coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
secrets-engine/verifier
History
tegwick ebca4f5adb build: package CLI with pinned producer verifier 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
2026-10-16 09:20:33 +02:00
..
internal/sign fix(auth): authenticate producer-signed decisions before authorization 2026-10-16 07:51:44 +02:00
pkg/api fix(auth): authenticate producer-signed decisions before authorization 2026-10-16 07:51:44 +02:00
testsupport/signer fix(auth): authenticate producer-signed decisions before authorization 2026-10-16 07:51:44 +02:00
go.mod fix(auth): authenticate producer-signed decisions before authorization 2026-10-16 07:51:44 +02:00
LICENSE.access-engine fix(auth): authenticate producer-signed decisions before authorization 2026-10-16 07:51:44 +02:00
main.go fix(auth): authenticate producer-signed decisions before authorization 2026-10-16 07:51:44 +02:00
producer-source.json fix(auth): authenticate producer-signed decisions before authorization 2026-10-16 07:51:44 +02:00
README.md build: package CLI with pinned producer verifier 2026-10-16 09:20:33 +02:00

README.md

Access Engine decision verifier

The API types and internal/sign/sign.go are unchanged producer source, pinned by revision and SHA-256 in producer-source.json. License attribution and the original license text are in LICENSE.access-engine. This is source vendoring necessitated by the producer's Go internal package boundary, not a separately maintained crypto implementation. There are no external Go dependencies.

Build in this directory: go build -trimpath -o /tmp/secrets-engine-pdp-verify .. Install that binary through the deployment's reviewed package/image path and set SECRETS_ENGINE_PDP_VERIFIER to its absolute path. Do not compile at request time. The Python wheel alone is insufficient: deployments must install this helper. The testsupport/signer executable is test-only and must not be installed.

From repository root, run python3 scripts/check_pdp_producer_source.py before building, and optionally add --upstream /path/to/access-engine to detect producer drift. To update: select/review an upstream revision, copy these exact source files and native replay fixtures, update the manifest, run both upstream signature checks and downstream consumer tests, then review the complete diff. Never change canonicalization locally. Producer contract additions fail closed until reviewed.

The helper reads the original JSON envelope, verifies using Go's producer verifier, and returns only the authenticated typed envelope. The Python boundary rejects duplicate keys, nonfinite values and invalid UTF-8 before invoking it. Unknown typed fields refuse. The unsigned producer mode is never a production fallback.

The Check API defaults to mandatory authentication. Its deliberately named allow_unsigned_test_fixture argument is used only by synthetic transport tests; production authorize_action never passes it. The helper runs with an empty environment, so ambient backend and identity credentials cannot reach it.

For the complete reproducible CLI build and offline fresh-prefix installation, use the release bundle contract. This replaces manual helper copying for packaged deployments; package and key admission remain separate owner decisions.