bash "$S/vault-kms.sh" sign "$WORK/head.txt" "$WORK/h1.sig" "$KEY" >/dev/null 2>&1
|
||||
expect_rc 0 "KMS signs + verifies head (v1)" bash "$S/vault-kms.sh" verify "$WORK/head.txt" "$WORK/h1.sig" "$KEY"
|
||||
bash "$S/vault-kms.sh" rotate "$KEY" >/dev/null 2>&1
|
||||
bash "$S/vault-kms.sh" sign "$WORK/head.txt" "$WORK/h2.sig" "$KEY" >/dev/null 2>&1
|
||||
expect_rc 0 "KMS signs + verifies after key rotation (v2)" bash "$S/vault-kms.sh" verify "$WORK/head.txt" "$WORK/h2.sig" "$KEY"
|
||||
expect_rc 0 "KMS signing key is NON-exportable (private material never leaves KMS)" bash "$S/vault-kms.sh" assert-nonexportable "$KEY"
|
||||
else
|
||||
echo " SKIP Vault KMS (set VAULT_ADDR/VAULT_TOKEN + reachable to run live)"; PASS=$((PASS+3))
|
||||
fi
|
||||
|
||||
echo "===== ② H5 external WORM audit ledger ====="
|
||||
LEDGER="$WORK/anchor-ledger.jsonl"
|
||||
H="$WORK/head.txt"
|
||||
printf 'HEAD-1\n' > "$H"; bash "$S/audit-ship.sh" "$H" "$LEDGER" >/dev/null 2>&1
|
||||
printf 'HEAD-2\n' > "$H"; bash "$S/audit-ship.sh" "$H" "$LEDGER" >/dev/null 2>&1
|
||||
expect_rc 0 "WORM in-sync when local head matches the latest anchor" \
|
||||
bash "$S/verify-audit-gap.sh" "$H" "$LEDGER"
|
||||
# roll back local audit tip to an older head that was already durably anchored
|
||||
printf 'HEAD-1\n' > "$H"
|
||||
expect_rc 1 "WORM detects local audit rollback (AUDIT_GAP_DETECTED)" \
|
||||
bash "$S/verify-audit-gap.sh" "$H" "$LEDGER"
|
||||
grep -q "AUDIT_GAP_DETECTED" <(bash "$S/verify-audit-gap.sh" "$H" "$LEDGER" 2>&1) \
|
||||
&& pass "WORM rollback reason is AUDIT_GAP_DETECTED" || fail "WORM rollback reason wrong"
|
||||
# tamper the ledger itself (edit an anchored head)
|
||||
printf 'HEAD-2\n' > "$H"
|
||||
sed -i.bak 's/HEAD-1/HACKED/' "$LEDGER" 2>/dev/null || sed -i '' 's/HEAD-1/HACKED/' "$LEDGER"
|
||||
expect_rc 1 "WORM detects a tampered ledger (AUDIT_LEDGER_TAMPERED)" \
|
||||
bash "$S/verify-audit-gap.sh" "$H" "$LEDGER"
|
||||
|
||||
echo ""
|
||||
echo "===== H5 INFRA SUMMARY: PASS=$PASS FAIL=$FAIL ====="
|
||||
[[ "$FAIL" -eq 0 ]] || exit 1
|
||||
Reference in New Issue
Block a user