mirror of
https://github.com/hanzoai/kms.git
synced 2026-10-17 11:18:16 +00:00
zeekayandHanzo Dev
e6a50f427e
This package kept its own HTTP secret plane — routes, an audit log, version CAS
and a JWT gate — beside the one cloud already serves at
/v1/kms/orgs/{org}/secrets. Two doors onto the same store means two places
where a tenant boundary can be got wrong, and only one of them was reviewed as
the authorization surface.
What is left is storage and the ZAP transport, whose authorizer is a signed
consensus-authority snapshot and which stays disabled unless that snapshot is
present. This package now makes no authorization decision at all: IAM owns
identity, cloud folds the caller's validated org into the storage key so one
tenant's path cannot name another's record, and secrets are sealed at rest with
the replicator streaming encrypted backups to S3.
go.sum carried a stale pair for luxfi/vm v1.3.1 — the tag was republished, and
the entries here predated it, so nothing in the module could build. The values
now match the public checksum database, which six other repos in the estate
already agreed with.
Co-authored-by: Hanzo Dev <[email protected]>
124 lines
5.1 KiB
AMPL
124 lines
5.1 KiB
AMPL
module github.com/hanzoai/kms
|
|
|
|
// Hanzo KMS is a thin wrapper over the canonical luxfi/kms implementation.
|
|
// All server logic lives in github.com/luxfi/kms. This module provides:
|
|
// - cmd/kmsd : daemon with Hanzo defaults (port 8443, /data/hanzo-kms, branding)
|
|
// - cmd/kms : admin CLI (uses pkg/kmsclient)
|
|
// - pkg/kmsclient : Go client library used by other Hanzo services
|
|
//
|
|
// Wire-compatible with luxfi clients on both HTTP (/v1/kms/*) and ZAP
|
|
// (opcodes 0x0040..0x0043).
|
|
|
|
go 1.26.5
|
|
|
|
// luxfi/keys + luxfi/kms drive the consensus-native ZAP secret surface.
|
|
// Threshold signing is delegated over ZAP to an external luxfi/mpc daemon
|
|
// (cfg.MPCAddr / MPCVaultID); this module links luxfi/kms's pkg/mpc client
|
|
// only — never the standalone luxfi/mpc daemon module. Versions live in the
|
|
// require block below (single source of truth).
|
|
require (
|
|
github.com/golang-jwt/jwt/v5 v5.3.1
|
|
github.com/luxfi/keys v1.4.2 // indirect
|
|
github.com/luxfi/kms v1.12.16
|
|
github.com/luxfi/log v1.4.3
|
|
github.com/luxfi/zap v1.2.7
|
|
github.com/luxfi/zapdb v1.10.6
|
|
)
|
|
|
|
require (
|
|
github.com/hanzoai/kms/sdk/go v1.1.0
|
|
github.com/luxfi/ids v1.3.2
|
|
github.com/luxfi/trace v1.3.0
|
|
)
|
|
|
|
require (
|
|
github.com/hanzos3/crc64nvme v1.1.2 // indirect
|
|
github.com/hanzos3/go v1.0.2 // indirect
|
|
github.com/hanzos3/md5-simd v1.1.3 // indirect
|
|
github.com/zap-proto/fiber/v3 v3.2.1 // indirect
|
|
github.com/zap-proto/go v1.3.0 // indirect
|
|
github.com/zap-proto/http v0.3.1 // indirect
|
|
github.com/zap-proto/mcp v1.0.5 // indirect
|
|
go.opentelemetry.io/otel/sdk v1.44.0 // indirect
|
|
)
|
|
|
|
require (
|
|
filippo.io/hpke v0.4.0 // indirect
|
|
github.com/andybalholm/brotli v1.2.1 // indirect
|
|
github.com/btcsuite/btcd/btcutil v1.1.6 // indirect
|
|
github.com/cenkalti/backoff v2.2.1+incompatible // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/cloudflare/circl v1.6.3 // indirect
|
|
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1 // indirect
|
|
github.com/dgraph-io/ristretto/v2 v2.4.0 // indirect
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
github.com/go-ini/ini v1.67.0 // indirect
|
|
github.com/go-logr/logr v1.4.3 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/gofiber/schema v1.7.1 // indirect
|
|
github.com/gofiber/utils/v2 v2.0.4 // indirect
|
|
github.com/google/flatbuffers v25.12.19+incompatible // indirect
|
|
github.com/google/uuid v1.6.0 // indirect
|
|
github.com/gorilla/rpc v1.2.1 // indirect
|
|
github.com/grandcat/zeroconf v1.0.0 // indirect
|
|
github.com/holiman/uint256 v1.3.2 // indirect
|
|
github.com/klauspost/compress v1.18.6 // indirect
|
|
github.com/klauspost/cpuid/v2 v2.3.0 // indirect
|
|
github.com/klauspost/crc32 v1.3.0 // indirect
|
|
github.com/luxfi/accel v1.2.4 // indirect
|
|
github.com/luxfi/address v1.1.1 // indirect
|
|
github.com/luxfi/age v1.6.0 // indirect
|
|
github.com/luxfi/cache v1.3.1 // indirect
|
|
github.com/luxfi/constants v1.6.2 // indirect
|
|
github.com/luxfi/container v0.2.2 // indirect
|
|
github.com/luxfi/crypto v1.20.5 // indirect
|
|
github.com/luxfi/geth v1.20.2 // indirect
|
|
github.com/luxfi/go-bip32 v1.1.0 // indirect
|
|
github.com/luxfi/go-bip39 v1.2.0 // indirect
|
|
github.com/luxfi/math v1.5.1 // indirect
|
|
github.com/luxfi/math/big v0.1.0 // indirect
|
|
github.com/luxfi/mdns v0.1.1 // indirect
|
|
github.com/luxfi/metric v1.10.0 // indirect
|
|
github.com/luxfi/mock v0.1.1 // indirect
|
|
github.com/luxfi/sampler v1.1.0 // indirect
|
|
github.com/luxfi/tls v1.1.1 // indirect
|
|
github.com/mattn/go-colorable v0.1.15 // indirect
|
|
github.com/mattn/go-isatty v0.0.22 // indirect
|
|
github.com/miekg/dns v1.1.72 // indirect
|
|
github.com/mr-tron/base58 v1.3.0 // indirect
|
|
github.com/philhofer/fwd v1.2.0 // indirect
|
|
github.com/rs/xid v1.6.0 // indirect
|
|
github.com/supranational/blst v0.3.16 // indirect
|
|
github.com/tinylib/msgp v1.6.4 // indirect
|
|
github.com/valyala/bytebufferpool v1.0.0 // indirect
|
|
github.com/valyala/fasthttp v1.70.0 // indirect
|
|
github.com/zap-proto/zip v1.27.2
|
|
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
|
go.opentelemetry.io/otel v1.44.0 // indirect
|
|
go.opentelemetry.io/otel/metric v1.44.0 // indirect
|
|
go.opentelemetry.io/otel/trace v1.44.0 // indirect
|
|
go.uber.org/mock v0.6.0 // indirect
|
|
go.yaml.in/yaml/v3 v3.0.4 // indirect
|
|
golang.org/x/crypto v0.52.0 // indirect
|
|
golang.org/x/exp v0.0.0-20260529124908-c761662dc8c9 // indirect
|
|
golang.org/x/mod v0.36.0 // indirect
|
|
golang.org/x/net v0.55.0 // indirect
|
|
golang.org/x/sync v0.20.0 // indirect
|
|
golang.org/x/sys v0.45.0 // indirect
|
|
golang.org/x/text v0.37.0 // indirect
|
|
golang.org/x/tools v0.45.0 // indirect
|
|
gonum.org/v1/gonum v0.17.0 // indirect
|
|
google.golang.org/protobuf v1.36.11 // indirect
|
|
gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
|
|
)
|
|
|
|
// The kmsclient library lives in this repo (sdk/go) and is released together
|
|
// with the server. Build the in-tree copy so cmd/kms and cmd/kms-fetch pick up
|
|
// the fix that sends env explicitly on the HTTP path (see sdk/go/kmsclient).
|
|
// The require above stays at the last published tag so dropping this replace
|
|
// falls back to a real version, never a missing one; publish sdk/go/v1.1.1 and
|
|
// bump the require when cutting the next SDK release.
|
|
replace github.com/hanzoai/kms/sdk/go => ./sdk/go
|
|
|
|
exclude github.com/luxfi/genesis v1.5.21
|