0ae29ae342
Some checks failed
validate / Rego (opa fmt + opa test) (push) Successful in 16s
validate / JSON Schema (ajv) (push) Successful in 20s
build-images / signing-service image (push) Successful in 24s
validate / DB (migrate up/down dry-run) (push) Failing after 26s
validate / Go (vet + test) (push) Successful in 1m16s
Adds services/verification-service exposing POST /api/v1/verify/chain for sink:dummy-sink. The handler runs the six hard-coded chain checks described in DEV-612 and reserves decision_id in a new `verification_decisions` table so a replayed sink delivery is refused without recomputing signatures. - DSSE signature verification against configurable approval + transform signer key_ids, loaded from VERIFICATION_SIGNER_KEYS (pem/hex/b64/b64u) - RFC 6962 inclusion-proof verifier (shared leaf/node hashing with services/transparency-log/pkg/backend) - Content binding: subject.digest.sha256 must match predicate.content_hash (approval) and request.payload_hash (transform) - Hard-coded coverage of allowed_transformations / allowed_sinks / expires_at predicates (OPA deferred to Phase 2 per the subtask) - Replay guard via new db/trust/migrations/0005_verification_decisions (in-memory store ships; Postgres skeleton mirrors sibling pattern) - Dockerfile mirrors signing-service pattern (distroless static + nonroot) - README documents endpoint, reason-code taxonomy, required predicate fields, and the Phase-2 non-scope Tests: happy path + 7 negatives (bad signature, missing inclusion proof, hash drift, sink not allowed, expired, replay, operation not allowed). Co-Authored-By: Paperclip <noreply@paperclip.ing>
35 lines
1 KiB
Docker
35 lines
1 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
|
|
# ---------- build ----------
|
|
FROM golang:1.23-alpine3.20 AS build
|
|
|
|
ENV CGO_ENABLED=0 \
|
|
GOOS=linux \
|
|
GOFLAGS="-trimpath"
|
|
|
|
WORKDIR /src
|
|
|
|
# Pre-cache module metadata before copying sources.
|
|
COPY services/verification-service/go.mod ./services/verification-service/
|
|
RUN --mount=type=cache,target=/root/.cache/go-build \
|
|
--mount=type=cache,target=/go/pkg/mod \
|
|
cd services/verification-service && go mod download
|
|
|
|
COPY services/verification-service/ ./services/verification-service/
|
|
|
|
WORKDIR /src/services/verification-service
|
|
RUN --mount=type=cache,target=/root/.cache/go-build \
|
|
--mount=type=cache,target=/go/pkg/mod \
|
|
go vet ./... && \
|
|
go test ./... && \
|
|
go build -ldflags="-s -w" -o /out/verification-service ./cmd/verification-service
|
|
|
|
# ---------- runtime ----------
|
|
FROM gcr.io/distroless/static-debian12:nonroot
|
|
|
|
COPY --from=build /out/verification-service /verification-service
|
|
|
|
USER 65532:65532
|
|
EXPOSE 8084
|
|
ENTRYPOINT ["/verification-service"]
|
|
CMD ["-listen=:8084", "-backend=memory"]
|