mirror of
https://github.com/shankar0123/certctl.git
synced 2026-06-07 16:11:29 +00:00
shankar0123
21aeed4f4e
Phase 0 closure (Path B2, post-rewrite):
addlicense sweep — adds the canonical certctl LLC copyright + BUSL-1.1
SPDX header to every production Go file. Template:
// Copyright 2026 certctl LLC. All rights reserved.
// SPDX-License-Identifier: BUSL-1.1
Coverage: 338 / 338 production Go files (cmd/ + internal/, excluding
*_test.go and **/testdata/**). Pre-sweep coverage was 22 / 338 (6.5%);
post-sweep is 338 / 338 (100%).
Normalized 22 pre-existing legacy headers (`// Copyright (c) certctl`
+ `// SPDX-License-Identifier: BSL-1.1`) and 1 file using a
`Certctl Contributors` attribution. The legacy SPDX ID `BSL-1.1`
is non-standard; the official SPDX identifier for Business Source
License 1.1 is `BUSL-1.1` (capital U). All 338 files now share the
canonical form.
Generated via:
addlicense -c "certctl LLC" -y 2026 \
-f cowork/legal/copyright-header.tpl \
-ignore '**/testdata/**' -ignore '**/*_test.go' \
cmd/ internal/
Verification:
find cmd internal -name '*.go' -not -name '*_test.go' \
-not -path '*/testdata/*' \
-exec grep -L '^// Copyright 2026 certctl LLC' {} \; | wc -l
Returns: 0
gofmt clean. Header additions are comments only, no compile impact.
Closes: cowork/certctl-architecture-diligence-audit.html#fix-RED-4
65 lines
3.0 KiB
Go
65 lines
3.0 KiB
Go
// Copyright 2026 certctl LLC. All rights reserved.
|
|
// SPDX-License-Identifier: BUSL-1.1
|
|
|
|
package service
|
|
|
|
// Production hardening II Phase 7 — typed audit-action codes for the
|
|
// cert-export surface.
|
|
//
|
|
// Naming contract: every code is `cert_export_<format>` where
|
|
// <format> ∈ {pem, pkcs12} for the success cases and `_failed` for
|
|
// the error cases. Operators grep the audit log on these exact strings
|
|
// to find every export event for compliance + breach-investigation
|
|
// purposes.
|
|
//
|
|
// Pre-Phase-7 the audit log carried inline strings ("export_pem" /
|
|
// "export_pkcs12"). Those bare codes are PRESERVED for back-compat
|
|
// with existing audit-log analysers; the new typed constants are
|
|
// emitted alongside via the split-emit pattern (mirrors the EST
|
|
// hardening bundle's est_audit_actions.go split-emit at
|
|
// internal/service/est.go::processEnrollment).
|
|
//
|
|
// All four codes appear in the troubleshooting matrix in
|
|
// docs/security.md::Production-grade security posture per the Phase
|
|
// 10 documentation deliverable.
|
|
const (
|
|
// AuditActionCertExportPEM is emitted when ExportPEM succeeds.
|
|
// Detail map carries: serial, has_private_key (always false in
|
|
// V2 — cert-only export is the only V2 path), actor_kind.
|
|
AuditActionCertExportPEM = "cert_export_pem"
|
|
|
|
// AuditActionCertExportPEMWithKey is reserved for a future bundle
|
|
// that adds a key-bearing PEM export path. V2 never emits this
|
|
// constant; it exists in the type system so a future bundle
|
|
// doesn't need to add a constant + a schema migration in the
|
|
// same commit. Operators that want to alert on key-bearing
|
|
// exports can configure the alert today and have it fire when
|
|
// the future bundle ships.
|
|
AuditActionCertExportPEMWithKey = "cert_export_pem_with_key"
|
|
|
|
// AuditActionCertExportPKCS12 is emitted when ExportPKCS12
|
|
// succeeds. Detail map carries: serial, has_private_key (always
|
|
// false in V2 — the trust-store mode of pkcs12.Modern is the
|
|
// only V2 path; cert+key bundle is a V3-Pro deferral), cipher
|
|
// ("AES-256-CBC-PBE2" — the cipher pkcs12.Modern produces),
|
|
// actor_kind.
|
|
AuditActionCertExportPKCS12 = "cert_export_pkcs12"
|
|
|
|
// AuditActionCertExportFailed is emitted when an export attempt
|
|
// fails (any error path before the response is written). Detail
|
|
// map carries: serial (when known), error (string form). Lets
|
|
// operators alert on sustained export failures (corrupt cert
|
|
// chain, missing version, repository error).
|
|
AuditActionCertExportFailed = "cert_export_failed"
|
|
)
|
|
|
|
// PKCS12CipherModernAES256 is the cipher identifier emitted in the
|
|
// PKCS#12 export audit detail. Pinned here so a future dependency
|
|
// upgrade that silently changes the underlying go-pkcs12 default is
|
|
// caught by the audit drift review (operator notices the value
|
|
// diverging from what's advertised in docs/crl-ocsp.md).
|
|
//
|
|
// pkcs12.Modern (the SSLMate library) produces AES-256-CBC PBE2
|
|
// with SHA-256 KDF. Documented in github.com/SSLMate/go-pkcs12 v0.7+.
|
|
const PKCS12CipherModernAES256 = "AES-256-CBC-PBE2-SHA256"
|