185 lines
8.8 KiB
Go
185 lines
8.8 KiB
Go
|
package kmsrotationconformance
|
||
|
|
|
||
|
|
import (
|
||
|
|
"bytes"
|
||
|
|
"crypto/sha256"
|
||
|
|
"encoding/hex"
|
||
|
|
"encoding/json"
|
||
|
|
"errors"
|
||
|
|
"fmt"
|
||
|
|
"io"
|
||
|
|
"regexp"
|
||
|
|
"slices"
|
||
|
|
"strings"
|
||
|
|
"time"
|
||
|
|
)
|
||
|
|
|
||
|
|
const (
|
||
|
|
CaptureSchema = "kms-rotation-capture-v1"
|
||
|
|
ReportSchema = "kms-rotation-conformance-report-v1"
|
||
|
|
)
|
||
|
|
|
||
|
|
var digestPattern = regexp.MustCompile(`^sha256:[0-9a-f]{64}$`)
|
||
|
|
|
||
|
|
type Capture struct {
|
||
|
|
SchemaVersion string `json:"schema_version"`
|
||
|
|
EvidenceSource string `json:"evidence_source"`
|
||
|
|
CandidateVersion string `json:"candidate_version"`
|
||
|
|
BuildDigest string `json:"build_digest"`
|
||
|
|
Environment string `json:"environment"`
|
||
|
|
ProviderRef string `json:"provider_ref"`
|
||
|
|
WorkloadIdentityRef string `json:"workload_identity_ref"`
|
||
|
|
ProviderAuditRef string `json:"provider_audit_ref"`
|
||
|
|
AttestedByRef string `json:"attested_by_ref"`
|
||
|
|
AttestedAt time.Time `json:"attested_at"`
|
||
|
|
CollectedAt time.Time `json:"collected_at"`
|
||
|
|
Rotations []RotationEvidence `json:"rotations"`
|
||
|
|
}
|
||
|
|
|
||
|
|
type RotationEvidence struct {
|
||
|
|
SecretRef string `json:"secret_ref"`
|
||
|
|
ConsumerRef string `json:"consumer_ref"`
|
||
|
|
ConsumptionMode string `json:"consumption_mode"`
|
||
|
|
OldVersionRef string `json:"old_version_ref"`
|
||
|
|
NewVersionRef string `json:"new_version_ref"`
|
||
|
|
StartedAt time.Time `json:"started_at"`
|
||
|
|
CompletedAt time.Time `json:"completed_at"`
|
||
|
|
NewCredentialVerified bool `json:"new_credential_verified"`
|
||
|
|
OldCredentialRejected bool `json:"old_credential_rejected"`
|
||
|
|
BusinessContinuityVerified bool `json:"business_continuity_verified"`
|
||
|
|
SecretValueNotExported bool `json:"secret_value_not_exported"`
|
||
|
|
PreRotationProbeRef string `json:"pre_rotation_probe_ref"`
|
||
|
|
NewCredentialProbeRef string `json:"new_credential_probe_ref"`
|
||
|
|
OldRejectionProbeRef string `json:"old_rejection_probe_ref"`
|
||
|
|
ContinuityProbeRef string `json:"continuity_probe_ref"`
|
||
|
|
AccessAuditRef string `json:"access_audit_ref"`
|
||
|
|
}
|
||
|
|
|
||
|
|
type Check struct {
|
||
|
|
Code string `json:"code"`
|
||
|
|
Status string `json:"status"`
|
||
|
|
Detail string `json:"detail"`
|
||
|
|
}
|
||
|
|
|
||
|
|
type Report struct {
|
||
|
|
SchemaVersion string `json:"schema_version"`
|
||
|
|
Result string `json:"result"`
|
||
|
|
GeneratedAt time.Time `json:"generated_at"`
|
||
|
|
CandidateVersion string `json:"candidate_version"`
|
||
|
|
BuildDigest string `json:"build_digest"`
|
||
|
|
EvidenceScope string `json:"evidence_scope"`
|
||
|
|
ExternalValidationRequired bool `json:"external_validation_required"`
|
||
|
|
Environment string `json:"environment"`
|
||
|
|
ProviderRef string `json:"provider_ref"`
|
||
|
|
RotationCount int `json:"rotation_count"`
|
||
|
|
ConsumptionModes []string `json:"consumption_modes"`
|
||
|
|
InputSHA256 map[string]string `json:"input_sha256"`
|
||
|
|
Checks []Check `json:"checks"`
|
||
|
|
Disclaimer string `json:"disclaimer"`
|
||
|
|
}
|
||
|
|
|
||
|
|
func ParseCapture(content []byte) (Capture, error) {
|
||
|
|
var capture Capture
|
||
|
|
if err := decodeStrict(content, &capture); err != nil {
|
||
|
|
return Capture{}, fmt.Errorf("decode KMS rotation capture: %w", err)
|
||
|
|
}
|
||
|
|
return capture, nil
|
||
|
|
}
|
||
|
|
|
||
|
|
func ParseReport(content []byte) (Report, error) {
|
||
|
|
var report Report
|
||
|
|
if err := decodeStrict(content, &report); err != nil {
|
||
|
|
return Report{}, fmt.Errorf("decode KMS rotation report: %w", err)
|
||
|
|
}
|
||
|
|
return report, nil
|
||
|
|
}
|
||
|
|
|
||
|
|
func Evaluate(capture Capture, candidateVersion, buildDigest string, generatedAt time.Time) Report {
|
||
|
|
candidateVersion = strings.TrimSpace(candidateVersion)
|
||
|
|
buildDigest = strings.ToLower(strings.TrimSpace(buildDigest))
|
||
|
|
report := Report{
|
||
|
|
SchemaVersion: ReportSchema, Result: "PASS", GeneratedAt: generatedAt.UTC(), CandidateVersion: candidateVersion,
|
||
|
|
BuildDigest: buildDigest, EvidenceScope: "LOCAL_SECRET", ExternalValidationRequired: true,
|
||
|
|
Environment: capture.Environment, ProviderRef: capture.ProviderRef, RotationCount: len(capture.Rotations),
|
||
|
|
ConsumptionModes: []string{}, InputSHA256: map[string]string{}, Checks: []Check{},
|
||
|
|
Disclaimer: "轮换一致性报告只证明所提供的身份、版本、认证探针、业务连续性和审计引用相互一致；不复制密钥正文，也不替代生产发布审批。",
|
||
|
|
}
|
||
|
|
if capture.EvidenceSource == "KMS_HSM" {
|
||
|
|
report.EvidenceScope = "REAL_KMS_HSM"
|
||
|
|
}
|
||
|
|
add := func(code string, ok bool, detail string) {
|
||
|
|
status := "PASS"
|
||
|
|
if !ok {
|
||
|
|
status, report.Result = "FAIL", "FAIL"
|
||
|
|
}
|
||
|
|
report.Checks = append(report.Checks, Check{Code: code, Status: status, Detail: detail})
|
||
|
|
}
|
||
|
|
add("CAPTURE_SCHEMA", capture.SchemaVersion == CaptureSchema, "轮换证据必须使用"+CaptureSchema)
|
||
|
|
add("EVIDENCE_SOURCE", capture.EvidenceSource == "LOCAL" || capture.EvidenceSource == "KMS_HSM", "证据来源必须明确为LOCAL或KMS_HSM")
|
||
|
|
add("CANDIDATE_IDENTITY", candidateVersion != "" && digestPattern.MatchString(buildDigest), "候选版本和sha256构建摘要必须完整")
|
||
|
|
add("CAPTURE_CANDIDATE_BINDING", capture.CandidateVersion == candidateVersion && strings.ToLower(capture.BuildDigest) == buildDigest, "轮换采集必须绑定同一候选版本和构建摘要")
|
||
|
|
|
||
|
|
real := capture.EvidenceSource == "KMS_HSM"
|
||
|
|
providerOK := capture.ProviderRef != "" && capture.AttestedByRef != "" && !capture.AttestedAt.IsZero() && !capture.CollectedAt.IsZero() && !capture.AttestedAt.After(capture.CollectedAt)
|
||
|
|
if real {
|
||
|
|
providerOK = providerOK && (capture.Environment == "STAGING" || capture.Environment == "PRODUCTION") && capture.WorkloadIdentityRef != "" && capture.ProviderAuditRef != ""
|
||
|
|
} else {
|
||
|
|
providerOK = providerOK && capture.Environment == "LOCAL"
|
||
|
|
}
|
||
|
|
add("PROVIDER_IDENTITY", providerOK, "真实证据必须绑定云KMS/HSM、工作负载身份、提供器审计和安全复核引用")
|
||
|
|
|
||
|
|
rotationsOK, versionOK, newOK, oldOK, continuityOK, refsOK := len(capture.Rotations) > 0, true, true, true, true, true
|
||
|
|
seenSecrets, modes := map[string]bool{}, map[string]bool{}
|
||
|
|
for _, rotation := range capture.Rotations {
|
||
|
|
if rotation.SecretRef == "" || rotation.ConsumerRef == "" || seenSecrets[rotation.SecretRef+"|"+rotation.ConsumerRef] || !slices.Contains([]string{"DYNAMIC_READ", "ROLLING_RESTART"}, rotation.ConsumptionMode) || rotation.StartedAt.IsZero() || rotation.CompletedAt.IsZero() || rotation.CompletedAt.Before(rotation.StartedAt) || rotation.CompletedAt.After(capture.CollectedAt) || !rotation.SecretValueNotExported {
|
||
|
|
rotationsOK = false
|
||
|
|
}
|
||
|
|
seenSecrets[rotation.SecretRef+"|"+rotation.ConsumerRef] = true
|
||
|
|
modes[rotation.ConsumptionMode] = true
|
||
|
|
versionOK = versionOK && rotation.OldVersionRef != "" && rotation.NewVersionRef != "" && rotation.OldVersionRef != rotation.NewVersionRef
|
||
|
|
newOK = newOK && rotation.NewCredentialVerified
|
||
|
|
oldOK = oldOK && rotation.OldCredentialRejected
|
||
|
|
continuityOK = continuityOK && rotation.BusinessContinuityVerified
|
||
|
|
refsOK = refsOK && rotation.PreRotationProbeRef != "" && rotation.NewCredentialProbeRef != "" && rotation.OldRejectionProbeRef != "" && rotation.ContinuityProbeRef != "" && rotation.AccessAuditRef != ""
|
||
|
|
}
|
||
|
|
for mode := range modes {
|
||
|
|
report.ConsumptionModes = append(report.ConsumptionModes, mode)
|
||
|
|
}
|
||
|
|
sortStrings(report.ConsumptionModes)
|
||
|
|
if real {
|
||
|
|
rotationsOK = rotationsOK && modes["DYNAMIC_READ"] && modes["ROLLING_RESTART"]
|
||
|
|
}
|
||
|
|
add("ROTATION_SCOPE", rotationsOK, "真实KMS/HSM必须覆盖逐请求动态读取和受控滚动重启两种消费模式")
|
||
|
|
add("VERSION_TRANSITION", versionOK, "每次轮换必须从非空旧版本切换到不同的新版本")
|
||
|
|
add("NEW_CREDENTIAL_ACCEPTED", newOK, "新凭据必须通过实际认证探针")
|
||
|
|
add("OLD_CREDENTIAL_REJECTED", oldOK, "旧凭据必须在轮换窗口结束后稳定拒绝")
|
||
|
|
add("BUSINESS_CONTINUITY", continuityOK, "轮换期间业务连续性探针必须通过")
|
||
|
|
add("AUDIT_REFERENCES", refsOK, "每次轮换必须保存基线、新凭据、旧凭据拒绝、连续性和访问审计引用")
|
||
|
|
if real && providerOK && rotationsOK && versionOK && newOK && oldOK && continuityOK && refsOK && report.Result == "PASS" {
|
||
|
|
report.ExternalValidationRequired = false
|
||
|
|
}
|
||
|
|
return report
|
||
|
|
}
|
||
|
|
|
||
|
|
func SHA256(content []byte) string {
|
||
|
|
digest := sha256.Sum256(content)
|
||
|
|
return hex.EncodeToString(digest[:])
|
||
|
|
}
|
||
|
|
|
||
|
|
func decodeStrict(content []byte, target any) error {
|
||
|
|
decoder := json.NewDecoder(bytes.NewReader(content))
|
||
|
|
decoder.DisallowUnknownFields()
|
||
|
|
if err := decoder.Decode(target); err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
var trailing any
|
||
|
|
if err := decoder.Decode(&trailing); !errors.Is(err, io.EOF) {
|
||
|
|
return errors.New("trailing JSON data")
|
||
|
|
}
|
||
|
|
return nil
|
||
|
|
}
|
||
|
|
|
||
|
|
func sortStrings(values []string) {
|
||
|
|
slices.Sort(values)
|
||
|
|
}
|