Fimeg/RedFlag
Watch
1
0
Fork
You've already forked RedFlag
 0
Code Releases 1 Activity

source: advance the checked projection

Browse source 
Source-Sha: 194a59adfd6c901635da7a9c18253bb2210e2426
Policy-Sha: b9b0be0ee74e55f561a803b8aef6be3c2134f5a83b46816a069a372f2eb04f4d
Tree-Digest: 4697f2e281c1c6ecafff17cf6eeb391a0a1ac0fa6e5fc429f5b473f4579c252c
This commit is contained in:
Source publisher 2026-09-21 14:39:08 +00:00
commit ffdccba10f
42 changed files with 2516 additions and 554 deletions
Download patch file Download diff file Expand all files Collapse all files

25
agent/internal/supplychain/mutation.go
View file

@ -10,6 +10,7 @@ import (
"os"
"os/exec"
"path/filepath"
"runtime"
"time"
"github.com/Fimeg/RedFlag/agent/internal/capability"
@ -68,6 +69,9 @@ func (e *Executor) MintEnvelope(
manifest capability.MutationManifest,
gateEvidence GateEvidence,
) (*capability.MutationEnvelope, string, error) {
if runtime.GOOS == "windows" {
return nil, "", fmt.Errorf("Windows local mint requires authenticated StepUp; mint authority is unavailable")
}
requestID, err := uuid.NewV4()
if err != nil {
return nil, "", fmt.Errorf("generate envelope request id: %w", err)
@ -144,6 +148,24 @@ func (e *Executor) MintEnvelope(
return &envelope, request.RequestID, nil
}
// VerifyEnvelope drives the installed privileged verifier over the platform's
// own transport and returns its joined receipt. Verification only: it mints
// nothing, runs no backend, and consumes no execution authorization. SEC-030
// requires read-only proof of the Windows transport before a backend can be
// admitted, and this is the Agent's one way to ask for it.
func (e *Executor) VerifyEnvelope(
ctx context.Context,
envelope *capability.MutationEnvelope,
) (*capability.MutationReceipt, error) {
if envelope == nil {
return nil, fmt.Errorf("mutation envelope is nil")
}
if runtime.GOOS != "windows" {
return nil, fmt.Errorf("envelope verification transport is implemented on Windows only")
}
return verifyWindowsEnvelope(ctx, envelope)
}
// ExecuteEnvelope hands one signed envelope to the privileged verifier and
// returns its joined receipt, including denials and failed package execution.
func (e *Executor) ExecuteEnvelope(
@ -153,6 +175,9 @@ func (e *Executor) ExecuteEnvelope(
if envelope == nil {
return nil, fmt.Errorf("mutation envelope is nil")
}
if runtime.GOOS == "windows" {
return executeWindowsEnvelope(ctx, envelope)
}
payload, err := json.Marshal(envelope)
if err != nil {
return nil, fmt.Errorf("marshal mutation envelope: %w", err)