gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: require Vault audit signing in production

Browse Source
This commit is contained in:
thanhnv
2026-07-18 00:15:38 +07:00
parent 00963119f4
commit d129ba60ef
3 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/casan-harness/tests/phase-sec02-tests.sh
+6
View File
@@ -56,6 +56,12 @@ env CASAN_VERIFY_STRICT=1 CASAN_AUDIT_KEY_DIR="$KD2" bash "$BASH_DIR/governance-
&& pass "unsigned head from enforced run FAILS strict verify (fail-closed)" \
|| fail "unsigned head passed strict verify"
# 4) Production must never silently fall back from Vault Transit to a local key.
printf '{"timestamp":"2026-07-18T00:00:00Z","action":"test"}\n' > "$WORK/audit.jsonl"
[[ "$(rc_of env CASAN_PROFILE=prod VAULT_ADDR= VAULT_TOKEN= CASAN_GOVERNANCE_ROOT="$WORK/prod-gov" bash "$BASH_DIR/sign-audit-head.sh" "$WORK/audit.jsonl")" -ne 0 ]] \
&& pass "prod audit signer refuses local-key fallback when Vault is unavailable" \
|| fail "prod audit signer accepted a local-key fallback"
echo ""
echo "===== SEC-02 SUMMARY: PASS=$PASS FAIL=$FAIL ====="
[[ "$FAIL" -eq 0 ]] || exit 1