Tyler King
a58d548518
- Network-policy SPIRE plugin extension - Governance event notification with merkle anchoring - Shellstream specs for consent channels + HFL embedded ABI - All 17 audit findings from AUDIT.md remediated - SSH credential composer + substrate key manager updates - Test coverage for config + sshcert packages Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
47 lines
1.3 KiB
Go
47 lines
1.3 KiB
Go
// SSH Credential Composer — SPIRE CredentialComposer plugin.
|
|
//
|
|
// Runs in SPIRE Server. Intercepts SVID minting to generate SSH certificates
|
|
// with Shellstream governance extensions. Handles both SSH certificate creation
|
|
// and governance metadata injection in a single plugin.
|
|
package main
|
|
|
|
import (
|
|
"context"
|
|
"log"
|
|
|
|
"github.com/hashicorp/go-plugin"
|
|
"google.golang.org/grpc"
|
|
)
|
|
|
|
var handshakeConfig = plugin.HandshakeConfig{
|
|
ProtocolVersion: 1,
|
|
MagicCookieKey: "ServerAgent",
|
|
MagicCookieValue: "GuildhouseSpire",
|
|
}
|
|
|
|
// SSHCredentialComposerPlugin implements plugin.GRPCPlugin for the credential composer.
|
|
type SSHCredentialComposerPlugin struct {
|
|
plugin.Plugin
|
|
Impl *SSHCredentialComposer
|
|
}
|
|
|
|
func (p *SSHCredentialComposerPlugin) GRPCServer(broker *plugin.GRPCBroker, s *grpc.Server) error {
|
|
log.Println("ssh-credential-composer: gRPC server registered")
|
|
return nil
|
|
}
|
|
|
|
func (p *SSHCredentialComposerPlugin) GRPCClient(ctx context.Context, broker *plugin.GRPCBroker, c *grpc.ClientConn) (interface{}, error) {
|
|
return nil, nil
|
|
}
|
|
|
|
func main() {
|
|
composer := &SSHCredentialComposer{}
|
|
|
|
plugin.Serve(&plugin.ServeConfig{
|
|
HandshakeConfig: handshakeConfig,
|
|
Plugins: map[string]plugin.Plugin{
|
|
"credential_composer": &SSHCredentialComposerPlugin{Impl: composer},
|
|
},
|
|
GRPCServer: plugin.DefaultGRPCServer,
|
|
})
|
|
}
|