feat(wave5): CI/CD pipeline + Vault KMS + OKR deploy to port 80/3001
Infrastructure (H3 CI gate, H5 KMS): - Gitea Actions enabled (GITEA__actions__ENABLED=true) - act_runner: Docker-outside-of-Docker for deploy job - Vault Transit RSA-2048 signing keys (casan-audit-key, casan-policy-key) Vault KMS scripts (H5 governance): - .specify/scripts/bash/vault-kms.sh — sign/verify/pubkey/ensure-key - .specify/scripts/bash/sign-audit-head.sh — sign audit chain via Vault - Updated sign-policy-bundle.sh — Vault path + local fallback - Updated security-gate.sh — KMS gate added (PASS=11 FAIL=0) OKR app deployment (port 80/3001): - Dockerfile.backend — node:22-slim (node:sqlite requires Node 22) - Dockerfile.frontend — node:20-alpine build + nginx:alpine runtime - nginx/nginx.conf — React SPA + /api/v1/* proxy to okr-backend:3001 - backend/entrypoint.sh — auto init DB on first run + seed - .dockerignore CI pipeline (.gitea/workflows/ci.yml): - Job 1: Vitest frontend tests (H3) - Job 2: CASAN security gate + Vault KMS signing (H4/H5) - Job 3: Deploy OKR → port 80 (runs on push to main after tests pass) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
thanhnv
co-authored by
Claude Sonnet 4.6
Claude Sonnet 4.6
parent
6e95e929f0
commit
9892e82221
@@ -18,6 +18,9 @@ run() { # <name> <command...>
|
||||
echo "== CASAN security gate =="
|
||||
run "run-casan4 harness suite" bash "$ROOT/.specify/tests/run-casan4-harness-tests.sh"
|
||||
run "adversarial suite" bash "$ROOT/.specify/tests/adversarial-harness-tests.sh"
|
||||
# Wave 5: sign audit head via Vault KMS (or local fallback) before verifying.
|
||||
# This changes verify output from anchor=unsigned to anchor=signed when Vault is configured.
|
||||
run "sign audit-chain head (KMS)" bash "$ROOT/.specify/scripts/bash/sign-audit-head.sh"
|
||||
run "audit hash-chain (signed)" bash "$ROOT/.specify/scripts/bash/verify-audit-chain.sh"
|
||||
run "tool-call audit (signed)" bash "$ROOT/.specify/scripts/bash/verify-tool-audit.sh"
|
||||
# Wave 3 additions
|
||||
|
||||
@@ -0,0 +1,89 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
# CASAN H5 — Sign the audit chain head hash via Vault KMS (or local key fallback).
|
||||
#
|
||||
# Called by CI after harness tests rebuild audit.jsonl, so that
|
||||
# verify-audit-chain.sh produces "anchor=signed" (not "anchor=unsigned").
|
||||
#
|
||||
# Usage:
|
||||
# sign-audit-head.sh [audit-jsonl]
|
||||
#
|
||||
# Writes:
|
||||
# <audit-dir>/audit-head.txt — the head hash (plain text)
|
||||
# <audit-dir>/audit-head.sig — RSA signature of audit-head.txt
|
||||
#
|
||||
# After this script, verify-audit-chain.sh reports:
|
||||
# AUDIT_CHAIN_VALID anchor=signed
|
||||
#
|
||||
# Environment (KMS path):
|
||||
# VAULT_ADDR — e.g. http://vault:8200
|
||||
# VAULT_TOKEN — token with transit/sign/casan-audit-key capability
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
|
||||
|
||||
AUDIT_LOG="${1:-$PROJECT_ROOT/.specify/logs/audit/audit.jsonl}"
|
||||
AUDIT_DIR="$(dirname "$AUDIT_LOG")"
|
||||
HEAD_FILE="$AUDIT_DIR/audit-head.txt"
|
||||
HEAD_SIG="$AUDIT_DIR/audit-head.sig"
|
||||
AUDIT_PUB="$PROJECT_ROOT/.specify/level5/central-governance/audit-public.pem"
|
||||
|
||||
if [[ ! -f "$AUDIT_LOG" ]]; then
|
||||
echo "SIGN_AUDIT_HEAD_SKIP audit.jsonl not found" >&2
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# ── Compute the current chain head ────────────────────────────────────────
|
||||
HEAD_HASH="$(python - "$AUDIT_LOG" <<'PY'
|
||||
import hashlib, json, sys
|
||||
path = sys.argv[1]
|
||||
previous = ""
|
||||
with open(path, encoding="utf-8") as f:
|
||||
for line in f:
|
||||
if not line.strip():
|
||||
continue
|
||||
record = json.loads(line)
|
||||
core = "|".join([
|
||||
record.get("timestamp",""), record.get("trace_id",""),
|
||||
record.get("action",""), record.get("actor",""),
|
||||
record.get("risk_level",""), record.get("decision",""),
|
||||
record.get("approval_status",""), record.get("approver",""),
|
||||
record.get("input_hash",""), record.get("output_hash",""),
|
||||
previous,
|
||||
])
|
||||
previous = hashlib.sha256(core.encode()).hexdigest()
|
||||
print(previous)
|
||||
PY
|
||||
)"
|
||||
|
||||
if [[ -z "$HEAD_HASH" ]]; then
|
||||
echo "SIGN_AUDIT_HEAD_SKIP empty chain" >&2
|
||||
exit 0
|
||||
fi
|
||||
|
||||
printf '%s' "$HEAD_HASH" > "$HEAD_FILE"
|
||||
|
||||
# ── Sign the head file ────────────────────────────────────────────────────
|
||||
VAULT_KMS="$SCRIPT_DIR/vault-kms.sh"
|
||||
|
||||
if [[ -n "${VAULT_ADDR:-}" && -n "${VAULT_TOKEN:-}" ]] && \
|
||||
curl -sf "$VAULT_ADDR/v1/sys/health" >/dev/null 2>&1; then
|
||||
# KMS path — sign via Vault Transit, export public key
|
||||
bash "$VAULT_KMS" enable-transit
|
||||
bash "$VAULT_KMS" sign "$HEAD_FILE" "$HEAD_SIG" "casan-audit-key"
|
||||
bash "$VAULT_KMS" pubkey "$AUDIT_PUB" "casan-audit-key"
|
||||
echo "SIGN_AUDIT_HEAD_OK head=$HEAD_HASH anchor=vault-kms"
|
||||
else
|
||||
# Fallback — local key (dev environment without Vault)
|
||||
# IMPORTANT: Do NOT generate a new key pair here. audit-public.pem is committed
|
||||
# and shared by both audit.jsonl and tool-calls.jsonl verification. Generating a
|
||||
# new key overwrites audit-public.pem and breaks tool-calls-head.sig verification.
|
||||
AUDIT_PRIV="$PROJECT_ROOT/.specify/level5/central-governance/audit-private.pem"
|
||||
if [[ ! -f "$AUDIT_PRIV" ]]; then
|
||||
echo "SIGN_AUDIT_HEAD_SKIP no private key and VAULT_ADDR not set — verify will show anchor=unsigned" >&2
|
||||
exit 0
|
||||
fi
|
||||
openssl dgst -sha256 -sign "$AUDIT_PRIV" -out "$HEAD_SIG" "$HEAD_FILE"
|
||||
echo "SIGN_AUDIT_HEAD_OK head=$HEAD_HASH anchor=local-file"
|
||||
fi
|
||||
@@ -65,12 +65,24 @@ PY
|
||||
|
||||
if [[ "$MODE" == "sign" ]]; then
|
||||
generate_manifest
|
||||
if [[ ! -f "$PRIVATE_KEY" ]]; then
|
||||
openssl genrsa -out "$PRIVATE_KEY" 2048 >/dev/null 2>&1
|
||||
openssl rsa -in "$PRIVATE_KEY" -pubout -out "$PUBLIC_KEY" >/dev/null 2>&1
|
||||
|
||||
if [[ -n "${VAULT_ADDR:-}" && -n "${VAULT_TOKEN:-}" ]] && \
|
||||
curl -sf "$VAULT_ADDR/v1/sys/health" >/dev/null 2>&1; then
|
||||
# ── KMS path: sign via HashiCorp Vault Transit (key never stored on disk) ──
|
||||
VAULT_KMS="$SCRIPT_DIR/vault-kms.sh"
|
||||
bash "$VAULT_KMS" enable-transit
|
||||
bash "$VAULT_KMS" sign "$MANIFEST" "$SIGNATURE" "casan-policy-key"
|
||||
bash "$VAULT_KMS" pubkey "$PUBLIC_KEY" "casan-policy-key"
|
||||
echo "POLICY_BUNDLE_SIGNED manifest=$MANIFEST signature=$SIGNATURE public_key=$PUBLIC_KEY key_backend=vault-kms"
|
||||
else
|
||||
# ── Fallback: local key file (dev / no Vault) ─────────────────────────────
|
||||
if [[ ! -f "$PRIVATE_KEY" ]]; then
|
||||
openssl genrsa -out "$PRIVATE_KEY" 2048 >/dev/null 2>&1
|
||||
openssl rsa -in "$PRIVATE_KEY" -pubout -out "$PUBLIC_KEY" >/dev/null 2>&1
|
||||
fi
|
||||
openssl dgst -sha256 -sign "$PRIVATE_KEY" -out "$SIGNATURE" "$MANIFEST"
|
||||
echo "POLICY_BUNDLE_SIGNED manifest=$MANIFEST signature=$SIGNATURE public_key=$PUBLIC_KEY key_backend=local-file"
|
||||
fi
|
||||
openssl dgst -sha256 -sign "$PRIVATE_KEY" -out "$SIGNATURE" "$MANIFEST"
|
||||
echo "POLICY_BUNDLE_SIGNED manifest=$MANIFEST signature=$SIGNATURE public_key=$PUBLIC_KEY"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
|
||||
+171
@@ -0,0 +1,171 @@
|
||||
#!/usr/bin/env bash
|
||||
# CASAN H5 — HashiCorp Vault KMS helper
|
||||
#
|
||||
# Provides Vault-backed signing operations as a drop-in replacement for
|
||||
# direct openssl key-file usage. Scripts detect KMS availability via:
|
||||
# [[ -n "${VAULT_ADDR:-}" && -n "${VAULT_TOKEN:-}" ]]
|
||||
#
|
||||
# Usage (direct):
|
||||
# vault-kms.sh sign <file> <output.sig> [key_name]
|
||||
# vault-kms.sh verify <file> <sig_file> [key_name]
|
||||
# vault-kms.sh pubkey <output.pem> [key_name]
|
||||
# vault-kms.sh status
|
||||
#
|
||||
# Usage (sourced):
|
||||
# source vault-kms.sh
|
||||
# vault_kms_sign <file> <output.sig> [key_name]
|
||||
# vault_kms_pubkey <output.pem> [key_name]
|
||||
# vault_kms_status
|
||||
#
|
||||
# Environment:
|
||||
# VAULT_ADDR — e.g. http://vault:8200 or http://161.33.139.73:8200
|
||||
# VAULT_TOKEN — root token or policy token with transit/sign/* capability
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
: "${VAULT_ADDR:?VAULT_ADDR must be set}"
|
||||
: "${VAULT_TOKEN:?VAULT_TOKEN must be set}"
|
||||
|
||||
_VAULT_DEFAULT_KEY="casan-policy-key"
|
||||
_VAULT_AUDIT_KEY="casan-audit-key"
|
||||
|
||||
# ── Ensure required tools ──────────────────────────────────────────────────
|
||||
_check_deps() {
|
||||
for cmd in curl python3; do
|
||||
command -v "$cmd" >/dev/null 2>&1 || { echo "vault-kms: required: $cmd" >&2; exit 1; }
|
||||
done
|
||||
}
|
||||
|
||||
# ── Transit: ensure key exists ────────────────────────────────────────────
|
||||
vault_kms_ensure_key() {
|
||||
local key="${1:-$_VAULT_DEFAULT_KEY}"
|
||||
local status
|
||||
status=$(curl -sf \
|
||||
-H "X-Vault-Token: $VAULT_TOKEN" \
|
||||
"$VAULT_ADDR/v1/transit/keys/$key" 2>/dev/null | \
|
||||
python3 -c "import sys,json; d=json.load(sys.stdin); print('ok' if 'data' in d else 'missing')" 2>/dev/null || echo "missing")
|
||||
|
||||
if [[ "$status" != "ok" ]]; then
|
||||
curl -sf -X POST \
|
||||
-H "X-Vault-Token: $VAULT_TOKEN" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"type":"rsa-2048","exportable":false,"allow_plaintext_backup":false}' \
|
||||
"$VAULT_ADDR/v1/transit/keys/$key" >/dev/null
|
||||
echo "vault-kms: created transit key: $key" >&2
|
||||
fi
|
||||
}
|
||||
|
||||
# ── Sign a file ───────────────────────────────────────────────────────────
|
||||
# Produces a DER binary signature compatible with:
|
||||
# openssl dgst -sha256 -verify pub.pem -signature <output.sig> <file>
|
||||
vault_kms_sign() {
|
||||
local file="$1" output="$2" key="${3:-$_VAULT_DEFAULT_KEY}"
|
||||
_check_deps
|
||||
vault_kms_ensure_key "$key"
|
||||
|
||||
# Base64-encode the file content for the Vault API payload
|
||||
local input_b64
|
||||
input_b64=$(base64 -w0 < "$file" 2>/dev/null || base64 < "$file")
|
||||
|
||||
# Call Vault Transit sign — PKCS#1 v1.5 + SHA-256 (compatible with openssl verify)
|
||||
local response
|
||||
response=$(curl -sf -X POST \
|
||||
-H "X-Vault-Token: $VAULT_TOKEN" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "{\"input\":\"$input_b64\",\"hash_algorithm\":\"sha2-256\",\"signature_algorithm\":\"pkcs1v15\",\"prehashed\":false}" \
|
||||
"$VAULT_ADDR/v1/transit/sign/$key") || {
|
||||
echo "vault-kms: sign request failed (key=$key)" >&2; exit 1
|
||||
}
|
||||
|
||||
# Extract signature and strip the "vault:v1:" prefix → raw base64 DER bytes
|
||||
local sig_b64
|
||||
sig_b64=$(printf '%s' "$response" | python3 -c "
|
||||
import sys, json
|
||||
d = json.load(sys.stdin)
|
||||
sig = d['data']['signature']
|
||||
# vault:v1:<base64> → keep only base64 part
|
||||
print(sig.split(':')[-1])
|
||||
")
|
||||
|
||||
# Decode base64 → binary DER file (identical format to openssl -sign output)
|
||||
printf '%s' "$sig_b64" | base64 -d > "$output"
|
||||
echo "vault-kms: signed $file → $output (key=$key anchor=vault-kms)" >&2
|
||||
}
|
||||
|
||||
# ── Export public key ─────────────────────────────────────────────────────
|
||||
# Writes the RSA public key as PEM so openssl dgst -verify still works.
|
||||
vault_kms_pubkey() {
|
||||
local output="$1" key="${2:-$_VAULT_DEFAULT_KEY}"
|
||||
_check_deps
|
||||
vault_kms_ensure_key "$key"
|
||||
|
||||
local response
|
||||
response=$(curl -sf \
|
||||
-H "X-Vault-Token: $VAULT_TOKEN" \
|
||||
"$VAULT_ADDR/v1/transit/keys/$key") || {
|
||||
echo "vault-kms: pubkey fetch failed (key=$key)" >&2; exit 1
|
||||
}
|
||||
|
||||
python3 - "$output" <<PY
|
||||
import sys, json
|
||||
output = sys.argv[1]
|
||||
response = """$response"""
|
||||
d = json.loads(response)
|
||||
keys = d["data"]["keys"]
|
||||
# keys is a dict; pick the latest version
|
||||
latest = max(keys.keys(), key=lambda k: int(k))
|
||||
pub = keys[latest]["public_key"]
|
||||
with open(output, "w") as f:
|
||||
f.write(pub if pub.endswith("\n") else pub + "\n")
|
||||
print(f"vault-kms: public key written to {output}", file=sys.stderr)
|
||||
PY
|
||||
}
|
||||
|
||||
# ── Verify a signature ────────────────────────────────────────────────────
|
||||
# Uses openssl with the public key exported from Vault.
|
||||
vault_kms_verify() {
|
||||
local file="$1" sig_file="$2" key="${3:-$_VAULT_DEFAULT_KEY}"
|
||||
local tmp_pub
|
||||
tmp_pub=$(mktemp /tmp/vault-pub-XXXXX.pem)
|
||||
trap 'rm -f "$tmp_pub"' RETURN
|
||||
vault_kms_pubkey "$tmp_pub" "$key"
|
||||
openssl dgst -sha256 -verify "$tmp_pub" -signature "$sig_file" "$file" >/dev/null
|
||||
}
|
||||
|
||||
# ── Connectivity check ────────────────────────────────────────────────────
|
||||
vault_kms_status() {
|
||||
if curl -sf "$VAULT_ADDR/v1/sys/health" >/dev/null 2>&1; then
|
||||
echo "VAULT_KMS_AVAILABLE addr=$VAULT_ADDR"
|
||||
return 0
|
||||
else
|
||||
echo "VAULT_KMS_UNAVAILABLE addr=${VAULT_ADDR:-unset}"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# ── Enable transit engine (idempotent) ────────────────────────────────────
|
||||
vault_kms_enable_transit() {
|
||||
curl -sf -X POST \
|
||||
-H "X-Vault-Token: $VAULT_TOKEN" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"type":"transit"}' \
|
||||
"$VAULT_ADDR/v1/sys/mounts/transit" >/dev/null 2>&1 || true
|
||||
}
|
||||
|
||||
# ── CLI entrypoint ────────────────────────────────────────────────────────
|
||||
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
|
||||
CMD="${1:-status}"
|
||||
shift || true
|
||||
case "$CMD" in
|
||||
sign) vault_kms_sign "$@" ;;
|
||||
pubkey) vault_kms_pubkey "$@" ;;
|
||||
verify) vault_kms_verify "$@" ;;
|
||||
status) vault_kms_status ;;
|
||||
enable-transit) vault_kms_enable_transit ;;
|
||||
ensure-key) vault_kms_ensure_key "${1:-}" ;;
|
||||
*)
|
||||
echo "Usage: vault-kms.sh {sign|pubkey|verify|status|enable-transit|ensure-key}" >&2
|
||||
exit 64
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
Reference in New Issue
Block a user