From e4c9b69b4668e799cbe373d9c56680febef89640 Mon Sep 17 00:00:00 2001 From: Privatae Date: Tue, 20 Oct 2026 04:42:14 +0000 Subject: [PATCH] bastion 0.53.2 --- .gitea/workflows/ci.yml | 124 + .gitignore | 10 + CHANGELOG.md | 1621 +++++++++++++ CONTRIBUTING.md | 77 + LICENSE | 674 ++++++ README.md | 1516 +++++++++++++ SECURITY.md | 121 + client-go/.gitignore | 7 + client-go/addfolder.go | 158 ++ client-go/agents.go | 901 ++++++++ client-go/agents_darwin.go | 216 ++ client-go/agents_exe_linux_test.go | 120 + client-go/agents_kind_test.go | 384 ++++ client-go/agents_linux.go | 170 ++ client-go/agents_linux_test.go | 30 + client-go/agents_other.go | 36 + client-go/agents_parse.go | 862 +++++++ client-go/agents_test.go | 744 ++++++ client-go/agents_windows.go | 530 +++++ client-go/anchor.go | 1308 +++++++++++ client-go/anchor_release.go | 211 ++ client-go/anchor_release_test.go | 242 ++ client-go/anchor_test.go | 1732 ++++++++++++++ client-go/approvalpipe.go | 517 +++++ client-go/approvalpipe_loop_test.go | 188 ++ client-go/approvalpipe_test.go | 366 +++ client-go/approvalpipe_windows.go | 456 ++++ client-go/approvals_owner.go | 164 ++ client-go/approvals_owner_test.go | 97 + client-go/backupcli.go | 408 ++++ client-go/backupcli_test.go | 52 + client-go/backupfetch.go | 548 +++++ client-go/backupfetch_scope_test.go | 63 + client-go/backupfetch_test.go | 417 ++++ client-go/backupfixture_test.go | 106 + client-go/backuphash_bound_test.go | 96 + client-go/backuphash_progress_test.go | 184 ++ client-go/backupkey.go | 467 ++++ client-go/backupkey_test.go | 206 ++ client-go/backuplist.go | 324 +++ client-go/backuplist_test.go | 245 ++ client-go/backuppush.go | 545 +++++ client-go/backuppush_bound_test.go | 78 + client-go/backuppush_headers_test.go | 165 ++ client-go/backuppush_stuck_test.go | 344 +++ client-go/backuppush_test.go | 331 +++ client-go/backupreads_test.go | 231 ++ client-go/backupreseal.go | 676 ++++++ client-go/backupreseal_bind_test.go | 151 ++ client-go/backupreseal_store_test.go | 192 ++ client-go/backupreseal_test.go | 527 +++++ client-go/backupretention.go | 155 ++ client-go/backupretention_test.go | 268 +++ client-go/backuproot_test.go | 297 +++ client-go/backupshared_bound_test.go | 184 ++ client-go/backupstate.go | 859 +++++++ client-go/baseline.go | 827 +++++++ client-go/baseline_all_linux.go | 74 + client-go/baseline_all_other.go | 14 + client-go/baseline_classes_review_test.go | 387 ++++ client-go/baseline_classes_test.go | 469 ++++ client-go/baseline_classes_wiring_test.go | 764 +++++++ client-go/baseline_identity.go | 408 ++++ client-go/baseline_identity_linux.go | 425 ++++ client-go/baseline_identity_other.go | 41 + client-go/baseline_listeners.go | 139 ++ client-go/baseline_test.go | 478 ++++ client-go/baselinesign.go | 546 +++++ client-go/baselinesign_test.go | 951 ++++++++ client-go/baselinesign_unix_test.go | 41 + client-go/buildtags_test.go | 129 ++ client-go/capsfamily_test.go | 252 +++ client-go/claims_git_test.go | 431 ++++ client-go/claims_static_test.go | 1043 +++++++++ client-go/claims_tunnel_test.go | 130 ++ client-go/claims_unix_test.go | 635 ++++++ client-go/claims_update_forward_test.go | 175 ++ client-go/claims_update_test.go | 85 + client-go/coder_egress.go | 385 ++++ client-go/coder_forward.go | 151 ++ client-go/coder_grant.go | 366 +++ client-go/coder_socket.go | 351 +++ client-go/coder_socket_peer_linux.go | 93 + client-go/coder_socket_peer_other.go | 11 + client-go/coders.go | 1994 ++++++++++++++++ client-go/coders_cli.go | 321 +++ client-go/coders_linux.go | 63 + client-go/coders_linux_test.go | 2010 +++++++++++++++++ client-go/coders_live_linux_test.go | 203 ++ client-go/coders_other.go | 25 + client-go/computer.go | 318 +++ client-go/computer_darwin.go | 153 ++ client-go/computer_darwin_test.go | 37 + client-go/computer_linux.go | 278 +++ client-go/computer_linux_test.go | 75 + client-go/computer_other.go | 16 + client-go/computer_test.go | 156 ++ client-go/computer_tree.go | 213 ++ client-go/computer_tree_darwin.go | 54 + client-go/computer_tree_linux.go | 107 + client-go/computer_tree_other.go | 7 + client-go/computer_tree_test.go | 125 + client-go/computer_tree_windows.go | 107 + client-go/computer_windows.go | 188 ++ client-go/config.go | 651 ++++++ client-go/config_test.go | 212 ++ client-go/console_hostops.go | 163 ++ client-go/console_test.go | 158 ++ client-go/console_unix.go | 11 + client-go/console_windows.go | 53 + client-go/contain.go | 210 ++ client-go/containfinding.go | 477 ++++ client-go/containfinding_test.go | 524 +++++ client-go/contextextract.go | 770 +++++++ client-go/contextextract_test.go | 351 +++ client-go/contextframes.go | 652 ++++++ client-go/contextframes_test.go | 592 +++++ client-go/contextocr.go | 756 +++++++ client-go/contextocr_layerfirst_test.go | 465 ++++ client-go/contextocr_test.go | 1176 ++++++++++ client-go/contextoffice.go | 1691 ++++++++++++++ .../contextoffice_defect_fixtures_test.go | 705 ++++++ client-go/contextoffice_fixtures_test.go | 411 ++++ .../contextoffice_order_fixtures_test.go | 1412 ++++++++++++ client-go/contextoffice_order_test.go | 374 +++ client-go/contextoffice_test.go | 881 ++++++++ client-go/contextprep.go | 471 ++++ client-go/contextprep_test.go | 302 +++ client-go/contextpull.go | 277 +++ client-go/contextpull_test.go | 529 +++++ client-go/contextsock.go | 214 ++ client-go/contextsock_darwin.go | 17 + client-go/contextsock_linux.go | 15 + client-go/contextsock_test.go | 281 +++ client-go/contextsock_unix.go | 114 + client-go/contextsock_windows.go | 43 + client-go/contextstt.go | 1411 ++++++++++++ client-go/contextstt_test.go | 916 ++++++++ client-go/contextui.go | 138 ++ client-go/ctx.go | 180 ++ client-go/ctx_test.go | 88 + client-go/ctxcap_measure_test.go | 131 ++ client-go/dcn.go | 814 +++++++ client-go/dcn_plan.go | 411 ++++ client-go/dcn_plan_test.go | 216 ++ client-go/dcn_test.go | 286 +++ client-go/delta.go | 998 ++++++++ client-go/delta_blind_class_test.go | 332 +++ client-go/delta_linux.go | 217 ++ client-go/delta_linux_test.go | 80 + client-go/delta_other.go | 30 + client-go/delta_test.go | 1451 ++++++++++++ client-go/deltacache.go | 144 ++ client-go/deltacache_darwin.go | 25 + client-go/deltacache_linux.go | 24 + client-go/deltacache_other.go | 12 + client-go/deltacache_test.go | 125 + client-go/deltacache_windows.go | 28 + client-go/deltanoise.go | 439 ++++ client-go/deltarun.go | 791 +++++++ client-go/deltastate.go | 314 +++ client-go/device.go | 1029 +++++++++ client-go/device_plan.go | 343 +++ client-go/directive_refusal.go | 71 + client-go/diskmap.go | 884 ++++++++ client-go/diskmap_fifo_unix_test.go | 10 + client-go/diskmap_fifo_windows_test.go | 9 + client-go/diskmap_scope_test.go | 243 ++ client-go/diskmap_test.go | 590 +++++ client-go/diskmap_unix.go | 59 + client-go/diskmap_windows.go | 98 + client-go/egress.go | 259 +++ client-go/egress_relay.go | 118 + client-go/egress_test.go | 127 ++ client-go/enforcing.go | 239 ++ client-go/enforcing_test.go | 89 + client-go/env.go | 34 + client-go/env_test.go | 94 + client-go/events.go | 196 ++ client-go/events_test.go | 235 ++ client-go/filelock_unix.go | 23 + client-go/filelock_windows.go | 25 + client-go/freeagent.go | 441 ++++ client-go/freeagent_drop.go | 368 +++ client-go/freeagent_drop_test.go | 376 +++ client-go/freeagent_drop_unix.go | 195 ++ client-go/freeagent_drop_windows.go | 463 ++++ client-go/freeagent_drop_winrules.go | 130 ++ client-go/freeagent_drop_winrules_test.go | 143 ++ client-go/freeagent_managed.go | 1063 +++++++++ client-go/freeagent_managed_test.go | 628 +++++ client-go/freeagent_sign_test.go | 167 ++ client-go/freeagent_test.go | 300 +++ client-go/fuzz_backup_test.go | 90 + client-go/fuzz_grants_test.go | 347 +++ client-go/fuzz_ops_linux_test.go | 74 + client-go/fuzz_paths_test.go | 103 + client-go/fuzz_paths_unix_test.go | 408 ++++ client-go/fuzz_signed_test.go | 74 + client-go/fuzz_tunnel_test.go | 36 + client-go/gitlane.go | 235 ++ client-go/go.mod | 25 + client-go/go.sum | 38 + client-go/harness.go | 853 +++++++ client-go/hostname_guard_test.go | 22 + client-go/hostops_test.go | 1082 +++++++++ client-go/inferencefilter.go | 471 ++++ client-go/keepalive.go | 74 + client-go/keepalive_test.go | 117 + client-go/killtree.go | 390 ++++ client-go/killtree_real_linux_test.go | 276 +++ client-go/killtree_test.go | 554 +++++ client-go/killtree_unix.go | 12 + client-go/killtree_windows.go | 14 + client-go/lab.go | 849 +++++++ client-go/llm_openai_test.go | 135 ++ client-go/local_host_linux_test.go | 1220 ++++++++++ client-go/local_host_tcp_linux_test.go | 504 +++++ client-go/localdeny.go | 280 +++ client-go/localdeny_frame_test.go | 115 + client-go/localdeny_test.go | 279 +++ client-go/localdeny_twoprocess_test.go | 106 + client-go/machinestore.go | 1281 +++++++++++ client-go/machinestore_test.go | 1834 +++++++++++++++ client-go/machinestore_unix_test.go | 91 + client-go/main.go | 625 +++++ client-go/main_test.go | 138 ++ client-go/mgmt.go | 605 +++++ client-go/mgmt_audit.go | 462 ++++ client-go/mgmt_audit_roll_test.go | 138 ++ client-go/mgmt_audit_test.go | 607 +++++ client-go/mirror.go | 1052 +++++++++ client-go/mirror_test.go | 227 ++ client-go/mode.go | 134 ++ client-go/modelscope.go | 167 ++ client-go/modelscope_test.go | 887 ++++++++ client-go/modelswap.go | 1315 +++++++++++ client-go/modelswap_async_internal_test.go | 214 ++ client-go/modelswap_async_test.go | 486 ++++ client-go/modelswap_test.go | 869 +++++++ client-go/notify.go | 387 ++++ client-go/notify_test.go | 437 ++++ client-go/notify_windows.go | 508 +++++ client-go/observe.go | 33 + client-go/observe_endpoints.go | 216 ++ client-go/observe_endpoints_test.go | 1174 ++++++++++ client-go/observe_ops.go | 968 ++++++++ client-go/observe_ops_linux.go | 356 +++ client-go/observe_ops_other.go | 19 + client-go/observe_ops_test.go | 785 +++++++ client-go/observe_pull.go | 958 ++++++++ client-go/ocrprobe.png | Bin 0 -> 1975 bytes client-go/operatorsecret_auth_test.go | 50 + client-go/opmask.go | 258 +++ client-go/opmask_test.go | 320 +++ client-go/ops.go | 1707 ++++++++++++++ client-go/ops_action.go | 542 +++++ client-go/ops_action_linux.go | 909 ++++++++ client-go/ops_action_linux_test.go | 836 +++++++ client-go/ops_action_test.go | 308 +++ client-go/ops_exec_linux.go | 1151 ++++++++++ client-go/ops_exec_other.go | 95 + client-go/ops_linux_test.go | 362 +++ client-go/ops_memory_linux.go | 407 ++++ client-go/ops_plan.go | 775 +++++++ client-go/ops_plan_linux.go | 854 +++++++ client-go/ops_plan_linux_test.go | 983 ++++++++ client-go/ops_plan_test.go | 573 +++++ client-go/ops_receipts.go | 299 +++ client-go/ops_seal.go | 204 ++ client-go/ops_test.go | 799 +++++++ client-go/ops_verbs_linux.go | 919 ++++++++ client-go/ops_verbs_linux_test.go | 600 +++++ client-go/ops_view.go | 269 +++ client-go/ops_view_test.go | 118 + client-go/origin.go | 261 +++ client-go/origin_darwin.go | 71 + client-go/origin_darwin_test.go | 16 + client-go/origin_linux.go | 132 ++ client-go/origin_linux_test.go | 34 + client-go/origin_other.go | 14 + client-go/origin_test.go | 259 +++ client-go/origin_windows.go | 97 + client-go/otherbastions.go | 410 ++++ client-go/otherbastions_test.go | 407 ++++ client-go/ownaddr.go | 146 ++ client-go/ownaddr_linux.go | 127 ++ client-go/ownaddr_netns_linux_test.go | 339 +++ client-go/ownaddr_other.go | 7 + client-go/ownaddr_test.go | 222 ++ client-go/owner.go | 230 ++ client-go/owner_test.go | 172 ++ client-go/pair.go | 542 +++++ client-go/pair_fp_test.go | 126 ++ client-go/pair_stdin.go | 68 + client-go/pair_stdin_test.go | 182 ++ client-go/pair_tcp.go | 351 +++ client-go/pair_unix.go | 295 +++ client-go/pairing_ops.go | 367 +++ client-go/pairing_redeem_test.go | 213 ++ client-go/peers.go | 85 + client-go/peers_test.go | 192 ++ client-go/pii.go | 95 + client-go/pii_test.go | 105 + client-go/policy.go | 767 +++++++ client-go/policy_seam_test.go | 188 ++ client-go/policy_test.go | 688 ++++++ client-go/privilege.go | 140 ++ client-go/privilege_test.go | 125 + client-go/privilege_windows.go | 92 + client-go/procidentity_linux.go | 31 + client-go/procidentity_other.go | 7 + client-go/publicname_test.go | 175 ++ client-go/quarantine.go | 245 ++ client-go/reconcile.go | 169 ++ client-go/relaunch_unix.go | 9 + client-go/relaunch_windows.go | 66 + client-go/release_sign.go | 172 ++ client-go/release_sign_agent_test.go | 55 + client-go/release_sign_test.go | 225 ++ client-go/review_fixes_test.go | 381 ++++ client-go/rootexec.go | 742 ++++++ client-go/rootexec_test.go | 757 +++++++ client-go/rootexec_unix.go | 145 ++ client-go/rootexec_watch.go | 377 ++++ client-go/rootexec_watch_connect_test.go | 40 + client-go/rootexec_watch_linux.go | 453 ++++ client-go/rootexec_watch_linux_test.go | 308 +++ client-go/rootexec_watch_other.go | 27 + client-go/rootexec_watch_test.go | 304 +++ client-go/rootexec_windows.go | 15 + client-go/rotate.go | 535 +++++ client-go/rotate_test.go | 657 ++++++ client-go/run.go | 1209 ++++++++++ client-go/runguard_darwin.go | 31 + client-go/runguard_test.go | 19 + client-go/runguard_unix.go | 13 + client-go/runguard_windows.go | 107 + client-go/runlock_unix.go | 63 + client-go/runlock_unix_test.go | 78 + client-go/sanction.go | 770 +++++++ client-go/sanction_test.go | 830 +++++++ client-go/schedulers.go | 456 ++++ client-go/schedulers_darwin.go | 42 + client-go/schedulers_linux.go | 77 + client-go/schedulers_test.go | 137 ++ client-go/schedulers_windows.go | 50 + client-go/seccomp-personal.json | 472 ++++ client-go/service.go | 758 +++++++ client-go/service_mirror.go | 417 ++++ client-go/service_mirror_e2e_test.go | 120 + client-go/service_mirror_test.go | 380 ++++ client-go/service_peer.go | 28 + client-go/service_peer_other.go | 14 + client-go/service_reach.go | 483 ++++ client-go/service_reach_test.go | 375 +++ client-go/service_sock_linux.go | 37 + client-go/service_sock_linux_test.go | 97 + client-go/service_sock_other.go | 16 + client-go/service_test.go | 854 +++++++ client-go/session.go | 714 ++++++ client-go/session_test.go | 756 +++++++ client-go/session_unix.go | 207 ++ client-go/session_windows.go | 17 + client-go/singleton.go | 557 +++++ client-go/singleton_linux.go | 37 + client-go/singleton_other.go | 14 + client-go/singleton_test.go | 573 +++++ client-go/singleton_windows.go | 19 + client-go/status_liveness_test.go | 46 + client-go/stdio_console_darwin.go | 26 + client-go/stdio_console_linux.go | 26 + client-go/stdio_console_other.go | 11 + client-go/stdio_console_windows.go | 23 + client-go/stepup.go | 1340 +++++++++++ client-go/stepup_enroll_test.go | 168 ++ client-go/stepup_landing_test.go | 82 + client-go/stepup_qr.go | 66 + client-go/stepup_qr_test.go | 136 ++ client-go/stepup_test.go | 277 +++ client-go/supervise_test.go | 192 ++ client-go/switch_cli.go | 142 ++ client-go/switch_cli_test.go | 155 ++ client-go/sysservice.go | 376 +++ client-go/sysservice_darwin.go | 169 ++ client-go/sysservice_notwindows.go | 7 + client-go/sysservice_other.go | 20 + client-go/sysservice_other_test.go | 49 + .../sysservice_programfiles_static_test.go | 76 + client-go/sysservice_test.go | 441 ++++ client-go/sysservice_windows.go | 384 ++++ .../4d281d39fdc26bfe | 2 + .../bfd9f136c796aa84 | 3 + .../fe04d9ca36bc8d1b | 3 + .../49b7f44fb359f528 | 4 + client-go/testdata/mirror_url_vectors.json | 218 ++ client-go/tray.go | 194 ++ client-go/tray_other.go | 24 + client-go/tray_pipe_windows.go | 194 ++ client-go/tray_test.go | 224 ++ client-go/tray_windows.go | 184 ++ client-go/ui.go | 938 ++++++++ client-go/ui_approvals_flow_test.go | 189 ++ client-go/ui_approvals_test.go | 311 +++ client-go/ui_banners_test.go | 213 ++ client-go/ui_preview_test.go | 80 + client-go/ui_test.go | 365 +++ client-go/uiassets/agents.css | 88 + client-go/uiassets/agents.html | 244 ++ client-go/uiassets/app.css | 188 ++ client-go/uiassets/approvals.html | 110 + client-go/uiassets/context.css | 62 + client-go/uiassets/context.html | 203 ++ client-go/uiassets/diskmap.css | 126 ++ client-go/uiassets/diskmap.html | 257 +++ client-go/uiassets/given.css | 59 + client-go/uiassets/given.html | 193 ++ client-go/uiassets/htmx.LICENSE | 13 + client-go/uiassets/htmx.min.js | 1 + client-go/uiassets/page.html | 66 + client-go/uiassets/policy.css | 119 + client-go/uiassets/policy.html | 269 +++ client-go/uiassets/setup.css | 97 + client-go/uiassets/setup.html | 287 +++ client-go/uiassets/status.html | 170 ++ client-go/uiassets/tray-bad.ico | Bin 0 -> 27218 bytes client-go/uiassets/tray-ok.ico | Bin 0 -> 27391 bytes client-go/uiassets/tray-warn.ico | Bin 0 -> 27927 bytes client-go/uiauth.go | 317 +++ client-go/uiauth_test.go | 271 +++ client-go/uicontext.go | 444 ++++ client-go/uicontext_test.go | 679 ++++++ client-go/uidevice.go | 388 ++++ client-go/uidevice_test.go | 499 ++++ client-go/uidiskmap.go | 1046 +++++++++ client-go/uidiskmap_scope_test.go | 212 ++ client-go/uidiskmap_test.go | 971 ++++++++ client-go/uigiven.go | 681 ++++++ client-go/uigiven_test.go | 1142 ++++++++++ client-go/uipolicy.go | 471 ++++ client-go/uipolicy_test.go | 538 +++++ client-go/uipopup_other.go | 8 + client-go/uipopup_windows.go | 61 + client-go/uisanction.go | 421 ++++ client-go/uisanction_test.go | 591 +++++ client-go/uisetup.go | 990 ++++++++ client-go/uisetup_test.go | 899 ++++++++ client-go/uitray.go | 106 + client-go/uitray_test.go | 163 ++ client-go/uiwalkfail_test.go | 229 ++ client-go/update.go | 415 ++++ client-go/update_available_test.go | 203 ++ client-go/update_swap_test.go | 50 + client-go/update_test.go | 21 + client-go/walkfail_test.go | 500 ++++ client-go/writes.go | 398 ++++ deploy/VERSION | 1 + deploy/build.sh | 47 + deploy/check-claims.sh | 70 + deploy/fuzz.sh | 25 + deploy/install.ps1 | 233 ++ deploy/install.sh | 193 ++ deploy/publish.sh | 337 +++ deploy/release-sign/go.mod | 10 + deploy/release-sign/go.sum | 6 + deploy/release-sign/main.go | 387 ++++ deploy/release-sign/main_test.go | 199 ++ deploy/release-sign/pinned.go | 60 + deploy/release-verify.sh | 50 + deploy/verify-release.sh | 87 + scripts/test_no_personal_data.py | 524 +++++ 471 files changed, 159794 insertions(+) create mode 100644 .gitea/workflows/ci.yml create mode 100644 .gitignore create mode 100644 CHANGELOG.md create mode 100644 CONTRIBUTING.md create mode 100644 LICENSE create mode 100644 README.md create mode 100644 SECURITY.md create mode 100644 client-go/.gitignore create mode 100644 client-go/addfolder.go create mode 100644 client-go/agents.go create mode 100644 client-go/agents_darwin.go create mode 100644 client-go/agents_exe_linux_test.go create mode 100644 client-go/agents_kind_test.go create mode 100644 client-go/agents_linux.go create mode 100644 client-go/agents_linux_test.go create mode 100644 client-go/agents_other.go create mode 100644 client-go/agents_parse.go create mode 100644 client-go/agents_test.go create mode 100644 client-go/agents_windows.go create mode 100644 client-go/anchor.go create mode 100644 client-go/anchor_release.go create mode 100644 client-go/anchor_release_test.go create mode 100644 client-go/anchor_test.go create mode 100644 client-go/approvalpipe.go create mode 100644 client-go/approvalpipe_loop_test.go create mode 100644 client-go/approvalpipe_test.go create mode 100644 client-go/approvalpipe_windows.go create mode 100644 client-go/approvals_owner.go create mode 100644 client-go/approvals_owner_test.go create mode 100644 client-go/backupcli.go create mode 100644 client-go/backupcli_test.go create mode 100644 client-go/backupfetch.go create mode 100644 client-go/backupfetch_scope_test.go create mode 100644 client-go/backupfetch_test.go create mode 100644 client-go/backupfixture_test.go create mode 100644 client-go/backuphash_bound_test.go create mode 100644 client-go/backuphash_progress_test.go create mode 100644 client-go/backupkey.go create mode 100644 client-go/backupkey_test.go create mode 100644 client-go/backuplist.go create mode 100644 client-go/backuplist_test.go create mode 100644 client-go/backuppush.go create mode 100644 client-go/backuppush_bound_test.go create mode 100644 client-go/backuppush_headers_test.go create mode 100644 client-go/backuppush_stuck_test.go create mode 100644 client-go/backuppush_test.go create mode 100644 client-go/backupreads_test.go create mode 100644 client-go/backupreseal.go create mode 100644 client-go/backupreseal_bind_test.go create mode 100644 client-go/backupreseal_store_test.go create mode 100644 client-go/backupreseal_test.go create mode 100644 client-go/backupretention.go create mode 100644 client-go/backupretention_test.go create mode 100644 client-go/backuproot_test.go create mode 100644 client-go/backupshared_bound_test.go create mode 100644 client-go/backupstate.go create mode 100644 client-go/baseline.go create mode 100644 client-go/baseline_all_linux.go create mode 100644 client-go/baseline_all_other.go create mode 100644 client-go/baseline_classes_review_test.go create mode 100644 client-go/baseline_classes_test.go create mode 100644 client-go/baseline_classes_wiring_test.go create mode 100644 client-go/baseline_identity.go create mode 100644 client-go/baseline_identity_linux.go create mode 100644 client-go/baseline_identity_other.go create mode 100644 client-go/baseline_listeners.go create mode 100644 client-go/baseline_test.go create mode 100644 client-go/baselinesign.go create mode 100644 client-go/baselinesign_test.go create mode 100644 client-go/baselinesign_unix_test.go create mode 100644 client-go/buildtags_test.go create mode 100644 client-go/capsfamily_test.go create mode 100644 client-go/claims_git_test.go create mode 100644 client-go/claims_static_test.go create mode 100644 client-go/claims_tunnel_test.go create mode 100644 client-go/claims_unix_test.go create mode 100644 client-go/claims_update_forward_test.go create mode 100644 client-go/claims_update_test.go create mode 100644 client-go/coder_egress.go create mode 100644 client-go/coder_forward.go create mode 100644 client-go/coder_grant.go create mode 100644 client-go/coder_socket.go create mode 100644 client-go/coder_socket_peer_linux.go create mode 100644 client-go/coder_socket_peer_other.go create mode 100644 client-go/coders.go create mode 100644 client-go/coders_cli.go create mode 100644 client-go/coders_linux.go create mode 100644 client-go/coders_linux_test.go create mode 100644 client-go/coders_live_linux_test.go create mode 100644 client-go/coders_other.go create mode 100644 client-go/computer.go create mode 100644 client-go/computer_darwin.go create mode 100644 client-go/computer_darwin_test.go create mode 100644 client-go/computer_linux.go create mode 100644 client-go/computer_linux_test.go create mode 100644 client-go/computer_other.go create mode 100644 client-go/computer_test.go create mode 100644 client-go/computer_tree.go create mode 100644 client-go/computer_tree_darwin.go create mode 100644 client-go/computer_tree_linux.go create mode 100644 client-go/computer_tree_other.go create mode 100644 client-go/computer_tree_test.go create mode 100644 client-go/computer_tree_windows.go create mode 100644 client-go/computer_windows.go create mode 100644 client-go/config.go create mode 100644 client-go/config_test.go create mode 100644 client-go/console_hostops.go create mode 100644 client-go/console_test.go create mode 100644 client-go/console_unix.go create mode 100644 client-go/console_windows.go create mode 100644 client-go/contain.go create mode 100644 client-go/containfinding.go create mode 100644 client-go/containfinding_test.go create mode 100644 client-go/contextextract.go create mode 100644 client-go/contextextract_test.go create mode 100644 client-go/contextframes.go create mode 100644 client-go/contextframes_test.go create mode 100644 client-go/contextocr.go create mode 100644 client-go/contextocr_layerfirst_test.go create mode 100644 client-go/contextocr_test.go create mode 100644 client-go/contextoffice.go create mode 100644 client-go/contextoffice_defect_fixtures_test.go create mode 100644 client-go/contextoffice_fixtures_test.go create mode 100644 client-go/contextoffice_order_fixtures_test.go create mode 100644 client-go/contextoffice_order_test.go create mode 100644 client-go/contextoffice_test.go create mode 100644 client-go/contextprep.go create mode 100644 client-go/contextprep_test.go create mode 100644 client-go/contextpull.go create mode 100644 client-go/contextpull_test.go create mode 100644 client-go/contextsock.go create mode 100644 client-go/contextsock_darwin.go create mode 100644 client-go/contextsock_linux.go create mode 100644 client-go/contextsock_test.go create mode 100644 client-go/contextsock_unix.go create mode 100644 client-go/contextsock_windows.go create mode 100644 client-go/contextstt.go create mode 100644 client-go/contextstt_test.go create mode 100644 client-go/contextui.go create mode 100644 client-go/ctx.go create mode 100644 client-go/ctx_test.go create mode 100644 client-go/ctxcap_measure_test.go create mode 100644 client-go/dcn.go create mode 100644 client-go/dcn_plan.go create mode 100644 client-go/dcn_plan_test.go create mode 100644 client-go/dcn_test.go create mode 100644 client-go/delta.go create mode 100644 client-go/delta_blind_class_test.go create mode 100644 client-go/delta_linux.go create mode 100644 client-go/delta_linux_test.go create mode 100644 client-go/delta_other.go create mode 100644 client-go/delta_test.go create mode 100644 client-go/deltacache.go create mode 100644 client-go/deltacache_darwin.go create mode 100644 client-go/deltacache_linux.go create mode 100644 client-go/deltacache_other.go create mode 100644 client-go/deltacache_test.go create mode 100644 client-go/deltacache_windows.go create mode 100644 client-go/deltanoise.go create mode 100644 client-go/deltarun.go create mode 100644 client-go/deltastate.go create mode 100644 client-go/device.go create mode 100644 client-go/device_plan.go create mode 100644 client-go/directive_refusal.go create mode 100644 client-go/diskmap.go create mode 100644 client-go/diskmap_fifo_unix_test.go create mode 100644 client-go/diskmap_fifo_windows_test.go create mode 100644 client-go/diskmap_scope_test.go create mode 100644 client-go/diskmap_test.go create mode 100644 client-go/diskmap_unix.go create mode 100644 client-go/diskmap_windows.go create mode 100644 client-go/egress.go create mode 100644 client-go/egress_relay.go create mode 100644 client-go/egress_test.go create mode 100644 client-go/enforcing.go create mode 100644 client-go/enforcing_test.go create mode 100644 client-go/env.go create mode 100644 client-go/env_test.go create mode 100644 client-go/events.go create mode 100644 client-go/events_test.go create mode 100644 client-go/filelock_unix.go create mode 100644 client-go/filelock_windows.go create mode 100644 client-go/freeagent.go create mode 100644 client-go/freeagent_drop.go create mode 100644 client-go/freeagent_drop_test.go create mode 100644 client-go/freeagent_drop_unix.go create mode 100644 client-go/freeagent_drop_windows.go create mode 100644 client-go/freeagent_drop_winrules.go create mode 100644 client-go/freeagent_drop_winrules_test.go create mode 100644 client-go/freeagent_managed.go create mode 100644 client-go/freeagent_managed_test.go create mode 100644 client-go/freeagent_sign_test.go create mode 100644 client-go/freeagent_test.go create mode 100644 client-go/fuzz_backup_test.go create mode 100644 client-go/fuzz_grants_test.go create mode 100644 client-go/fuzz_ops_linux_test.go create mode 100644 client-go/fuzz_paths_test.go create mode 100644 client-go/fuzz_paths_unix_test.go create mode 100644 client-go/fuzz_signed_test.go create mode 100644 client-go/fuzz_tunnel_test.go create mode 100644 client-go/gitlane.go create mode 100644 client-go/go.mod create mode 100644 client-go/go.sum create mode 100644 client-go/harness.go create mode 100644 client-go/hostname_guard_test.go create mode 100644 client-go/hostops_test.go create mode 100644 client-go/inferencefilter.go create mode 100644 client-go/keepalive.go create mode 100644 client-go/keepalive_test.go create mode 100644 client-go/killtree.go create mode 100644 client-go/killtree_real_linux_test.go create mode 100644 client-go/killtree_test.go create mode 100644 client-go/killtree_unix.go create mode 100644 client-go/killtree_windows.go create mode 100644 client-go/lab.go create mode 100644 client-go/llm_openai_test.go create mode 100644 client-go/local_host_linux_test.go create mode 100644 client-go/local_host_tcp_linux_test.go create mode 100644 client-go/localdeny.go create mode 100644 client-go/localdeny_frame_test.go create mode 100644 client-go/localdeny_test.go create mode 100644 client-go/localdeny_twoprocess_test.go create mode 100644 client-go/machinestore.go create mode 100644 client-go/machinestore_test.go create mode 100644 client-go/machinestore_unix_test.go create mode 100644 client-go/main.go create mode 100644 client-go/main_test.go create mode 100644 client-go/mgmt.go create mode 100644 client-go/mgmt_audit.go create mode 100644 client-go/mgmt_audit_roll_test.go create mode 100644 client-go/mgmt_audit_test.go create mode 100644 client-go/mirror.go create mode 100644 client-go/mirror_test.go create mode 100644 client-go/mode.go create mode 100644 client-go/modelscope.go create mode 100644 client-go/modelscope_test.go create mode 100644 client-go/modelswap.go create mode 100644 client-go/modelswap_async_internal_test.go create mode 100644 client-go/modelswap_async_test.go create mode 100644 client-go/modelswap_test.go create mode 100644 client-go/notify.go create mode 100644 client-go/notify_test.go create mode 100644 client-go/notify_windows.go create mode 100644 client-go/observe.go create mode 100644 client-go/observe_endpoints.go create mode 100644 client-go/observe_endpoints_test.go create mode 100644 client-go/observe_ops.go create mode 100644 client-go/observe_ops_linux.go create mode 100644 client-go/observe_ops_other.go create mode 100644 client-go/observe_ops_test.go create mode 100644 client-go/observe_pull.go create mode 100644 client-go/ocrprobe.png create mode 100644 client-go/operatorsecret_auth_test.go create mode 100644 client-go/opmask.go create mode 100644 client-go/opmask_test.go create mode 100644 client-go/ops.go create mode 100644 client-go/ops_action.go create mode 100644 client-go/ops_action_linux.go create mode 100644 client-go/ops_action_linux_test.go create mode 100644 client-go/ops_action_test.go create mode 100644 client-go/ops_exec_linux.go create mode 100644 client-go/ops_exec_other.go create mode 100644 client-go/ops_linux_test.go create mode 100644 client-go/ops_memory_linux.go create mode 100644 client-go/ops_plan.go create mode 100644 client-go/ops_plan_linux.go create mode 100644 client-go/ops_plan_linux_test.go create mode 100644 client-go/ops_plan_test.go create mode 100644 client-go/ops_receipts.go create mode 100644 client-go/ops_seal.go create mode 100644 client-go/ops_test.go create mode 100644 client-go/ops_verbs_linux.go create mode 100644 client-go/ops_verbs_linux_test.go create mode 100644 client-go/ops_view.go create mode 100644 client-go/ops_view_test.go create mode 100644 client-go/origin.go create mode 100644 client-go/origin_darwin.go create mode 100644 client-go/origin_darwin_test.go create mode 100644 client-go/origin_linux.go create mode 100644 client-go/origin_linux_test.go create mode 100644 client-go/origin_other.go create mode 100644 client-go/origin_test.go create mode 100644 client-go/origin_windows.go create mode 100644 client-go/otherbastions.go create mode 100644 client-go/otherbastions_test.go create mode 100644 client-go/ownaddr.go create mode 100644 client-go/ownaddr_linux.go create mode 100644 client-go/ownaddr_netns_linux_test.go create mode 100644 client-go/ownaddr_other.go create mode 100644 client-go/ownaddr_test.go create mode 100644 client-go/owner.go create mode 100644 client-go/owner_test.go create mode 100644 client-go/pair.go create mode 100644 client-go/pair_fp_test.go create mode 100644 client-go/pair_stdin.go create mode 100644 client-go/pair_stdin_test.go create mode 100644 client-go/pair_tcp.go create mode 100644 client-go/pair_unix.go create mode 100644 client-go/pairing_ops.go create mode 100644 client-go/pairing_redeem_test.go create mode 100644 client-go/peers.go create mode 100644 client-go/peers_test.go create mode 100644 client-go/pii.go create mode 100644 client-go/pii_test.go create mode 100644 client-go/policy.go create mode 100644 client-go/policy_seam_test.go create mode 100644 client-go/policy_test.go create mode 100644 client-go/privilege.go create mode 100644 client-go/privilege_test.go create mode 100644 client-go/privilege_windows.go create mode 100644 client-go/procidentity_linux.go create mode 100644 client-go/procidentity_other.go create mode 100644 client-go/publicname_test.go create mode 100644 client-go/quarantine.go create mode 100644 client-go/reconcile.go create mode 100644 client-go/relaunch_unix.go create mode 100644 client-go/relaunch_windows.go create mode 100644 client-go/release_sign.go create mode 100644 client-go/release_sign_agent_test.go create mode 100644 client-go/release_sign_test.go create mode 100644 client-go/review_fixes_test.go create mode 100644 client-go/rootexec.go create mode 100644 client-go/rootexec_test.go create mode 100644 client-go/rootexec_unix.go create mode 100644 client-go/rootexec_watch.go create mode 100644 client-go/rootexec_watch_connect_test.go create mode 100644 client-go/rootexec_watch_linux.go create mode 100644 client-go/rootexec_watch_linux_test.go create mode 100644 client-go/rootexec_watch_other.go create mode 100644 client-go/rootexec_watch_test.go create mode 100644 client-go/rootexec_windows.go create mode 100644 client-go/rotate.go create mode 100644 client-go/rotate_test.go create mode 100644 client-go/run.go create mode 100644 client-go/runguard_darwin.go create mode 100644 client-go/runguard_test.go create mode 100644 client-go/runguard_unix.go create mode 100644 client-go/runguard_windows.go create mode 100644 client-go/runlock_unix.go create mode 100644 client-go/runlock_unix_test.go create mode 100644 client-go/sanction.go create mode 100644 client-go/sanction_test.go create mode 100644 client-go/schedulers.go create mode 100644 client-go/schedulers_darwin.go create mode 100644 client-go/schedulers_linux.go create mode 100644 client-go/schedulers_test.go create mode 100644 client-go/schedulers_windows.go create mode 100644 client-go/seccomp-personal.json create mode 100644 client-go/service.go create mode 100644 client-go/service_mirror.go create mode 100644 client-go/service_mirror_e2e_test.go create mode 100644 client-go/service_mirror_test.go create mode 100644 client-go/service_peer.go create mode 100644 client-go/service_peer_other.go create mode 100644 client-go/service_reach.go create mode 100644 client-go/service_reach_test.go create mode 100644 client-go/service_sock_linux.go create mode 100644 client-go/service_sock_linux_test.go create mode 100644 client-go/service_sock_other.go create mode 100644 client-go/service_test.go create mode 100644 client-go/session.go create mode 100644 client-go/session_test.go create mode 100644 client-go/session_unix.go create mode 100644 client-go/session_windows.go create mode 100644 client-go/singleton.go create mode 100644 client-go/singleton_linux.go create mode 100644 client-go/singleton_other.go create mode 100644 client-go/singleton_test.go create mode 100644 client-go/singleton_windows.go create mode 100644 client-go/status_liveness_test.go create mode 100644 client-go/stdio_console_darwin.go create mode 100644 client-go/stdio_console_linux.go create mode 100644 client-go/stdio_console_other.go create mode 100644 client-go/stdio_console_windows.go create mode 100644 client-go/stepup.go create mode 100644 client-go/stepup_enroll_test.go create mode 100644 client-go/stepup_landing_test.go create mode 100644 client-go/stepup_qr.go create mode 100644 client-go/stepup_qr_test.go create mode 100644 client-go/stepup_test.go create mode 100644 client-go/supervise_test.go create mode 100644 client-go/switch_cli.go create mode 100644 client-go/switch_cli_test.go create mode 100644 client-go/sysservice.go create mode 100644 client-go/sysservice_darwin.go create mode 100644 client-go/sysservice_notwindows.go create mode 100644 client-go/sysservice_other.go create mode 100644 client-go/sysservice_other_test.go create mode 100644 client-go/sysservice_programfiles_static_test.go create mode 100644 client-go/sysservice_test.go create mode 100644 client-go/sysservice_windows.go create mode 100644 client-go/testdata/fuzz/FuzzAnExcludedPathIsExcludedHoweverItIsSpelled/4d281d39fdc26bfe create mode 100644 client-go/testdata/fuzz/FuzzAnOpEffectNeverCoversTheMachinesOwnRecord/bfd9f136c796aa84 create mode 100644 client-go/testdata/fuzz/FuzzMovePlanStaysInsideTheRoot/fe04d9ca36bc8d1b create mode 100644 client-go/testdata/fuzz/FuzzServiceSlotPathsStayInTheirDirectory/49b7f44fb359f528 create mode 100644 client-go/testdata/mirror_url_vectors.json create mode 100644 client-go/tray.go create mode 100644 client-go/tray_other.go create mode 100644 client-go/tray_pipe_windows.go create mode 100644 client-go/tray_test.go create mode 100644 client-go/tray_windows.go create mode 100644 client-go/ui.go create mode 100644 client-go/ui_approvals_flow_test.go create mode 100644 client-go/ui_approvals_test.go create mode 100644 client-go/ui_banners_test.go create mode 100644 client-go/ui_preview_test.go create mode 100644 client-go/ui_test.go create mode 100644 client-go/uiassets/agents.css create mode 100644 client-go/uiassets/agents.html create mode 100644 client-go/uiassets/app.css create mode 100644 client-go/uiassets/approvals.html create mode 100644 client-go/uiassets/context.css create mode 100644 client-go/uiassets/context.html create mode 100644 client-go/uiassets/diskmap.css create mode 100644 client-go/uiassets/diskmap.html create mode 100644 client-go/uiassets/given.css create mode 100644 client-go/uiassets/given.html create mode 100644 client-go/uiassets/htmx.LICENSE create mode 100644 client-go/uiassets/htmx.min.js create mode 100644 client-go/uiassets/page.html create mode 100644 client-go/uiassets/policy.css create mode 100644 client-go/uiassets/policy.html create mode 100644 client-go/uiassets/setup.css create mode 100644 client-go/uiassets/setup.html create mode 100644 client-go/uiassets/status.html create mode 100644 client-go/uiassets/tray-bad.ico create mode 100644 client-go/uiassets/tray-ok.ico create mode 100644 client-go/uiassets/tray-warn.ico create mode 100644 client-go/uiauth.go create mode 100644 client-go/uiauth_test.go create mode 100644 client-go/uicontext.go create mode 100644 client-go/uicontext_test.go create mode 100644 client-go/uidevice.go create mode 100644 client-go/uidevice_test.go create mode 100644 client-go/uidiskmap.go create mode 100644 client-go/uidiskmap_scope_test.go create mode 100644 client-go/uidiskmap_test.go create mode 100644 client-go/uigiven.go create mode 100644 client-go/uigiven_test.go create mode 100644 client-go/uipolicy.go create mode 100644 client-go/uipolicy_test.go create mode 100644 client-go/uipopup_other.go create mode 100644 client-go/uipopup_windows.go create mode 100644 client-go/uisanction.go create mode 100644 client-go/uisanction_test.go create mode 100644 client-go/uisetup.go create mode 100644 client-go/uisetup_test.go create mode 100644 client-go/uitray.go create mode 100644 client-go/uitray_test.go create mode 100644 client-go/uiwalkfail_test.go create mode 100644 client-go/update.go create mode 100644 client-go/update_available_test.go create mode 100644 client-go/update_swap_test.go create mode 100644 client-go/update_test.go create mode 100644 client-go/walkfail_test.go create mode 100644 client-go/writes.go create mode 100644 deploy/VERSION create mode 100755 deploy/build.sh create mode 100755 deploy/check-claims.sh create mode 100755 deploy/fuzz.sh create mode 100644 deploy/install.ps1 create mode 100644 deploy/install.sh create mode 100755 deploy/publish.sh create mode 100644 deploy/release-sign/go.mod create mode 100644 deploy/release-sign/go.sum create mode 100644 deploy/release-sign/main.go create mode 100644 deploy/release-sign/main_test.go create mode 100644 deploy/release-sign/pinned.go create mode 100755 deploy/release-verify.sh create mode 100755 deploy/verify-release.sh create mode 100644 scripts/test_no_personal_data.py diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml new file mode 100644 index 0000000..3c55232 --- /dev/null +++ b/.gitea/workflows/ci.yml @@ -0,0 +1,124 @@ +# The checks CONTRIBUTING.md asks for, run on every push to main and every +# pull request into main. It holds no secrets: the only credential is the job's +# own token, used to fetch the commit under test. +# +# Every Go step runs in the Go toolchain image deploy/build.sh builds releases +# with, pinned by digest, so CI and the release use the same compiler. The +# personal-data check is plain Python and runs in the job's own container. +# Each container is capped at 6 CPUs, and GOMAXPROCS says so too, so Go does +# not schedule more threads than the runner is allowed to use. +name: ci + +on: + push: + branches: [main] + pull_request: + branches: [main] + +env: + GO_IMAGE: golang@sha256:1ae0735f00daffa3aaf1363a5184c0d2dc55c78e3db4ec70241cdac97bf84b59 + # The pull request's own head, or the pushed commit. + WANT: ${{ gitea.event.pull_request.head.sha || gitea.sha }} + +jobs: + test: + runs-on: platform + steps: + - name: fetch the commit + run: | + set -euo pipefail + git init -q . + git -c http.extraHeader="Authorization: token ${{ gitea.token }}" \ + fetch -q --depth=1 "${{ gitea.server_url }}/${{ gitea.repository }}.git" "$WANT" + git checkout -q --detach FETCH_HEAD + test "$(git rev-parse HEAD)" = "$WANT" + - name: gofmt, go vet on linux/darwin/windows, build, go test + # pdftotext, python3, setpriv and git are what the extract and peer-identity + # tests call; without them those tests fail rather than skip. Alpine's + # git has no http-backend (it is in git-daemon), which the forge-token + # test serves its repository with. + # The backup tests check this code against the age command itself: a + # pinned age release, its archive checked against the SHA-256 below, + # and PRIVATAE_REQUIRE_AGE makes those tests fail rather than skip if + # it is missing. + run: | + docker run --rm --cpus 6 -e GOMAXPROCS=6 -v "$PWD":/src -w /src/client-go \ + -e GOTOOLCHAIN=local -e CGO_ENABLED=0 -e PRIVATAE_REQUIRE_AGE=1 "$GO_IMAGE" sh -euc ' + apk add -q --no-cache poppler-utils python3 setpriv curl git git-daemon + case "$(uname -m)" in + x86_64) a=amd64; sum=cbe24006683f8eb669266162894b9a522a1af52f2665fbc63a4bb032ed26ac10 ;; + aarch64) a=arm64; sum=6b8dc4333c53a5a57c9e5834e3a48f92605d7154014cd07269ff3327db5d37f4 ;; + *) echo "no pinned age release for $(uname -m)"; exit 1 ;; + esac + curl -fsSL -o /tmp/age.tgz "https://github.com/FiloSottile/age/releases/download/v1.3.2/age-v1.3.2-linux-$a.tar.gz" + echo "$sum /tmp/age.tgz" | sha256sum -c - + tar -xzf /tmp/age.tgz -C /tmp age/age + export AGE_BIN=/tmp/age/age + "$AGE_BIN" --version + echo "== gofmt"; out="$(gofmt -l .)"; [ -z "$out" ] || { echo "$out"; exit 1; } + for os in linux darwin windows; do echo "== go vet ($os)"; GOOS=$os go vet ./...; done + echo "== go build"; go build -o /tmp/privatae-bastion . + echo "== go test"; go test -count=1 ./...' + - name: the same for deploy/release-sign + run: | + docker run --rm --cpus 6 -e GOMAXPROCS=6 -v "$PWD":/src -w /src/deploy/release-sign \ + -e GOTOOLCHAIN=local -e CGO_ENABLED=0 "$GO_IMAGE" sh -euc ' + out="$(gofmt -l .)"; [ -z "$out" ] || { echo "$out"; exit 1; } + for os in linux darwin windows; do GOOS=$os go vet ./...; done + go test -count=1 ./...' + + personal-data: + runs-on: platform + steps: + - name: fetch the commit + run: | + set -euo pipefail + git init -q . + git -c http.extraHeader="Authorization: token ${{ gitea.token }}" \ + fetch -q --depth=1 "${{ gitea.server_url }}/${{ gitea.repository }}.git" "$WANT" + git checkout -q --detach FETCH_HEAD + test "$(git rev-parse HEAD)" = "$WANT" + - name: no person's data in the tree + # Reads files, runs nothing from the tree. The term check needs the + # maintainers' key, which a CI job never holds, so here it is skipped and + # the run says so; the entity-id, provenance, email and phone checks run. + run: python3 scripts/test_no_personal_data.py + - name: no Host source file names in the tree + # The member repository publishes this tree as a release was built, + # and its release step refuses a path into the Host's Python + # (server/... or brain/... .py): this repo has no such files, so the + # path can only name another program's source. Checked here, before a + # merge, instead of after a release is built and signed. git grep exits + # 1 when nothing matches and above 1 when it could not search (no + # repository, a pattern it cannot read); only 1 passes. + run: | + rc=0 + git grep -nIE 'server/[a-z_/]+\.py|brain/[a-z_/]+\.py' || rc=$? + case "$rc" in + 1) ;; + 0) echo "these lines name another program's source file; describe it instead" >&2 + exit 1 ;; + *) echo "git grep could not search the tree (exit $rc), so it was not checked" >&2 + exit 1 ;; + esac + + fuzz: + needs: test + runs-on: platform + steps: + - name: fetch the commit + run: | + set -euo pipefail + git init -q . + git -c http.extraHeader="Authorization: token ${{ gitea.token }}" \ + fetch -q --depth=1 "${{ gitea.server_url }}/${{ gitea.repository }}.git" "$WANT" + git checkout -q --detach FETCH_HEAD + test "$(git rev-parse HEAD)" = "$WANT" + - name: every fuzz target, 5 seconds each + # A short pass on every commit. Run deploy/fuzz.sh with its default of + # 20 seconds before changing a wall a host's input goes through. + run: | + docker run --rm --cpus 6 -e GOMAXPROCS=6 -v "$PWD":/src -w /src \ + -e GOTOOLCHAIN=local -e CGO_ENABLED=0 "$GO_IMAGE" sh -euc ' + apk add -q --no-cache bash + deploy/fuzz.sh 5' diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..91744da --- /dev/null +++ b/.gitignore @@ -0,0 +1,10 @@ +# Build output +client-go/dist/ +client-go/privatae-bastion +client-go/privatae-bastion.exe + +# Editor / OS +.DS_Store +.vscode/ +.idea/ +*.swp diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..e3c3d92 --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,1621 @@ +# Changelog + +All notable changes to the bastion. + +The version in `deploy/VERSION` on `main` is the next release, not necessarily +the one machines run. A merged change waits there until it is published. The +published version is whatever names +at the moment, and it is the only version a bastion will update to. Between a +merge and a publish, `main` is ahead of the manifest. + +Two things can keep a version listed here from reaching most machines: + +- **Superseded before publishing.** When a second release is merged before the + first is published, only the later one is published, and it carries the + changes of both. +- **Held.** Automatic updates move our own machines to a published version + first, and everyone else only after it has run on them for a day without a + machine going silent. A version that fails that check is held: automatic + updates move no other machine to it, and it is never released again, only + superseded by a newer version. + +From 0.39.1 on, a heading marks a version *not published* or *held* once +that is settled. The newest entries may not be published yet; the manifest +says which version is. Older entries are not marked. + +## 0.53.2 + +- **No change to what the bastion does.** Two code comments named source files + of the Host program; they now describe them instead, so the release's source + can be published to the member repository as built. CI checks for such + names before a change merges. + +## 0.53.1 + +- **`switch` turns a capability family off for a host from a terminal.** + `sudo -H privatae-bastion switch on|off` writes the same + local deny list the console page's switch does, so it can only remove + reach: off makes this machine refuse that family for that host and tell it + why, and on clears the refusal without granting anything past the host's + signed grant. Both directions need machine authority. `switch --list` + prints every paired host's families, on or off, one per line, for a person + or a setup script on a machine with no browser; beside a system service on + macOS or Windows it is refused to an ordinary account, whose own state is + not the machine's. The deny list is now replaced whole (temp file and + rename) under a lock both writers take, so the gate never reads it half + written and a switch from the page and one from a terminal cannot drop + each other. +- **`release-sign` signs C-Series Cloud manifests.** It accepts the kind + `cseries-cloud` beside `bastion` and `bastion-agent`, with the same + statement and keys, for the manifest a C-Series Cloud machine's updater + checks before it moves to new images or a new overlay. +- **`release-sign` signs the C-Series App Store catalog.** It accepts the kind + `cseries-store`, with the same statement and keys, for the catalog a + C-Series Host checks before it lists or installs an app from the public + store. A signature for one kind does not verify as another. +- **Fixed: `stepup-enroll --console-only` refused root on Linux.** The + startup check recorded whether the process administers the machine only + when a macOS or Windows system service was installed, and on Linux the + service is the systemd unit, so that check never ran there and root was + told it does not administer the machine. Root on Linux enrols into its own + state, which is the state the unit reads. An ordinary account on Linux is + still refused, and so is every account on macOS and Windows until the + system service is installed. `approvals-owner` shares the rule and now takes + root on Linux the same way. +- **`pair` takes the token on standard input.** `pair -` reads it as the first + line of standard input, so the token is not in the process list while + `pair` runs or in the shell's history after. Every form of `pair` takes `-` + in place of ``, and the token as an argument works as before. `pair` + with no token is still the usage error, whatever standard input is: some + terminals do not register as one, and reading there would wait with nothing + said. At a terminal, `pair -` asks for the token on standard error. A first + line that is empty, more than one word or longer than 4096 bytes is refused, + and no refusal repeats what was read. + +## 0.53.0 + +- **A Host with no platform in a VM on this machine can pair over TCP.** + `pair --redeem-url https://127.0.0.1:8810/v1/local/redeem --host-ca ` + redeems the token on the Host's enroll port (`POST /v1/local/redeem`, the + platform redeem's body) over TLS that trusts that CA and nothing else, no + system roots, and checks the name `host.cseries.internal` on the Host's + certificate. The URL must be `https://[:]/`, with no user + info, query or fragment. `--host-ca` is required with it and refused with a + unix or platform pairing, and must hold CA certificates only; all of this is + checked before the token is read, so a refusal dials nothing. The redeem + follows no redirect: an enroll port that answers with one is refused as it + answered. The Host's answer must say transport `tcp`, carry the same CA as + `--host-ca` and an operator certificate for this bastion's key that the CA + signed for client use, and name a lane on the host the redeem URL names. + The pairing records transport `tcp`, the lane address and the CA, which is + pinned as for a unix pairing: a `pair --replace` under another CA is + refused before the redeem dials, and a pairing does not change transport + on a `--replace`. +- **Its lanes go to the Host's lane port**, the address its answer names, + with the same mutual TLS as the unix lane socket: this bastion's operator + certificate, which the Host knows it by, the pinned CA as the only root, and + the name `host.cseries.internal`. Then the same bearer and protocol: egress, + management, the two parked harness workers, sessions, git, the heartbeat + and what its reply directs. `status` and `pair` show the lane address. +- **What a TCP pairing does not have yet.** No WireGuard forwards: no ollama, + LLM or PII forward, no service slots, no endpoint rotation, as for a unix + pairing. No coder runs, on any machine, Linux included: a run's control + plane is a tunnel port or a socket in a unix pairing's runs directory, and a + TCP pairing has neither, so run-up for a TCP-paired Host is refused before + any container starts, and so is every run-up while this machine's pairings + cannot be read. Off Linux, coder runs stay refused for every pairing, + as before; running them inside the Host's VM is not built. +- `unix://` redeem URLs work as before. +- **Beside a Windows system service, the signed-in person approves in their + own tray.** The service serves a named pipe, `\\.\pipe\privatae-bastion-approvals`. + Its ACL admits SYSTEM, Administrators and interactive users. Interactive + users get read and write and no right to create an instance of the pipe. + Remote clients are refused. The service identifies each client from the + pipe (`GetNamedPipeClientProcessId` and that process's token) and serves + only a process that runs as the person signed in to its own session, in an + active session, and of those only the account that owns this machine's + approvals (below); every other account is refused for list, deny and + approve alike. Through it a client can list the pending step-up requests, + in the words `approvals` prints. It can approve one request id with a code + from the authenticator enrolled here, checked by the existing step-up check + and bound to the sha256 of the purpose the client was shown. It can deny + one, which needs no code. +- **`privatae-bastion approvals-owner --sid [--replace]`**, with + machine authority, records that account in the service's state + (`approvals_owner.json`); an installer's elevated step passes the SID of the + account that ran it. The same SID again changes nothing. A different SID is + refused and the recorded owner stays, unless `--replace` is given, which is + taken only on a console (an Administrator terminal), never with output + captured as an installer runs it. A record that cannot be read is treated + the same way. With no readable owner, the pipe serves nobody. +- **The pipe's name is never free while the service serves it.** A + replacement instance is created before a failed connect's instance is + closed, as it already was before a connected one is handed over. If another + process holds the name when the service starts, the first create fails (it + insists on a new name), and the service tries again, waiting 1 s and + doubling to 60 s, logging once per series of failed attempts and once when + serving again. It never serves under a name it did not create. +- **What never crosses the pipe.** The TOTP secret, `ui.secret` and approval + ids. Device approvals are not listed, because they need no code. +- **Wrong codes on the pipe are limited** (NIST SP 800-63B 5.2.2). Five are + free. After that the pipe takes one attempt per 30 seconds. After 100 in a + row it takes none. A code accepted on any other lane resets the count. +- **`privatae-bastion tray`**: the person's icon and approvals window, run as + them and drawn from the pipe. `service install` starts it at every sign-in + through the HKLM Run value `PrivataeBastionTray`, and `service uninstall` + removes that value. One tray runs per session. The tray checks that the + pipe's server is the `PrivataeBastion` service process before it sends + anything. The daemon's own tray stays as it was for a bastion that runs as + the person; the service still shows none. +- **`stepup-enroll --console-only`**, for an installer's elevated step. The + secret is shown only when standard input and output are a console. It is + saved only in the system service's state: on Windows and macOS when the + service is installed and the process has machine authority, on Linux when + the process is root. Both checks run before a secret exists. +- **`release-anchor --host (--host-ca | --force)`**, with + machine authority, for an anchor whose Host is gone, e.g. a Host on this + machine deleted with its data and set up again. `--host-ca` is the new + Host's CA. It is refused when that is the CA this box pinned for the host, + since the same CA means the same Host, alive, and when this box pinned no + CA to compare. `--force` skips that check and is taken only on a console; + an installer never passes it. All of this is checked before anything + changes. It drops the anchor if it is that host and refuses any other. + It unpairs that host. It renames that host's DCN state (key pin, factor, + grants) to `dcn/.released-