core/go-crypt
8
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
18 commits 1 branch 4 tags 308 KiB
Commit graph

18 commits

This branch
This branch
All branches
Author SHA1 Message Date
Snider
f5fb34c7fb chore: go mod tidy for 1.26.0 
Co-Authored-By: Virgil <virgil@lethean.io>
 2026-02-22 20:35:59 +00:00
Snider
8ba3fe68d6 chore: bump go directive to 1.26.0 
Co-Authored-By: Virgil <virgil@lethean.io>
 2026-02-22 20:33:48 +00:00
Snider
f4eaab401d chore: pin forge deps to v0.0.1 tags for Go 1.26 compat 
Go 1.26 rejects non-semver version strings (like 'main') in go.mod.
Tags v0.0.1 now exist on all forge repos — workspace still overrides
for local development.

Co-Authored-By: Virgil <virgil@lethean.io>
 2026-02-22 20:15:05 +00:00
Snider
e2283dc076 chore: use workspace-resolved versions, drop replace directives 
Forge module versions now use main branch resolution via ~/Code/go.work
workspace. Removes local replace directives — the central go.work handles
all cross-repo resolution during development.

Co-Authored-By: Virgil <virgil@lethean.io>
 2026-02-22 19:49:36 +00:00
Snider
fde12e1539 feat: migrate crypt and test commands from CLI 
Co-Authored-By: Virgil <virgil@lethean.io>
 2026-02-21 19:38:16 +00:00
Snider
9585da8e66 chore: resolve forge deps from registry, remove local replaces 
Co-Authored-By: Virgil <virgil@lethean.io>
 2026-02-21 19:09:41 +00:00
Snider
5674668061 docs: add README with quick start and docs links 
Co-Authored-By: Virgil <virgil@lethean.io>
 2026-02-20 15:11:19 +00:00
Snider
bbf2322389 docs: graduate TODO/FINDINGS into production documentation 
Replace internal task tracking (TODO.md, FINDINGS.md) with structured
documentation in docs/. Trim CLAUDE.md to agent instructions only.

Co-Authored-By: Virgil <virgil@lethean.io>
 2026-02-20 15:01:55 +00:00
Snider
9b65defdd8 feat(trust): Phase 3 — approval workflow, audit log, dynamic policies, scope wildcards 
Co-Authored-By: Virgil <virgil@lethean.io>
 2026-02-20 04:02:47 +00:00
Snider
fc21d01a71 docs(findings): document Phase 2 key management decisions 
Covers F1 resolution (Argon2id migration), dual-path password
verification, revocation JSON design, key rotation flow, and
HardwareKey interface rationale.

Co-Authored-By: Virgil <virgil@lethean.io>
 2026-02-20 02:29:17 +00:00
Snider
36c3b5d669 docs(todo): mark Phase 2 key management complete (301eac1) 
Co-Authored-By: Virgil <virgil@lethean.io>
 2026-02-20 02:27:39 +00:00
Snider
301eac1d76 feat(auth): Phase 2 key management — Argon2id, rotation, revocation 
- Register now uses Argon2id (crypt.HashPassword) instead of LTHN hash
- Login detects hash format: Argon2id (.hash) first, LTHN (.lthn) fallback
- Transparent migration: successful legacy login re-hashes with Argon2id
- RotateKeyPair: decrypt metadata with old password, generate new PGP
  keypair, re-encrypt, update hash, invalidate all sessions
- RevokeKey: write JSON revocation record to .rev, invalidate sessions
- IsRevoked: parse .rev for valid JSON (ignores legacy placeholder)
- Login/CreateChallenge reject revoked users
- HardwareKey interface (hardware.go): contract for PKCS#11/YubiKey
- verifyPassword helper: shared Argon2id→LTHN fallback logic
- 55 tests total, all pass with -race

Co-Authored-By: Virgil <virgil@lethean.io>
 2026-02-20 02:27:03 +00:00
Snider
91a290dc03 docs: refine Phase 2 key management tasks with step-by-step instructions 
- Step 2.1: LTHN→Argon2id password hash migration (addresses F1)
- Step 2.2: RotateKeyPair with full decrypt/re-encrypt flow
- Step 2.3: Replace .rev placeholder with proper revocation
- Step 2.4: HardwareKey interface contract (no implementation)

Co-Authored-By: Virgil <virgil@lethean.io>
 2026-02-20 02:02:02 +00:00
Snider
c5d3c307cf docs(todo): add commit hash for Phase 1 completion 
Co-Authored-By: Virgil <virgil@lethean.io>
 2026-02-20 01:45:14 +00:00
Snider
1aeabfd32b feat(auth): add SessionStore interface with SQLite persistence 
Extract in-memory session map into SessionStore interface with two
implementations: MemorySessionStore (default, backward-compatible) and
SQLiteSessionStore (persistent via go-store). Add WithSessionStore
option, background cleanup goroutine, and comprehensive tests including
persistence verification and concurrency safety.

Phase 1: Session Persistence — complete.

Co-Authored-By: Virgil <virgil@lethean.io>
 2026-02-20 01:44:51 +00:00
Snider
9331fc6eac test(phase0): expand test coverage, security audit, and benchmarks 
Add 29 new tests across auth/, crypt/, and trust/ packages:
- auth: concurrent sessions, token uniqueness, challenge expiry boundary,
  empty password, long/unicode usernames, air-gapped round-trip, expired refresh
- crypt: wrong passphrase, empty/large plaintext, KDF determinism, HKDF info
  separation, checksum edge cases
- trust: concurrent registry operations, tier validation, token expiry boundary,
  empty ScopedRepos behaviour, unknown capabilities

Add benchmark suites:
- crypt: Argon2, ChaCha20, AES-GCM, HMAC (1KB/1MB payloads)
- trust: PolicyEvaluate (100 agents), RegistryGet, RegistryRegister

Security audit documented in FINDINGS.md:
- F1: LTHN hash used for password verification (medium)
- F2: PGP private keys not zeroed after use (low, upstream limitation)
- F3: Empty ScopedRepos bypasses repo scope check (medium)
- F4: go vet clean, no math/rand, no secrets in error messages

All tests pass with -race. go vet clean.

Co-Authored-By: Virgil <virgil@lethean.io>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-02-20 01:14:41 +00:00
Snider
5087f710c6 docs: add domain expert guide, task queue, and research notes 
CLAUDE.md: architecture guide for auth/crypt/trust with algorithm reference
TODO.md: 4-phase task queue (hardening, sessions, key mgmt, policy)
FINDINGS.md: package inventory, security review flags, integration points

Co-Authored-By: Virgil <virgil@lethean.io>
 2026-02-20 00:58:58 +00:00
Claude
8498ecf890
feat: extract crypto/security packages from core/go 
ChaCha20-Poly1305, AES-256-GCM, Argon2 key derivation, OpenPGP
challenge-response auth, and trust tier policy engine.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-02-16 15:25:54 +00:00