2026-10-25 18:02:44 +00:00
|
|
|
module basicstack.de/proofedmesh/services/signing-service
|
|
|
|
|
|
signing-service: Pocket-ID JWKS + K8s TokenReview + OPA (DEV-609)
Wires the signing-service's production path for ProofedMesh Phase 1:
the service now performs a double identity check (Pocket-ID OIDC JWT
+ K8s ServiceAccount TokenReview), reconciles both against the
trust-api `agents` registry, and asks an OPA/Rego policy whether the
caller may sign with the requested key_ref.
Code
- internal/token/pocket_id.go: OIDC-Discovery-backed JWKS validator
with automatic kid rotation (coreos/go-oidc).
- internal/token/k8s_tokenreview.go: hand-rolled TokenReview client;
reads X-Workload-Token, posts to authentication.k8s.io/v1 via the
pod's in-cluster SA token + CA.
- internal/registry: Postgres resolver for the agents table +
in-memory Static resolver for tests.
- internal/policy/opa.go: OPA/rego StructuredDecider; input carries
both lookups so the policy can enforce identity consistency AND
the key_ref ↔ role mapping.
- internal/httpapi/sign.go: new structured flow when
Validator+TokenReviewer+Registry+StructuredPolicy are all wired;
dev path (static bearers + AllowAll) remains intact.
- cmd/signing-service/main.go: -pocket-id-issuer,
-pocket-id-audience, -k8s-tokenreview, -registry-dsn,
-policy-bundle flags.
Policy
- policies/sinks/signing_service.rego: identities_agree +
key_ref_matches_role rules; agent → key_ref prefix map covers
approval-service, testagent-transform, dummy-sink.
Deploy
- deploy/signing-service/01-rbac.yaml: ClusterRole with
tokenreviews.create + binding to the signing-service SA.
- deploy/signing-service/20-deployment.yaml: adds POCKET_ID_ISSUER,
POCKET_ID_AUDIENCE, TRUST_PG_DSN env, projected SA token volume,
OPA policy ConfigMap mount, structured flags.
- deploy/signing-service/00-serviceaccount.yaml: disables default
auto-mount; a projected volume is used.
- deploy/signing-service/README.md: documents prod flags +
ConfigMap generation.
Tests
- httptest-mock Pocket-ID (OIDC discovery + JWKS, kid rotation),
StaticTokenReviewer fake, Static registry, real Rego policy.
- Happy paths: Approval-Service → trust-api/approval-signer-2026-q4;
testagent-transform → trust-api/agent-testagent-transform-2026-q4.
- Denies: registry mismatch, wrong key_ref for role, missing /
bad workload token, bad Pocket-ID token, kid rotation.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-10-25 19:42:40 +00:00
|
|
|
go 1.26.0
|
|
|
|
|
|
|
|
|
|
require (
|
|
|
|
|
github.com/coreos/go-oidc/v3 v3.21.0
|
|
|
|
|
github.com/jackc/pgx/v5 v5.11.0
|
|
|
|
|
github.com/open-policy-agent/opa v1.21.4
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
require (
|
|
|
|
|
github.com/agnivade/levenshtein v1.2.1 // indirect
|
|
|
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
|
|
|
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1 // indirect
|
|
|
|
|
github.com/go-jose/go-jose/v4 v4.1.4 // indirect
|
|
|
|
|
github.com/gobwas/glob v1.0.0 // indirect
|
|
|
|
|
github.com/goccy/go-json v0.10.6 // indirect
|
|
|
|
|
github.com/google/uuid v1.6.0 // indirect
|
|
|
|
|
github.com/jackc/pgpassfile v1.0.0 // indirect
|
|
|
|
|
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
|
|
|
|
|
github.com/jackc/puddle/v2 v2.2.2 // indirect
|
|
|
|
|
github.com/lestrrat-go/blackmagic v1.0.4 // indirect
|
|
|
|
|
github.com/lestrrat-go/dsig v1.4.0 // indirect
|
|
|
|
|
github.com/lestrrat-go/dsig-secp256k1 v1.0.0 // indirect
|
|
|
|
|
github.com/lestrrat-go/httpcc v1.0.1 // indirect
|
|
|
|
|
github.com/lestrrat-go/httprc/v3 v3.0.6 // indirect
|
|
|
|
|
github.com/lestrrat-go/jwx/v3 v3.3.0 // indirect
|
|
|
|
|
github.com/lestrrat-go/option/v2 v2.0.0 // indirect
|
|
|
|
|
github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9 // indirect
|
|
|
|
|
github.com/segmentio/asm v1.2.1 // indirect
|
|
|
|
|
github.com/sirupsen/logrus v1.10.2 // indirect
|
|
|
|
|
github.com/tchap/go-patricia/v2 v2.3.3 // indirect
|
|
|
|
|
github.com/valyala/fastjson v1.6.10 // indirect
|
|
|
|
|
github.com/vektah/gqlparser/v2 v2.5.37 // indirect
|
|
|
|
|
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
|
|
|
|
|
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
|
|
|
|
|
github.com/yashtewari/glob-intersection v0.2.0 // indirect
|
|
|
|
|
go.yaml.in/yaml/v3 v3.0.5 // indirect
|
|
|
|
|
golang.org/x/crypto v0.57.0 // indirect
|
|
|
|
|
golang.org/x/oauth2 v0.36.0 // indirect
|
|
|
|
|
golang.org/x/sync v0.23.0 // indirect
|
|
|
|
|
golang.org/x/sys v0.48.0 // indirect
|
|
|
|
|
golang.org/x/text v0.42.0 // indirect
|
|
|
|
|
google.golang.org/protobuf v1.36.12 // indirect
|
|
|
|
|
)
|