mirror of
https://github.com/hanzoai/drive.git
synced 2026-10-30 18:38:28 +00:00
8c7f713a86
Replaces the deployment-identity stand-in. A master held by an HSM (luxfi/hsm
PasswordProvider: aws/gcp/azure/zymbit/yubihsm/pkcs11 in prod, env/file for dev)
is HKDF-derived to a wrap key; the deployment's ML-KEM-768+X25519 age identity is
ChaCha20-Poly1305-sealed under it at {DataDir}/identity.sealed. The master never
leaves the HSM; the PQ secret is never stored in clear; restore needs the HSM.
Provisioning is ML-DSA-attested (luxfi/hsm MLDSASigner).
mount.go: resolveIdentity uses the Custodian when DRIVE_HSM_PROVIDER is set.
Test proves: sealed (not plaintext) at rest, right master recovers the same
identity, wrong master rejected. Closes the #1 SOC 2 key-custody code gap.
Co-authored-by: Hanzo Dev <[email protected]>
75 lines
3.3 KiB
AMPL
75 lines
3.3 KiB
AMPL
module github.com/hanzoai/drive
|
|
|
|
go 1.26.4
|
|
|
|
require (
|
|
github.com/hanzoai/cloud v0.1.3
|
|
github.com/hanzoai/sqlite3 v1.0.0
|
|
github.com/hanzoai/vfs v0.4.3
|
|
github.com/hanzoai/zip v0.2.1
|
|
github.com/luxfi/age v1.5.0
|
|
github.com/luxfi/hsm v1.1.4
|
|
github.com/luxfi/log v1.4.3
|
|
golang.org/x/crypto v0.53.0
|
|
)
|
|
|
|
require (
|
|
filippo.io/hpke v0.4.0 // indirect
|
|
github.com/andybalholm/brotli v1.2.1 // indirect
|
|
github.com/ansel1/merry v1.8.1 // indirect
|
|
github.com/ansel1/merry/v2 v2.2.2 // indirect
|
|
github.com/aws/aws-sdk-go-v2 v1.41.5 // indirect
|
|
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.5 // indirect
|
|
github.com/aws/aws-sdk-go-v2/config v1.32.13 // indirect
|
|
github.com/aws/aws-sdk-go-v2/credentials v1.19.13 // indirect
|
|
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.21 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.18 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.10 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.18 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/s3 v1.96.2 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/signin v1.0.9 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/sso v1.30.14 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.18 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/sts v1.41.10 // indirect
|
|
github.com/aws/smithy-go v1.24.2 // indirect
|
|
github.com/cenkalti/backoff v2.2.1+incompatible // indirect
|
|
github.com/cloudflare/circl v1.6.3 // indirect
|
|
github.com/gemalto/flume v1.0.0 // indirect
|
|
github.com/gemalto/kmip-go v0.1.0 // indirect
|
|
github.com/gofiber/fiber/v3 v3.2.0 // indirect
|
|
github.com/gofiber/schema v1.7.1 // indirect
|
|
github.com/gofiber/utils/v2 v2.0.4 // indirect
|
|
github.com/google/uuid v1.6.0 // indirect
|
|
github.com/grandcat/zeroconf v1.0.0 // indirect
|
|
github.com/klauspost/compress v1.18.5 // indirect
|
|
github.com/luxfi/accel v1.1.9 // indirect
|
|
github.com/luxfi/crypto v1.19.17 // indirect
|
|
github.com/luxfi/mdns v0.1.1 // indirect
|
|
github.com/luxfi/zap v0.7.2 // indirect
|
|
github.com/mattn/go-colorable v0.1.14 // indirect
|
|
github.com/mattn/go-isatty v0.0.22 // indirect
|
|
github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
|
|
github.com/miekg/dns v1.1.72 // indirect
|
|
github.com/miekg/pkcs11 v1.1.1 // indirect
|
|
github.com/ncruces/go-sqlite3-wasm/v3 v3.1.35302 // indirect
|
|
github.com/ncruces/julianday v1.0.0 // indirect
|
|
github.com/philhofer/fwd v1.2.0 // indirect
|
|
github.com/tinylib/msgp v1.6.4 // indirect
|
|
github.com/valyala/bytebufferpool v1.0.0 // indirect
|
|
github.com/valyala/fasthttp v1.70.0 // indirect
|
|
go.uber.org/multierr v1.11.0 // indirect
|
|
go.uber.org/zap v1.27.1 // indirect
|
|
golang.org/x/mod v0.36.0 // indirect
|
|
golang.org/x/net v0.55.0 // indirect
|
|
golang.org/x/sync v0.21.0 // indirect
|
|
golang.org/x/sys v0.46.0 // indirect
|
|
golang.org/x/text v0.38.0 // indirect
|
|
golang.org/x/tools v0.45.0 // indirect
|
|
gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
|
|
)
|