coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Sign decision envelopes and close FLEX-WP-0024.
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 53s
Details

Browse source 
Detached Ed25519 over the canonical envelope with signature omitted.
Unsigned is stated, not implied. Testdata fixtures prove verify and
tamper failure without minting a production key. FLEX-WP-0025 is
finished with the validate check from the previous commit.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
This commit is contained in:
tegwick 2026-09-14 09:57:50 +02:00
parent c074237aac
commit 127f83da4d
15 changed files with 697 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

22
examples/secrets-engine/replay/README.md
View file

@ -8,6 +8,9 @@ to verify its digest join (`627810b`) unchanged. `FLEX-WP-0021-T03`.
| `decision_rotate.json` | `../check_request_allow_rotate.json` — plain allow, empty context |
| `decision_destroy_dual_control.json` | `../check_request_allow_destroy_dual_control.json` — dual control, valid approval-claim |
| `decision_wrong_tenant_deny.json` | `../check_request_deny_wrong_tenant.json` — foreign tenant, denied `wrong_tenant` |
| `decision_rotate_signed.json` | same rotate envelope, Ed25519-signed with the testdata key (`FLEX-WP-0024-T03`) |
| `decision_rotate_signed_tampered.json` | the signed rotate envelope with `effect`/`reason` altered after signing |
| `keys.json` | public half of the testdata key (`kid=testdata-ed25519`). Not a production key |
Regenerate either with:
@ -18,6 +21,25 @@ go run ./cmd/flex-auth check \
-request examples/secrets-engine/check_request_allow_rotate.json
```
## Envelope signature (FLEX-WP-0024)
A consumer verifier is untested until it has seen both a valid signature and
an invalid one. These two files are that pair:
```bash
# genuine — must verify
# tampered — must fail
# public key: keys.json kid testdata-ed25519
```
The signed material is `json.Marshal` of the envelope with `signature`
omitted (`docs/decision-envelope-signature.md`). `request_digest` is the same
on the unsigned rotate fixture, the signed fixture, and the tampered fixture,
because the signature is not binding material.
The testdata private seed is `0x42` repeated 32 times. It is **not** the
OpenBao custody path.
## What is stable and what is not
**Stable across runs** — these are the fields to pin a contract test against: