mirror of
https://github.com/whyour/qinglong.git
synced 2026-09-20 16:07:11 +08:00
433 lines
12 KiB
JavaScript
433 lines
12 KiB
JavaScript
#!/usr/bin/env node
|
|
|
|
'use strict';
|
|
|
|
const fs = require('node:fs');
|
|
const net = require('node:net');
|
|
const path = require('node:path');
|
|
|
|
const FIXTURE = 'qinglong/plugin-package-management-live-evidence@v1';
|
|
const BANNED_KEYS = new Set([
|
|
'assertion',
|
|
'authorization',
|
|
'bearer',
|
|
'connectionstring',
|
|
'dsn',
|
|
'password',
|
|
'privatekey',
|
|
'secret',
|
|
'tlskey',
|
|
'token',
|
|
]);
|
|
|
|
function finding(code, detail) {
|
|
return Object.freeze({ code, detail });
|
|
}
|
|
|
|
function exactKeys(value, expected) {
|
|
return (
|
|
value !== null &&
|
|
typeof value === 'object' &&
|
|
!Array.isArray(value) &&
|
|
JSON.stringify(Object.keys(value).sort()) ===
|
|
JSON.stringify([...expected].sort())
|
|
);
|
|
}
|
|
|
|
function isSha256(value) {
|
|
return typeof value === 'string' && /^sha256:[a-f0-9]{64}$/.test(value);
|
|
}
|
|
|
|
function isIsoTime(value) {
|
|
return (
|
|
typeof value === 'string' &&
|
|
/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/.test(value) &&
|
|
Number.isFinite(Date.parse(value))
|
|
);
|
|
}
|
|
|
|
function isToken(value, maximum = 128) {
|
|
return (
|
|
typeof value === 'string' &&
|
|
value.length >= 1 &&
|
|
value.length <= maximum &&
|
|
/^[A-Za-z0-9][A-Za-z0-9._:/-]*$/.test(value)
|
|
);
|
|
}
|
|
|
|
function containsSensitiveMaterial(value, key = '') {
|
|
if (BANNED_KEYS.has(key.toLowerCase())) return true;
|
|
if (typeof value === 'string') {
|
|
return (
|
|
/-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/.test(value) ||
|
|
/postgres(?:ql)?:\/\/[^/\s]+:[^@\s]+@/i.test(value) ||
|
|
/\beyJ[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\b/.test(
|
|
value,
|
|
)
|
|
);
|
|
}
|
|
if (Array.isArray(value)) {
|
|
return value.some((entry) => containsSensitiveMaterial(entry));
|
|
}
|
|
if (value && typeof value === 'object') {
|
|
return Object.entries(value).some(([childKey, child]) =>
|
|
containsSensitiveMaterial(child, childKey),
|
|
);
|
|
}
|
|
return false;
|
|
}
|
|
|
|
function isExternalIssuer(value) {
|
|
if (typeof value !== 'string' || value.length > 512) return false;
|
|
let parsed;
|
|
try {
|
|
parsed = new URL(value);
|
|
} catch {
|
|
return false;
|
|
}
|
|
const hostname = parsed.hostname.toLowerCase();
|
|
return (
|
|
parsed.protocol === 'https:' &&
|
|
parsed.username === '' &&
|
|
parsed.password === '' &&
|
|
parsed.search === '' &&
|
|
parsed.hash === '' &&
|
|
parsed.toString() === value &&
|
|
net.isIP(hostname) === 0 &&
|
|
hostname !== 'localhost' &&
|
|
!hostname.endsWith('.localhost') &&
|
|
!hostname.endsWith('.local') &&
|
|
!hostname.endsWith('.test') &&
|
|
!hostname.endsWith('.invalid') &&
|
|
!hostname.endsWith('.example')
|
|
);
|
|
}
|
|
|
|
function validKubernetesVersion(value) {
|
|
const match =
|
|
typeof value === 'string'
|
|
? /^v1\.([0-9]{2,3})\.([0-9]+)(?:[-+][0-9A-Za-z](?:[0-9A-Za-z.-]{0,62}[0-9A-Za-z])?)?$/.exec(
|
|
value,
|
|
)
|
|
: null;
|
|
return Boolean(match && Number(match[1]) >= 32);
|
|
}
|
|
|
|
function strictlyIncreasingGenerations(value) {
|
|
return (
|
|
Array.isArray(value) &&
|
|
value.length === 3 &&
|
|
value.every(
|
|
(generation) => Number.isSafeInteger(generation) && generation >= 1,
|
|
) &&
|
|
value[0] < value[1] &&
|
|
value[1] < value[2]
|
|
);
|
|
}
|
|
|
|
function allTrue(value, expectedKeys) {
|
|
return (
|
|
exactKeys(value, expectedKeys) &&
|
|
expectedKeys.every((key) => value[key] === true)
|
|
);
|
|
}
|
|
|
|
function validatePluginPackageManagementLiveEvidence(report) {
|
|
const findings = [];
|
|
if (
|
|
!exactKeys(report, [
|
|
'schemaVersion',
|
|
'fixture',
|
|
'observedAt',
|
|
'platform',
|
|
'deployment',
|
|
'identity',
|
|
'ceremony',
|
|
'isolation',
|
|
'rotation',
|
|
'gates',
|
|
]) ||
|
|
report?.schemaVersion !== 1 ||
|
|
report?.fixture !== FIXTURE ||
|
|
!isIsoTime(report?.observedAt)
|
|
) {
|
|
findings.push(
|
|
finding(
|
|
'QL3_PLUGIN_MANAGEMENT_LIVE_REPORT_SHAPE',
|
|
'the report must use the exact versioned live-evidence envelope',
|
|
),
|
|
);
|
|
}
|
|
|
|
if (containsSensitiveMaterial(report)) {
|
|
findings.push(
|
|
finding(
|
|
'QL3_PLUGIN_MANAGEMENT_LIVE_SECRET_EXPOSURE',
|
|
'the report must not contain assertions, tokens, credentials, DSNs or private keys',
|
|
),
|
|
);
|
|
}
|
|
|
|
const platform = report?.platform;
|
|
if (
|
|
!exactKeys(platform, [
|
|
'kubernetesVersion',
|
|
'architecture',
|
|
'managementImageId',
|
|
'postgresVersionNumber',
|
|
'postgresImageId',
|
|
'cniName',
|
|
'cniVersion',
|
|
'controlPlaneNodes',
|
|
'workerNodes',
|
|
]) ||
|
|
!validKubernetesVersion(platform?.kubernetesVersion) ||
|
|
!['amd64', 'arm64'].includes(platform?.architecture) ||
|
|
!isSha256(platform?.managementImageId) ||
|
|
platform?.postgresVersionNumber !== 180004 ||
|
|
!isSha256(platform?.postgresImageId) ||
|
|
!isToken(platform?.cniName, 64) ||
|
|
!isToken(platform?.cniVersion, 64) ||
|
|
!Number.isSafeInteger(platform?.controlPlaneNodes) ||
|
|
platform.controlPlaneNodes < 3 ||
|
|
!Number.isSafeInteger(platform?.workerNodes) ||
|
|
platform.workerNodes < 2
|
|
) {
|
|
findings.push(
|
|
finding(
|
|
'QL3_PLUGIN_MANAGEMENT_LIVE_PLATFORM',
|
|
'evidence must bind supported Kubernetes, exact images, an identified CNI, three control-plane nodes and two workers',
|
|
),
|
|
);
|
|
}
|
|
|
|
const deployment = report?.deployment;
|
|
if (
|
|
!exactKeys(deployment, [
|
|
'namespace',
|
|
'service',
|
|
'replicas',
|
|
'readyReplicas',
|
|
'podIdentitySha256',
|
|
'nodeIdentitySha256',
|
|
'serviceAccount',
|
|
'automountServiceAccountToken',
|
|
'databaseRole',
|
|
'migrationCount',
|
|
'controlCoreCapability',
|
|
'tableCount',
|
|
]) ||
|
|
deployment?.namespace !== 'qinglong3-system' ||
|
|
deployment?.service !== 'ql3-plugin-package-management' ||
|
|
deployment?.replicas !== 2 ||
|
|
deployment?.readyReplicas !== 2 ||
|
|
!Array.isArray(deployment?.podIdentitySha256) ||
|
|
deployment.podIdentitySha256.length !== 2 ||
|
|
!deployment.podIdentitySha256.every(isSha256) ||
|
|
new Set(deployment.podIdentitySha256).size !== 2 ||
|
|
!Array.isArray(deployment?.nodeIdentitySha256) ||
|
|
deployment.nodeIdentitySha256.length !== 2 ||
|
|
!deployment.nodeIdentitySha256.every(isSha256) ||
|
|
new Set(deployment.nodeIdentitySha256).size !== 2 ||
|
|
deployment?.serviceAccount !== 'ql3-plugin-package-management' ||
|
|
deployment?.automountServiceAccountToken !== false ||
|
|
deployment?.databaseRole !== 'ql3_package_manager' ||
|
|
deployment?.migrationCount !== 25 ||
|
|
deployment?.controlCoreCapability !== 24 ||
|
|
deployment?.tableCount !== 38
|
|
) {
|
|
findings.push(
|
|
finding(
|
|
'QL3_PLUGIN_MANAGEMENT_LIVE_DEPLOYMENT',
|
|
'evidence must bind two ready replicas on distinct nodes, zero token mount, manager-only PostgreSQL and the v24 schema',
|
|
),
|
|
);
|
|
}
|
|
|
|
const identity = report?.identity;
|
|
const generations = identity?.keysetGenerations;
|
|
if (
|
|
!exactKeys(identity, [
|
|
'providerKind',
|
|
'issuer',
|
|
'discoveryDocumentSha256',
|
|
'jwksSha256',
|
|
'audience',
|
|
'requesterSubjectSha256',
|
|
'reviewerSubjectSha256',
|
|
'requesterAssurance',
|
|
'reviewerAssurance',
|
|
'keysetGenerations',
|
|
'finalLedgerGeneration',
|
|
'finalRevokedKeyCount',
|
|
]) ||
|
|
identity?.providerKind !== 'external_oidc' ||
|
|
!isExternalIssuer(identity?.issuer) ||
|
|
!isSha256(identity?.discoveryDocumentSha256) ||
|
|
!isSha256(identity?.jwksSha256) ||
|
|
identity?.audience !== 'qinglong3-package-management' ||
|
|
!isSha256(identity?.requesterSubjectSha256) ||
|
|
!isSha256(identity?.reviewerSubjectSha256) ||
|
|
identity.requesterSubjectSha256 === identity.reviewerSubjectSha256 ||
|
|
!['multi_factor', 'hardware'].includes(identity?.requesterAssurance) ||
|
|
!['multi_factor', 'hardware'].includes(identity?.reviewerAssurance) ||
|
|
!strictlyIncreasingGenerations(generations) ||
|
|
identity?.finalLedgerGeneration !== generations?.[2] ||
|
|
!Number.isSafeInteger(identity?.finalRevokedKeyCount) ||
|
|
identity.finalRevokedKeyCount < 1 ||
|
|
identity.finalRevokedKeyCount > 64
|
|
) {
|
|
findings.push(
|
|
finding(
|
|
'QL3_PLUGIN_MANAGEMENT_LIVE_IDENTITY',
|
|
'evidence must bind one external canonical OIDC issuer, two distinct strong users and a three-generation durable rotation',
|
|
),
|
|
);
|
|
}
|
|
|
|
if (
|
|
!allTrue(report?.ceremony, [
|
|
'requesterProposeAccepted',
|
|
'requesterSelfDecisionRejected',
|
|
'reviewerDecisionAccepted',
|
|
'requesterAndReviewerDistinct',
|
|
'inspectionAuthorized',
|
|
'durableAuditObserved',
|
|
])
|
|
) {
|
|
findings.push(
|
|
finding(
|
|
'QL3_PLUGIN_MANAGEMENT_LIVE_CEREMONY',
|
|
'the real two-user ceremony must prove propose, self-decision denial, independent approval, inspection and durable audit',
|
|
),
|
|
);
|
|
}
|
|
|
|
if (
|
|
!allTrue(report?.isolation, [
|
|
'labelledClientAllowed',
|
|
'unlabelledClientDenied',
|
|
'wrongPortDenied',
|
|
'kubernetesApiEgressDenied',
|
|
'publicInternetEgressDenied',
|
|
'postgresEgressAllowed',
|
|
'managerSecretReadDenied',
|
|
'managerExecutorMutationDenied',
|
|
])
|
|
) {
|
|
findings.push(
|
|
finding(
|
|
'QL3_PLUGIN_MANAGEMENT_LIVE_ISOLATION',
|
|
'live NetworkPolicy and authority denial evidence must cover ingress, egress, Kubernetes API, Secret and executor mutation',
|
|
),
|
|
);
|
|
}
|
|
|
|
const rotation = report?.rotation;
|
|
if (
|
|
!exactKeys(rotation, [
|
|
'overlapOldAssertionAccepted',
|
|
'newAssertionAccepted',
|
|
'revokedOldAssertionRejected',
|
|
'previousTlsSerialSha256',
|
|
'currentTlsSerialSha256',
|
|
'previousTlsSecretVersionSha256',
|
|
'currentTlsSecretVersionSha256',
|
|
'allReplicasReadyThroughout',
|
|
'tls13BeforeAndAfter',
|
|
]) ||
|
|
rotation?.overlapOldAssertionAccepted !== true ||
|
|
rotation?.newAssertionAccepted !== true ||
|
|
rotation?.revokedOldAssertionRejected !== true ||
|
|
!isSha256(rotation?.previousTlsSerialSha256) ||
|
|
!isSha256(rotation?.currentTlsSerialSha256) ||
|
|
rotation.previousTlsSerialSha256 === rotation.currentTlsSerialSha256 ||
|
|
!isSha256(rotation?.previousTlsSecretVersionSha256) ||
|
|
!isSha256(rotation?.currentTlsSecretVersionSha256) ||
|
|
rotation.previousTlsSecretVersionSha256 ===
|
|
rotation.currentTlsSecretVersionSha256 ||
|
|
rotation?.allReplicasReadyThroughout !== true ||
|
|
rotation?.tls13BeforeAndAfter !== true
|
|
) {
|
|
findings.push(
|
|
finding(
|
|
'QL3_PLUGIN_MANAGEMENT_LIVE_ROTATION',
|
|
'evidence must prove overlap/revoke, distinct TLS generations, TLS 1.3 and zero-unavailable two-replica rotation',
|
|
),
|
|
);
|
|
}
|
|
|
|
if (
|
|
!allTrue(report?.gates, [
|
|
'externalIdentity',
|
|
'separationOfDuty',
|
|
'twoReplicaAvailability',
|
|
'networkPolicy',
|
|
'keysetRotation',
|
|
'tlsRotation',
|
|
'leastPrivilege',
|
|
'schema',
|
|
'passed',
|
|
])
|
|
) {
|
|
findings.push(
|
|
finding(
|
|
'QL3_PLUGIN_MANAGEMENT_LIVE_GATES',
|
|
'every independent live management gate must be explicitly true',
|
|
),
|
|
);
|
|
}
|
|
|
|
return Object.freeze({
|
|
schemaVersion: 1,
|
|
fixture: FIXTURE,
|
|
findings: Object.freeze(findings),
|
|
compatible: findings.length === 0,
|
|
});
|
|
}
|
|
|
|
function readEvidenceFile(filePath) {
|
|
if (!path.isAbsolute(filePath)) {
|
|
throw new Error('evidence report path must be absolute');
|
|
}
|
|
const stat = fs.lstatSync(filePath);
|
|
if (!stat.isFile() || stat.isSymbolicLink()) {
|
|
throw new Error('evidence report must be a regular non-symlink file');
|
|
}
|
|
if (stat.size < 2 || stat.size > 1024 * 1024) {
|
|
throw new Error('evidence report must be between 2 bytes and 1 MiB');
|
|
}
|
|
if ((stat.mode & 0o022) !== 0) {
|
|
throw new Error('evidence report must not be group/world writable');
|
|
}
|
|
return JSON.parse(fs.readFileSync(filePath, 'utf8'));
|
|
}
|
|
|
|
if (require.main === module) {
|
|
const args = process.argv.slice(2);
|
|
if (args.length !== 1 || !args[0].startsWith('--report=')) {
|
|
process.stderr.write(
|
|
'usage: ql3-plugin-package-management-live-evidence-audit --report=/absolute/report.json\n',
|
|
);
|
|
process.exitCode = 2;
|
|
} else {
|
|
try {
|
|
const report = readEvidenceFile(args[0].slice('--report='.length));
|
|
const result = validatePluginPackageManagementLiveEvidence(report);
|
|
process.stdout.write(`${JSON.stringify(result)}\n`);
|
|
if (!result.compatible) process.exitCode = 1;
|
|
} catch (error) {
|
|
process.stderr.write(
|
|
`${
|
|
error instanceof Error ? error.message : 'unknown evidence error'
|
|
}\n`,
|
|
);
|
|
process.exitCode = 1;
|
|
}
|
|
}
|
|
}
|
|
|
|
module.exports = {
|
|
validatePluginPackageManagementLiveEvidence,
|
|
};
|