Trilltechnician/incredigo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

rotate: 4 SaaS-token/app-signing drivers + data-separated proof tracking

Browse Source 
Add gitlab, cloudflare, ghactions (MOCK-ONLY) and appsecret (LIVE-VM) one-file
Rotators, each with a table-driven cutover-proof + leak-check test. gitlab/
cloudflare/ghactions are in-place SaaS-token rolls (self/rotate, value-roll,
sealed-secret overwrite) so RevokeOld is a no-op; ghactions seals via
nacl/box.SealAnonymous (no new go.mod dep). appsecret regenerates a local app
signing secret and rewrites it in place across every target file (atomic, mode-
preserving, redacted errors), discoverable via exact-match app-signing key names
in env.go.

Keep real-rotation code distinct from mock code: how each driver's cutover was
validated lives as DATA in internal/rotate/proofs.go (single source of truth) +
docs/ROTATION-PROOFS.md, surfaced as a PROOF column in `incredigo rotate` so a
MOCK-ONLY driver can never be mistaken for a LIVE-VM one. appsecret proven LIVE-VM
against real local files in the sandbox VM.

82 tests green, -race clean on rotate/sink/vault.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
leetcrypt
2026-06-18 15:28:05 -07:00
parent f6d145669c
commit b415c43bff
14 changed files with 1809 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/incredigo/main.go
+14 -8
View File
@@ -442,7 +442,7 @@ func rotateCmd() *cobra.Command {
}
results := rotate.Execute(ctx, gp, ecreds, v)
ew := tabwriter.NewWriter(os.Stdout, 0, 2, 2, ' ', 0)
fmt.Fprintln(ew, "DRIVER\tENTRY\tROTATED\tVERIFIED\tSTORED\tREVOKED\tERROR")
fmt.Fprintln(ew, "DRIVER\tPROOF\tENTRY\tROTATED\tVERIFIED\tSTORED\tREVOKED\tERROR")
var rotated, failed int
for _, r := range results {
errStr := ""
@@ -452,8 +452,8 @@ func rotateCmd() *cobra.Command {
} else {
rotated++
}
fmt.Fprintf(ew, "%s\t%s\t%t\t%t\t%t\t%t\t%s\n",
r.Driver, r.StorePath, r.Rotated, r.Verified, r.Stored, r.Revoked, errStr)
fmt.Fprintf(ew, "%s\t%s\t%s\t%t\t%t\t%t\t%t\t%s\n",
r.Driver, rotate.ProofLevelOf(r.Driver).String(), r.StorePath, r.Rotated, r.Verified, r.Stored, r.Revoked, errStr)
out := "ok"
if r.Err != nil {
out = r.Err.Error()
@@ -486,20 +486,26 @@ func rotateCmd() *cobra.Command {
w := tabwriter.NewWriter(os.Stdout, 0, 2, 2, ' ', 0)
if blastScan {
fmt.Fprintln(w, "DRIVER\tSOURCE\tIDENTITY\tCONSUMERS")
fmt.Fprintln(w, "DRIVER\tPROOF\tSOURCE\tIDENTITY\tCONSUMERS")
} else {
fmt.Fprintln(w, "DRIVER\tSOURCE\tIDENTITY")
fmt.Fprintln(w, "DRIVER\tPROOF\tSOURCE\tIDENTITY")
}
for i, p := range rotate.PlanAll(creds) {
drv := p.Driver
// PROOF is how the driver's real-cutover path was validated
// (LIVE-VM vs MOCK-ONLY) — surfaced so a mock-only driver can
// never be mistaken for a live one. No driver => no proof.
proof := "-"
if drv == "" {
drv = "(none)"
} else {
proof = rotate.ProofLevelOf(p.Driver).String()
}
if blastScan {
fmt.Fprintf(w, "%s\t%s\t%s\t%d file(s)\n",
drv, p.Credential.Source, p.Credential.Identity, len(radius[i].Files()))
fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%d file(s)\n",
drv, proof, p.Credential.Source, p.Credential.Identity, len(radius[i].Files()))
} else {
fmt.Fprintf(w, "%s\t%s\t%s\n", drv, p.Credential.Source, p.Credential.Identity)
fmt.Fprintf(w, "%s\t%s\t%s\t%s\n", drv, proof, p.Credential.Source, p.Credential.Identity)
}
}
w.Flush()