sneak
271c26e78a
check / check (push) Successful in 47s
Entry() now returns the exit code and only main calls os.Exit, so the deferred memguard.Purge() in Entry() runs on success and on error; before, os.Exit(1) skipped every deferred Destroy(). SIGINT and SIGTERM go through memguard's handler, which wipes every buffer and exits with status 1. The passphrase prompt turns terminal echo off until its read returns, and the handler exits before that, so the handler first restores the terminal settings saved at startup, but only when this process is in the terminal's foreground process group: a background process that changes the terminal is stopped instead of exiting. Model: opus-5-5
136 lines
6.7 KiB
Markdown
136 lines
6.7 KiB
Markdown
# Workflow
|
|
|
|
* branch (from `main`)
|
|
* do the work in Next Step
|
|
* move Next Step to the top of Completed Steps
|
|
* move the top item of Future Steps into Next Step
|
|
* commit (`TODO.md` changes in the same commit as the work)
|
|
* merge to `main` if the branch is not protected, otherwise open a PR
|
|
* push
|
|
|
|
# Status
|
|
|
|
pre-1.0. No git tags. TODO.md carries open 1.0 security blockers. Work in
|
|
flight on branch secure-enclave-unlocker (clean tree as of 2026-07-06).
|
|
|
|
# Next Step
|
|
|
|
Bring the repo into policy compliance in one commit:
|
|
|
|
- Add fmt-check and hooks targets to the Makefile (test/lint/fmt/check/
|
|
docker already exist).
|
|
- Add REPO_POLICIES.md and .editorconfig.
|
|
- Add .gitea/workflows/check.yml running make check.
|
|
- Verify Dockerfile base images are pinned by sha256.
|
|
|
|
# Completed Steps
|
|
|
|
- 2026-10-03: Key material is wiped on every exit: `Entry()` returns
|
|
the exit code after its deferred `memguard.Purge()` has run, and only
|
|
`main` calls `os.Exit`. SIGINT and SIGTERM go through memguard's
|
|
handler, which wipes every buffer before exiting; when the process is
|
|
in the terminal's foreground process group it first restores the
|
|
terminal settings from startup, so an interrupted passphrase prompt no
|
|
longer leaves echo off.
|
|
- 2026-10-02: A plain `docker build .` builds again: the size tests
|
|
skip a case that needs more locked memory than the process can
|
|
lock, and run every case under `script/cibuild`. The image stamps the
|
|
`VERSION` build argument, else `git describe --tags --always`, into
|
|
`Version`, and fails if `.git` is present but yields no version;
|
|
`make build` stamps `git describe` too, not a fixed `0.1.0`.
|
|
`.dockerignore` keeps `.git/config` out; `script/docker` is the
|
|
canonical copy.
|
|
- 2026-08-07: Updated golangci-lint to v2.12.2 with the canonical
|
|
`.golangci.yml` (all linters enabled minus the standard disable
|
|
list, `lll` 88, tests linted); bumped the `Dockerfile` lint-stage
|
|
image to the tagged v2.12.2 Debian digest; fixed all ~1550 new
|
|
findings across `internal/` and `pkg/` (line wrapping, `wsl_v5`
|
|
blank lines, sentinel errors for `err113`, `t.Parallel()` where
|
|
safe, `_test` package conversions, complexity/`dupl` helper
|
|
extraction) on branch `golangci-v2.12.2`. Reworked after review:
|
|
the `err113` sentinels in `internal/vault`, `internal/secret`,
|
|
`internal/cli` and `pkg/bip85` were reshaped so every composed
|
|
error message is byte-identical to `main`, and
|
|
`findUnlockerIDByMetadata` now returns an error so `unlocker list`
|
|
skips an unreadable `unlockers.d` entry with a warning instead of
|
|
emitting a fabricated fallback ID.
|
|
- 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
|
|
Makefile shims, README Entrypoints section
|
|
- 2026-03-11: Secure Enclave unlocker for hardware-backed secret
|
|
protection, plus review fixes (stub panics, derivation index, tests,
|
|
README) on branch secure-enclave-unlocker.
|
|
- 2026-02-28: Repo cleanup, removed stale .cursorrules and coverage.out.
|
|
- Audit fix wave (issues #1, #2, #3, #13, #14): skip unlockers with
|
|
missing metadata, allow uppercase secret names, fix hardcoded
|
|
derivation index, validate names in GetSecretVersion against path
|
|
traversal, return errors instead of panicking, add Warn() on silent
|
|
anomalies.
|
|
- Memory security hardening: LockedBuffer used through encrypt/decrypt
|
|
paths (Save/EncryptWithPassphrase/GetValue/gpg helpers), deprecated
|
|
bare-[]byte APIs removed.
|
|
- Per-secret keypair architecture, vault package refactor, versioning
|
|
with --version, comprehensive test suite with in-memory filesystem.
|
|
- Debug logging system (slog, GODEBUG flag, TTY-aware output).
|
|
- Renamed SEP unlocker to Keychain, reorganized import commands.
|
|
- 2025-05-28: Initial implementation (vault, age encryption, mnemonic,
|
|
CLI).
|
|
|
|
# Future Steps
|
|
|
|
- Compliance (after Next Step lands): keep main green under the new
|
|
.gitea workflow; run make check before every merge.
|
|
- Implement version-number shell completion for the second arg of
|
|
`secret version promote` and `secret version rm`
|
|
(`internal/cli/version.go`; was an in-code TODO removed for godox).
|
|
- Cover mnemonic-vs-xprv identity consistency in
|
|
`pkg/agehd/agehd_test.go` `TestMnemonicVsXPRVConsistency` (was an
|
|
in-code FIXME removed for godox).
|
|
- Darwin-gated files (`internal/secret/keychainunlocker.go`,
|
|
`seunlocker_darwin.go`, `internal/macse/macse_darwin.go`, related
|
|
tests) are not linted on the Linux CI runner and still contain lines
|
|
over the new 88-column limit; they will surface if lint ever runs on
|
|
macOS.
|
|
- Merge secure-enclave-unlocker to main once review is done.
|
|
- 1.0 critical security blockers (from repo TODO.md):
|
|
- Command injection: GPG key IDs passed unescaped to exec.Command
|
|
(pgpunlocker.go:323-327); data.String() passed unescaped to the
|
|
security command (keychainunlocker.go:472-476).
|
|
- Memory security: KeychainData stores AgePrivKeyPassphrase as a
|
|
plain string (keychainunlocker.go:342,393-396); age identity
|
|
.String() creates unprotected copies (keychainunlocker.go:356,
|
|
pgpunlocker.go:256, version.go:155); age secret key held in a
|
|
plain string in cli/crypto.go:86,91,113; private keys exposed via
|
|
buffer.Bytes() to GPGEncryptFunc and EncryptWithPassphrase.
|
|
- Race conditions: no file locking in vault/secrets.go:142-176;
|
|
non-atomic writes can leave the vault inconsistent.
|
|
- Input validation: dots in secret names risk path traversal
|
|
(vault/secrets.go:75-99); no maximum secret size (DoS).
|
|
- Timing attacks: bytes.Equal passphrase compare (cli/init.go:
|
|
209-216); non-constant-time public key compare (vault.go:95-100).
|
|
- High priority:
|
|
- Return errors instead of panicking on corrupted metadata
|
|
(pgpunlocker.go:116, keychainunlocker.go:141).
|
|
- Secure temporary file handling and cleanup.
|
|
- Print cobra usage only for argument errors, not internal
|
|
failures.
|
|
- Initialize a default unlock key at vault creation.
|
|
- Confirmation prompts for destructive operations (keys rm, vault
|
|
deletion).
|
|
- Add secret rm and vault deletion commands.
|
|
- Medium priority:
|
|
- Standardize error messages; stop leaking internals.
|
|
- Graceful handling of corrupted or missing key files with recovery
|
|
suggestions.
|
|
- Validate GPG key existence before creating PGP unlock keys.
|
|
- Split oversized CLI functions.
|
|
- Document env var security (SB_UNLOCK_PASSPHRASE,
|
|
SB_SECRET_MNEMONIC); clear after use.
|
|
- mlock/munlock for sensitive allocations.
|
|
- Cleanups: read statedir from environment or default instead of
|
|
passing it around.
|
|
- Enhancements: help examples, shell completion, colored output,
|
|
--quiet flag, name suggestions on miss, audit logging, hardware
|
|
integration tests (Keychain, GPG), naming consistency, vault
|
|
export/import, batch operations, search, secret metadata
|
|
(descriptions, tags).
|