merge main in wasm-imp branch#143
Merged
Merged
Conversation
feat: JWT authorization, 6-phase verification, attestation hooks, replay command, and security fixes
…tes (#49) Bumps the go_modules group with 4 updates in the / directory: [github.com/buger/jsonparser](https://github.com/buger/jsonparser), [github.com/go-git/go-git/v5](https://github.com/go-git/go-git), [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) and [google.golang.org/grpc](https://github.com/grpc/grpc-go). Updates `github.com/buger/jsonparser` from 1.1.1 to 1.1.2 - [Release notes](https://github.com/buger/jsonparser/releases) - [Commits](buger/jsonparser@v1.1.1...v1.1.2) Updates `github.com/go-git/go-git/v5` from 5.16.5 to 5.17.1 - [Release notes](https://github.com/go-git/go-git/releases) - [Commits](go-git/go-git@v5.16.5...v5.17.1) Updates `github.com/go-jose/go-jose/v4` from 4.1.3 to 4.1.4 - [Release notes](https://github.com/go-jose/go-jose/releases) - [Commits](go-jose/go-jose@v4.1.3...v4.1.4) Updates `google.golang.org/grpc` from 1.78.0 to 1.79.3 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.78.0...v1.79.3) --- updated-dependencies: - dependency-name: github.com/buger/jsonparser dependency-version: 1.1.2 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/go-git/go-git/v5 dependency-version: 5.17.1 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/go-jose/go-jose/v4 dependency-version: 4.1.4 dependency-type: indirect dependency-group: go_modules - dependency-name: google.golang.org/grpc dependency-version: 1.79.3 dependency-type: indirect dependency-group: go_modules ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…dates (#14) Bumps the npm_and_yarn group with 2 updates in the /docs-website directory: [minimatch](https://github.com/isaacs/minimatch) and [svgo](https://github.com/svg/svgo). Updates `minimatch` from 3.1.3 to 3.1.5 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.1.3...v3.1.5) Updates `svgo` from 3.3.2 to 3.3.3 - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v3.3.2...v3.3.3) --- updated-dependencies: - dependency-name: minimatch dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: svgo dependency-version: 3.3.3 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Rahul Vishwakarma <rahulvs2809@gmail.com>
* security: close 11 bash analyzer bypass vectors (#56) Fix H1-H6 (high) and M1-M5 (medium) bypass vectors identified in security review. Newline injection, process substitution, here-docs, brace expansion, alias/function definitions, shell redirections, dd if= syntax, env prefix stripping, absolute path normalization, single-command variable expansion, and obfuscation-without-pipe-to-exec are all now detected and denied. All detection functions respect shell quoting context to avoid false positives on legitimate commands. Signed-off-by: Rahul Vishwakarma <rahulvs2809@gmail.com> * epic: attestation verification pipeline — Phase 1 + anti-replay + content-based lookup Signed-off-by: Rahul Vishwakarma <rahulvs2809@gmail.com> * fix: session state integrity — file locking, race conditions, nil-policy fail-closed (#58) - H9: add syscall.Flock-based LockSession() and wrap all load-modify-save cycles in hooks handler with exclusive file locks to prevent TOCTOU races between concurrent hook processes. Save() now writes atomically via temp file + rename. - M6: MCP server recordAction/trackFile acquire file lock in addition to the in-process sessionMu, closing cross-process races. - L4: ReadPropagation uses atomic os.Rename to claim the file before reading, so concurrent children cannot both consume the same record. - M13: handlePreToolUse fails closed when session state exists but Policy is nil, instead of falling through to the ephemeral allow-all path. Closes #58 Signed-off-by: Rahul Vishwakarma <rahulvs2809@gmail.com> * fix: crypto correctness — DSSE PAE binary LE64, RSA padding pin, key hygiene (#57) - H10: switch createPAE to binary LE64 per DSSE v1 spec for interop with standard tooling. Add backward-compat legacy PAE in verification so pre-fix attestations continue to verify. - L3: pin RSA verification to PKCS1v15 only (matching signer), removing PSS fallback that enabled padding-confusion attacks. - L1: zero Ed25519 private key bytes in Signer.Close(). - L2: use crypto/rand 128-bit random for ephemeral certificate serial instead of hardcoded big.NewInt(1). - C2: already fixed (ed25519 branch signs raw data); updated audit test comments to reflect regression-test status. Signed-off-by: Rahul Vishwakarma <rahulvs2809@gmail.com> * fix: MCP server signing fallback chain — SPIRE → Fulcio → ephemeral Signed-off-by: Rahul Vishwakarma <rahulvs2809@gmail.com> * fix: close 5 fail-open behaviors — identity, limits, glob, recursion, grep (#60) Signed-off-by: Rahul Vishwakarma <rahulvs2809@gmail.com> * fix lint error Signed-off-by: Rahul Vishwakarma <rahulvs2809@gmail.com> * fix: AI eval safety, SSRF, data flow dedup, identity formula, policy digest (#61) Signed-off-by: Rahul Vishwakarma <rahulvs2809@gmail.com> * fix:http.DefaultClient follows redirects and never re-validates Signed-off-by: Rahul Vishwakarma <rahulvs2809@gmail.com> * fix: JWT hardening — TOCTOU, PolicyDigest, SubagentStop, require-token (#59) Signed-off-by: Rahul Vishwakarma <rahulvs2809@gmail.com> * fix: PR #67 review — attestation forgery, Ollama UX, perms, SetModel Signed-off-by: Rahul Vishwakarma <rahulvs2809@gmail.com> * Fix: extract the identity-init block from Serve() into a helper & Fix: deferred Store(false) rollback on error Signed-off-by: Rahul Vishwakarma <rahulvs2809@gmail.com> * fix lint error Signed-off-by: Rahul Vishwakarma <rahulvs2809@gmail.com> --------- Signed-off-by: Rahul Vishwakarma <rahulvs2809@gmail.com>
Signed-off-by: Rahul Vishwakarma <rahulvs2809@gmail.com>
Bumps the go_modules group with 1 update in the / directory: [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go). Updates `go.opentelemetry.io/otel/sdk` from 1.39.0 to 1.40.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.39.0...v1.40.0) --- updated-dependencies: - dependency-name: go.opentelemetry.io/otel/sdk dependency-version: 1.40.0 dependency-type: indirect dependency-group: go_modules ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Rahul Vishwakarma <rahulvs2809@gmail.com>
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.17.2 to 5.18.0. - [Release notes](https://github.com/go-git/go-git/releases) - [Commits](go-git/go-git@v5.17.2...v5.18.0) --- updated-dependencies: - dependency-name: github.com/go-git/go-git/v5 dependency-version: 5.18.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) from 1.40.0 to 1.43.0. - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.40.0...v1.43.0) --- updated-dependencies: - dependency-name: go.opentelemetry.io/otel/sdk dependency-version: 1.43.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Rahul Vishwakarma <rahulvs2809@gmail.com>
Bumps alpine from 3.21 to 3.23. --- updated-dependencies: - dependency-name: alpine dependency-version: '3.23' dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Rahul Vishwakarma <rahulvs2809@gmail.com>
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.18.0 to 5.19.0. - [Release notes](https://github.com/go-git/go-git/releases) - [Changelog](https://github.com/go-git/go-git/blob/main/HISTORY.md) - [Commits](go-git/go-git@v5.18.0...v5.19.0) --- updated-dependencies: - dependency-name: github.com/go-git/go-git/v5 dependency-version: 5.19.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
manzil-infinity180
merged commit 7acea36
into
wasm-implementation
39 of 40 checks passed
Docs Preview
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.