jpetree331
f97d4845af
Complete RedFlag codebase with two major security audit implementations.
== A-1: Ed25519 Key Rotation Support ==
Server:
- SignCommand sets SignedAt timestamp and KeyID on every signature
- signing_keys database table (migration 020) for multi-key rotation
- InitializePrimaryKey registers active key at startup
- /api/v1/public-keys endpoint for rotation-aware agents
- SigningKeyQueries for key lifecycle management
Agent:
- Key-ID-aware verification via CheckKeyRotation
- FetchAndCacheAllActiveKeys for rotation pre-caching
- Cache metadata with TTL and staleness fallback
- SecurityLogger events for key rotation and command signing
== A-2: Replay Attack Fixes (F-1 through F-7) ==
F-5 CRITICAL - RetryCommand now signs via signAndCreateCommand
F-1 HIGH - v3 format: "{agent_id}:{cmd_id}:{type}:{hash}:{ts}"
F-7 HIGH - Migration 026: expires_at column with partial index
F-6 HIGH - GetPendingCommands/GetStuckCommands filter by expires_at
F-2 HIGH - Agent-side executedIDs dedup map with cleanup
F-4 HIGH - commandMaxAge reduced from 24h to 4h
F-3 CRITICAL - Old-format commands rejected after 48h via CreatedAt
Verification fixes: migration idempotency (ETHOS #4), log format
compliance (ETHOS #1), stale comments updated.
All 24 tests passing. Docker --no-cache build verified.
See docs/ for full audit reports and deviation log (DEV-001 to DEV-019).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
72 lines
3.0 KiB
Modula-2
72 lines
3.0 KiB
Modula-2
module github.com/Fimeg/RedFlag/aggregator-server
|
|
|
|
go 1.24.0
|
|
|
|
require (
|
|
github.com/docker/docker v25.0.6+incompatible
|
|
github.com/gin-gonic/gin v1.11.0
|
|
github.com/golang-jwt/jwt/v5 v5.3.0
|
|
github.com/google/uuid v1.6.0
|
|
github.com/jmoiron/sqlx v1.4.0
|
|
github.com/lib/pq v1.10.9
|
|
golang.org/x/crypto v0.44.0
|
|
gopkg.in/natefinch/lumberjack.v2 v2.2.1
|
|
)
|
|
|
|
require (
|
|
github.com/Microsoft/go-winio v0.6.2 // indirect
|
|
github.com/alexedwards/argon2id v1.0.0 // indirect
|
|
github.com/bytedance/sonic v1.14.0 // indirect
|
|
github.com/bytedance/sonic/loader v0.3.0 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/cloudwego/base64x v0.1.6 // indirect
|
|
github.com/containerd/log v0.1.0 // indirect
|
|
github.com/distribution/reference v0.6.0 // indirect
|
|
github.com/docker/go-connections v0.4.0 // indirect
|
|
github.com/docker/go-units v0.5.0 // indirect
|
|
github.com/felixge/httpsnoop v1.0.4 // indirect
|
|
github.com/gabriel-vasile/mimetype v1.4.8 // indirect
|
|
github.com/gin-contrib/sse v1.1.0 // indirect
|
|
github.com/go-logr/logr v1.4.3 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/go-playground/locales v0.14.1 // indirect
|
|
github.com/go-playground/universal-translator v0.18.1 // indirect
|
|
github.com/go-playground/validator/v10 v10.27.0 // indirect
|
|
github.com/goccy/go-json v0.10.2 // indirect
|
|
github.com/goccy/go-yaml v1.18.0 // indirect
|
|
github.com/gogo/protobuf v1.3.2 // indirect
|
|
github.com/json-iterator/go v1.1.12 // indirect
|
|
github.com/klauspost/cpuid/v2 v2.3.0 // indirect
|
|
github.com/leodido/go-urn v1.4.0 // indirect
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
github.com/moby/term v0.5.2 // indirect
|
|
github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421 // indirect
|
|
github.com/modern-go/reflect2 v1.0.2 // indirect
|
|
github.com/morikuni/aec v1.1.0 // indirect
|
|
github.com/opencontainers/go-digest v1.0.0 // indirect
|
|
github.com/opencontainers/image-spec v1.1.1 // indirect
|
|
github.com/pelletier/go-toml/v2 v2.2.4 // indirect
|
|
github.com/pkg/errors v0.9.1 // indirect
|
|
github.com/quic-go/qpack v0.5.1 // indirect
|
|
github.com/quic-go/quic-go v0.54.0 // indirect
|
|
github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
|
|
github.com/ugorji/go/codec v1.3.0 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.64.0 // indirect
|
|
go.opentelemetry.io/otel v1.39.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.39.0 // indirect
|
|
go.opentelemetry.io/otel/metric v1.39.0 // indirect
|
|
go.opentelemetry.io/otel/trace v1.39.0 // indirect
|
|
go.uber.org/mock v0.5.0 // indirect
|
|
golang.org/x/arch v0.20.0 // indirect
|
|
golang.org/x/mod v0.29.0 // indirect
|
|
golang.org/x/net v0.47.0 // indirect
|
|
golang.org/x/sync v0.18.0 // indirect
|
|
golang.org/x/sys v0.39.0 // indirect
|
|
golang.org/x/text v0.31.0 // indirect
|
|
golang.org/x/time v0.14.0 // indirect
|
|
golang.org/x/tools v0.38.0 // indirect
|
|
google.golang.org/protobuf v1.36.10 // indirect
|
|
gotest.tools/v3 v3.5.2 // indirect
|
|
)
|