Tyler King
a58d548518
- Network-policy SPIRE plugin extension - Governance event notification with merkle anchoring - Shellstream specs for consent channels + HFL embedded ABI - All 17 audit findings from AUDIT.md remediated - SSH credential composer + substrate key manager updates - Test coverage for config + sshcert packages Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
47 lines
1.2 KiB
Go
47 lines
1.2 KiB
Go
// Substrate KeyManager — SPIRE KeyManager plugin.
|
|
//
|
|
// Runs in SPIRE Server. Manages signing keys with governance-aware rotation.
|
|
// Key rotation events require ceremony approval when the Accord policy demands it,
|
|
// ensuring that CA key changes are governed mutations.
|
|
package main
|
|
|
|
import (
|
|
"context"
|
|
"log"
|
|
|
|
"github.com/hashicorp/go-plugin"
|
|
"google.golang.org/grpc"
|
|
)
|
|
|
|
var handshakeConfig = plugin.HandshakeConfig{
|
|
ProtocolVersion: 1,
|
|
MagicCookieKey: "ServerAgent",
|
|
MagicCookieValue: "GuildhouseSpire",
|
|
}
|
|
|
|
// SubstrateKeyManagerPlugin implements plugin.GRPCPlugin for the key manager.
|
|
type SubstrateKeyManagerPlugin struct {
|
|
plugin.Plugin
|
|
Impl *SubstrateKeyManager
|
|
}
|
|
|
|
func (p *SubstrateKeyManagerPlugin) GRPCServer(broker *plugin.GRPCBroker, s *grpc.Server) error {
|
|
log.Println("substrate-keymanager: gRPC server registered")
|
|
return nil
|
|
}
|
|
|
|
func (p *SubstrateKeyManagerPlugin) GRPCClient(ctx context.Context, broker *plugin.GRPCBroker, c *grpc.ClientConn) (interface{}, error) {
|
|
return nil, nil
|
|
}
|
|
|
|
func main() {
|
|
km := &SubstrateKeyManager{}
|
|
|
|
plugin.Serve(&plugin.ServeConfig{
|
|
HandshakeConfig: handshakeConfig,
|
|
Plugins: map[string]plugin.Plugin{
|
|
"key_manager": &SubstrateKeyManagerPlugin{Impl: km},
|
|
},
|
|
GRPCServer: plugin.DefaultGRPCServer,
|
|
})
|
|
}
|