Tyler King
043b9b9bdc
New crate: bascule-shell (471 lines, 1.8MB binary) Login shell that detects identity + platform attestation at startup. Wraps bash/zsh/fish — operator works normally, identity travels with them. Identity detection (priority order): 1. Entra via WSL2 interop 2. Azure CLI 3. Kerberos TGT 4. Cached OIDC token 5. System user (fallback) Platform attestation: TPM 2.0 PCR values via tpm2_pcrread (PCRs 0,1,2,7,10,14) IMA measurement log hash + count Keylime agent state Entra device compliance (WSL2 only) Composite SHA-256 hash over all evidence Shell features: Banner with identity + attestation summary BASCULE_* env vars injected into inner shell --info mode for dry-run display --json mode for machine-readable output --exec mode for single-command execution Configurable via ~/.config/bascule/shell.toml Tested on Fedora with real TPM 2.0: 6 PCRs successfully read from hardware All env vars propagated to inner shell 1.8MB binary, 0 substrate deps Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
58 lines
1.4 KiB
YAML
58 lines
1.4 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
env:
|
|
CARGO_TERM_COLOR: always
|
|
RUSTFLAGS: -Dwarnings
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install Rust
|
|
uses: dtolnay/rust-toolchain@stable
|
|
with:
|
|
components: clippy, rustfmt
|
|
|
|
- name: Cache cargo
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
~/.cargo/registry
|
|
~/.cargo/git
|
|
target
|
|
key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
|
|
restore-keys: ${{ runner.os }}-cargo-
|
|
|
|
- name: Check formatting
|
|
run: cargo fmt --all --check
|
|
|
|
- name: Build (default features)
|
|
run: cargo build --release -p bascule-server
|
|
|
|
- name: Build (all features)
|
|
run: cargo build --release -p bascule-server --features agent-id
|
|
|
|
- name: Clippy
|
|
run: cargo clippy --all-targets --all-features -- -D warnings
|
|
|
|
- name: Tests
|
|
run: cargo test --all
|
|
|
|
- name: Binary size
|
|
run: ls -lh target/release/bascule
|
|
|
|
- name: Substrate contamination check
|
|
run: |
|
|
count=$(grep -c "substrate\|chronicle\|gsap\|hfl\|metakernel" Cargo.lock || true)
|
|
if [ "$count" -gt 0 ]; then
|
|
echo "ERROR: Substrate dependencies found in Cargo.lock"
|
|
exit 1
|
|
fi
|