fe5e2cf3c6
SPIRE WorkloadAttestor that reads governance env vars from /proc/{pid}/environ
(walking up the process tree to find gsh) and emits gsap: selectors on workload
SVIDs. Maps BASCULE_* vars set by bascule-shell and future GSH_* vars to the
11-selector vocabulary defined in gsap-types/src/selectors.rs.
- pkg/gsap/selectors.go: shared Go constants mirroring Rust vocabulary
- cmd/gsap-attestor/: plugin implementation with /proc reading, process tree
walking, capability ceiling translation, and fail-open for non-governed processes
- 28 tests covering selector extraction, proc parsing, tree walking, and depth limits
- Makefile, Dockerfile, deploy config updated
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
31 lines
474 B
Makefile
31 lines
474 B
Makefile
MODULE := github.com/guildhouse-cooperative/guildhouse-spire-plugins
|
|
BINDIR := bin
|
|
|
|
PLUGINS := \
|
|
oidc-attestor \
|
|
ssh-credential-composer \
|
|
governance-notifier \
|
|
substrate-keymanager \
|
|
gsap-attestor
|
|
|
|
.PHONY: all build test lint clean proto-gen
|
|
|
|
all: build
|
|
|
|
build: $(addprefix $(BINDIR)/,$(PLUGINS))
|
|
|
|
$(BINDIR)/%: cmd/%/*.go
|
|
@mkdir -p $(BINDIR)
|
|
go build -o $@ ./cmd/$*
|
|
|
|
test:
|
|
go test ./...
|
|
|
|
lint:
|
|
go vet ./...
|
|
|
|
clean:
|
|
rm -rf $(BINDIR) gen/
|
|
|
|
proto-gen:
|
|
buf generate
|