feat: plan 16-01

2026-07-06 21:47:38 +09:00
parent 4419cd9eae
commit 8c3c5e8bff
30 changed files with 1646 additions and 66 deletions
@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+# CASAN Plan-16 SEC-06 (H-06) — control-plane audit head is SIGNED.
+#
+# The control-plane audit chain is a recomputable hash chain: a file-writer who
+# edits the store could recompute every hash and the chain-only `verify-audit`
+# would still PASS, so governance-report would falsely report CERTIFIED. Signing
+# the head with an off-repo key closes this:
+#   * an intact signed store verifies (permissive + strict),
+#   * a recompute-tampered store FAILS (signature no longer matches the head),
+#   * a fully unsigned store FAILS in enforced mode (governance-report inherits
+#     CASAN_PROFILE=prod, so a certified run demands a signature).
+#
+# Deterministic; hermetic (temp store + temp keys + temp pubkey).
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+CP="$PROJECT_ROOT/.specify/scripts/bash/control-plane-settings.py"
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+
+export CASAN_CP_STORE_FILE="$WORK/store.json"
+export CASAN_CP_KEY_DIR="$WORK/keys"
+export CASAN_CP_PUB="$WORK/cp-public.pem"   # provisioned out-of-band (attacker cannot rewrite in this test)
+
+PASS=0; FAIL=0
+pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
+fail() { echo "FAIL: $1"; FAIL=$((FAIL + 1)); }
+rc_of() { set +e; "$@" >/dev/null 2>&1; echo $?; set -e 2>/dev/null || true; }
+
+echo "===== Plan-16 SEC-06: control-plane audit head signed ====="
+
+python3 "$CP" set compression.enabled true --actor a@x --reason r >/dev/null 2>&1
+python3 "$CP" set compression.mode structural --actor a@x --reason r >/dev/null 2>&1
+
+[[ "$(rc_of python3 "$CP" verify-audit)" -eq 0 ]] \
+  && pass "intact signed store verifies (permissive)" || fail "intact store rejected"
+[[ "$(rc_of env CASAN_VERIFY_STRICT=1 python3 "$CP" verify-audit)" -eq 0 ]] \
+  && pass "intact signed store verifies (strict)" || fail "intact store rejected in strict"
+
+# Recompute-attack: tamper a value AND recompute the entire hash chain so it is
+# internally consistent. The head signature (over the original head) must not match.
+python3 - "$CASAN_CP_STORE_FILE" <<'PY'
+import hashlib, json, sys
+p = sys.argv[1]; d = json.load(open(p))
+d["settings"]["compression.enabled"]["value"] = False
+prev = "0" * 64
+def he(e): return hashlib.sha256(json.dumps(e, sort_keys=True, ensure_ascii=False).encode()).hexdigest()
+for e in d["audit"]:
+    if e.get("key") == "compression.enabled" and e.get("action") == "set":
+        e["value"] = False
+    rest = {k: v for k, v in e.items() if k != "hash"}; rest["prevHash"] = prev
+    for k in list(e):
+        if k != "hash": e[k] = rest[k]
+    e["hash"] = he(rest); prev = e["hash"]
+json.dump(d, open(p, "w"), indent=2)
+PY
+[[ "$(rc_of python3 "$CP" verify-audit)" -ne 0 ]] \
+  && pass "recompute-tampered store FAILS (head signature mismatch)" \
+  || fail "recompute attack passed verification (H-06 not closed!)"
+
+# Keyless attacker: delete the signature artifacts entirely. Enforced mode (what a
+# certified run / prod profile uses) must reject an unsigned store; dev stays lax.
+rm -f "$CASAN_CP_STORE_FILE.head" "$CASAN_CP_STORE_FILE.head.sig" "$CASAN_CP_PUB"
+# rebuild a clean, internally-valid but UNSIGNED store (fresh sets would re-sign, so
+# strip the signature after): easiest is to reuse the tampered chain which is
+# internally valid; with sig files gone it is "unsigned".
+[[ "$(rc_of env CASAN_VERIFY_STRICT=1 python3 "$CP" verify-audit)" -ne 0 ]] \
+  && pass "unsigned store FAILS in enforced mode (prod / certified run)" \
+  || fail "unsigned store accepted in enforced mode"
+[[ "$(rc_of python3 "$CP" verify-audit)" -eq 0 ]] \
+  && pass "unsigned store still OK in permissive dev mode (backward compat)" \
+  || fail "permissive mode wrongly rejected unsigned store"
+
+echo ""
+echo "===== SEC-06 SUMMARY: PASS=$PASS FAIL=$FAIL ====="
+[[ "$FAIL" -eq 0 ]] || exit 1