47a5484614
Replace hardcoded posture return in AttestationHandler (Shellstream namespace 0x0005) with PostureReader that reads the posture-current ConfigMap written by the substrate-operator's posture evaluator. Data pipeline is now end-to-end: Keylime verifier -> posture evaluator -> ConfigMap -> bascule-agent Behavior: - posture_source='config': reads posture-current ConfigMap, maps level to PostureLevel, caches with configurable TTL (default 30s) - posture_source='static' or dev_mode: returns configured static level and wire value (replaces hardcoded string for clarity) - Graceful fallback: missing ConfigMap -> PostureLevel::Lockdown (fail-closed) + warning log New dependencies: kube, k8s-openapi, governance-types (via path). Does NOT add keylime-client — reads ConfigMap JSON directly. Signed-off-by: Tyler King <tking@guildhouse.dev> Signed-off-by: Tyler J King <tking727@gmail.com>
59 lines
1.4 KiB
TOML
59 lines
1.4 KiB
TOML
[package]
|
|
name = "bascule-agent"
|
|
version = "0.1.0"
|
|
edition = "2021"
|
|
|
|
[[bin]]
|
|
name = "bascule-agent"
|
|
path = "src/main.rs"
|
|
|
|
[[bin]]
|
|
name = "sb"
|
|
path = "src/bin/sb.rs"
|
|
|
|
[dependencies]
|
|
bascule-core = { workspace = true }
|
|
|
|
tokio = { workspace = true }
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
anyhow = { workspace = true }
|
|
tracing = { workspace = true }
|
|
tracing-subscriber = { workspace = true }
|
|
uuid = { workspace = true }
|
|
chrono = { workspace = true }
|
|
sha2 = { workspace = true }
|
|
jsonwebtoken = { workspace = true }
|
|
reqwest = { workspace = true }
|
|
dashmap = { workspace = true }
|
|
async-trait = { workspace = true }
|
|
|
|
# Cross-workspace path deps — substrate crates
|
|
substrate-rt = { path = "../../substrate/crates/substrate-rt" }
|
|
hfl-types = { path = "../../substrate/crates/hfl-types", features = ["serde", "agent-extensions"] }
|
|
governance-types = { path = "../../substrate/crates/governance-types" }
|
|
|
|
# Kubernetes (for posture ConfigMap reader)
|
|
kube = { workspace = true }
|
|
k8s-openapi = { workspace = true }
|
|
|
|
# Msgpack — retained for convenience constructors and legacy decode paths
|
|
rmp-serde = "1"
|
|
rmpv = { version = "1", features = ["with-serde"] }
|
|
|
|
# Config file parsing
|
|
toml = "0.8"
|
|
|
|
# CLI
|
|
clap = { workspace = true }
|
|
|
|
hex = { workspace = true }
|
|
|
|
# SSH server
|
|
russh = { workspace = true }
|
|
russh-keys = { workspace = true }
|
|
ssh-key = { workspace = true }
|
|
rand = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
tempfile = { workspace = true }
|