diff --git a/.github/workflows/actionci.yml b/.github/workflows/actionci.yml new file mode 100644 index 00000000..f8482e66 --- /dev/null +++ b/.github/workflows/actionci.yml @@ -0,0 +1,22 @@ +name: Action CI + +on: + push: + tags-ignore: + - 'v*' + branches: + - "master" + pull_request: + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +jobs: + actionci: + permissions: + contents: read + actions: read + security-events: write + uses: smallstep/workflows/.github/workflows/actionci.yml@main + secrets: inherit diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml deleted file mode 100644 index 8e9248e0..00000000 --- a/.github/workflows/actionlint.yml +++ /dev/null @@ -1,17 +0,0 @@ -name: Lint GitHub Actions workflows -on: - push: - workflow_call: - -concurrency: - group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} - cancel-in-progress: true - -permissions: - contents: write - pull-requests: write - -jobs: - actionlint: - uses: smallstep/workflows/.github/workflows/actionlint.yml@main - secrets: inherit diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d0199505..7ea60dac 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -26,4 +26,5 @@ jobs: with: only-latest-golang: false run-codeql: true + golangci-lint-version: "v2.12.1" secrets: inherit diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index c0b39e0c..b145ea96 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -2,8 +2,7 @@ name: Dependabot auto-merge on: pull_request permissions: - contents: write - pull-requests: write + pull-requests: read jobs: dependabot-auto-merge: diff --git a/.github/workflows/publish-packages.yml b/.github/workflows/publish-packages.yml new file mode 100644 index 00000000..8474c355 --- /dev/null +++ b/.github/workflows/publish-packages.yml @@ -0,0 +1,77 @@ +name: Publish to packages.smallstep.com + +# Independently publish packages to Red Hat (RPM) and Debian (DEB) repositories +# without running a full release. Downloads packages from GitHub releases, +# uploads to GCS, and imports to Artifact Registry. +# +# Usage (CLI): +# gh workflow run publish-packages.yml -f tag=v0.28.0 + +on: + workflow_dispatch: + inputs: + tag: + description: 'Git tag to publish (e.g., v0.28.0)' + required: true + type: string + +jobs: + publish: + runs-on: ubuntu-latest + permissions: + id-token: write + contents: read + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: ${{ inputs.tag }} + fetch-depth: 0 + + - name: Extract version + id: version + run: echo "version=${TAG#v}">> "$GITHUB_OUTPUT" + env: + TAG: ${{ inputs.tag }} + + - name: Is Pre-release + id: is_prerelease + run: | + if [[ "$TAG" == *"-rc"* ]]; then + echo "is_prerelease=true">> "$GITHUB_OUTPUT" + else + echo "is_prerelease=false">> "$GITHUB_OUTPUT" + fi + env: + TAG: ${{ inputs.tag }} + + - name: Authenticate to Google Cloud + uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 + with: + workload_identity_provider: ${{ secrets.GOOGLE_CLOUD_WORKLOAD_IDENTITY_PROVIDER }} + service_account: ${{ secrets.GOOGLE_CLOUD_GITHUB_SERVICE_ACCOUNT }} + + - name: Set up Cloud SDK + uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1 + with: + project_id: ${{ secrets.GOOGLE_CLOUD_PACKAGES_PROJECT_ID }} + + - name: Download packages from GitHub release + run: | + mkdir -p dist + gh release download "$TAG" --pattern "*${VERSION}*.deb" --pattern "*${VERSION}*.rpm" --dir dist + env: + TAG: ${{ inputs.tag }} + VERSION: ${{ steps.version.outputs.version }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + - name: Upload packages to GCS + run: | + for pkg in dist/*.deb dist/*.rpm; do + ./scripts/package-upload.sh "$pkg" step-cli ${{ steps.version.outputs.version }} + done + + - name: Import packages to Artifact Registry + run: ./scripts/package-repo-import.sh step-cli ${{ steps.version.outputs.version }} + env: + IS_PRERELEASE: ${{ steps.is_prerelease.outputs.is_prerelease }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5f948d71..5781e95a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -6,22 +6,27 @@ on: tags: - 'v*' # Push events to matching v*, i.e. v1.0, v20.15.10 +permissions: + contents: read + jobs: ci: permissions: actions: read contents: read security-events: write - uses: smallstep/cli/.github/workflows/ci.yml@master + uses: ./.github/workflows/ci.yml secrets: inherit - create_release: - name: Create Release + release_metadata: + name: Release Metadata + permissions: + contents: read needs: ci runs-on: ubuntu-latest env: DOCKER_IMAGE: smallstep/step-cli - DEBIAN_TAG: bookworm + DEBIAN_TAG: trixie outputs: version: ${{ steps.extract-tag.outputs.VERSION }} vversion: ${{ steps.extract-tag.outputs.VVERSION }} @@ -31,9 +36,11 @@ jobs: steps: - name: Is Pre-release id: is_prerelease + env: + REF: ${{ github.ref }} run: | set +e - echo ${{ github.ref }} | grep "\-rc.*" + echo "${REF}" | grep "\-rc.*" OUT=$? if [ $OUT -eq 0 ]; then IS_PRERELEASE=true; else IS_PRERELEASE=false; fi echo "IS_PRERELEASE=${IS_PRERELEASE}">> "${GITHUB_OUTPUT}" @@ -51,19 +58,9 @@ jobs: run: | echo "DOCKER_TAGS=${{ env.DOCKER_TAGS }},${{ env.DOCKER_IMAGE }}:latest">> "${GITHUB_ENV}" echo "DOCKER_TAGS_DEBIAN=${{ env.DOCKER_TAGS_DEBIAN }},${{ env.DOCKER_IMAGE }}:${DEBIAN_TAG}">> "${GITHUB_ENV}" - - name: Create Release - id: create_release - uses: softprops/action-gh-release@6da8fa9354ddfdc4aeace5fc48d7f679b5214090 # v2.4.1 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - tag_name: ${{ github.ref_name }} - name: Release ${{ github.ref_name }} - draft: false - prerelease: ${{ steps.is_prerelease.outputs.IS_PRERELEASE }} goreleaser: - needs: create_release + needs: release_metadata permissions: id-token: write contents: write @@ -71,33 +68,33 @@ jobs: uses: smallstep/workflows/.github/workflows/goreleaser.yml@main with: enable-packages-upload: true - is-prerelease: ${{ needs.create_release.outputs.is_prerelease == 'true' }} + is-prerelease: ${{ needs.release_metadata.outputs.is_prerelease == 'true' }} secrets: inherit build_upload_docker: name: Build & Upload Docker Images - needs: create_release + needs: release_metadata permissions: id-token: write - contents: write + contents: read uses: smallstep/workflows/.github/workflows/docker-buildx-push.yml@main with: platforms: linux/amd64,linux/386,linux/arm,linux/arm64 - tags: ${{ needs.create_release.outputs.docker_tags }} + tags: ${{ needs.release_metadata.outputs.docker_tags }} docker_image: smallstep/step-cli docker_file: docker/Dockerfile secrets: inherit build_upload_docker_debian: name: Build & Upload Docker Images using Debian - needs: create_release + needs: release_metadata permissions: id-token: write - contents: write + contents: read uses: smallstep/workflows/.github/workflows/docker-buildx-push.yml@main with: platforms: linux/amd64,linux/386,linux/arm,linux/arm64 - tags: ${{ needs.create_release.outputs.docker_tags_debian }} + tags: ${{ needs.release_metadata.outputs.docker_tags_debian }} docker_image: smallstep/step-cli docker_file: docker/Dockerfile.debian secrets: inherit @@ -106,14 +103,16 @@ jobs: update_reference_docs: name: Update Reference Docs + permissions: + contents: read runs-on: ubuntu-latest - needs: create_release - if: needs.create_release.outputs.is_prerelease == 'false' + needs: release_metadata + if: needs.release_metadata.outputs.is_prerelease == 'false' steps: - name: Checkout - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Go - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: 'stable' check-latest: true @@ -121,13 +120,13 @@ jobs: id: build run: V=1 make build - name: Checkout Docs - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: smallstep/docs token: ${{ secrets.DOCS_PAT }} path: './docs' - name: Setup bot SSH signing key - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 + uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0 env: HAS_SSH_PRIVATE_KEY: ${{ secrets.STEP_TRAVIS_CI_GH_PRIVATE_SIGNING_KEY != '' }} if: ${{ env.HAS_SSH_PRIVATE_KEY == 'true' }} @@ -140,7 +139,7 @@ jobs: cd ./docs git config user.email "eng+ci@smallstep.com" - git config user.name "step-travis-ci" + git config user.name "step-ci" # Configure GH commit signing key. git config --global commit.gpgsign true @@ -170,9 +169,9 @@ jobs: mv manifest.json.new manifest.json - git add . && git commit -a -m "step-cli ${{ needs.create_release.outputs.vversion }} reference update" + git add . && git commit -a -m "step-cli ${{ needs.release_metadata.outputs.vversion }} reference update" - name: Push changes - uses: ad-m/github-push-action@77c5b412c50b723d2a4fbc6d71fb5723bcd439aa # v1.0.0 + uses: ad-m/github-push-action@881a6320fdb16eb5318c5054f31c218aec2b324c # v1.3.0 with: github_token: ${{ secrets.DOCS_PAT }} branch: 'main' diff --git a/.github/workflows/triage.yml b/.github/workflows/triage.yml index f1363a4b..9f73ee33 100644 --- a/.github/workflows/triage.yml +++ b/.github/workflows/triage.yml @@ -10,6 +10,10 @@ on: - opened - reopened +permissions: + issues: write + pull-requests: write + jobs: triage: uses: smallstep/workflows/.github/workflows/triage.yml@main diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 00000000..92a61467 --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,12 @@ +rules: + unpinned-uses: + config: + policies: + "smallstep/*": ref-pin + secrets-inherit: + disable: true + ref-confusion: + disable: true + dangerous-triggers: + ignore: + - triage.yml diff --git a/.goreleaser.yml b/.goreleaser.yml index 575ed81a..d5950cdf 100644 --- a/.goreleaser.yml +++ b/.goreleaser.yml @@ -51,14 +51,10 @@ builds: binary: bin/step - # This build is specifically for nFPM targets (.deb and .rpm files). - # It's exactly the same as the default build above, except: - # - it only builds the archs we want to produce .deb and .rpm files for - # - the name of the output binary is step-cli + # It's exactly the same as the default build above, except the binary is + # named step-cli. It inherits all Linux targets from the default build. << : *BUILD id: nfpm - targets: - - linux_amd64 - - linux_arm64 binary: step-cli archives: @@ -154,9 +150,12 @@ checksum: signs: - cmd: cosign - signature: "${artifact}.sig" - certificate: "${artifact}.pem" - args: ["sign-blob", "--oidc-issuer=https://token.actions.githubusercontent.com", "--output-certificate=${certificate}", "--output-signature=${signature}", "${artifact}", "--yes"] + signature: "${artifact}.sigstore.json" + args: + - "sign-blob" + - "--bundle=${signature}" + - "${artifact}" + - "--yes" artifacts: all publishers: @@ -234,8 +233,7 @@ release: ``` cosign verify-blob \ - --certificate ~/Download/step_darwin_{{ .Version }}_amd64.tar.gz.pem \ - --signature ~/Downloads/step_darwin_{{ .Version }}_amd64.tar.gz.sig \ + --bundle ~/Downloads/step_darwin_{{ .Version }}_amd64.tar.gz.sigstore.json \ --certificate-identity-regexp "https://github\.com/smallstep/workflows/.*" \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ ~/Downloads/step_darwin_{{ .Version }}_amd64.tar.gz @@ -371,7 +369,12 @@ winget: # Your app's long description. # # Templates: allowed - description: "" + description: | + step-cli lets you build, operate, and automate Public Key Infrastructure (PKI) + systems and workflows. It's a swiss army knife for authenticated encryption + (X.509, TLS), single sign-on (OAuth OIDC, SAML), multi-factor authentication + (OATH OTP, FIDO U2F), encryption mechanisms (JSON Web Encryption, NaCl), + and verifiable claims (JWT, SAML assertions). # License URL. # @@ -386,10 +389,25 @@ winget: # Create the PR - for testing skip_upload: auto + # Privacy URL. + # + # Templates: allowed + privacy_url: "https://smallstep.com/privacy-policy" + # Tags. tags: - cli - smallstep + - pki + - x509 + - certificates + - tls + - ssl + - jwt + - oauth + - security + - encryption + - cryptography # Repository to push the generated files to. repository: @@ -434,7 +452,7 @@ scoops: # Default for github is "https://github.com///releases/download/{{ .Tag }}/{{ .ArtifactName }}" # Default for gitlab is "https://gitlab.com///uploads/{{ .ArtifactUploadHash }}/{{ .ArtifactName }}" # Default for gitea is "https://gitea.com///releases/download/{{ .Tag }}/{{ .ArtifactName }}" - url_template: "http://github.com/smallstep/cli/releases/download/{{ .Tag }}/{{ .ArtifactName }}" + url_template: "https://github.com/smallstep/cli/releases/download/{{ .Tag }}/{{ .ArtifactName }}" # Repository to push the app manifest to. repository: diff --git a/CHANGELOG.md b/CHANGELOG.md index a5a6b3c8..0b208082 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,6 +14,9 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0. ### Added +- Support for inspecting certificates with post-quantum algorithms ML-DSA and + SLH-DSA (smallstep/certinfo#69). + ### Changed ### Deprecated @@ -26,24 +29,71 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0. --- -## [0.28.8] - unreleased +## [0.30.3] - 2026年06月09日 ### Added -### Changed +- Add support for inspecting certificates with post-quantum algorithms ML-DSA and + SLH-DSA (smallstep/certinfo#69, smallstep/cli#1605). -- Do not create an identity token if it's not enabled (smallstep/cli#1495). +### Fixed -### Deprecated +- Fix file paths being misidentified as KMS URIs when the path didn't match a KMS + URI pattern; detection now uses an existence check instead (smallstep/cli#1604). +- Fix `step ssh proxycommand` hanging when the server closes the connection before + stdin is closed (smallstep/cli#1647). -### Removed + +## [0.30.2] - 2026年03月22日 + +- Update certificates to v0.30.2 + + +## [0.30.1] - 2026年03月18日 + +- Fix release issue + + +## [0.30.0] - 2026年03月18日 + +### Added + +- Allow using KMS URIs directly without the `--kms` flag for commands that use + the cryptoutils package (smallstep/cli#1560). + +### Changed + +- Expand `--kms` flag help text with detailed documentation for all supported + KMS types (YubiKey PIV, PKCS #11, TPM 2.0, Google Cloud KMS, AWS KMS, Azure + Key Vault) and usage examples (smallstep/cli#1550). +- Prefer `verification_uri_complete` over `verification_uri` in the OIDC + Device Authorization Flow when the IdP provides it, so users don't need to + manually enter a code (smallstep/cli#1430). +- Skip printing the user code during OIDC device authorization when the + complete verification URI already embeds it (smallstep/cli#1595). +- Suppress output messages for `step certificate needs-renewal` and `step ssh + needs-renewal` commands when certificates don't need renewal. Use the + `--verbose` flag to always show messages regardless of renewal status + (smallstep/cli#1548). ### Fixed -### Security +- Overwrite file when using --force with step crypto key format (smallstep/cli#1581) + +## [0.29.0] - 2025年12月02日 + +### Added + +- Add PKIX fingerprint support for `step crypto key fingerprint` (smallstep/cli#1474) +- Add remote configuration of the provisioner GCP organization id (smallstep/cli#1490) + +### Changed + +- Do not create an identity token if it's not enabled (smallstep/cli#1495). +- Make --attestation-uri incompatible with --kms for `step ca certificate` (smallstep/cli#1516) -## [0.28.7] - unreleased +## [0.28.7] - 2025年07月13日 ### Added diff --git a/README.md b/README.md index 0a6d86da..14550b58 100644 --- a/README.md +++ b/README.md @@ -54,7 +54,7 @@ Step CLI's command groups illustrate its wide-ranging uses: - [Generate and verify](https://smallstep.com/docs/step-cli/reference/crypto/otp/) TOTP tokens for multi-factor authentication (MFA) - Work with [NaCl](https://nacl.cr.yp.to/)'s high-speed tools for encryption and signing - - [Apply key derivation functions](https://smallstep.com/docs/step-cli/reference/crypto/kdf/) (KDFs) and [verify passwords](https://smallstep.com/docs/step-cli/reference/crypto/kdf/compare/) using `scrypt`, `bcrypt`, and `argo2` + - [Apply key derivation functions](https://smallstep.com/docs/step-cli/reference/crypto/kdf/) (KDFs) and [verify passwords](https://smallstep.com/docs/step-cli/reference/crypto/kdf/compare/) using `scrypt`, `bcrypt`, and `argon2` - Generate and check [file hashes](https://smallstep.com/docs/step-cli/reference/crypto/hash/) - [`step oauth`](https://smallstep.com/docs/step-cli/reference/oauth/): Add an OAuth 2.0 single sign-on flow to any CLI application. diff --git a/command/api/token/create.go b/command/api/token/create.go index 3d5a2fd2..dc270533 100644 --- a/command/api/token/create.go +++ b/command/api/token/create.go @@ -120,7 +120,7 @@ func createAction(ctx *cli.Context) (err error) { client := http.Client{ Transport: transport, } - resp, err := client.Do(post) + resp, err := client.Do(post) // #nosec G704 -- request depends on configuration if err != nil { return err } diff --git a/command/ca/acme/eab/list.go b/command/ca/acme/eab/list.go index d1cd28ff..51e1bfe5 100644 --- a/command/ca/acme/eab/list.go +++ b/command/ca/acme/eab/list.go @@ -5,6 +5,7 @@ import ( "io" "os" "os/exec" + "strings" "github.com/pkg/errors" "github.com/urfave/cli" @@ -99,8 +100,16 @@ func listAction(ctx *cli.Context) (err error) { // prepare the $PAGER command to run when not disabled and when available pager := os.Getenv("PAGER") + if strings.ContainsAny(pager, " \t\n;&|") { + return errors.New("invalid PAGER environment value") + } + + if _, err := exec.LookPath(pager); err != nil { + return fmt.Errorf("invalid PAGER environment value: %w", err) + } + if usePager && pager != "" { - cmd = exec.Command(pager) + cmd = exec.Command(pager) // #nosec G702 -- $PAGER is intended to be provided by users; basic validation applied var err error out, err = cmd.StdinPipe() if err != nil { diff --git a/command/ca/acme/eab/sigchild.go b/command/ca/acme/eab/sigchild.go index 7f0e5715..f2e55f12 100644 --- a/command/ca/acme/eab/sigchild.go +++ b/command/ca/acme/eab/sigchild.go @@ -1,5 +1,4 @@ //go:build !windows -// +build !windows package eab diff --git a/command/ca/acme/eab/sigchild_windows.go b/command/ca/acme/eab/sigchild_windows.go index 4398a249..7c2edccc 100644 --- a/command/ca/acme/eab/sigchild_windows.go +++ b/command/ca/acme/eab/sigchild_windows.go @@ -1,5 +1,4 @@ //go:build windows -// +build windows package eab diff --git a/command/ca/certificate.go b/command/ca/certificate.go index 5657d66e..74ea4db9 100644 --- a/command/ca/certificate.go +++ b/command/ca/certificate.go @@ -109,6 +109,13 @@ Request a new certificate with an X5C provisioner: $ step ca certificate foo.internal foo.crt foo.key --x5c-cert x5c.cert --x5c-key x5c.key ''' +Request a new certificate with an X5C provisioner using a certificate and private key stored on a YubiKey: +''' +$ step ca certificate joe@example.com joe.crt joe.key \ + --x5c-cert yubikey:slot-id=9a \ + --x5c-key 'yubikey:slot-id=9a?pin=value=123456' +''' + **Certificate Templates** - With a provisioner configured with a custom template we can use the **--set** flag to pass user variables: ''' @@ -228,10 +235,16 @@ func certificateAction(ctx *cli.Context) error { offline := ctx.Bool("offline") sans := ctx.StringSlice("san") - // offline and token are incompatible because the token is generated before - // the start of the offline CA. - if offline && tok != "" { + switch { + case offline && tok != "": + // offline and token are incompatible because the token is generated before + // the start of the offline CA. return errs.IncompatibleFlagWithFlag(ctx, "offline", "token") + case ctx.String("attestation-uri") != "" && ctx.String("kms") != "": + // attestation-uri and kms are incompatible because the ACME-DA flow + // expects all necessary parameters in the attestation-uri, and having + // both can be confusing. + return errs.IncompatibleFlagWithFlag(ctx, "attestation-uri", "kms") } // certificate flow unifies online and offline flows on a single api diff --git a/command/ca/provisioner/add.go b/command/ca/provisioner/add.go index 0c18b50c..a6b081a7 100644 --- a/command/ca/provisioner/add.go +++ b/command/ca/provisioner/add.go @@ -28,7 +28,7 @@ import ( ) func addCommand() cli.Command { - return cli.Command{ + return cli.Command{ // #nosec G101 -- Google OIDC example values Name: "add", Action: cli.ActionFunc(addAction), Usage: "add a provisioner", diff --git a/command/ca/provisioner/caConfigClient.go b/command/ca/provisioner/caConfigClient.go index 5cd0dd6a..eceb20a6 100644 --- a/command/ca/provisioner/caConfigClient.go +++ b/command/ca/provisioner/caConfigClient.go @@ -94,7 +94,6 @@ func newCaConfigClient(ctx context.Context, cfg *config.Config, cfgFile string) } a, err := authority.New(cfg, authority.WithAdminDB(newNoDB()), authority.WithSkipInit(), authority.WithProvisioners(provClxn)) //nolint:staticcheck // TODO: WithProvisioners has been deprecated, temporarily do not lint this line. - if err != nil { return nil, errors.Wrapf(err, "error loading authority") } diff --git a/command/ca/provisioner/provisioner.go b/command/ca/provisioner/provisioner.go index 54e92217..c0e9bcff 100644 --- a/command/ca/provisioner/provisioner.go +++ b/command/ca/provisioner/provisioner.go @@ -651,14 +651,14 @@ func readNebulaRoots(rootFile string) ([][]byte, error) { return nil, err } - var crt *nebula.NebulaCertificate - var certs []*nebula.NebulaCertificate + var crt nebula.Certificate + var certs []nebula.Certificate for len(b)> 0 { - crt, b, err = nebula.UnmarshalNebulaCertificateFromPEM(b) + crt, b, err = nebula.UnmarshalCertificateFromPEM(b) if err != nil { return nil, errors.Wrapf(err, "error reading %s", rootFile) } - if crt.Details.IsCA { + if crt.IsCA() { certs = append(certs, crt) } } @@ -668,7 +668,7 @@ func readNebulaRoots(rootFile string) ([][]byte, error) { rootBytes := make([][]byte, len(certs)) for i, crt := range certs { - b, err = crt.MarshalToPEM() + b, err = crt.MarshalPEM() if err != nil { return nil, errors.Wrap(err, "error marshaling certificate") } diff --git a/command/ca/provisioner/provisioner_test.go b/command/ca/provisioner/provisioner_test.go new file mode 100644 index 00000000..fe0168bf --- /dev/null +++ b/command/ca/provisioner/provisioner_test.go @@ -0,0 +1,97 @@ +package provisioner + +import ( + "crypto/ed25519" + "crypto/rand" + "net/netip" + "os" + "testing" + "time" + + nebula "github.com/slackhq/nebula/cert" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func TestReadNebulaRoots(t *testing.T) { + t.Run("ok", func(t *testing.T) { + tempDir := t.TempDir() + ca, _ := mustNebulaCurve25519CA(t) + file, _ := serializeAndWriteNebulaCert(t, tempDir, ca) + + roots, err := readNebulaRoots(file) + assert.NoError(t, err) + assert.Len(t, roots, 1) + }) + + t.Run("fail/reading", func(t *testing.T) { + roots, err := readNebulaRoots("non-existing-file") + assert.Error(t, err) + assert.Empty(t, roots) + }) + + t.Run("fail/invalid-pem", func(t *testing.T) { + tempDir := t.TempDir() + + file, err := os.CreateTemp(tempDir, "nebula-test-cert-*") + require.NoError(t, err) + defer file.Close() + + _, err = file.Write([]byte{0}) + require.NoError(t, err) + + roots, err := readNebulaRoots(file.Name()) + assert.Error(t, err) + assert.Empty(t, roots) + }) + + t.Run("fail/no-certificates", func(t *testing.T) { + tempDir := t.TempDir() + + file, err := os.CreateTemp(tempDir, "nebula-test-cert-*") + require.NoError(t, err) + defer file.Close() + + roots, err := readNebulaRoots(file.Name()) + assert.Error(t, err) + assert.Empty(t, roots) + }) +} + +func mustNebulaCurve25519CA(t *testing.T) (nebula.Certificate, ed25519.PrivateKey) { + t.Helper() + + pub, priv, err := ed25519.GenerateKey(rand.Reader) + require.NoError(t, err) + + tbs := &nebula.TBSCertificate{ + Version: nebula.Version1, + Name: "TestCA", + Groups: []string{"test"}, + Networks: []netip.Prefix{netip.MustParsePrefix("10.1.0.0/16")}, + NotBefore: time.Now().Add(-1 * time.Minute), + NotAfter: time.Now().Add(10 * time.Minute), + PublicKey: pub, + IsCA: true, + Curve: nebula.Curve_CURVE25519, + } + nc, err := tbs.Sign(nil, nebula.Curve_CURVE25519, priv) + require.NoError(t, err) + + return nc, priv +} + +func serializeAndWriteNebulaCert(t *testing.T, tempDir string, cert nebula.Certificate) (string, []byte) { + file, err := os.CreateTemp(tempDir, "nebula-test-cert-*") + require.NoError(t, err) + defer file.Close() + + pem, err := cert.MarshalPEM() + require.NoError(t, err) + data, err := cert.Marshal() + require.NoError(t, err) + _, err = file.Write(pem) + require.NoError(t, err) + + return file.Name(), data +} diff --git a/command/ca/rekey.go b/command/ca/rekey.go index cd58fbf7..aa80dcac 100644 --- a/command/ca/rekey.go +++ b/command/ca/rekey.go @@ -83,12 +83,22 @@ Rekey a certificate forcing the overwrite of the previous certificate and key $ step ca rekey --force internal.crt internal.key ''' -Rekey a certificate which key is in a KMS, with another from the same KMS: +Rekey a certificate using a KMS, with another from the same KMS: +''' +$ step ca rekey --private-key 'yubikey:slot-id=9a?pin-value=123456' \ + yubikey.crt 'yubikey:slot-id=82?pin-value=123456' +''' + +Rekey a certificate using a KMS with the <--kms> flag: ''' $ step ca rekey \ --kms 'pkcs11:module-path=/usr/local/lib/softhsm/libsofthsm2.so;token=smallstep?pin-value=password' \ - --private-key 'pkcs11:id=4002' - pkcs11.crt 'pkcs11:id=4001' + --private-key 'pkcs11:id=4002' pkcs11.crt 'pkcs11:id=4001' +''' + +''' +$ step ca rekey --key yubikey:pin-value=123456 --private-key yubikey:slot-id=9a \ + yubikey.crt 'yubikey:slot-id=82 ''' Rekey a certificate providing the <--ca-url> and <--root> flags: @@ -239,7 +249,7 @@ func rekeyCertificateAction(ctx *cli.Context) error { // For now, if the --kms flag is given, do not allow to generate a new key // and write it on disk. We can't use the daemon mode because we // cannot generate new keys. - if kmsURI != "" { + if kmsURI != "" || cryptoutil.IsKMS(keyFile) { switch { case givenPrivate == "": return errs.RequiredWithFlag(ctx, "kms", "private-key") diff --git a/command/ca/renew.go b/command/ca/renew.go index 0eaa4e6a..b26b6be8 100644 --- a/command/ca/renew.go +++ b/command/ca/renew.go @@ -107,6 +107,11 @@ $ step ca renew --mtls=false --force internal.crt internal.key Renew a certificate which key is in a KMS: ''' +$ step ca renew yubikey.crt 'yubikey:slot-id=9a?pin-value=123456' +''' + +Renew a certificate which key is in a KMS, using the <--kms> flag: +''' $ step ca renew \ --kms 'pkcs11:module-path=/usr/local/lib/softhsm/libsofthsm2.so;token=smallstep?pin-value=password' \ pkcs11.crt 'pkcs11:id=4001' diff --git a/command/ca/token.go b/command/ca/token.go index 91a11589..e074171c 100644 --- a/command/ca/token.go +++ b/command/ca/token.go @@ -173,8 +173,9 @@ Generate an X5C provisioner token using a certificate in a YubiKey. Note that a YubiKey does not support storing a certificate bundle. To make it work, you must add the intermediate and the root in the provisioner configuration: ''' -$ step ca token --kms yubikey:pin-value=123456 \ - --x5c-cert yubikey:slot-id=82 --x5c-key yubikey:slot-id=82 \ +$ step ca token \ + --x5c-cert yubikey:slot-id=82 \ + --x5c-key 'yubikey:slot-id=82?pin=value=123456' \ internal.example.com ''' diff --git a/command/certificate/create.go b/command/certificate/create.go index ed33493f..83dc7392 100644 --- a/command/certificate/create.go +++ b/command/certificate/create.go @@ -330,8 +330,18 @@ $ step certificate create --csr --template csr.tpl --san coyote@acme.corp \ "Wile E. Coyote" coyote.csr coyote.key ''' +Create a CSR using : +''' +$ step certificate create --csr --key 'yubikey:slot-id=9a?pin=value=123456' coyote@acme.corp coyote.csr +''' + Create a root certificate using : ''' +$ step certificate create --profile root-ca --key 'yubikey:slot-id=9a?pin=value=123456' 'KMS Root' root_ca.crt +''' + +Create a root certificate using and the <--kms> flag: +''' $ step kms create \ --kms 'pkcs11:module-path=/usr/local/lib/softhsm/libsofthsm2.so;token=smallstep?pin-value=password' \ 'pkcs11:id=4000;object=root-key' diff --git a/command/certificate/needsRenewal.go b/command/certificate/needsRenewal.go index 399ef0c3..d82afd2d 100644 --- a/command/certificate/needsRenewal.go +++ b/command/certificate/needsRenewal.go @@ -60,7 +60,7 @@ $ step certificate needs-renewal ./certificate.crt --bundle ''' Check if the leaf certificate provided by smallstep.com has passed 66 percent -of its vlaidity period: +of its validity period: ''' $ step certificate needs-renewal https://smallstep.com ''' @@ -234,5 +234,11 @@ func isVerboseExit(needsRenewal, isVerbose bool) error { } return nil } - return errs.NewExitError(errors.Errorf("certificate does not need renewal"), 1) + + if isVerbose { + return errs.NewExitError(errors.Errorf("certificate does not need renewal"), 1) + } + + // urfave/cli won't show any message + return cli.NewExitError("", 1) } diff --git a/command/certificate/sign.go b/command/certificate/sign.go index 628a391c..a220def3 100644 --- a/command/certificate/sign.go +++ b/command/certificate/sign.go @@ -167,7 +167,11 @@ $ step certificate sign \ --kms 'pkcs11:module-path=/usr/local/lib/softhsm/libsofthsm2.so;token=smallstep?pin-value=password' \ leaf.csr issuer.crt 'pkcs11:id=4001' ''' -`, + +Sign a CSR using a certificate and a key stored in a KMS: +''' +$ step certificate sign leaf.csr yubikey-slot-id=9a 'yubikey-slot-id=9a?pin-value=123456' +'''`, Flags: []cli.Flag{ flags.KMSUri, cli.StringFlag{ @@ -238,6 +242,7 @@ func signAction(ctx *cli.Context) error { csrFile := ctx.Args().Get(0) crtFile := ctx.Args().Get(1) keyFile := ctx.Args().Get(2) + kms := ctx.String("kms") // Parse certificate request csr, err := pemutil.ReadCertificateRequest(csrFile) @@ -249,7 +254,7 @@ func signAction(ctx *cli.Context) error { } // Parse issuer and issuer key (at least one should be present) - issuers, err := pemutil.ReadCertificateBundle(crtFile) + issuers, err := cryptoutil.LoadCertificate(kms, crtFile) if err != nil { return err } @@ -265,7 +270,7 @@ func signAction(ctx *cli.Context) error { opts = append(opts, pemutil.WithPasswordFile(passFile)) } - signer, err := cryptoutil.CreateSigner(ctx.String("kms"), keyFile, opts...) + signer, err := cryptoutil.CreateSigner(kms, keyFile, opts...) if err != nil { return err } diff --git a/command/certificate/verify.go b/command/certificate/verify.go index 81e34706..3bab3079 100644 --- a/command/certificate/verify.go +++ b/command/certificate/verify.go @@ -250,7 +250,6 @@ func verifyAction(ctx *cli.Context) error { switch { case (verifyCRL || verifyOCSP) && roots != "": - //nolint:gosec // using default configuration for 3rd party endpoints tlsConfig := &tls.Config{ RootCAs: rootPool, } @@ -389,7 +388,7 @@ func VerifyOCSPEndpoint(endpoint string, cert, issuer *x509.Certificate, httpCli return false, errors.Errorf("error contacting OCSP server: %s", endpoint) } httpReq.Header.Add("Content-Type", "application/ocsp-request") - httpResp, err := httpClient.Do(httpReq) + httpResp, err := httpClient.Do(httpReq) // #nosec G704 -- request relies on values from certificate or intentionally provided by user if err != nil { return false, errors.Errorf("error contacting OCSP server: %s", endpoint) } diff --git a/command/crypto/jwk/keyset.go b/command/crypto/jwk/keyset.go index a0e4aa8a..4cef7b97 100644 --- a/command/crypto/jwk/keyset.go +++ b/command/crypto/jwk/keyset.go @@ -234,7 +234,7 @@ func rwLockKeySet(filename string) (jwks *jose.JSONWebKeySet, writeFunc func(boo return } - fd := int(f.Fd()) + fd := int(f.Fd()) // #nosec G115 -- uintptr comes from file descriptor // non-blocking exclusive lock err = sysutils.FileLock(fd) diff --git a/command/crypto/key/format.go b/command/crypto/key/format.go index eac57d36..4be2f831 100644 --- a/command/crypto/key/format.go +++ b/command/crypto/key/format.go @@ -13,6 +13,7 @@ import ( "github.com/pkg/errors" "github.com/urfave/cli" + "github.com/smallstep/cli-utils/command" "github.com/smallstep/cli-utils/errs" "github.com/smallstep/cli-utils/fileutil" "github.com/smallstep/cli-utils/ui" @@ -27,7 +28,7 @@ import ( func formatCommand() cli.Command { return cli.Command{ Name: "format", - Action: cli.ActionFunc(formatAction), + Action: command.ActionFunc(formatAction), Usage: `reformat a public or private key`, UsageText: `**step crypto key format** [**--out**=]`, Description: `**step crypto key format** prints or writes the key in diff --git a/command/crypto/winpe/winpe.go b/command/crypto/winpe/winpe.go index 2c10ef99..d4029909 100644 --- a/command/crypto/winpe/winpe.go +++ b/command/crypto/winpe/winpe.go @@ -67,7 +67,7 @@ func extractPEAction(ctx *cli.Context) error { } func extractPE(filename string) error { - file, err := os.Open(filename) + file, err := os.Open(filename) // #nosec G703 -- file to open intentionally relies on user configuration if err != nil { return errors.Wrapf(err, "error opening %s", filename) } diff --git a/command/oauth/cmd.go b/command/oauth/cmd.go index 16761331..655637c5 100644 --- a/command/oauth/cmd.go +++ b/command/oauth/cmd.go @@ -66,9 +66,9 @@ const ( ) type token struct { - AccessToken string `json:"access_token"` + AccessToken string `json:"access_token"` // #nosec G117 -- JSON property IDToken string `json:"id_token"` - RefreshToken string `json:"refresh_token"` + RefreshToken string `json:"refresh_token"` // #nosec G117 -- JSON property ExpiresIn int `json:"expires_in"` TokenType string `json:"token_type"` Err string `json:"error,omitempty"` @@ -526,7 +526,7 @@ func oauthCmd(c *cli.Context) error { fmt.Println(tok.AccessToken) } } else { - b, err := json.MarshalIndent(tok, "", " ") + b, err := json.MarshalIndent(tok, "", " ") // #nosec G117 -- printing the token details intentionally if err != nil { return errors.Wrapf(err, "error marshaling token data") } @@ -571,13 +571,13 @@ type endpoint struct { } var knownProviders = map[string]endpoint{ - "google": { + "google": { // #nosec G101 -- no credentials; just well-known configuration values authorization: "https://accounts.google.com/o/oauth2/v2/auth", deviceAuthorization: "https://oauth2.googleapis.com/device/code", token: "https://www.googleapis.com/oauth2/v4/token", userInfo: "https://www.googleapis.com/oauth2/v3/userinfo", }, - "github": { + "github": { // #nosec G101 -- no credentials; just well-known configuration values authorization: "https://github.com/login/oauth/authorize", deviceAuthorization: "https://github.com/login/device/code", token: "https://github.com/login/oauth/access_token", @@ -712,7 +712,7 @@ func disco(provider string) (map[string]interface{}, error) { // application/json", without this header GitHub will use // application/x-www-form-urlencoded. func postForm(rawurl string, data url.Values) (*http.Response, error) { - req, err := http.NewRequest("POST", rawurl, strings.NewReader(data.Encode())) + req, err := http.NewRequest("POST", rawurl, strings.NewReader(data.Encode())) // #nosec G704 -- request intentionally relies on user data if err != nil { return nil, fmt.Errorf("create POST %s request failed: %w", rawurl, err) } @@ -722,7 +722,7 @@ func postForm(rawurl string, data url.Values) (*http.Response, error) { req.Header.Set("Content-Type", "application/x-www-form-urlencoded") req.Header.Set("Accept", "application/json") - return http.DefaultClient.Do(req) + return http.DefaultClient.Do(req) // #nosec G704 -- request intentionally relies on user configuration } // NewServer creates http server @@ -891,7 +891,12 @@ func (o *oauth) DoDeviceAuthorization() (*token, error) { return nil, errors.Wrap(err, "failure decoding device authz response to JSON") } + shouldPrintCode := true switch { + case idr.VerificationURIComplete != "": + // Prefer VerificationURIComplete if present for user convenience + idr.VerificationURI = idr.VerificationURIComplete + shouldPrintCode = false case idr.VerificationURI != "": // do nothing case idr.VerificationURL != "": @@ -906,8 +911,12 @@ func (o *oauth) DoDeviceAuthorization() (*token, error) { idr.Interval = defaultDeviceAuthzInterval } - fmt.Fprintf(os.Stderr, "Visit %s and enter the code:\n", idr.VerificationURI) - fmt.Fprintln(os.Stderr, idr.UserCode) + if shouldPrintCode { + fmt.Fprintf(os.Stderr, "Visit %s and enter the code:\n", idr.VerificationURI) + fmt.Fprintln(os.Stderr, idr.UserCode) + } else { + fmt.Fprintf(os.Stderr, "Visit %s:\n", idr.VerificationURI) + } // Poll the Token endpoint until the user completes the flow. data = url.Values{} @@ -1106,7 +1115,7 @@ func (o *oauth) ServeHTTP(w http.ResponseWriter, req *http.Request) { code, state := q.Get("code"), q.Get("state") if code == "" || state == "" { - fmt.Fprintf(os.Stderr, "Invalid request received: http://%s%s\n", req.RemoteAddr, req.URL.String()) + fmt.Fprintf(os.Stderr, "Invalid request received: http://%s%s\n", req.RemoteAddr, req.URL.String()) // #nosec G705 -- terminal output fmt.Fprintf(os.Stderr, "You may have an app or browser plugin that needs to be turned off\n") http.Error(w, "400 bad request", http.StatusBadRequest) return @@ -1309,7 +1318,7 @@ func (o *oauth) badRequest(w http.ResponseWriter, msg string) { w.Write([]byte(``)) w.Write([]byte(`

`)) w.Write([]byte(`Failure
`)) - w.Write([]byte(msg)) + w.Write([]byte(msg)) // #nosec G705 -- message is either a string literal, or comes from (trusted) IdP w.Write([]byte(`

AltStyle によって変換されたページ (->オリジナル) /

`)) o.errCh <- errors.New(msg) } diff --git a/command/ssh/needsRenewal.go b/command/ssh/needsRenewal.go index 4145e9ab..539f5ae4 100644 --- a/command/ssh/needsRenewal.go +++ b/command/ssh/needsRenewal.go @@ -172,5 +172,11 @@ func isVerboseExit(needsRenewal, isVerbose bool) error { } return nil } - return errs.NewExitError(errors.Errorf("certificate does not need renewal"), 1) + + if isVerbose { + return errs.NewExitError(errors.Errorf("certificate does not need renewal"), 1) + } + + // urfave/cli won't show any message + return cli.NewExitError("", 1) } diff --git a/command/ssh/proxycommand.go b/command/ssh/proxycommand.go index fe35cf18..0a0293b3 100644 --- a/command/ssh/proxycommand.go +++ b/command/ssh/proxycommand.go @@ -6,7 +6,6 @@ import ( "net" "os" "strings" - "sync" "time" "github.com/pkg/errors" @@ -228,6 +227,10 @@ func getBastion(ctx *cli.Context, user, host string) (*api.SSHBastionResponse, e } func proxyDirect(host, port string) error { + return proxyDirectWithIO(host, port, os.Stdin, os.Stdout) +} + +func proxyDirectWithIO(host, port string, stdin io.Reader, stdout io.Writer) error { address := net.JoinHostPort(host, port) addr, err := net.ResolveTCPAddr("tcp", address) if err != nil { @@ -238,22 +241,25 @@ func proxyDirect(host, port string) error { if err != nil { return errors.Wrapf(err, "error connecting to %s", address) } + defer conn.Close() - var wg sync.WaitGroup - wg.Add(1) + // Return as soon as either direction finishes. Waiting for both can + // deadlock when the server closes the connection while stdin stays open. + // See smallstep/cli#1641. Buffered so the slower goroutine never blocks + // sending after we've stopped receiving. + done := make(chan struct{}, 2) go func() { - io.Copy(conn, os.Stdin) + io.Copy(conn, stdin) conn.CloseWrite() - wg.Done() + done <- struct{}{} }() - wg.Add(1) go func() { - io.Copy(os.Stdout, conn) + io.Copy(stdout, conn) conn.CloseRead() - wg.Done() + done <- struct{}{} }() - wg.Wait() + <-done return nil } diff --git a/command/ssh/proxycommand_test.go b/command/ssh/proxycommand_test.go new file mode 100644 index 00000000..4484e930 --- /dev/null +++ b/command/ssh/proxycommand_test.go @@ -0,0 +1,55 @@ +package ssh + +import ( + "bytes" + "io" + "net" + "testing" + "time" + + "github.com/stretchr/testify/require" +) + +// Test_proxyDirectWithIO_serverClosesBeforeStdin reproduces smallstep/cli#1641: +// when the server closes the connection before the client has closed stdin, the +// proxycommand must still return promptly. Previously it would block in +// wg.Wait() forever because the stdin->conn goroutine stayed blocked reading a +// stdin that never reaches EOF (the ssh client keeps it open until the +// proxycommand exits). +func Test_proxyDirectWithIO_serverClosesBeforeStdin(t *testing.T) { + ln, err := net.Listen("tcp", "127.0.0.1:0") + require.NoError(t, err) + defer ln.Close() + + // Server sends some data and immediately closes the connection. + go func() { + conn, err := ln.Accept() + if err != nil { + return + } + conn.Write([]byte("hello")) + conn.Close() + }() + + host, port, err := net.SplitHostPort(ln.Addr().String()) + require.NoError(t, err) + + // stdin that never reaches EOF, simulating the ssh client keeping the + // proxycommand's stdin open for the lifetime of the session. + stdinR, stdinW := io.Pipe() + defer stdinW.Close() // write end intentionally left open during the call + + var stdout bytes.Buffer + done := make(chan error, 1) + go func() { + done <- proxyDirectWithIO(host, port, stdinR, &stdout) + }() + + select { + case err := <-done: + require.NoError(t, err) + require.Equal(t, "hello", stdout.String()) + case <-time.after(5 * time.Second): + t.Fatal("proxyDirectWithIO did not return after the server closed the connection") + } +} diff --git a/docker/Dockerfile b/docker/Dockerfile index 827345b6..af4b4f98 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -40,4 +40,4 @@ WORKDIR /home/step STOPSIGNAL SIGTERM -CMD /bin/bash +CMD [ "/bin/bash" ] diff --git a/docker/Dockerfile.debian b/docker/Dockerfile.debian index 5337a030..2bfc50c8 100644 --- a/docker/Dockerfile.debian +++ b/docker/Dockerfile.debian @@ -1,4 +1,4 @@ -FROM --platform=$BUILDPLATFORM golang:bookworm AS builder +FROM --platform=$BUILDPLATFORM golang:trixie AS builder WORKDIR /src COPY go.mod go.sum . @@ -20,7 +20,7 @@ RUN --mount=type=cache, \ CGO_ENABLED=0 GOOS_OVERRIDE="GOOS=${GOOS} GOARCH=${GOARCH} GOARM=${GOARM}" \ make V=1 bin/step -FROM debian:bookworm +FROM debian:trixie ENV STEP="/home/step" ENV STEPPATH="/home/step" @@ -30,8 +30,8 @@ ARG STEPGID=1000 RUN apt-get update \ && apt-get upgrade -y \ && apt-get install -y --no-install-recommends curl jq \ - && addgroup --gid ${STEPGID} step \ - && adduser --disabled-password --uid ${STEPUID} --gid ${STEPGID} step \ + && groupadd --gid ${STEPGID} step \ + && useradd --create-home --uid ${STEPUID} --gid ${STEPGID} step \ && chown step:step /home/step COPY --from=builder /src/bin/step "/usr/local/bin/step" @@ -41,4 +41,4 @@ WORKDIR /home/step STOPSIGNAL SIGTERM -CMD /bin/bash +CMD [ "/bin/bash" ] diff --git a/docs/CONTRIBUTING.md b/docs/CONTRIBUTING.md index c122a9f6..498237ab 100644 --- a/docs/CONTRIBUTING.md +++ b/docs/CONTRIBUTING.md @@ -40,7 +40,7 @@ primitives and higher order resources. ### Local Development -Check out the [local development](./local-development.md) guide for instructions for working on the `step` CLI code. +Check out the [local development](./docs/local-development.md) guide for instructions for working on the `step` CLI code. ### Submitting Patches diff --git a/exec/exec.go b/exec/exec.go index d841fdfa..e5899117 100644 --- a/exec/exec.go +++ b/exec/exec.go @@ -79,7 +79,7 @@ func RunWithPid(pidFile, name string, arg ...string) { cmd, exitCh, err := run(name, arg...) if err != nil { f.Close() - os.Remove(f.Name()) + _ = os.Remove(f.Name()) // #nosec G703 -- file does not depend on user configuration errorAndExit(name, err) } @@ -94,7 +94,7 @@ func RunWithPid(pidFile, name string, arg ...string) { } // clean, exit and wait until os.Exit - os.Remove(f.Name()) + _ = os.Remove(f.Name()) // #nosec G703 -- file does not depend on user configuration exitCh <- getExitStatus(cmd) exitCh <- 0 } diff --git a/flags/flags.go b/flags/flags.go index 95495200..d185e624 100644 --- a/flags/flags.go +++ b/flags/flags.go @@ -469,8 +469,42 @@ flag exists so it can be configured in $STEPPATH/config/defaults.json.`, } KMSUri = cli.StringFlag{ - Name: "kms", - Usage: "The to configure a Cloud KMS or an HSM.", + Name: "kms", + Usage: `The to configure a (cloud) KMS or an HSM. + is formatted as **kmstype:[key=value;...]?[key=value&...]**. The **;**-separated +parameters identify the KMS, and **&**-separated parameters contain credentials and additional configuration for those credentials. + +: Supported KMS types: + + **YubiKey PIV** + : Use **yubikey:** URIs. Parameters: **serial**, **pin-value**, **pin-source**, **management-key**, **management-key-source**. + + **PKCS #11** + : Use **pkcs11:** URIs. Parameters: **module-path**, **token**, **id**, **object**, **pin-value**, **pin-source**. + + **TPM 2.0** + : Use **tpmkms:** URIs. Parameters: **name**, **device**, **attestation-ca-url**. + + **Google Cloud KMS** + : Use **cloudkms:** URIs. Parameters: **credentials-file**. + + **AWS KMS** + : Use **awskms:** URIs. Parameters: **region**, **profile**, **credentials-file**. + + **Azure Key Vault** + : Use **azurekms:** URIs. Parameters: **tenant-id**, **client-id**, **client-secret**, **client-certificate-file**. + +: Examples: + +''' +yubikey:pin-value=123456 +pkcs11:module-path=/usr/lib/softhsm/libsofthsm2.so;token=smallstep?pin-value=pass +tpmkms:name=my-key;device=/dev/tpmrm0 +awskms:region=us-east-1 +azurekms:client-id=fooo;client-secret=bar;tenant-id=9de53416-4431-4181-7a8b-23af3EXAMPLE +''' + + For more information, see https://smallstep.com/docs/step-ca/cryptographic-protection/.`, } AttestationURI = cli.StringFlag{ diff --git a/go.mod b/go.mod index 0f9a0132..fdf31865 100644 --- a/go.mod +++ b/go.mod @@ -1,57 +1,58 @@ module github.com/smallstep/cli -go 1.24.0 +go 1.25.8 require ( github.com/Microsoft/go-winio v0.6.2 - github.com/ccoveille/go-safecast v1.7.0 - github.com/fxamacker/cbor/v2 v2.9.0 - github.com/go-jose/go-jose/v3 v3.0.4 + github.com/ccoveille/go-safecast/v2 v2.0.1 + github.com/fxamacker/cbor/v2 v2.9.3 + github.com/go-jose/go-jose/v3 v3.0.5 github.com/google/go-cmp v0.7.0 - github.com/google/go-tpm v0.9.6 + github.com/google/go-tpm v0.9.8 github.com/google/uuid v1.6.0 github.com/manifoldco/promptui v0.9.0 github.com/pkg/errors v0.9.1 github.com/pquerna/otp v1.5.0 - github.com/rogpeppe/go-internal v1.14.1 - github.com/slackhq/nebula v1.9.7 + github.com/rogpeppe/go-internal v1.16.0 + github.com/slackhq/nebula v1.10.3 github.com/smallstep/assert v0.0.0-20200723003110-82e2b9b3b262 - github.com/smallstep/certificates v0.28.4 - github.com/smallstep/certinfo v1.15.0 + github.com/smallstep/certificates v0.30.2 + github.com/smallstep/certinfo v1.16.0 github.com/smallstep/cli-utils v0.12.2 - github.com/smallstep/go-attestation v0.4.4-0.20241119153605-2306d5b464ca - github.com/smallstep/linkedca v0.25.0 + github.com/smallstep/go-attestation v0.4.4-0.20260814222900-a849f4e2cd68 + github.com/smallstep/linkedca v0.26.0 github.com/smallstep/truststore v0.13.0 github.com/smallstep/zcrypto v0.0.0-20221001003018-1ab2364d2a91 github.com/smallstep/zlint v0.0.0-20220930192201-67fb4aa21910 - github.com/stretchr/testify v1.11.1 + github.com/stretchr/testify v1.12.1 github.com/urfave/cli v1.22.17 - go.mozilla.org/pkcs7 v0.9.0 - go.step.sm/crypto v0.72.0 - golang.org/x/crypto v0.43.0 - golang.org/x/sys v0.37.0 - golang.org/x/term v0.36.0 - google.golang.org/protobuf v1.36.10 - software.sslmate.com/src/go-pkcs12 v0.6.0 + go.mozilla.org/pkcs7 v0.10.0 + go.step.sm/crypto v0.89.0 + golang.org/x/crypto v0.55.0 + golang.org/x/sys v0.47.0 + golang.org/x/term v0.45.0 + google.golang.org/protobuf v1.36.12 + software.sslmate.com/src/go-pkcs12 v0.7.3 ) require ( - cloud.google.com/go v0.120.0 // indirect - cloud.google.com/go/auth v0.16.5 // indirect + cloud.google.com/go v0.123.0 // indirect + cloud.google.com/go/auth v0.22.0 // indirect cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect cloud.google.com/go/compute/metadata v0.9.0 // indirect - cloud.google.com/go/iam v1.5.2 // indirect - cloud.google.com/go/longrunning v0.6.7 // indirect - cloud.google.com/go/security v1.18.5 // indirect - dario.cat/mergo v1.0.1 // indirect - filippo.io/edwards25519 v1.1.0 // indirect + cloud.google.com/go/iam v1.11.0 // indirect + cloud.google.com/go/longrunning v1.2.0 // indirect + cloud.google.com/go/security v1.19.2 // indirect + dario.cat/mergo v1.0.2 // indirect + filippo.io/bigmod v0.1.0 // indirect + filippo.io/edwards25519 v1.2.0 // indirect github.com/AndreasBriese/bbloom v0.0.0-20190825152654-46b345b51c96 // indirect - github.com/Azure/azure-sdk-for-go/sdk/azcore v1.19.1 // indirect - github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.12.0 // indirect - github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect - github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 // indirect + github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0 // indirect + github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0 // indirect + github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 // indirect + github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.5.0 // indirect github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 // indirect - github.com/AzureAD/microsoft-authentication-library-for-go v1.5.0 // indirect + github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2 // indirect github.com/Masterminds/goutils v1.1.1 // indirect github.com/Masterminds/semver/v3 v3.3.1 // indirect github.com/Masterminds/sprig/v3 v3.3.0 // indirect @@ -61,84 +62,83 @@ require ( github.com/cespare/xxhash v1.1.0 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/chzyer/readline v1.5.1 // indirect - github.com/coreos/go-oidc/v3 v3.14.1 // indirect + github.com/coreos/go-oidc/v3 v3.17.0 // indirect + github.com/coreos/go-systemd/v22 v22.7.0 // indirect github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect - github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect github.com/dgraph-io/badger v1.6.2 // indirect github.com/dgraph-io/badger/v2 v2.2007.4 // indirect github.com/dgraph-io/ristretto v0.1.1 // indirect github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13 // indirect github.com/dustin/go-humanize v1.0.1 // indirect github.com/felixge/httpsnoop v1.0.4 // indirect - github.com/go-chi/chi/v5 v5.2.2 // indirect - github.com/go-jose/go-jose/v4 v4.1.2 // indirect + github.com/go-chi/chi/v5 v5.2.5 // indirect + github.com/go-jose/go-jose/v4 v4.1.4 // indirect github.com/go-logr/logr v1.4.3 // indirect github.com/go-logr/stdr v1.2.2 // indirect - github.com/go-sql-driver/mysql v1.9.2 // indirect - github.com/golang-jwt/jwt/v5 v5.3.0 // indirect + github.com/go-sql-driver/mysql v1.9.3 // indirect + github.com/golang-jwt/jwt/v5 v5.3.1 // indirect github.com/golang/glog v1.2.5 // indirect github.com/golang/protobuf v1.5.4 // indirect github.com/golang/snappy v0.0.4 // indirect github.com/google/btree v1.1.3 // indirect github.com/google/certificate-transparency-go v1.3.2 // indirect - github.com/google/go-tpm-tools v0.4.6 // indirect + github.com/google/go-tpm-tools v0.4.9 // indirect github.com/google/go-tspi v0.3.0 // indirect github.com/google/s2a-go v0.1.9 // indirect - github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect - github.com/googleapis/gax-go/v2 v2.15.0 // indirect + github.com/googleapis/enterprise-certificate-proxy v0.3.19 // indirect + github.com/googleapis/gax-go/v2 v2.23.0 // indirect github.com/huandu/xstrings v1.5.0 // indirect github.com/jackc/pgpassfile v1.0.0 // indirect github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect - github.com/jackc/pgx/v5 v5.7.5 // indirect + github.com/jackc/pgx/v5 v5.9.2 // indirect github.com/jackc/puddle/v2 v2.2.2 // indirect github.com/klauspost/compress v1.18.0 // indirect github.com/kylelemons/godebug v1.1.0 // indirect github.com/mattn/go-colorable v0.1.14 // indirect - github.com/mattn/go-isatty v0.0.20 // indirect + github.com/mattn/go-isatty v0.0.24 // indirect github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect github.com/mitchellh/copystructure v1.2.0 // indirect github.com/mitchellh/reflectwalk v1.0.2 // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect - github.com/newrelic/go-agent/v3 v3.39.0 // indirect + github.com/newrelic/go-agent/v3 v3.42.0 // indirect github.com/peterbourgon/diskv/v3 v3.0.1 // indirect github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect - github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect - github.com/prometheus/client_golang v1.22.0 // indirect - github.com/prometheus/client_model v0.6.1 // indirect - github.com/prometheus/common v0.62.0 // indirect - github.com/prometheus/procfs v0.15.1 // indirect + github.com/prometheus/client_golang v1.23.2 // indirect + github.com/prometheus/client_model v0.6.2 // indirect + github.com/prometheus/common v0.67.5 // indirect + github.com/prometheus/procfs v0.19.2 // indirect github.com/rs/xid v1.6.0 // indirect github.com/russross/blackfriday/v2 v2.1.0 // indirect github.com/schollz/jsonstore v1.1.0 // indirect github.com/shopspring/decimal v1.4.0 // indirect github.com/shurcooL/sanitized_anchor_name v1.0.0 // indirect - github.com/sirupsen/logrus v1.9.3 // indirect - github.com/smallstep/nosql v0.7.0 // indirect + github.com/sirupsen/logrus v1.9.4 // indirect + github.com/smallstep/nosql v0.8.0 // indirect github.com/smallstep/pkcs7 v0.2.1 // indirect - github.com/smallstep/scep v0.0.0-20240926084937-8cf1ca453101 // indirect + github.com/smallstep/scep v0.0.0-20250318231241-a25cabb69492 // indirect github.com/spf13/cast v1.7.0 // indirect github.com/weppos/publicsuffix-go v0.20.0 // indirect github.com/x448/float16 v0.8.4 // indirect - go.etcd.io/bbolt v1.4.0 // indirect - go.opentelemetry.io/auto/sdk v1.1.0 // indirect - go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect - go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect - go.opentelemetry.io/otel v1.37.0 // indirect - go.opentelemetry.io/otel/metric v1.37.0 // indirect - go.opentelemetry.io/otel/trace v1.37.0 // indirect - golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b // indirect - golang.org/x/net v0.46.0 // indirect - golang.org/x/oauth2 v0.31.0 // indirect - golang.org/x/sync v0.17.0 // indirect - golang.org/x/text v0.30.0 // indirect - golang.org/x/time v0.13.0 // indirect - golang.org/x/tools v0.37.0 // indirect - google.golang.org/api v0.251.0 // indirect - google.golang.org/genproto v0.0.0-20250603155806-513f23925822 // indirect - google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20250929231259-57b25ae835d4 // indirect - google.golang.org/grpc v1.76.0 // indirect - google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 // indirect - gopkg.in/yaml.v3 v3.0.1 // indirect + go.etcd.io/bbolt v1.4.3 // indirect + go.opentelemetry.io/auto/sdk v1.2.1 // indirect + go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 // indirect + go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect + go.opentelemetry.io/otel v1.44.0 // indirect + go.opentelemetry.io/otel/metric v1.44.0 // indirect + go.opentelemetry.io/otel/trace v1.44.0 // indirect + go.yaml.in/yaml/v2 v2.4.3 // indirect + go.yaml.in/yaml/v3 v3.0.5 // indirect + golang.org/x/net v0.57.0 // indirect + golang.org/x/oauth2 v0.36.0 // indirect + golang.org/x/sync v0.22.0 // indirect + golang.org/x/text v0.41.0 // indirect + golang.org/x/time v0.15.0 // indirect + golang.org/x/tools v0.48.0 // indirect + google.golang.org/api v0.292.0 // indirect + google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d // indirect + google.golang.org/grpc v1.83.1 // indirect + google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2 // indirect howett.net/plist v1.0.0 // indirect ) diff --git a/go.sum b/go.sum index f544e714..51138cfc 100644 --- a/go.sum +++ b/go.sum @@ -1,43 +1,47 @@ -cloud.google.com/go v0.120.0 h1:wc6bgG9DHyKqF5/vQvX1CiZrtHnxJjBlKUyF9nP6meA= -cloud.google.com/go v0.120.0/go.mod h1:/beW32s8/pGRuj4IILWQNd4uuebeT4dkOhKmkfit64Q= -cloud.google.com/go/auth v0.16.5 h1:mFWNQ2FEVWAliEQWpAdH80omXFokmrnbDhUS9cBywsI= -cloud.google.com/go/auth v0.16.5/go.mod h1:utzRfHMP+Vv0mpOkTRQoWD2q3BatTOoWbA7gCc2dUhQ= +cloud.google.com/go v0.123.0 h1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE= +cloud.google.com/go v0.123.0/go.mod h1:xBoMV08QcqUGuPW65Qfm1o9Y4zKZBpGS+7bImXLTAZU= +cloud.google.com/go/auth v0.22.0 h1:Xp9wAKkLoeaYb5pYZZoQGz4E9sdPxIbzS3gywZE3ciQ= +cloud.google.com/go/auth v0.22.0/go.mod h1:M9o2Oz+YI2jAfxewJgb1vyI3vceHF+eohmxyzmrl+9s= cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc= cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c= cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs= cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10= -cloud.google.com/go/iam v1.5.2 h1:qgFRAGEmd8z6dJ/qyEchAuL9jpswyODjA2lS+w234g8= -cloud.google.com/go/iam v1.5.2/go.mod h1:SE1vg0N81zQqLzQEwxL2WI6yhetBdbNQuTvIKCSkUHE= -cloud.google.com/go/kms v1.23.1 h1:Mesyv84WoP3tPjUC0O5LRqPWICO0ufdpWf9jtBCEz64= -cloud.google.com/go/kms v1.23.1/go.mod h1:rZ5kK0I7Kn9W4erhYVoIRPtpizjunlrfU4fUkumUp8g= -cloud.google.com/go/longrunning v0.6.7 h1:IGtfDWHhQCgCjwQjV9iiLnUta9LBCo8R9QmAFsS/PrE= -cloud.google.com/go/longrunning v0.6.7/go.mod h1:EAFV3IZAKmM56TyiE6VAP3VoTzhZzySwI/YI1s/nRsY= -cloud.google.com/go/security v1.18.5 h1:6hqzvuwC8za9jyCTxygmEHnp4vZ8hfhwKVArxSCAVCo= -cloud.google.com/go/security v1.18.5/go.mod h1:D1wuUkDwGqTKD0Nv7d4Fn2Dc53POJSmO4tlg1K1iS7s= -dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s= -dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk= -filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA= -filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4= +cloud.google.com/go/iam v1.11.0 h1:KieQ9Pb+LLPak1O3Rv3GgCxhnmkYf7Xyh0P5HfF1jFM= +cloud.google.com/go/iam v1.11.0/go.mod h1:KP+nKGugNJW4LcLx1uEZcq1ok5sQHFaQehQNl4QDgV4= +cloud.google.com/go/kms v1.33.0 h1:pG0X78m212b2pv9N4fdMoUO69LuZGQ9kSvn8sHBOFAo= +cloud.google.com/go/kms v1.33.0/go.mod h1:CSGvW6GnMQbY+1nOHcIzhMtHSbExXlOmCKjWtYVjcpA= +cloud.google.com/go/longrunning v1.2.0 h1:WjYH3YHBGCxGJP9M4dWGHBfXr/cFIjMkNgWcJj7/iMM= +cloud.google.com/go/longrunning v1.2.0/go.mod h1:5KMQALFGOCtFoi2xSOA1u3H7WKlhmckgiyFw7+LGQp0= +cloud.google.com/go/security v1.19.2 h1:cF3FkCRRbRC1oXuaGZFl3qU2sdu2gP3iOAHKzL5y04Y= +cloud.google.com/go/security v1.19.2/go.mod h1:KXmf64mnOsLVKe8mk/bZpU1Rsvxqc0Ej0A6tgCeN93w= +dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8= +dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA= +filippo.io/bigmod v0.1.0 h1:UNzDk7y9ADKST+axd9skUpBQeW7fG2KrTZyOE4uGQy8= +filippo.io/bigmod v0.1.0/go.mod h1:OjOXDNlClLblvXdwgFFOQFJEocLhhtai8vGLy0JCZlI= +filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo= +filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc= github.com/AndreasBriese/bbloom v0.0.0-20190825152654-46b345b51c96 h1:cTp8I5+VIoKjsnZuH8vjyaysT/ses3EvZeaV/1UkF2M= github.com/AndreasBriese/bbloom v0.0.0-20190825152654-46b345b51c96/go.mod h1:bOvUY6CB00SOBii9/FifXqc0awNKxLFCL/+pkDPuyl8= -github.com/Azure/azure-sdk-for-go/sdk/azcore v1.19.1 h1:5YTBM8QDVIBN3sxBil89WfdAAqDZbyJTgh688DSxX5w= -github.com/Azure/azure-sdk-for-go/sdk/azcore v1.19.1/go.mod h1:YD5h/ldMsG0XiIw7PdyNhLxaM317eFh5yNLccNfGdyw= -github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.12.0 h1:wL5IEG5zb7BVv1Kv0Xm92orq+5hB5Nipn3B5tn4Rqfk= -github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.12.0/go.mod h1:J7MUC/wtRpfGVbQ5sIItY5/FuVWmvzlY21WAOfQnq/I= -github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2 h1:yz1bePFlP5Vws5+8ez6T3HWXPmwOK7Yvq8QxDBD3SKY= -github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2/go.mod h1:Pa9ZNPuoNu/GztvBSKk9J1cDJW6vk/n0zLtV4mgd8N8= -github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 h1:9iefClla7iYpfYWdzPCRDozdmndjTm8DXdpCzPajMgA= -github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2/go.mod h1:XtLgD3ZD34DAaVIIAyG3objl5DynM3CQ/vMcbBNJZGI= -github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 h1:E4MgwLBGeVB5f2MdcIVD3ELVAWpr+WD6MUe1i+tM/PA= -github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0/go.mod h1:Y2b/1clN4zsAoUd/pgNAQHjLDnTis/6ROkUfyob6psM= +github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0 h1:aokoqcHvaGjiM3VpjKDfMMnF/8epJ+Q1HLJ7CudztqE= +github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0/go.mod h1:/WYEx9pcM9Y+Dd/APJaNlSvVSvzl54rrMdZT5+Oi2LM= +github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0 h1:CU4+EJeJi3TKYWEcYuSdWsjzw0nVsK/H0MSQOiPcymU= +github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0/go.mod h1:q0+UTSRvShwUCrR/s5HtyInYphN7Wvxb7snFM3u+SLA= +github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.4.0 h1:xFaZZ+IubdftrDHnGGwZ6QvQ3KHTtWl2MCK+GMt2vxs= +github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.4.0/go.mod h1:mCBhUhlMjLLJKr5aqw2TNS/VqJOie8MzWq3DAMJeKso= +github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 h1:fhqpLE3UEXi9lPaBRpQ6XuRW0nU7hgg4zlmZZa+a9q4= +github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0/go.mod h1:7dCRMLwisfRH3dBupKeNCioWYUZ4SS09Z14H+7i8ZoY= +github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.5.0 h1:MaKvxE6D0KkjOg6Wd9M00iqP5PR0kUxCfiezes4JweM= +github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.5.0/go.mod h1:i2h9fsTFKZorh8RdV2IcSUf/Qj98GlTkrTvUbX/s8as= github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 h1:nCYfgcSyHZXJI8J0IWE5MsCGlb2xp9fJiXyxWgmOFg4= github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0/go.mod h1:ucUjca2JtSZboY8IoUqyQyuuXvwbMBVwFOm0vdQPNhA= github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJTmL004Abzc5wDB5VtZG2PJk5ndYDgVacGqfirKxjM= github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE= -github.com/AzureAD/microsoft-authentication-library-for-go v1.5.0 h1:XkkQbfMyuH2jTSjQjSoihryI8GINRcs4xp8lNawg0FI= -github.com/AzureAD/microsoft-authentication-library-for-go v1.5.0/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk= +github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2 h1:RHK7bS+HQMslb1sZpAokUt+zTVmue0hKSs2C791hhzU= +github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk= github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU= github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho= +github.com/GoogleCloudPlatform/confidential-space/server v0.0.0-20260522213940-e5c6d01a3007 h1:DoeEFwEGBdqcawmpiWtSsSVVZ+wk3zpqvcvssO2JLmY= +github.com/GoogleCloudPlatform/confidential-space/server v0.0.0-20260522213940-e5c6d01a3007/go.mod h1:s8F0JYEods/WL03WxZaGsWCnumZeeLD+WKHzspOV9u0= github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI= github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU= github.com/Masterminds/semver/v3 v3.3.1 h1:QtNSWtVZ3nBfk8mAOu/B6v7FMJ+NHTIgUPi7rj+4nv4= @@ -51,41 +55,43 @@ github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAE github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8= github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d h1:Byv0BzEl3/e6D5CLfI0j/7hiIEtvGVFPCZ7Ei2oq8iQ= github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw= -github.com/aws/aws-sdk-go-v2 v1.39.2 h1:EJLg8IdbzgeD7xgvZ+I8M1e0fL0ptn/M47lianzth0I= -github.com/aws/aws-sdk-go-v2 v1.39.2/go.mod h1:sDioUELIUO9Znk23YVmIk86/9DOpkbyyVb1i/gUNFXY= -github.com/aws/aws-sdk-go-v2/config v1.31.12 h1:pYM1Qgy0dKZLHX2cXslNacbcEFMkDMl+Bcj5ROuS6p8= -github.com/aws/aws-sdk-go-v2/config v1.31.12/go.mod h1:/MM0dyD7KSDPR+39p9ZNVKaHDLb9qnfDurvVS2KAhN8= -github.com/aws/aws-sdk-go-v2/credentials v1.18.16 h1:4JHirI4zp958zC026Sm+V4pSDwW4pwLefKrc0bF2lwI= -github.com/aws/aws-sdk-go-v2/credentials v1.18.16/go.mod h1:qQMtGx9OSw7ty1yLclzLxXCRbrkjWAM7JnObZjmCB7I= -github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.9 h1:Mv4Bc0mWmv6oDuSWTKnk+wgeqPL5DRFu5bQL9BGPQ8Y= -github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.9/go.mod h1:IKlKfRppK2a1y0gy1yH6zD+yX5uplJ6UuPlgd48dJiQ= -github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.9 h1:se2vOWGD3dWQUtfn4wEjRQJb1HK1XsNIt825gskZ970= -github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.9/go.mod h1:hijCGH2VfbZQxqCDN7bwz/4dzxV+hkyhjawAtdPWKZA= -github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.9 h1:6RBnKZLkJM4hQ+kN6E7yWFveOTg8NLPHAkqrs4ZPlTU= -github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.9/go.mod h1:V9rQKRmK7AWuEsOMnHzKj8WyrIir1yUJbZxDuZLFvXI= -github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 h1:bIqFDwgGXXN1Kpp99pDOdKMTTb5d2KyU5X/BZxjOkRo= -github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3/go.mod h1:H5O/EsxDWyU+LP/V8i5sm8cxoZgc2fdNR9bxlOFrQTo= -github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1 h1:oegbebPEMA/1Jny7kvwejowCaHz1FWZAQ94WXFNCyTM= -github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1/go.mod h1:kemo5Myr9ac0U9JfSjMo9yHLtw+pECEHsFtJ9tqCEI8= -github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.9 h1:5r34CgVOD4WZudeEKZ9/iKpiT6cM1JyEROpXjOcdWv8= -github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.9/go.mod h1:dB12CEbNWPbzO2uC6QSWHteqOg4JfBVJOojbAoAUb5I= -github.com/aws/aws-sdk-go-v2/service/kms v1.45.6 h1:Br3kil4j7RPW+7LoLVkYt8SuhIWlg6ylmbmzXJ7PgXY= -github.com/aws/aws-sdk-go-v2/service/kms v1.45.6/go.mod h1:FKXkHzw1fJZtg1P1qoAIiwen5thz/cDRTTDCIu8ljxc= -github.com/aws/aws-sdk-go-v2/service/sso v1.29.6 h1:A1oRkiSQOWstGh61y4Wc/yQ04sqrQZr1Si/oAXj20/s= -github.com/aws/aws-sdk-go-v2/service/sso v1.29.6/go.mod h1:5PfYspyCU5Vw1wNPsxi15LZovOnULudOQuVxphSflQA= -github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.1 h1:5fm5RTONng73/QA73LhCNR7UT9RpFH3hR6HWL6bIgVY= -github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.1/go.mod h1:xBEjWD13h+6nq+z4AkqSfSvqRKFgDIQeaMguAJndOWo= -github.com/aws/aws-sdk-go-v2/service/sts v1.38.6 h1:p3jIvqYwUZgu/XYeI48bJxOhvm47hZb5HUQ0tn6Q9kA= -github.com/aws/aws-sdk-go-v2/service/sts v1.38.6/go.mod h1:WtKK+ppze5yKPkZ0XwqIVWD4beCwv056ZbPQNoeHqM8= -github.com/aws/smithy-go v1.23.0 h1:8n6I3gXzWJB2DxBDnfxgBaSX6oe0d/t10qGz7OKqMCE= -github.com/aws/smithy-go v1.23.0/go.mod h1:t1ufH5HMublsJYulve2RKmHDC15xu1f26kHCp/HgceI= +github.com/aws/aws-sdk-go-v2 v1.43.4 h1:b9FTvbRwy+JCsfp2Wp6wV/KbOx3Aj7nkoFb2cRX0IhE= +github.com/aws/aws-sdk-go-v2 v1.43.4/go.mod h1:70vwSy16txshwG+g55WkpgPKDIByzHI8ccBsOteo3bQ= +github.com/aws/aws-sdk-go-v2/config v1.32.35 h1:UEzXuET8E42lxBPijuACu/tEK7v5lFPlk0Q+GT5WD9E= +github.com/aws/aws-sdk-go-v2/config v1.32.35/go.mod h1:KaMtJpFa2JlL2BStjjHQVwQpzZEmw+ND/EgVrfFoo2g= +github.com/aws/aws-sdk-go-v2/credentials v1.19.34 h1:y6GkSmcv5myd1ngrYbGmiLlwQqB6TQhOuN/tbSSuWDY= +github.com/aws/aws-sdk-go-v2/credentials v1.19.34/go.mod h1:w3dTcnDVoQIewjo7JG45hduAToikiIFLC4FIO7fndvw= +github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.35 h1:+S7kbJoLDDQ5tE+lHrUBgMkzC8NLgsaioS2F3dVoFAE= +github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.35/go.mod h1:Ak7xXviIARfFdNUJ9Etb0bdVDt/KAvKjMGJVLWXDzik= +github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.35 h1:kzVuGlatQtYinwBJEEyLAbggepCoavosiaHHX9+fD+c= +github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.35/go.mod h1:0yLx0yEI+SfqeJMPvOtIEFoZbiQYXMGszBueiutQyaI= +github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.35 h1:WK6CjihTuLisCjSKKbildJ79sGZZgbBz3iNa7VsKIhU= +github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.35/go.mod h1:KYleN57luLoe97R7vTnx8PMcVrr9gAcRECtOjl91DNg= +github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.36 h1:jbGY4CXLzZElOXgGsexlC3Hi+3YM0rSmk4opFXKqg/k= +github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.36/go.mod h1:uBu/9aKsS/UQGc72RAt3y54kjgYQxmhut8ZD2dXCDNE= +github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.15 h1:JJLBQxwY+AFwuPAi5ivGc1ChnTdUt4cXMv7e76m2c/Y= +github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.15/go.mod h1:lQknBIe78MVL0cQOQDlag8KGflMbMEVFx9mB6O8ENvk= +github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.35 h1:BBEElKh4a+rKshvjrfpajTe9CbpZvrbb4Jkg2PB7RzA= +github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.35/go.mod h1:zaZk983w//8beSruBVec/mr4CmDwgZitW/qzGhAAX0g= +github.com/aws/aws-sdk-go-v2/service/kms v1.55.4 h1:8T9CDPlcIUpXTKXXfMMFtD1eujGXbVysGiidx79bTkc= +github.com/aws/aws-sdk-go-v2/service/kms v1.55.4/go.mod h1:XlYycjMbh9zYnTPpjUropzSDngZd/x37jNa9vGHA7hE= +github.com/aws/aws-sdk-go-v2/service/signin v1.5.4 h1:cOJELVNrq5Q3Udry2GLuHUM7MhwpeaQRdYaoa6GI/yI= +github.com/aws/aws-sdk-go-v2/service/signin v1.5.4/go.mod h1:f4LxzKBtaTxD7xh3PiVg3CE1tchQemfmghaJr+NbK2c= +github.com/aws/aws-sdk-go-v2/service/sso v1.33.4 h1:AMW7a7S8iQaHjBYZdU3PCq4GKRPijTPRAc7e6XtEThY= +github.com/aws/aws-sdk-go-v2/service/sso v1.33.4/go.mod h1:QQNsFV1DVXoXcZt18FS8lI8rtUrlDyAuWZLQ5shunv4= +github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.4 h1:AsbZcJAQPRmHDJG8K1N0pof/1zPWjVT8TFlTWuGLSvo= +github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.4/go.mod h1:6imqztH0//t0mKbl6yWl7swSEl7F/w32oAmqB3vP1ag= +github.com/aws/aws-sdk-go-v2/service/sts v1.45.4 h1:w/AryDYMjSUANSQ2uoZxJovUsMTwWJNTv3IMex30Y+4= +github.com/aws/aws-sdk-go-v2/service/sts v1.45.4/go.mod h1:WeBiAa67azG7Su9Vf+ChGDBLiAozJCXzdjXiPBUwtbc= +github.com/aws/smithy-go v1.27.6 h1:0zjT8jgK3jbrTT7JJ3EE6JsMhX8JTrZ+f1sEndYDXrA= +github.com/aws/smithy-go v1.27.6/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc= github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw= github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8= github.com/boombuler/barcode v1.0.1 h1:NDBbPmhS+EqABEs5Kg3n/5ZNjy73Pz7SIV+KCeqyXcs= github.com/boombuler/barcode v1.0.1/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8= -github.com/ccoveille/go-safecast v1.7.0 h1:i+0eldPFBeXCTARGyocNS6BNRomquA/GhTZVNEtaIXI= -github.com/ccoveille/go-safecast v1.7.0/go.mod h1:QqwNjxQ7DAqY0C721OIO9InMk9zCwcsO7tnRuHytad8= +github.com/ccoveille/go-safecast/v2 v2.0.1 h1:2+mIu3gXtwmWelBia2kkxfB8eP4orTHDH7ClSlWkd6I= +github.com/ccoveille/go-safecast/v2 v2.0.1/go.mod h1:JIYA4CAR33blIDuE6fSwCp2sz1oOBahXnvmdBhOAABs= github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko= github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc= github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= @@ -100,20 +106,20 @@ github.com/chzyer/readline v1.5.1/go.mod h1:Eh+b79XXUwfKfcPLepksvw2tcLE/Ct21YObk github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU= github.com/chzyer/test v1.0.0 h1:p3BQDXSxOhOG0P9z6/hGnII4LGiEPOYBhs8asl/fC04= github.com/chzyer/test v1.0.0/go.mod h1:2JlltgoNkt4TW/z9V/IzDdFaMTM2JPIi26O1pF38GC8= -github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 h1:aQ3y1lwWyqYPiWZThqv1aFbZMiM9vblcSArJRf2Irls= -github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8= +github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 h1:aBangftG7EVZoUb69Os8IaYg++6uMOdKK83QtkkvJik= +github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2/go.mod h1:qwXFYgsP6T7XnJtbKlf1HP8AjxZZyzxMmc+Lq5GjlU4= github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE= github.com/coreos/go-etcd v2.0.0+incompatible/go.mod h1:Jez6KQU2B/sWsbdaef3ED8NzMklzPG4d5KIOhIy30Tk= -github.com/coreos/go-oidc/v3 v3.14.1 h1:9ePWwfdwC4QKRlCXsJGou56adA/owXczOzwKdOumLqk= -github.com/coreos/go-oidc/v3 v3.14.1/go.mod h1:HaZ3szPaZ0e4r6ebqvsLWlk2Tn+aejfmrfah6hnSYEU= +github.com/coreos/go-oidc/v3 v3.17.0 h1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc= +github.com/coreos/go-oidc/v3 v3.17.0/go.mod h1:wqPbKFrVnE90vty060SB40FCJ8fTHTxSwyXJqZH+sI8= github.com/coreos/go-semver v0.2.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk= +github.com/coreos/go-systemd/v22 v22.7.0 h1:LAEzFkke61DFROc7zNLX/WA2i5J8gYqe0rSj9KI28KA= +github.com/coreos/go-systemd/v22 v22.7.0/go.mod h1:xNUYtjHu2EDXbsxz1i41wouACIwT7Ybq9o0BQhMwD0w= github.com/cpuguy83/go-md2man v1.0.10/go.mod h1:SmD6nW6nTyfqj6ABTjUi3V3JVMnlJmwcJI5acqYI6dE= github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo= github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= -github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/dgraph-io/badger v1.6.2 h1:mNw0qs90GVgGGWylh0umH5iag1j6n/PeJtNvL6KY/x8= github.com/dgraph-io/badger v1.6.2/go.mod h1:JW2yswe3V058sS0kZ2h/AXeDSqFjxnZcRrVH//y2UQE= github.com/dgraph-io/badger/v2 v2.2007.4 h1:TRWBQg8UrlUhaFdco01nO2uXwzKS7zd+HVdwV/GHc4o= @@ -128,33 +134,33 @@ github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13/go.mod h1:SqUrOPUn github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk= github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY= github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto= -github.com/envoyproxy/go-control-plane v0.13.4 h1:zEqyPVyku6IvWCFwux4x9RxkLOMUL+1vC9xUFv5l2/M= -github.com/envoyproxy/go-control-plane/envoy v1.32.4 h1:jb83lalDRZSpPWW2Z7Mck/8kXZ5CQAFYVjQcdVIr83A= -github.com/envoyproxy/go-control-plane/envoy v1.32.4/go.mod h1:Gzjc5k8JcJswLjAx1Zm+wSYE20UrLtt7JZMWiWQXQEw= -github.com/envoyproxy/protoc-gen-validate v1.2.1 h1:DEo3O99U8j4hBFwbJfrz9VtgcDfUKS7KJ7spH3d86P8= -github.com/envoyproxy/protoc-gen-validate v1.2.1/go.mod h1:d/C80l/jxXLdfEIhX1W2TmLfsJ31lvEjwamM4DxlWXU= +github.com/envoyproxy/go-control-plane v0.14.0 h1:hbG2kr4RuFj222B6+7T83thSPqLjwBIfQawTkC++2HA= +github.com/envoyproxy/go-control-plane/envoy v1.37.0 h1:u3riX6BoYRfF4Dr7dwSOroNfdSbEPe9Yyl09/B6wBrQ= +github.com/envoyproxy/go-control-plane/envoy v1.37.0/go.mod h1:DReE9MMrmecPy+YvQOAOHNYMALuowAnbjjEMkkWOi6A= +github.com/envoyproxy/protoc-gen-validate v1.3.3 h1:MVQghNeW+LZcmXe7SY1V36Z+WFMDjpqGAGacLe2T0ds= +github.com/envoyproxy/protoc-gen-validate v1.3.3/go.mod h1:TsndJ/ngyIdQRhMcVVGDDHINPLWB7C82oDArY51KfB0= github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg= github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8= github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0= github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo= -github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM= -github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ= -github.com/go-chi/chi/v5 v5.2.2 h1:CMwsvRVTbXVytCk1Wd72Zy1LAsAh9GxMmSNWLHCG618= -github.com/go-chi/chi/v5 v5.2.2/go.mod h1:L2yAIGWB3H+phAw1NxKwWM+7eUH/lU8pOMm5hHcoops= -github.com/go-jose/go-jose/v3 v3.0.4 h1:Wp5HA7bLQcKnf6YYao/4kpRpVMp/yf6+pJKV8WFSaNY= -github.com/go-jose/go-jose/v3 v3.0.4/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ= -github.com/go-jose/go-jose/v4 v4.1.2 h1:TK/7NqRQZfgAh+Td8AlsrvtPoUyiHh0LqVvokh+1vHI= -github.com/go-jose/go-jose/v4 v4.1.2/go.mod h1:22cg9HWM1pOlnRiY+9cQYJ9XHmya1bYW8OeDM6Ku6Oo= +github.com/fxamacker/cbor/v2 v2.9.3 h1:oQBnFATpNdY8gJHTndDDv5Xl4QqNaz51G5LLEPhng3Q= +github.com/fxamacker/cbor/v2 v2.9.3/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ= +github.com/go-chi/chi/v5 v5.2.5 h1:Eg4myHZBjyvJmAFjFvWgrqDTXFyOzjj7YIm3L3mu6Ug= +github.com/go-chi/chi/v5 v5.2.5/go.mod h1:X7Gx4mteadT3eDOMTsXzmI4/rwUpOwBHLpAfupzFJP0= +github.com/go-jose/go-jose/v3 v3.0.5 h1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ= +github.com/go-jose/go-jose/v3 v3.0.5/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ= +github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= +github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= -github.com/go-sql-driver/mysql v1.9.2 h1:4cNKDYQ1I84SXslGddlsrMhc8k4LeDVj6Ad6WRjiHuU= -github.com/go-sql-driver/mysql v1.9.2/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU= -github.com/golang-jwt/jwt/v5 v5.3.0 h1:pv4AsKCKKZuqlgs5sUmn4x8UlGa0kEVt/puTpKx9vvo= -github.com/golang-jwt/jwt/v5 v5.3.0/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE= +github.com/go-sql-driver/mysql v1.9.3 h1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo= +github.com/go-sql-driver/mysql v1.9.3/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU= +github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY= +github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE= github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q= github.com/golang/glog v1.2.5 h1:DrW6hGnjIhtvhOIiAKT6Psh/Kd/ldepEa81DKeiRJ5I= github.com/golang/glog v1.2.5/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w= @@ -176,16 +182,18 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/go-configfs-tsm v0.3.3-0.20240919001351-b4b5b84fdcbc h1:SG12DWUUM5igxm+//YX5Yq4vhdoRnOG9HkCodkOn+YU= github.com/google/go-configfs-tsm v0.3.3-0.20240919001351-b4b5b84fdcbc/go.mod h1:EL1GTDFMb5PZQWDviGfZV9n87WeGTR/JUg13RfwkgRo= +github.com/google/go-eventlog v0.0.3-0.20260416001248-6807b85eecf0 h1:STyioPkz8nqMMIk3+YlyJ/WyEJZxho1YUZXu99uAbQ0= +github.com/google/go-eventlog v0.0.3-0.20260416001248-6807b85eecf0/go.mod h1:7huE5P8w2NTObSwSJjboHmB7ioBNblkijdzoVa2skfQ= github.com/google/go-github v17.0.0+incompatible/go.mod h1:zLgOLi98H3fifZn+44m+umXrS52loVEgC2AApnigrVQ= github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck= -github.com/google/go-sev-guest v0.13.0 h1:DJB6ACdykyweMU0HGOp/TQ7cjsnbV2ecbYunu2E0qy0= -github.com/google/go-sev-guest v0.13.0/go.mod h1:SK9vW+uyfuzYdVN0m8BShL3OQCtXZe/JPF7ZkpD3760= -github.com/google/go-tdx-guest v0.3.2-0.20241009005452-097ee70d0843 h1:+MoPobRN9HrDhGyn6HnF5NYo4uMBKaiFqAtf/D/OB4A= -github.com/google/go-tdx-guest v0.3.2-0.20241009005452-097ee70d0843/go.mod h1:g/n8sKITIT9xRivBUbizo34DTsUm2nN2uU3A662h09g= -github.com/google/go-tpm v0.9.6 h1:Ku42PT4LmjDu1H5C5ISWLlpI1mj+Zq7sPGKoRw2XROA= -github.com/google/go-tpm v0.9.6/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY= -github.com/google/go-tpm-tools v0.4.6 h1:hwIwPG7w4z5eQEBq11gYw8YYr9xXLfBQ/0JsKyq5AJM= -github.com/google/go-tpm-tools v0.4.6/go.mod h1:MsVQbJnRhKDfWwf5zgr3cDGpj13P1uLAFF0wMEP/n5w= +github.com/google/go-sev-guest v0.14.0 h1:dCb4F3YrHTtrDX3cYIPTifEDz7XagZmXQioxRBW4wOo= +github.com/google/go-sev-guest v0.14.0/go.mod h1:SK9vW+uyfuzYdVN0m8BShL3OQCtXZe/JPF7ZkpD3760= +github.com/google/go-tdx-guest v0.3.2-0.20250814004405-ffb0869e6f4d h1:Ff8goEP/ue2/rZT5qyoRicuySCYDbAXEZS8Cf1fgsUo= +github.com/google/go-tdx-guest v0.3.2-0.20250814004405-ffb0869e6f4d/go.mod h1:uHy3VaNXNXhl0fiPxKqTxieeouqQmW6A0EfLcaeCYBk= +github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo= +github.com/google/go-tpm v0.9.8/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY= +github.com/google/go-tpm-tools v0.4.9 h1:jZEhnE4WRFbomSssBH2gWaIViIHU1gjH1jz76+xC9bI= +github.com/google/go-tpm-tools v0.4.9/go.mod h1:Omb8zosA8qY9URn1gsrO2i4b6DFqGp29BqNx18V66c4= github.com/google/go-tspi v0.3.0 h1:ADtq8RKfP+jrTyIWIZDIYcKOMecRqNJFOew2IT0Inus= github.com/google/go-tspi v0.3.0/go.mod h1:xfMGI3G0PhxCdNVcYr1C4C+EizojDg/TXuX5by8CiHI= github.com/google/logger v1.1.1 h1:+6Z2geNxc9G+4D4oDO9njjjn2d0wN5d7uOo0vOIW1NQ= @@ -194,10 +202,10 @@ github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0= github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/googleapis/enterprise-certificate-proxy v0.3.6 h1:GW/XbdyBFQ8Qe+YAmFU9uHLo7OnF5tL52HFAgMmyrf4= -github.com/googleapis/enterprise-certificate-proxy v0.3.6/go.mod h1:MkHOF77EYAE7qfSuSS9PU6g4Nt4e11cnsDUowfwewLA= -github.com/googleapis/gax-go/v2 v2.15.0 h1:SyjDc1mGgZU5LncH8gimWo9lW1DtIfPibOG81vgd/bo= -github.com/googleapis/gax-go/v2 v2.15.0/go.mod h1:zVVkkxAQHa1RQpg9z2AUCMnKhi0Qld9rcmyfL1OZhoc= +github.com/googleapis/enterprise-certificate-proxy v0.3.19 h1:mMOE7DN2+p76/EdIrmAy9B9bH+yC4563vmnJ34QR8i4= +github.com/googleapis/enterprise-certificate-proxy v0.3.19/go.mod h1:rSEsBUemEBZEexP2y6jPp16LUmUbjmSbcPMQizR0o4k= +github.com/googleapis/gax-go/v2 v2.23.0 h1:Tchl7qkvE7Ip3y+ztvNufYFvkfqTe7NfLTYGIdJRLuE= +github.com/googleapis/gax-go/v2 v2.23.0/go.mod h1:rBQKOVJCdb8IFEzg+FCwlt1LP/xMDGuqUXhUG+XMXEg= github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ= github.com/huandu/xstrings v1.5.0 h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI= github.com/huandu/xstrings v1.5.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE= @@ -206,8 +214,8 @@ github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsI github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg= github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo= github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM= -github.com/jackc/pgx/v5 v5.7.5 h1:JHGfMnQY+IEtGM63d+NGMjoRpysB2JBwDr5fsngwmJs= -github.com/jackc/pgx/v5 v5.7.5/go.mod h1:aruU7o91Tc2q2cFp5h4uP3f6ztExVpyVv88Xl/8Vl8M= +github.com/jackc/pgx/v5 v5.9.2 h1:3ZhOzMWnR4yJ+RW1XImIPsD1aNSz4T4fyP7zlQb56hw= +github.com/jackc/pgx/v5 v5.9.2/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4= github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo= github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4= github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI= @@ -231,8 +239,8 @@ github.com/manifoldco/promptui v0.9.0 h1:3V4HzJk1TtXW1MTZMP7mdlwbBpIinw3HztaIlYt github.com/manifoldco/promptui v0.9.0/go.mod h1:ka04sppxSGFAtxX0qhlYQjISsg9mR4GWtQEhdbn6Pgg= github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE= github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8= -github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY= -github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y= +github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI= +github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A= github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d h1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI= github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE= github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw= @@ -243,8 +251,8 @@ github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zx github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= -github.com/newrelic/go-agent/v3 v3.39.0 h1:VVhsJR422oOxU/sJ1HZrop/OC7G1GTClIviVJxeJrK8= -github.com/newrelic/go-agent/v3 v3.39.0/go.mod h1:4QXvru0vVy/iu7mfkNHT7T2+9TC9zPGO8aUEdKqY138= +github.com/newrelic/go-agent/v3 v3.42.0 h1:aA2Ea1RT5eD59LtOS1KGFXSmaDs6kM3Jeqo7PpuQoFQ= +github.com/newrelic/go-agent/v3 v3.42.0/go.mod h1:sCgxDCVydoKD/C4S8BFxDtmFHvdWHtaIz/a3kiyNB/k= github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic= github.com/peterbourgon/diskv/v3 v3.0.1 h1:x06SQA46+PKIUftmEujdwSEpIx8kR+M9eLYsUxeYveU= github.com/peterbourgon/diskv/v3 v3.0.1/go.mod h1:kJ5Ny7vLdARGU3WUuy6uzO6T0nb/2gWcT1JiBvRmb5o= @@ -256,20 +264,18 @@ github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo= github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= -github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/pquerna/otp v1.5.0 h1:NMMR+WrmaqXU4EzdGJEE1aUUI0AMRzsp96fFFWNPwxs= github.com/pquerna/otp v1.5.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg= -github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q= -github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0= -github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E= -github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY= -github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ2Io= -github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I= -github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc= -github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk= -github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= -github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= +github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o= +github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg= +github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk= +github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE= +github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4= +github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw= +github.com/prometheus/procfs v0.19.2 h1:zUMhqEW66Ex7OXIiDkll3tl9a1ZdilUOd/F6ZXw4Vws= +github.com/prometheus/procfs v0.19.2/go.mod h1:M0aotyiemPhBCM0z5w87kL22CxfcH05ZpYlu+b4J7mw= +github.com/rogpeppe/go-internal v1.16.0 h1:O9DK+vNMDVGLr2BeZqmpLeMjiMNkuXfcqntWbZV6S5g= +github.com/rogpeppe/go-internal v1.16.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs= github.com/rs/xid v1.6.0 h1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU= github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0= github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g= @@ -281,29 +287,28 @@ github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME= github.com/shurcooL/sanitized_anchor_name v1.0.0 h1:PdmoCO6wvbs+7yrJyMORt4/BmY5IYyJwS/kOiWx8mHo= github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc= -github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ= -github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ= -github.com/slackhq/nebula v1.9.7 h1:v5u46efIyYHGdfjFnozQbRRhMdaB9Ma1SSTcUcE2lfE= -github.com/slackhq/nebula v1.9.7/go.mod h1:1+4q4wd3dDAjO8rKCttSb9JIVbklQhuJiBp5I0lbIsQ= +github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w= +github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g= +github.com/slackhq/nebula v1.10.3 h1:EstYj8ODEcv6T0R9X5BVq1zgWZnyU5gtPzk99QF1PMU= +github.com/slackhq/nebula v1.10.3/go.mod h1:IL5TUQm4x9IFx2kCKPYm1gP47pwd5b8QGnnBH2RHnvs= github.com/smallstep/assert v0.0.0-20200723003110-82e2b9b3b262 h1:unQFBIznI+VYD1/1fApl1A+9VcBk+9dcqGfnePY87LY= github.com/smallstep/assert v0.0.0-20200723003110-82e2b9b3b262/go.mod h1:MyOHs9Po2fbM1LHej6sBUT8ozbxmMOFG+E+rx/GSGuc= -github.com/smallstep/certificates v0.28.4 h1:JTU6/A5Xes6m+OsR6fw1RACSA362vJc9SOFVG7poBEw= -github.com/smallstep/certificates v0.28.4/go.mod h1:LUqo+7mKZE7FZldlTb0zhU4A0bq4G4+akieFMcTaWvA= -github.com/smallstep/certinfo v1.15.0 h1:oxvuOr6KvwuXjgyg+gJEUJW6Gz9pm4uAGQ5tirpmTHg= -github.com/smallstep/certinfo v1.15.0/go.mod h1:t5s4J23P3B/j68l2efuJFSZqCj0kBU8sa2FYbHRaffw= +github.com/smallstep/certificates v0.30.2 h1:1G3xBi8sJ740iA1mMPW2Svv7EIZKJ4Zf/iQtA5QlN0Y= +github.com/smallstep/certificates v0.30.2/go.mod h1:oyaE/aEYUGDr+YiCZLAxxP22bOQqcSHTeDgp8Vv2rlY= +github.com/smallstep/certinfo v1.16.0 h1:ZxDI9EDmCh4B/j9YtlTk/6ut+H/Gi0N3d0TwHv7F2YY= +github.com/smallstep/certinfo v1.16.0/go.mod h1:OPwtFVAOx29OjOYsVtj9cDliDFywkVYPt+ExDg43kPs= github.com/smallstep/cli-utils v0.12.2 h1:lGzM9PJrH/qawbzMC/s2SvgLdJPKDWKwKzx9doCVO+k= github.com/smallstep/cli-utils v0.12.2/go.mod h1:uCPqefO29goHLGqFnwk0i8W7XJu18X3WHQFRtOm/00Y= -github.com/smallstep/go-attestation v0.4.4-0.20241119153605-2306d5b464ca h1:VX8L0r8vybH0bPeaIxh4NQzafKQiqvlOn8pmOXbFLO4= -github.com/smallstep/go-attestation v0.4.4-0.20241119153605-2306d5b464ca/go.mod h1:vNAduivU014fubg6ewygkAvQC0IQVXqdc8vaGl/0er4= -github.com/smallstep/linkedca v0.25.0 h1:txT9QHGbCsJq0MhAghBq7qhurGY727tQuqUi+n4BVBo= -github.com/smallstep/linkedca v0.25.0/go.mod h1:Q3jVAauFKNlF86W5/RFtgQeyDKz98GL/KN3KG4mJOvc= -github.com/smallstep/nosql v0.7.0 h1:YiWC9ZAHcrLCrayfaF+QJUv16I2bZ7KdLC3RpJcnAnE= -github.com/smallstep/nosql v0.7.0/go.mod h1:H5VnKMCbeq9QA6SRY5iqPylfxLfYcLwvUff3onQ8+HU= -github.com/smallstep/pkcs7 v0.0.0-20240911091500-b1cae6277023/go.mod h1:CM5KrX7rxWgwDdMj9yef/pJB2OPgy/56z4IEx2UIbpc= +github.com/smallstep/go-attestation v0.4.4-0.20260814222900-a849f4e2cd68 h1:KcK2guFXrE5sX/nvF1b+atHP6DjRB1gCv3ppyTXB2Zk= +github.com/smallstep/go-attestation v0.4.4-0.20260814222900-a849f4e2cd68/go.mod h1:vNAduivU014fubg6ewygkAvQC0IQVXqdc8vaGl/0er4= +github.com/smallstep/linkedca v0.26.0 h1:NsxTVo3zI3KwOFFiVodeHtuGgKq0b5kOUXVLjjNTvXY= +github.com/smallstep/linkedca v0.26.0/go.mod h1:Z8c7EgVrSHNhshIhRnUGfKfE796+TwF2eyErhqANmJQ= +github.com/smallstep/nosql v0.8.0 h1:FBTCUfKPmWYbrozW+RBKu+fnvbn+zr5rVli/XB4Jp4A= +github.com/smallstep/nosql v0.8.0/go.mod h1:5dUpNotHLHhOUapP0PLBVVfp3tG1DFC31VRccg+Cqwo= github.com/smallstep/pkcs7 v0.2.1 h1:6Kfzr/QizdIuB6LSv8y1LJdZ3aPSfTNhTLqAx9CTLfA= github.com/smallstep/pkcs7 v0.2.1/go.mod h1:RcXHsMfL+BzH8tRhmrF1NkkpebKpq3JEM66cOFxanf0= -github.com/smallstep/scep v0.0.0-20240926084937-8cf1ca453101 h1:LyZqn24/ZiVg8v9Hq07K6mx6RqPtpDeK+De5vf4QEY4= -github.com/smallstep/scep v0.0.0-20240926084937-8cf1ca453101/go.mod h1:EuKQjYGQwhUa1mgD21zxIgOgUYLsqikJmvxNscxpS/Y= +github.com/smallstep/scep v0.0.0-20250318231241-a25cabb69492 h1:k23+s51sgYix4Zgbvpmy+1ZgXLjr4ZTkBTqXmpnImwA= +github.com/smallstep/scep v0.0.0-20250318231241-a25cabb69492/go.mod h1:QQhwLqCS13nhv8L5ov7NgusowENUtXdEzdytjmJHdZQ= github.com/smallstep/truststore v0.13.0 h1:90if9htAOblavbMeWlqNLnO9bsjjgVv2hQeQJCi/py4= github.com/smallstep/truststore v0.13.0/go.mod h1:3tmMp2aLKZ/OA/jnFUB0cYPcho402UG2knuJoPh4j7A= github.com/smallstep/zcrypto v0.0.0-20221001003018-1ab2364d2a91 h1:XE0cgVBMkYPxOZv4F3YY5mX9GgentifWU6vyJb6gKmc= @@ -333,8 +338,8 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo= github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY= -github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= -github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= +github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= +github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0= github.com/urfave/cli v1.22.17 h1:SYzXoiPfQjHBbkYxbew5prZHS1TOLT3ierW8SYLqtVQ= github.com/urfave/cli v1.22.17/go.mod h1:b0ht0aqgH/6pBYzzxURyrM4xXNgsoT/n2ZzwQiEhNVo= @@ -346,44 +351,47 @@ github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM= github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg= github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q= github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= -go.etcd.io/bbolt v1.4.0 h1:TU77id3TnN/zKr7CO/uk+fBCwF2jGcMuw2B/FMAzYIk= -go.etcd.io/bbolt v1.4.0/go.mod h1:AsD+OCi/qPN1giOX1aiLAha3o1U8rAz65bvN4j0sRuk= -go.mozilla.org/pkcs7 v0.9.0 h1:yM4/HS9dYv7ri2biPtxt8ikvB37a980dg69/pKmS+eI= -go.mozilla.org/pkcs7 v0.9.0/go.mod h1:SNgMg+EgDFwmvSmLRTNKC5fegJjB7v23qTQ0XLGUNHk= -go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA= -go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A= -go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 h1:q4XOmH/0opmeuJtPsbFNivyl7bCt7yRBbeEm2sC/XtQ= -go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0/go.mod h1:snMWehoOh2wsEwnvvwtDyFCxVeDAODenXHtn5vzrKjo= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q= -go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ= -go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I= -go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE= -go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E= -go.opentelemetry.io/otel/sdk v1.37.0 h1:ItB0QUqnjesGRvNcmAcU0LyvkVyGJ2xftD29bWdDvKI= -go.opentelemetry.io/otel/sdk v1.37.0/go.mod h1:VredYzxUvuo2q3WRcDnKDjbdvmO0sCzOvVAiY+yUkAg= -go.opentelemetry.io/otel/sdk/metric v1.37.0 h1:90lI228XrB9jCMuSdA0673aubgRobVZFhbjxHHspCPc= -go.opentelemetry.io/otel/sdk/metric v1.37.0/go.mod h1:cNen4ZWfiD37l5NhS+Keb5RXVWZWpRE+9WyVCpbo5ps= -go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4= -go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0= -go.step.sm/crypto v0.72.0 h1:cwkxbmnN8jj8YWmoXdoGhaac81d2SwXguwmHN9KJxHw= -go.step.sm/crypto v0.72.0/go.mod h1:EAy7MSOXxCvCaDAKJqz0bLdTSDdhpEM9xqye8XsfrM4= +go.etcd.io/bbolt v1.4.3 h1:dEadXpI6G79deX5prL3QRNP6JB8UxVkqo4UPnHaNXJo= +go.etcd.io/bbolt v1.4.3/go.mod h1:tKQlpPaYCVFctUIgFKFnAlvbmB3tpy1vkTnDWohtc0E= +go.mozilla.org/pkcs7 v0.10.0 h1:jmljzDzNYFzaP1dFlgmCiQml9e+iEMmv8/NNs4evQbg= +go.mozilla.org/pkcs7 v0.10.0/go.mod h1:SNgMg+EgDFwmvSmLRTNKC5fegJjB7v23qTQ0XLGUNHk= +go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= +go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= +go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 h1:yI1/OhfEPy7J9eoa6Sj051C7n5dvpj0QX8g4sRchg04= +go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0/go.mod h1:NoUCKYWK+3ecatC4HjkRktREheMeEtrXoQxrqYFeHSc= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 h1:OyrsyzuttWTSur2qN/Lm0m2a8yqyIjUVBZcxFPuXq2o= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0/go.mod h1:C2NGBr+kAB4bk3xtMXfZ94gqFDtg/GkI7e9zqGh5Beg= +go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= +go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= +go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc= +go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo= +go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58= +go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0= +go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI= +go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA= +go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk= +go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= +go.step.sm/crypto v0.89.0 h1:NPxryE+cZ4XDwXOQY2U6Gu+mOzOihuRLPIsX7WtPzZM= +go.step.sm/crypto v0.89.0/go.mod h1:IEgE6DndnYojbDyHU7eYXpwWzpu4ftkouw7nyI6jsxg= +go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= +go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y= go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU= go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0= go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y= +go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0= +go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8= +go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= +go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc= golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU= golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8= -golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70= golang.org/x/crypto v0.33.0/go.mod h1:bVdXmD7IV/4GdElGPozy6U7lWdRXA4qyRVGJV57uQ5M= -golang.org/x/crypto v0.43.0 h1:dduJYIi3A3KOfdGOHX8AVZ/jGiyPa3IbBozJ5kNuE04= -golang.org/x/crypto v0.43.0/go.mod h1:BFbav4mRNlXJL4wNeejLpWxB7wMbc79PdRGhWKncxR0= -golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b h1:M2rDM6z3Fhozi9O7NWsxAkg/yqS/lQJ6PmkyIV3YP+o= -golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b/go.mod h1:3//PLf8L/X+8b4vuAfHzxeRUl04Adcb341+IGKfnqS8= +golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M= +golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= @@ -398,20 +406,19 @@ golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg= golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk= golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44= golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM= -golang.org/x/net v0.46.0 h1:giFlY12I07fugqwPuWJi68oOnpfqFnJIJzaIIm2JVV4= -golang.org/x/net v0.46.0/go.mod h1:Q9BGdFy1y4nkUwiLvT5qtyhAnEHgnQ/zd8PfU6nc210= -golang.org/x/oauth2 v0.31.0 h1:8Fq0yVZLh4j4YA47vHKFTa9Ew5XIrCP8LC6UeNZnLxo= -golang.org/x/oauth2 v0.31.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA= +golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= +golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= +golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= +golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y= golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= -golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= -golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug= -golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= +golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= +golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= golang.org/x/sys v0.0.0-20181122145206-62eef0e2fa9b/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20181205085412-a5c9d58dba9a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= @@ -420,20 +427,17 @@ golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220310020820-b874c991c1a5/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20221010170243-090e33056c14/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= -golang.org/x/sys v0.25.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= -golang.org/x/sys v0.37.0 h1:fdNQudmxPjkdUTPnLn5mdQv7Zwvbvpaxqs831goi9kQ= -golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= +golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= +golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= @@ -442,10 +446,9 @@ golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo= golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU= golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk= golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY= -golang.org/x/term v0.24.0/go.mod h1:lOBK/LVxemqiMij05LGJ0tzNr8xlmwBRJ81PX6wVLH8= golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s= -golang.org/x/term v0.36.0 h1:zMPR+aF8gfksFprF/Nc/rd1wRS1EI6nDBGyWAvDzx2Q= -golang.org/x/term v0.36.0/go.mod h1:Qu394IJq6V6dCBRgwqshf3mPF85AqzYEzofzRdZkWss= +golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0= +golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= @@ -454,37 +457,36 @@ golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= -golang.org/x/text v0.18.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY= golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY= -golang.org/x/text v0.30.0 h1:yznKA/E9zq54KzlzBEAWn1NXSQ8DIp/NYMy88xJjl4k= -golang.org/x/text v0.30.0/go.mod h1:yDdHFIX9t+tORqspjENWgzaCVXgk0yYnYuSZ8UzzBVM= -golang.org/x/time v0.13.0 h1:eUlYslOIt32DgYD6utsuUeHs4d7AsEYLuIAdg7FlYgI= -golang.org/x/time v0.13.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4= +golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= +golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M= +golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= +golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58= golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk= -golang.org/x/tools v0.37.0 h1:DVSRzp7FwePZW356yEAChSdNcQo6Nsp+fex1SUW09lE= -golang.org/x/tools v0.37.0/go.mod h1:MBN5QPQtLMHVdvsbtarmTNukZDdgwdwlO5qGacAzF0w= +golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE= +golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= -gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk= -gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E= -google.golang.org/api v0.251.0 h1:6lea5nHRT8RUmpy9kkC2PJYnhnDAB13LqrLSVQlMIE8= -google.golang.org/api v0.251.0/go.mod h1:Rwy0lPf/TD7+T2VhYcffCHhyyInyuxGjICxdfLqT7KI= -google.golang.org/genproto v0.0.0-20250603155806-513f23925822 h1:rHWScKit0gvAPuOnu87KpaYtjK5zBMLcULh7gxkCXu4= -google.golang.org/genproto v0.0.0-20250603155806-513f23925822/go.mod h1:HubltRL7rMh0LfnQPkMH4NPDFEWp0jw3vixw7jEM53s= -google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c h1:AtEkQdl5b6zsybXcbz00j1LwNodDuH6hVifIaNqk7NQ= -google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c/go.mod h1:ea2MjsO70ssTfCjiwHgI0ZFqcw45Ksuk2ckf9G468GA= -google.golang.org/genproto/googleapis/rpc v0.0.0-20250929231259-57b25ae835d4 h1:i8QOKZfYg6AbGVZzUAY3LrNWCKF8O6zFisU9Wl9RER4= -google.golang.org/genproto/googleapis/rpc v0.0.0-20250929231259-57b25ae835d4/go.mod h1:HSkG/KdJWusxU1F6CNrwNDjBMgisKxGnc5dAZfT0mjQ= -google.golang.org/grpc v1.76.0 h1:UnVkv1+uMLYXoIz6o7chp59WfQUYA2ex/BXQ9rHZu7A= -google.golang.org/grpc v1.76.0/go.mod h1:Ju12QI8M6iQJtbcsV+awF5a4hfJMLi4X0JLo94ULZ6c= -google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 h1:F29+wU6Ee6qgu9TddPgooOdaqsxTMunOoj8KA5yuS5A= -google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1/go.mod h1:5KF+wpkbTSbGcR9zteSqZV6fqFOWBl4Yde8En8MryZA= -google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE= -google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= +gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= +gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= +google.golang.org/api v0.292.0 h1:Ewiwo/GTtiaPZSNAZQUcWLh8AYDEoPmIXyJfeoTSMHU= +google.golang.org/api v0.292.0/go.mod h1:07kjmMnFGm2RQuCza2EZM/5N68G/fVvFb1xKjWqoFA0= +google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 h1:XzmzkmB14QhVhgnawEVsOn6OFsnpyxNPRY9QV01dNB0= +google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:L43LFes82YgSonw6iTXTxXUX1OlULt4AQtkik4ULL/I= +google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 h1:jQ9p21COKWjP3VwuFrNRiiOTMh3mPpN45R7SLrH/HUU= +google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7/go.mod h1:KqHwBx2upmfa1XSi1WuRvC+2VGCLtooKkfmyvRbUmqA= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d h1:IL4hdHzcUv2l/gcg98/Rj3FbtE6axwqslOW8SW0C+S0= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= +google.golang.org/grpc v1.83.1 h1:HIO0+BEtBP6soyqvqC8sNUjZ7bTs+0hFQuFF+RAy++Y= +google.golang.org/grpc v1.83.1/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ= +google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2 h1:rgSNvqscFZ1JgV/4wH5GOsZFSFkR2Eua9As3KIr2LlM= +google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2/go.mod h1:iMEtFwDlAhjDU9L5mY6U1XLwlIId/G3h+QcBHDIvrJ8= +google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc= +google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= @@ -493,9 +495,8 @@ gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0/go.mod h1:WDnlLJ4WF5VGsH/HVa gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= howett.net/plist v1.0.0 h1:7CrbWYbPPO/PyNy38b2EB/+gYbjCe2DXBxgtOOZbSQM= howett.net/plist v1.0.0/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g= -software.sslmate.com/src/go-pkcs12 v0.6.0 h1:f3sQittAeF+pao32Vb+mkli+ZyT+VwKaD014qFGq6oU= -software.sslmate.com/src/go-pkcs12 v0.6.0/go.mod h1:Qiz0EyvDRJjjxGyUQa2cCNZn/wMyzrRJ/qcDXOQazLI= +software.sslmate.com/src/go-pkcs12 v0.7.3 h1:JBQD3FDqYjTeyDAeZQklj2ar88ykBLtALloPJHyAauU= +software.sslmate.com/src/go-pkcs12 v0.7.3/go.mod h1:Qiz0EyvDRJjjxGyUQa2cCNZn/wMyzrRJ/qcDXOQazLI= diff --git a/internal/cast/cast.go b/internal/cast/cast.go index c97f09fe..e123f1d3 100644 --- a/internal/cast/cast.go +++ b/internal/cast/cast.go @@ -1,7 +1,7 @@ package cast import ( - "github.com/ccoveille/go-safecast" + "github.com/ccoveille/go-safecast/v2" ) type signed interface { @@ -17,7 +17,7 @@ type number interface { } func SafeUint(x int) (uint, error) { - return safecast.ToUint(x) + return safecast.Convert[uint](x) } func Uint(x int) uint { @@ -30,7 +30,7 @@ func Uint(x int) uint { } func SafeInt(x uint) (int, error) { - return safecast.ToInt(x) + return safecast.Convert[int](x) } func Int(x uint) int { @@ -43,7 +43,7 @@ func Int(x uint) int { } func SafeInt64[T number](x T) (int64, error) { - return safecast.ToInt64(x) + return safecast.Convert[int64](x) } func Int64[T number](x T) int64 { @@ -56,7 +56,7 @@ func Int64[T number](x T) int64 { } func SafeUint64[T signed](x T) (uint64, error) { - return safecast.ToUint64(x) + return safecast.Convert[uint64](x) } func Uint64[T signed](x T) uint64 { @@ -69,7 +69,7 @@ func Uint64[T signed](x T) uint64 { } func SafeInt32[T signed](x T) (int32, error) { - return safecast.ToInt32(x) + return safecast.Convert[int32](x) } func Int32[T signed](x T) int32 { @@ -82,7 +82,7 @@ func Int32[T signed](x T) int32 { } func SafeUint32[T number](x T) (uint32, error) { - return safecast.ToUint32(x) + return safecast.Convert[uint32](x) } func Uint32[T number](x T) uint32 { @@ -95,7 +95,7 @@ func Uint32[T number](x T) uint32 { } func SafeUint8(x int) (uint8, error) { - return safecast.ToUint8(x) + return safecast.Convert[uint8](x) } func Uint8(x int) uint8 { diff --git a/internal/cmd/root.go b/internal/cmd/root.go index 99ae3638..37eea4e6 100644 --- a/internal/cmd/root.go +++ b/internal/cmd/root.go @@ -163,7 +163,7 @@ func panicHandler() { fmt.Fprintln(os.Stderr, "Something unexpected happened.") fmt.Fprintln(os.Stderr, "If you want to help us debug the problem, please run:") - fmt.Fprintf(os.Stderr, "STEPDEBUG=1 %s\n", strings.Join(os.Args, " ")) + fmt.Fprintf(os.Stderr, "STEPDEBUG=1 %q\n", strings.Join(os.Args, " ")) // #nosec G705 -- terminal output fmt.Fprintln(os.Stderr, "and send the output to info@smallstep.com") os.Exit(2) } diff --git a/internal/cryptoutil/cryptoutil.go b/internal/cryptoutil/cryptoutil.go index 005e7468..aea8a2bf 100644 --- a/internal/cryptoutil/cryptoutil.go +++ b/internal/cryptoutil/cryptoutil.go @@ -11,6 +11,7 @@ import ( "errors" "fmt" "io" + "os" "os/exec" "strconv" "strings" @@ -22,8 +23,13 @@ import ( "go.step.sm/crypto/pemutil" ) -// IsKMS returns true if the given uri is a KMS URI. +// IsKMS returns true if the given uri is a KMS URI. It will return false if a +// file exists with the same name, even if the path matches a KMS uri pattern. func IsKMS(rawuri string) bool { + if _, err := os.Stat(rawuri); err == nil { + return false + } + typ, err := kms.TypeOf(rawuri) if err != nil || typ == apiv1.DefaultKMS { return false @@ -31,6 +37,11 @@ func IsKMS(rawuri string) bool { return true } +func isFilename(name string) bool { + _, err := os.Stat(name) + return err == nil +} + // Attestor is the interface implemented by step-kms-plugin using the key, sign, // and attest commands. type Attestor interface { @@ -39,7 +50,7 @@ type Attestor interface { } func PublicKey(kmsURI, name string, opts ...pemutil.Options) (crypto.PublicKey, error) { - if kmsURI == "" { + if isFilename(name) { s, err := pemutil.Read(name, opts...) if err != nil { return nil, err @@ -61,7 +72,7 @@ func PublicKey(kmsURI, name string, opts ...pemutil.Options) (crypto.PublicKey, // CreateSigner reads a key from a file with a given name or creates a signer // with the given kms and name uri. func CreateSigner(kmsURI, name string, opts ...pemutil.Options) (crypto.Signer, error) { - if kmsURI == "" || isSoftKMS(kmsURI) { + if isFilename(name) { s, err := pemutil.Read(name, opts...) if err != nil { return nil, err @@ -75,13 +86,9 @@ func CreateSigner(kmsURI, name string, opts ...pemutil.Options) (crypto.Signer, return newKMSSigner(kmsURI, name) } -func isSoftKMS(kmsURI string) bool { - return strings.HasPrefix(strings.ToLower(strings.TrimSpace(kmsURI)), "softkms") -} - // LoadCertificate returns a x509.Certificate from a kms or file func LoadCertificate(kmsURI, certPath string) ([]*x509.Certificate, error) { - if kmsURI == "" { + if isFilename(certPath) { s, err := pemutil.ReadCertificateBundle(certPath) if err != nil { return nil, fmt.Errorf("file %s does not contain a valid certificate: %w", certPath, err) @@ -117,7 +124,7 @@ func LoadCertificate(kmsURI, certPath string) ([]*x509.Certificate, error) { // LoadJSONWebKey returns a jose.JSONWebKey from a KMS or a file. func LoadJSONWebKey(kmsURI, name string, opts ...jose.Option) (*jose.JSONWebKey, error) { - if kmsURI == "" { + if isFilename(name) { return jose.ReadKey(name, opts...) } diff --git a/internal/plugin/plugin.go b/internal/plugin/plugin.go index 00610525..4c620163 100644 --- a/internal/plugin/plugin.go +++ b/internal/plugin/plugin.go @@ -38,7 +38,7 @@ func LookPath(name string) (string, error) { } for _, ext := range exts { path := filepath.Join(step.BasePath(), "plugins", fileName+ext) - if _, err := os.Stat(path); err == nil { + if _, err := os.Stat(path); err == nil { // #nosec G703 -- path to stat intentionally relies on (partial) user configuration return path, nil } } diff --git a/internal/sshutil/agent_unix.go b/internal/sshutil/agent_unix.go index 07aa4350..8f179950 100644 --- a/internal/sshutil/agent_unix.go +++ b/internal/sshutil/agent_unix.go @@ -1,5 +1,4 @@ //go:build aix || darwin || dragonfly || freebsd || linux || netbsd || openbsd || solaris -// +build aix darwin dragonfly freebsd linux netbsd openbsd solaris package sshutil @@ -15,7 +14,7 @@ import ( // to the agent. func dialAgent() (*Agent, error) { socket := os.Getenv("SSH_AUTH_SOCK") - conn, err := net.Dial("unix", socket) + conn, err := net.Dial("unix", socket) // #nosec G704 -- SSH_AUTH_SOCK points to a local Unix domain socket path if err != nil { return nil, errors.Wrap(err, "error connecting with ssh-agent") } diff --git a/internal/sshutil/agent_windows.go b/internal/sshutil/agent_windows.go index f323756b..7d45f8d3 100644 --- a/internal/sshutil/agent_windows.go +++ b/internal/sshutil/agent_windows.go @@ -17,7 +17,7 @@ func dialAgent() (*Agent, error) { // Override the default windows openssh-ssh-agent pipe if socket := os.Getenv("SSH_AUTH_SOCK"); socket != "" { // Attempt unix sockets for environments like cygwin. - if conn, err := net.Dial("unix", socket); err == nil { + if conn, err := net.Dial("unix", socket); err == nil { // #nosec G704 -- SSH_AUTH_SOCK points to a local Unix domain socket path return &Agent{ ExtendedAgent: agent.NewClient(conn), Conn: conn, diff --git a/internal/sshutil/pipe.go b/internal/sshutil/pipe.go index 52cd8586..c8071ccf 100644 --- a/internal/sshutil/pipe.go +++ b/internal/sshutil/pipe.go @@ -38,7 +38,7 @@ var ( ) func readWindowsPipeNameFrom(configFile string) (pipeName string) { - file, err := os.Open(configFile) + file, err := os.Open(configFile) // #nosec G703 -- intentionally reading from user configuration if err == nil { sc := bufio.NewScanner(file) for sc.Scan() { diff --git a/internal/sshutil/shell.go b/internal/sshutil/shell.go index 81e925a5..60e9f80d 100644 --- a/internal/sshutil/shell.go +++ b/internal/sshutil/shell.go @@ -179,7 +179,7 @@ func (s *Shell) RemoteShell() error { defer session.Close() var fallback bool - if fd := int(os.Stdin.Fd()); term.IsTerminal(fd) { + if fd := int(os.Stdin.Fd()); term.IsTerminal(fd) { // #nosec G115 -- uintptr comes from file descriptor // Put terminal in raw mode if originalState, err := term.MakeRaw(fd); err != nil { fallback = true diff --git a/pkg/bcrypt_pbkdf/bcrypt_pbkdf.go b/pkg/bcrypt_pbkdf/bcrypt_pbkdf.go index 4e7b58f5..a599d660 100644 --- a/pkg/bcrypt_pbkdf/bcrypt_pbkdf.go +++ b/pkg/bcrypt_pbkdf/bcrypt_pbkdf.go @@ -92,6 +92,6 @@ func bcryptHash(out, shapass, shasalt []byte) { } // Swap bytes due to different endianness. for i := 0; i < 32; i += 4 { - out[i+3], out[i+2], out[i+1], out[i] = out[i], out[i+1], out[i+2], out[i+3] + out[i+3], out[i+2], out[i+1], out[i] = out[i], out[i+1], out[i+2], out[i+3] // #nosec G602 -- loop condition guarantees this doesn't go out of range } } diff --git a/token/options.go b/token/options.go index 3ceb1d1b..f956466a 100644 --- a/token/options.go +++ b/token/options.go @@ -264,14 +264,19 @@ func WithNebulaCert(certFile string, anyKey any) Options { if err != nil { return errors.Wrapf(err, "error reading %s", certFile) } + + blockType := nebula.CertificateBanner // default to a v1 Nebula certificate if bytes.HasPrefix(b, pemCertPrefix) { block, _ := pem.Decode(b) - if block == nil || block.Type != nebula.CertBanner { + if block == nil || (block.Type != nebula.CertificateBanner && block.Type != nebula.CertificateV2Banner) { return errors.Errorf("error reading %s: not a proper nebula certificate", certFile) } b = block.Bytes + blockType = block.Type } - crt, err := nebula.UnmarshalNebulaCertificate(b) + + pemData := pem.EncodeToMemory(&pem.Block{Type: blockType, Bytes: b}) + crt, _, err := nebula.UnmarshalCertificateFromPEM(pemData) if err != nil { return errors.Wrapf(err, "error reading %s", certFile) } diff --git a/token/options_test.go b/token/options_test.go index 5b7e209d..f3bd134a 100644 --- a/token/options_test.go +++ b/token/options_test.go @@ -7,6 +7,7 @@ import ( "crypto/elliptic" "crypto/rand" "net" + "net/netip" "os" "path/filepath" "testing" @@ -15,15 +16,17 @@ import ( nebula "github.com/slackhq/nebula/cert" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" + "golang.org/x/crypto/ssh" + "go.step.sm/crypto/jose" "go.step.sm/crypto/pemutil" "go.step.sm/crypto/x25519" - "golang.org/x/crypto/ssh" ) func TestOptions(t *testing.T) { empty := new(Claims) now := time.Now() + c25519CACert, c25519CAKey := mustNebulaCurve25519CA(t) p256CACert, p256CAKey := mustNebulaP256CA(t) c25519Cert, c25519Signer := mustNebulaCurve25519Cert(t, "test.lan", mustNebulaIPNet(t, "10.1.0.1/16"), []string{"test"}, c25519CACert, c25519CAKey) @@ -119,16 +122,18 @@ func mustReadSSHPublicKey(t *testing.T, filename string) ssh.PublicKey { return pub } -func serializeAndWriteNebulaCert(t *testing.T, tempDir string, cert *nebula.NebulaCertificate) (string, []byte) { +func serializeAndWriteNebulaCert(t *testing.T, tempDir string, cert nebula.Certificate) (string, []byte) { file, err := os.CreateTemp(tempDir, "nebula-test-cert-*") require.NoError(t, err) defer file.Close() - pem, err := cert.MarshalToPEM() + + pem, err := cert.MarshalPEM() require.NoError(t, err) data, err := cert.Marshal() require.NoError(t, err) _, err = file.Write(pem) require.NoError(t, err) + return file.Name(), data } @@ -145,65 +150,57 @@ func mustNebulaIPNet(t *testing.T, s string) *net.IPNet { return ipNet } -func mustNebulaCurve25519CA(t *testing.T) (*nebula.NebulaCertificate, ed25519.PrivateKey) { +func mustNebulaCurve25519CA(t *testing.T) (nebula.Certificate, ed25519.PrivateKey) { t.Helper() + pub, priv, err := ed25519.GenerateKey(rand.Reader) require.NoError(t, err) - nc := &nebula.NebulaCertificate{ - Details: nebula.NebulaCertificateDetails{ - Name: "TestCA", - Groups: []string{"test"}, - Ips: []*net.IPNet{ - mustNebulaIPNet(t, "10.1.0.0/16"), - }, - Subnets: []*net.IPNet{}, - NotBefore: time.Now(), - NotAfter: time.Now().Add(10 * time.Minute), - PublicKey: pub, - IsCA: true, - Curve: nebula.Curve_CURVE25519, - }, + tbs := &nebula.TBSCertificate{ + Version: nebula.Version1, + Name: "TestCA", + Groups: []string{"test"}, + Networks: []netip.Prefix{netip.MustParsePrefix("10.1.0.0/16")}, + NotBefore: time.Now().Add(-1 * time.Minute), + NotAfter: time.Now().Add(10 * time.Minute), + PublicKey: pub, + IsCA: true, + Curve: nebula.Curve_CURVE25519, } - - require.NoError(t, nc.Sign(nebula.Curve_CURVE25519, priv)) + nc, err := tbs.Sign(nil, nebula.Curve_CURVE25519, priv) + require.NoError(t, err) return nc, priv } -func mustNebulaP256CA(t *testing.T) (*nebula.NebulaCertificate, *ecdh.PrivateKey) { +func mustNebulaP256CA(t *testing.T) (nebula.Certificate, *ecdh.PrivateKey) { t.Helper() + priv, err := ecdh.P256().GenerateKey(rand.Reader) require.NoError(t, err) - nc := &nebula.NebulaCertificate{ - Details: nebula.NebulaCertificateDetails{ - Name: "TestCA", - Groups: []string{"test"}, - Ips: []*net.IPNet{ - mustNebulaIPNet(t, "10.1.0.0/16"), - }, - Subnets: []*net.IPNet{}, - NotBefore: time.Now(), - NotAfter: time.Now().Add(10 * time.Minute), - PublicKey: priv.PublicKey().Bytes(), - IsCA: true, - Curve: nebula.Curve_P256, - }, + tbs := &nebula.TBSCertificate{ + Version: nebula.Version1, + Name: "TestCA", + Groups: []string{"test"}, + Networks: []netip.Prefix{netip.MustParsePrefix("10.1.0.0/16")}, + NotBefore: time.Now().Add(-1 * time.Minute), + NotAfter: time.Now().Add(10 * time.Minute), + PublicKey: priv.PublicKey().Bytes(), + IsCA: true, + Curve: nebula.Curve_P256, } - - require.NoError(t, nc.Sign(nebula.Curve_P256, priv.Bytes())) + nc, err := tbs.Sign(nil, nebula.Curve_P256, priv.Bytes()) + require.NoError(t, err) return nc, priv } -func mustNebulaCurve25519Cert(t *testing.T, name string, ipNet *net.IPNet, groups []string, ca *nebula.NebulaCertificate, signer ed25519.PrivateKey) (*nebula.NebulaCertificate, x25519.PrivateKey) { +func mustNebulaCurve25519Cert(t *testing.T, name string, ipNet *net.IPNet, groups []string, ca nebula.Certificate, signer ed25519.PrivateKey) (nebula.Certificate, x25519.PrivateKey) { t.Helper() pub, priv, err := x25519.GenerateKey(rand.Reader) require.NoError(t, err) - issuer, err := ca.Sha256Sum() - require.NoError(t, err) invertedGroups := make(map[string]struct{}, len(groups)) for _, name := range groups { @@ -214,34 +211,29 @@ func mustNebulaCurve25519Cert(t *testing.T, name string, ipNet *net.IPNet, group curve := nebula.Curve_CURVE25519 t1 := time.Now().Truncate(time.Second) - nc := &nebula.NebulaCertificate{ - Details: nebula.NebulaCertificateDetails{ - Name: name, - Ips: []*net.IPNet{ipNet}, - Subnets: []*net.IPNet{}, - Groups: groups, - NotBefore: t1, - NotAfter: t1.Add(5 * time.Minute), - PublicKey: pub, - IsCA: false, - Issuer: issuer, - InvertedGroups: invertedGroups, - Curve: curve, - }, + tbs := &nebula.TBSCertificate{ + Version: nebula.Version1, + Name: name, + Networks: []netip.Prefix{netip.MustParsePrefix(ipNet.String())}, + Groups: groups, + NotBefore: t1, + NotAfter: t1.Add(5 * time.Minute), + PublicKey: pub, + IsCA: false, + Curve: curve, } - require.NoError(t, nc.Sign(curve, key)) + nc, err := tbs.Sign(ca, curve, key) + require.NoError(t, err) return nc, priv } -func mustNebulaP256Cert(t *testing.T, name string, ipNet *net.IPNet, groups []string, ca *nebula.NebulaCertificate, signer *ecdh.PrivateKey) (*nebula.NebulaCertificate, *ecdsa.PrivateKey) { +func mustNebulaP256Cert(t *testing.T, name string, ipNet *net.IPNet, groups []string, ca nebula.Certificate, signer *ecdh.PrivateKey) (nebula.Certificate, *ecdsa.PrivateKey) { t.Helper() priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader) require.NoError(t, err) - issuer, err := ca.Sha256Sum() - require.NoError(t, err) invertedGroups := make(map[string]struct{}, len(groups)) for _, name := range groups { @@ -255,23 +247,20 @@ func mustNebulaP256Cert(t *testing.T, name string, ipNet *net.IPNet, groups []st require.NoError(t, err) t1 := time.Now().Truncate(time.Second) - nc := &nebula.NebulaCertificate{ - Details: nebula.NebulaCertificateDetails{ - Name: name, - Ips: []*net.IPNet{ipNet}, - Subnets: []*net.IPNet{}, - Groups: groups, - NotBefore: t1, - NotAfter: t1.Add(5 * time.Minute), - PublicKey: pk.PublicKey().Bytes(), - IsCA: false, - Issuer: issuer, - InvertedGroups: invertedGroups, - Curve: curve, - }, + tbs := &nebula.TBSCertificate{ + Version: nebula.Version2, + Name: name, + Networks: []netip.Prefix{netip.MustParsePrefix(ipNet.String())}, + Groups: groups, + NotBefore: t1, + NotAfter: t1.Add(5 * time.Minute), + PublicKey: pk.PublicKey().Bytes(), + IsCA: false, + Curve: curve, } - require.NoError(t, nc.Sign(curve, key)) + nc, err := tbs.Sign(ca, curve, key) + require.NoError(t, err) return nc, priv } diff --git a/token/parse.go b/token/parse.go index f3f43ac3..82c6c622 100644 --- a/token/parse.go +++ b/token/parse.go @@ -53,7 +53,7 @@ type Payload struct { Version interface{} `json:"ver"` XMSMirID string `json:"xms_mirid"` K8sSANamespace string `json:"kubernetes.io/serviceaccount/namespace,omitempty"` - K8sSASecretName string `json:"kubernetes.io/serviceaccount/secret.name,omitempty"` + K8sSASecretName string `json:"kubernetes.io/serviceaccount/secret.name,omitempty"` // #nosec G117 -- JSON property K8sSAServiceAccountName string `json:"kubernetes.io/serviceaccount/service-account.name,omitempty"` K8sSAServiceAccountUID string `json:"kubernetes.io/serviceaccount/service-account.uid,omitempty"` Google *GCPGooglePayload `json:"google"` // GCP token claims diff --git a/utils/cautils/tpm.go b/utils/cautils/tpm.go index d44336cc..e08c839d 100644 --- a/utils/cautils/tpm.go +++ b/utils/cautils/tpm.go @@ -509,18 +509,18 @@ func (ac *attestationClient) performAttestation(ctx context.Context, t *tpm.TPM, encryptedCredentials := tpm.EncryptedCredential{ Credential: attResp.Credential, - Secret: attResp.Secret, + Secret: attResp.EncryptedSecret, } // activate the credential with the TPM - secret, err := ak.ActivateCredential(ctx, encryptedCredentials) + decryptedSecret, err := ak.ActivateCredential(ctx, encryptedCredentials) if err != nil { return nil, fmt.Errorf("failed activating credential: %w", err) } - secretResp, err := ac.secret(ctx, secret) + secretResp, err := ac.verifyDecryptedSecret(ctx, decryptedSecret) if err != nil { - return nil, fmt.Errorf("failed validating secret: %w", err) + return nil, fmt.Errorf("failed validating decrypted secret: %w", err) } akChain := make([]*x509.Certificate, len(secretResp.CertificateChain)) @@ -559,8 +559,8 @@ type attestationRequest struct { } type attestationResponse struct { - Credential []byte `json:"credential"` - Secret []byte `json:"secret"` // encrypted secret + Credential []byte `json:"credential"` + EncryptedSecret []byte `json:"secret"` // #nosec G117 -- JSON property carrying encrypted secret } // attest performs the HTTP POST request to the `/attest` endpoint of the @@ -616,7 +616,7 @@ func (ac *attestationClient) attest(ctx context.Context, info *tpm.Info, eks []* return nil, fmt.Errorf("failed creating POST http request for %q: %w", attestURL, err) } - resp, err := ac.client.Do(req) + resp, err := ac.client.Do(req) // #nosec G704 -- request intentionally relies on user configuration if err != nil { return nil, fmt.Errorf("failed performing attestation request with Attestation CA %q: %w", attestURL, err) } @@ -635,21 +635,21 @@ func (ac *attestationClient) attest(ctx context.Context, info *tpm.Info, eks []* } type secretRequest struct { - Secret []byte `json:"secret"` // decrypted secret + DecryptedSecret []byte `json:"secret"` // #nosec G117 -- JSON property carrying decrypted secret } type secretResponse struct { CertificateChain [][]byte `json:"chain"` } -// secret performs the HTTP POST request to the `/secret` endpoint of the -// Attestation CA. -func (ac *attestationClient) secret(ctx context.Context, secret []byte) (*secretResponse, error) { +// verifyDecryptedSecret performs the HTTP POST request to the `/secret` +// endpoint of the Attestation CA. +func (ac *attestationClient) verifyDecryptedSecret(ctx context.Context, secret []byte) (*secretResponse, error) { sr := secretRequest{ - Secret: secret, + DecryptedSecret: secret, } - body, err := json.Marshal(sr) + body, err := json.Marshal(sr) // #nosec G117 -- the decrypted secret is intentionally sent back to attestation CA (via HTTPS) if err != nil { return nil, fmt.Errorf("failed marshaling secret request: %w", err) } @@ -660,7 +660,7 @@ func (ac *attestationClient) secret(ctx context.Context, secret []byte) (*secret return nil, fmt.Errorf("failed creating POST http request for %q: %w", secretURL, err) } - resp, err := ac.client.Do(req) + resp, err := ac.client.Do(req) // #nosec G704 -- request intentionally relies on user configuration if err != nil { return nil, fmt.Errorf("failed performing secret request with attestation CA %q: %w", secretURL, err) } diff --git a/utils/read.go b/utils/read.go index ca4675de..86afb038 100644 --- a/utils/read.go +++ b/utils/read.go @@ -53,7 +53,7 @@ func ReadString(r io.Reader) (string, error) { // ReadPasswordFromFile reads and returns the password from the given filename. // The contents of the file will be trimmed at the right. func ReadPasswordFromFile(filename string) ([]byte, error) { - password, err := os.ReadFile(filename) + password, err := os.ReadFile(filename) // #nosec G703 -- file intended to be provided by user if err != nil { return nil, errs.FileError(err, filename) } @@ -94,7 +94,7 @@ func ReadFile(name string) (b []byte, err error) { b, err = io.ReadAll(stdin) } else { var contents []byte - contents, err = os.ReadFile(name) + contents, err = os.ReadFile(name) // #nosec G703 -- file intended to be provided by user if err != nil { return nil, errs.FileError(err, name) } diff --git a/utils/sysutils/sysutils_unix.go b/utils/sysutils/sysutils_unix.go index b462d76e..00e3de96 100644 --- a/utils/sysutils/sysutils_unix.go +++ b/utils/sysutils/sysutils_unix.go @@ -1,5 +1,4 @@ //go:build aix || darwin || dragonfly || freebsd || linux || netbsd || openbsd || solaris -// +build aix darwin dragonfly freebsd linux netbsd openbsd solaris package sysutils