951f22f80e
- services/transparency-log/pkg/backend/trillian.go: real gRPC client on github.com/google/trillian v1.6.1. Submit() does QueueLeaf with the canonical DSSE envelope as LeafValue and the raw content_hash bytes as LeafIdentityHash, then polls GetLatestSignedLogRoot + GetInclusionProofByHash until the leaf is sequenced. Idempotency uses Trillian's ALREADY_EXISTS signal on the inner QueuedLogLeaf.Status, so a repeated submit still returns 200 OK with the originally-assigned log_index + a valid proof against the current STH. - Unconfigured backend (missing endpoint or LogID) returns the historical ErrTrillianUnavailable so the httpapi layer keeps mapping it to 503 instead of silently 500. Existing stub-returns-503 test updated. - cmd/transparency-log: pointer-receiver Trillian wiring; flag docs mention the production SRV name. - services/transparency-log/Dockerfile: distroless multi-stage build used by deploy/trillian/40-transparency-log.yaml. - deploy/trillian/: full K8s stack for the agent-trust namespace — MySQL 8.4 StatefulSet (schema init ConfigMap vendored from upstream storage.sql v1.6.1), Trillian LogServer + LogSigner Deployments on gcr.io/trillian-opensource-ci:v1.6.1, createtree Job that writes the TreeID to a ConfigMap (re-apply safe), transparency-log Deployment with --backend=trillian pulling TRILLIAN_LOG_ID from the ConfigMap. - deploy/trillian/README.md: first-time apply + smoke-test + secret rotation + signer-key clarification (STH key is Trillian-internal; DSSE envelope signing stays with signing-service / OpenBao). - services/admin-api: go.mod / go.sum pick up the new transitive deps (trillian + grpc) via the local replace on transparency-log. - services/transparency-log/README.md: Backends table updated; next- steps list no longer carries Trillian-deployment as a follow-up. Deployed to the live cluster from this heartbeat: MySQL + LogServer + LogSigner running in agent-trust, tree id 8482455225499059043, service smoke-tested end-to-end (201 on first POST, 200 on idempotent repeat, 409 on content_hash mismatch, tree_size=2 with correct audit path). Co-Authored-By: Paperclip <noreply@paperclip.ing>
79 lines
2.4 KiB
Go
79 lines
2.4 KiB
Go
// Command transparency-log serves the ADR-0005 Transparency Log API.
|
|
//
|
|
// By default it runs with the in-memory backend (dev + CI). The Trillian
|
|
// backend is a stub until the Trillian deployment subtask lands; selecting
|
|
// it today returns 503 on every submit, which is the intended signal that
|
|
// production is not yet wired.
|
|
package main
|
|
|
|
import (
|
|
"context"
|
|
"flag"
|
|
"log"
|
|
"net/http"
|
|
"os"
|
|
"os/signal"
|
|
"syscall"
|
|
"time"
|
|
|
|
"basicstack.de/proofedmesh/services/transparency-log/pkg/backend"
|
|
"basicstack.de/proofedmesh/services/transparency-log/pkg/httpapi"
|
|
)
|
|
|
|
func main() {
|
|
addr := flag.String("addr", ":8080", "listen address")
|
|
// Default to memory for local `go run` and tests; prod manifests
|
|
// (deploy/trillian/40-transparency-log.yaml) always pass --backend=trillian.
|
|
backendKind := flag.String("backend", "memory", "backend: memory | trillian")
|
|
trillianAddr := flag.String("trillian-addr", "", "trillian LogServer address (prod), e.g. trillian-log-server.agent-trust.svc.cluster.local:8090")
|
|
trillianLogID := flag.Int64("trillian-log-id", 0, "trillian tree id (prod)")
|
|
flag.Parse()
|
|
|
|
be, err := buildBackend(*backendKind, *trillianAddr, *trillianLogID)
|
|
if err != nil {
|
|
log.Fatalf("backend init: %v", err)
|
|
}
|
|
srv := &httpapi.Server{Backend: be, LogError: log.Printf}
|
|
|
|
httpSrv := &http.Server{
|
|
Addr: *addr,
|
|
Handler: srv.Handler(),
|
|
ReadHeaderTimeout: 5 * time.Second,
|
|
}
|
|
|
|
ctx, cancel := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
|
|
defer cancel()
|
|
|
|
errc := make(chan error, 1)
|
|
go func() {
|
|
log.Printf("transparency-log: listening on %s (backend=%s)", *addr, *backendKind)
|
|
errc <- httpSrv.ListenAndServe()
|
|
}()
|
|
|
|
select {
|
|
case err := <-errc:
|
|
if err != nil && err != http.ErrServerClosed {
|
|
log.Fatalf("listen: %v", err)
|
|
}
|
|
case <-ctx.Done():
|
|
log.Printf("transparency-log: shutdown requested")
|
|
shutdownCtx, shutdownCancel := context.WithTimeout(context.Background(), 5*time.Second)
|
|
defer shutdownCancel()
|
|
_ = httpSrv.Shutdown(shutdownCtx)
|
|
}
|
|
}
|
|
|
|
func buildBackend(kind, trillianAddr string, trillianLogID int64) (backend.Backend, error) {
|
|
switch kind {
|
|
case "memory", "":
|
|
return backend.NewMemory(), nil
|
|
case "trillian":
|
|
return &backend.Trillian{Endpoint: trillianAddr, LogID: trillianLogID}, nil
|
|
default:
|
|
return nil, errUnknownBackend(kind)
|
|
}
|
|
}
|
|
|
|
type errUnknownBackend string
|
|
|
|
func (e errUnknownBackend) Error() string { return "unknown backend: " + string(e) }
|