gsadmin/certctl
1
0
Fork 0
mirror of https://github.com/shankar0123/certctl.git synced 2026-06-07 22:11:38 +00:00
Code Issues Packages Projects Releases Wiki Activity
995 Commits 1 Branch 82 Tags
67dbd18fda647a4c3fdac1263a315dddbd23ca3c
Commit Graph

5 Commits

Author SHA1 Message Date
shankar0123 8e84527ba2 fix(deploy): Hotfix #16 — split unixOwnerFromStat per-OS build tags (closes Windows CI matrix) 
CI's cross-platform-build (windows-latest) job has been red for
several runs:

  internal/deploy/ownership.go:205 — undefined: syscall.Stat_t

Root cause:
  `syscall.Stat_t` is the Unix-specific POSIX stat-struct shape
  (linux / darwin / freebsd / openbsd / netbsd / dragonfly /
  solaris all expose it). On Windows GOOS, the syscall package
  defines `syscall.Win32FileAttributeData` instead, which carries
  no uid/gid fields. Any production tsx that names `syscall.Stat_t`
  unconditionally fails to compile on GOOS=windows.

  The function was added pre-cross-platform-matrix and never had
  to compile for Windows; CI's `cross-platform-build` job (added
  by Phase 3 TEST-H2) is what surfaced it. The ubuntu / macos
  matrix runs stayed green because both GOOSes expose the type.

Fix (standard Go per-platform build-tag split):
  Move `unixOwnerFromStat(fi os.FileInfo) (uid, gid int, ok bool)`
  out of ownership.go into per-OS sibling files:

    internal/deploy/ownership_unix.go    //go:build unix
    internal/deploy/ownership_windows.go //go:build windows

  ownership_unix.go: same impl as before. Uses `syscall.Stat_t`.
  Covers every Unix-y GOOS via Go 1.19+'s `unix` build constraint
  (linux + darwin + freebsd + openbsd + netbsd + dragonfly +
  solaris).

  ownership_windows.go: stub that returns (-1, -1, false). Windows
  has no native uid/gid; file ownership is expressed via SIDs +
  ACLs (`syscall.Win32FileAttributeData`), which the deploy
  package's call sites can't translate into uid/gid anyway. All
  four callers — applyOwnership (ownership.go:75),
  preserveSourceOwner (atomic.go:237), and two test sites — ALREADY
  handle ok=false by falling back to Plan.Defaults / runtime
  umask. Stub returning false is the correct platform contract.

  ownership.go: drop the `syscall` import (no longer needed there)
  + replace the function body with a doc comment pointing to the
  per-OS files so future readers know where the impl lives.

Note: the agent binary still compiles + runs on Windows; the
chown/chmod codepaths in the deploy package gate on
`runningAsRoot()` (os.Geteuid() == 0) which is also Unix-only in
practice — Windows agents run as a service under a SID that
doesn't translate to a uid anyway, so ownership operations on
Windows naturally no-op.

Verification (Go toolchain wired in sandbox, sub-platform builds
ran locally):
  • gofmt -l on all three touched files — clean
  • GOOS=linux GOARCH=amd64 go build ./internal/deploy/... — exit 0
  • GOOS=darwin GOARCH=amd64 go build ./internal/deploy/... — exit 0
  • GOOS=windows GOARCH=amd64 go build ./internal/deploy/... — exit 0
  • GOOS=windows GOARCH=amd64 go build ./cmd/{server,agent,cli,mcp-server}/...
    — exit 0 (all four CI matrix targets)
  • go vet ./internal/deploy/... — exit 0
  • staticcheck ./internal/deploy/... — zero findings
  • go test -short -count=1 ./internal/deploy/... — ok 0.216s (the
    four callers' tests all still pass on Linux)

Ground-truth: origin/master tip 622c19c (TEST-H3 just pushed)
verified via GitHub API BEFORE commit.

Falsifiable proof for the next CI run: the windows-latest leg of
cross-platform-build should turn green. The ubuntu-latest and
macos-latest legs were already green; this fix doesn't touch
their build path.
 2026-05-14 20:04:25 +00:00
shankar0123 21aeed4f4e legal: addlicense headers + normalize legacy variants (Phase 0 RED-4) 
Phase 0 closure (Path B2, post-rewrite):

addlicense sweep — adds the canonical certctl LLC copyright + BUSL-1.1
SPDX header to every production Go file. Template:

  // Copyright 2026 certctl LLC. All rights reserved.
  // SPDX-License-Identifier: BUSL-1.1

Coverage: 338 / 338 production Go files (cmd/ + internal/, excluding
*_test.go and **/testdata/**). Pre-sweep coverage was 22 / 338 (6.5%);
post-sweep is 338 / 338 (100%).

Normalized 22 pre-existing legacy headers (`// Copyright (c) certctl`
+ `// SPDX-License-Identifier: BSL-1.1`) and 1 file using a
`Certctl Contributors` attribution. The legacy SPDX ID `BSL-1.1`
is non-standard; the official SPDX identifier for Business Source
License 1.1 is `BUSL-1.1` (capital U). All 338 files now share the
canonical form.

Generated via:
  addlicense -c "certctl LLC" -y 2026 \
    -f cowork/legal/copyright-header.tpl \
    -ignore '**/testdata/**' -ignore '**/*_test.go' \
    cmd/ internal/

Verification:
  find cmd internal -name '*.go' -not -name '*_test.go' \
    -not -path '*/testdata/*' \
    -exec grep -L '^// Copyright 2026 certctl LLC' {} \; | wc -l

  Returns: 0

gofmt clean. Header additions are comments only, no compile impact.

Closes: cowork/certctl-architecture-diligence-audit.html#fix-RED-4
 2026-05-13 21:23:35 +00:00
shankar0123 75097909e9 2026-05-05 18:18:29 +00:00
shankar0123 7444df01e2 feat(nginx): atomic deploy + post-deploy TLS verify + rollback + ValidateOnly + ownership preservation 
Phase 4 of the deploy-hardening I master bundle. The canonical NGINX
implementation that Phases 5-9 model on. Replaces the historical
os.WriteFile flow at internal/connector/target/nginx/nginx.go:99
with deploy.Apply() and adds three production-grade competitor-gap
features: atomic deploy with rollback, post-deploy TLS verify, file
ownership preservation.

NGINX connector — internal/connector/target/nginx/nginx.go:

- DeployCertificate now wires deploy.Apply with PreCommit running
  the operator's ValidateCommand (e.g. `nginx -t`), PostCommit
  running ReloadCommand (e.g. `nginx -s reload`), and an explicit
  post-deploy TLS verify step that dials the configured endpoint,
  pulls the leaf cert SHA-256, and compares against what was just
  deployed. SHA-256 mismatch (wrong vhost / cached cert / NGINX
  still serving stale) triggers automatic rollback: backup files
  are restored + reload fired again. Failed-second-reload returns
  ErrRollbackFailed (operator-actionable; loud audit + alert).

- ValidateOnly replaces the Phase 3 stub: runs the operator's
  ValidateCommand without touching the live cert. V2 contract is
  syntax-only validation (full pre-deploy temp-config validation
  is V3-Pro). Returns ErrValidateOnlyNotSupported when no
  ValidateCommand is configured.

- New per-target Config fields: PostDeployVerify (frozen-decision-
  0.3 default ON), PostDeployVerifyAttempts (default 3 — defends
  against load-balanced targets where the verify might hit a
  different pod that hasn't picked up the new cert yet),
  PostDeployVerifyBackoff (default 2s exponential), per-file
  Mode/Owner/Group overrides (KeyFileMode, CertFileMode,
  KeyFileOwner, etc.), and BackupRetention (default 3, -1 to
  disable backups entirely — documented foot-gun).

- buildPlan honors per-distro nginx user (Debian: www-data,
  Alpine: nginx, Red Hat: nginx) by checking the local user
  database; falls back to no-chown when neither exists. Means
  the connector is portable across distros without operator
  config.

Deploy package — internal/deploy/ownership.go:

- applyOwnership now silently swallows chown failures when the
  agent isn't running as root. Production agents always run as
  root and chown failures are real bugs; dev / CI runs as a
  regular user where chown to a different uid will always fail
  with EPERM (or EINVAL on some tmpfs configs) and would
  otherwise force every test to run with sudo. Production-grade
  contract preserved (uid 0 still hard-fails on chown errors).

Test suite — internal/connector/target/nginx/nginx_atomic_test.go
ships 42 new named tests (NGINX total: 17 pre-existing + 42 new = 59,
above the prompt's >=40 bar; matches the IIS depth bar of 41):

- Atomic-deploy invariants (cert+chain+key all-or-nothing,
  validate-fails-no-files-changed, reload-fails-rollback,
  rollback-also-fails-escalation)
- SHA-256 idempotency (full match skips, partial match deploys all)
- Post-deploy TLS verify (fingerprint-match-success,
  SHA256-mismatch-rollback, dial-timeout-rollback, retries-until-
  match, retries-exhausted-rollback, no-endpoint-skips,
  disabled-skips-entirely, default-10s-timeout, endpoint-forwarded)
- Ownership / mode preservation (existing-mode-preserved, override-
  wins, KeyFileMode override applied)
- Backup retention (keeps-last-N, disabled-creates-no-backups,
  fresh-deploy-creates-backup)
- Concurrency (same-paths-serialize via deploy package's file mutex,
  different-paths-parallelize)
- ValidateOnly (happy-path-nil, command-fails-wrapped-error,
  no-config-returns-sentinel, ctx-cancelled, stderr-in-message)
- Edge cases (no-chain, no-key, no-chain-path, empty-cert-PEM,
  ctx-cancelled, all-four-one-apply)
- Result.Metadata + DeploymentID shape contracts

Coverage: NGINX 91.0% (above the >=85% prompt bar). Race detector
clean. golangci-lint v2.11.4 clean. Existing 17 tests still all pass
(no behavior change in the legacy paths exercised there).

Phase 5 next: mirror this implementation for Apache + lift its
test count from 3 to >=30. Same template applies through Phases
6-9 for the remaining 11 connectors.
 2026-04-30 14:50:56 +00:00
shankar0123 f5c67a51b2 feat(deploy): atomic write + validate + rollback primitive shared across all target connectors 
Phase 1 of the deploy-hardening I master bundle. Closes the load-bearing
prerequisite for the seven Bundle I items by extracting one canonical
atomic-deploy primitive at internal/deploy/ that all 13 target connectors
will consume in Phases 4-9.

The package ships:

- Plan + Apply API: write all File entries to sibling .certctl-tmp.<nanos>
  in the destination directory (same-filesystem guarantees os.Rename atomicity),
  call PreCommit (validate-with-the-target), atomic-rename all temps to final,
  call PostCommit (reload). On PostCommit failure, restore from pre-deploy
  backups + re-call PostCommit. If second PostCommit also fails, return
  ErrRollbackFailed (operator-actionable; documented loud).

- AtomicWriteFile lower-level entry for connectors that don't fit the Plan
  model (F5, K8s — they ship bytes through APIs, not local files).

- SHA-256 idempotency: every Apply short-circuits when all File destinations
  already match SHA-256 of new bytes. Defends against agent-restart retry
  storms hammering targets with no-op reloads.

- Ownership + mode preservation: existing nginx:nginx 0640 stays
  nginx:nginx 0640 across renewals. Per-target FileDefaults applies for
  first-deploy. Per-File explicit Mode/Owner/Group overrides win over both.
  Closes the silent-failure mode where os.WriteFile(path, bytes, 0600) at
  apache.go:119 (et al.) clobbered worker access.

- Backup retention janitor: pre-deploy backup at <path>.certctl-bak.<nanos>;
  default keeps last 3 (DefaultBackupRetention); BackupRetention=-1 disables
  backups (rollback impossible — documented foot-gun).

- File-level mutex via sync.Map: two concurrent Apply calls touching the
  same destination serialize. Per-target serialization (Phase 2) is finer-
  grained at the agent dispatch layer; this is the file-level guard.

- Sentinel errors for connector errors.Is checks:
  ErrPlanInvalid, ErrValidateFailed, ErrReloadFailed, ErrRollbackFailed.

Tests (37 named cases across deploy_test.go + coverage_test.go) pin every
load-bearing invariant the prompt's Phase 1 requires, plus error-leg
coverage uplifts:

- TestApply_HappyPath_PreCommitSucceeds_PostCommitSucceeds_FilesAtomic
- TestApply_PreCommitFails_NoFilesChanged (atomic-or-nothing on validate)
- TestApply_PostCommitFails_FilesRolledBack (rollback wire)
- TestApply_RollbackAlsoFails_ReturnsErrRollbackFailed (escalation path)
- TestApply_IdempotentSkip_SHA256Match (idempotency short-circuit)
- TestApply_PreservesExistingOwnerAndMode_WhenNotOverridden
- TestApply_RespectsOverrides_OwnerGroupMode
- TestApply_ConcurrentApplyToSameFile_Serializes (file-level lock)
- TestApply_BackupRetention_KeepsLastN (janitor pruning)
- TestApply_NoExistingFile_UsesDefaultsForOwnerGroupMode
- TestAtomicWriteFile_TempFileCleanedUpOnError
- TestAtomicWriteFile_RenameRaceWithReader_AtomicReadAlwaysSeesOldOrNew
  (POSIX-rename atomicity proof via concurrent reader)

Plus white-box tests for resolveOwnership, lookupUID/GID, and deeper error
legs in restoreFromBackups + applyOwnership + AtomicWriteFile.

Coverage 87.3% — practical ceiling without injecting a fault-aware FS
abstraction (Write/Sync/Close OS errors are unreachable from go test
without sudo'd disk-fill or a custom interface seam). Above the existing
service-layer 70% floor; Phases 4-9 will lift this further as they exercise
the package through real-connector use.

Race detector clean; gofmt + go vet + golangci-lint v2.11.4 all 0 issues.

The package is the load-bearing prerequisite for Phases 4-9. Phase 2 next:
per-target deploy mutex in cmd/agent/main.go.

Spec: cowork/deploy-hardening-i-prompt.md
Baseline + recon: cowork/deploy-hardening-i/baseline.md
 2026-04-30 14:29:19 +00:00