fe5e2cf3c6
SPIRE WorkloadAttestor that reads governance env vars from /proc/{pid}/environ
(walking up the process tree to find gsh) and emits gsap: selectors on workload
SVIDs. Maps BASCULE_* vars set by bascule-shell and future GSH_* vars to the
11-selector vocabulary defined in gsap-types/src/selectors.rs.
- pkg/gsap/selectors.go: shared Go constants mirroring Rust vocabulary
- cmd/gsap-attestor/: plugin implementation with /proc reading, process tree
walking, capability ceiling translation, and fail-open for non-governed processes
- 28 tests covering selector extraction, proc parsing, tree walking, and depth limits
- Makefile, Dockerfile, deploy config updated
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
46 lines
1.1 KiB
Go
46 lines
1.1 KiB
Go
// GSAP Attestor — SPIRE WorkloadAttestor plugin.
|
|
//
|
|
// Runs in SPIRE Agent. Reads governance environment variables from
|
|
// the process tree and maps them to GSAP SPIRE selectors for
|
|
// registration matching.
|
|
package main
|
|
|
|
import (
|
|
"context"
|
|
"log"
|
|
|
|
"github.com/hashicorp/go-plugin"
|
|
"google.golang.org/grpc"
|
|
)
|
|
|
|
var handshakeConfig = plugin.HandshakeConfig{
|
|
ProtocolVersion: 1,
|
|
MagicCookieKey: "ServerAgent",
|
|
MagicCookieValue: "GuildhouseSpire",
|
|
}
|
|
|
|
type GsapAttestorPlugin struct {
|
|
plugin.Plugin
|
|
Impl *GsapAttestor
|
|
}
|
|
|
|
func (p *GsapAttestorPlugin) GRPCServer(broker *plugin.GRPCBroker, s *grpc.Server) error {
|
|
log.Println("gsap-attestor: gRPC server registered")
|
|
return nil
|
|
}
|
|
|
|
func (p *GsapAttestorPlugin) GRPCClient(ctx context.Context, broker *plugin.GRPCBroker, c *grpc.ClientConn) (interface{}, error) {
|
|
return nil, nil
|
|
}
|
|
|
|
func main() {
|
|
attestor := &GsapAttestor{}
|
|
|
|
plugin.Serve(&plugin.ServeConfig{
|
|
HandshakeConfig: handshakeConfig,
|
|
Plugins: map[string]plugin.Plugin{
|
|
"workload_attestor": &GsapAttestorPlugin{Impl: attestor},
|
|
},
|
|
GRPCServer: plugin.DefaultGRPCServer,
|
|
})
|
|
}
|