Jeffrey Paul
1fc11529ed
All checks were successful
check / check (push) Successful in 40s
Reviewed-on: #25
94 lines
4.2 KiB
Markdown
94 lines
4.2 KiB
Markdown
# Workflow
|
|
|
|
* branch (from `main`)
|
|
* do the work in Next Step
|
|
* move Next Step to the top of Completed Steps
|
|
* move the top item of Future Steps into Next Step
|
|
* commit (`TODO.md` changes in the same commit as the work)
|
|
* merge to `main` if the branch is not protected, otherwise open a PR
|
|
* push
|
|
|
|
# Status
|
|
|
|
pre-1.0. No git tags. TODO.md carries open 1.0 security blockers. Work in
|
|
flight on branch secure-enclave-unlocker (clean tree as of 2026-07-06).
|
|
|
|
# Next Step
|
|
|
|
Bring the repo into policy compliance in one commit:
|
|
|
|
- Add fmt-check and hooks targets to the Makefile (test/lint/fmt/check/
|
|
docker already exist).
|
|
- Add REPO_POLICIES.md and .editorconfig.
|
|
- Add .gitea/workflows/check.yml running make check.
|
|
- Verify Dockerfile base images are pinned by sha256.
|
|
|
|
# Completed Steps
|
|
|
|
- 2026-03-11: Secure Enclave unlocker for hardware-backed secret
|
|
protection, plus review fixes (stub panics, derivation index, tests,
|
|
README) on branch secure-enclave-unlocker.
|
|
- 2026-02-28: Repo cleanup, removed stale .cursorrules and coverage.out.
|
|
- Audit fix wave (issues #1, #2, #3, #13, #14): skip unlockers with
|
|
missing metadata, allow uppercase secret names, fix hardcoded
|
|
derivation index, validate names in GetSecretVersion against path
|
|
traversal, return errors instead of panicking, add Warn() on silent
|
|
anomalies.
|
|
- Memory security hardening: LockedBuffer used through encrypt/decrypt
|
|
paths (Save/EncryptWithPassphrase/GetValue/gpg helpers), deprecated
|
|
bare-[]byte APIs removed.
|
|
- Per-secret keypair architecture, vault package refactor, versioning
|
|
with --version, comprehensive test suite with in-memory filesystem.
|
|
- Debug logging system (slog, GODEBUG flag, TTY-aware output).
|
|
- Renamed SEP unlocker to Keychain, reorganized import commands.
|
|
- 2025-05-28: Initial implementation (vault, age encryption, mnemonic,
|
|
CLI).
|
|
|
|
# Future Steps
|
|
|
|
- Compliance (after Next Step lands): keep main green under the new
|
|
.gitea workflow; run make check before every merge.
|
|
- Merge secure-enclave-unlocker to main once review is done.
|
|
- 1.0 critical security blockers (from repo TODO.md):
|
|
- Command injection: GPG key IDs passed unescaped to exec.Command
|
|
(pgpunlocker.go:323-327); data.String() passed unescaped to the
|
|
security command (keychainunlocker.go:472-476).
|
|
- Memory security: KeychainData stores AgePrivKeyPassphrase as a
|
|
plain string (keychainunlocker.go:342,393-396); age identity
|
|
.String() creates unprotected copies (keychainunlocker.go:356,
|
|
pgpunlocker.go:256, version.go:155); age secret key held in a
|
|
plain string in cli/crypto.go:86,91,113; private keys exposed via
|
|
buffer.Bytes() to GPGEncryptFunc and EncryptWithPassphrase.
|
|
- Race conditions: no file locking in vault/secrets.go:142-176;
|
|
non-atomic writes can leave the vault inconsistent.
|
|
- Input validation: dots in secret names risk path traversal
|
|
(vault/secrets.go:75-99); no maximum secret size (DoS).
|
|
- Timing attacks: bytes.Equal passphrase compare (cli/init.go:
|
|
209-216); non-constant-time public key compare (vault.go:95-100).
|
|
- High priority:
|
|
- Return errors instead of panicking on corrupted metadata
|
|
(pgpunlocker.go:116, keychainunlocker.go:141).
|
|
- Secure temporary file handling and cleanup.
|
|
- Print cobra usage only for argument errors, not internal
|
|
failures.
|
|
- Initialize a default unlock key at vault creation.
|
|
- Confirmation prompts for destructive operations (keys rm, vault
|
|
deletion).
|
|
- Add secret rm and vault deletion commands.
|
|
- Medium priority:
|
|
- Standardize error messages; stop leaking internals.
|
|
- Graceful handling of corrupted or missing key files with recovery
|
|
suggestions.
|
|
- Validate GPG key existence before creating PGP unlock keys.
|
|
- Split oversized CLI functions.
|
|
- Document env var security (SB_UNLOCK_PASSPHRASE,
|
|
SB_SECRET_MNEMONIC); clear after use.
|
|
- mlock/munlock for sensitive allocations.
|
|
- Cleanups: read statedir from environment or default instead of
|
|
passing it around.
|
|
- Enhancements: help examples, shell completion, colored output,
|
|
--quiet flag, name suggestions on miss, audit logging, hardware
|
|
integration tests (Keychain, GPG), naming consistency, vault
|
|
export/import, batch operations, search, secret metadata
|
|
(descriptions, tags).
|