mirror of
https://github.com/luxfi/mpc.git
synced 2026-09-24 00:26:24 +00:00
zeekay
657674f4ce
Fixes all findings from the Blue Team defensive security review of the redacted → redacted custody architecture transition. HIGH: - S-1: Implement P-256 ECDH + AES-256-GCM encryption of passkey backup shards - W-2: Reject unparseable WebAuthn public keys (was silently skipping verification) - O-1: Add Ed25519 binary signature verification package (pkg/integrity) MEDIUM: - W-1: Validate attestation is a real P-256 curve point, not raw attestation object - W-3: Add origin validation to all WebAuthn flows (register, verify, trade approve) - N-2: Remove plaintext TCP fallback from MPC node transport (TLS mandatory) - K-1: Fail-closed on empty/whitespace orgID (prevents cross-tenant key leakage) - A-1: Make AuditEntry immutable (Update/Delete return error) - A-2: Add MPC-level signing audit log (wallet, message hash, intent, trigger) - O-3: Invalidate backup shards after key reshare (stale shares are useless) - O-2: Reject env/file password providers in production (require cloud HSM) LOW: - T-1: Add error handling + MarkSignFailed to signing goroutine - T-2: Verify caller authorization in handleTradeSubmit - K-2: Secret erasure stub now calls runtime.GC() instead of no-op - N-1: Add VerifyConnection callback to reject peers without TLS certs Tests: 69 unit + 7 fuzz targets, ~900K fuzz executions, 19/19 packages green. Makefile: add -tags json1 for SQLite JSON function support in ORM tests.
103 lines
2.9 KiB
Makefile
103 lines
2.9 KiB
Makefile
.PHONY: all build clean lux-mpc lux-mpc-cli test test-verbose test-coverage e2e-test e2e-clean cleanup-test-env
|
|
|
|
BIN_DIR := bin
|
|
|
|
# Go 1.26 experimental features:
|
|
# runtimesecret - zeroes stack/register state after secret.Do() for forward secrecy
|
|
# simd - SIMD intrinsics (amd64/arm64)
|
|
GOEXPERIMENT ?= runtimesecret,simd
|
|
|
|
# Default target
|
|
all: build
|
|
|
|
# Build all binaries
|
|
build: lux-mpc lux-mpc-cli lux-mpc-bridge
|
|
|
|
# Install lux-mpc (builds and places it in $GOBIN or $GOPATH/bin)
|
|
lux-mpc:
|
|
GOWORK=off GOEXPERIMENT=$(GOEXPERIMENT) go build -o lux-mpc ./cmd/lux-mpc
|
|
|
|
# Install lux-mpc-cli
|
|
lux-mpc-cli:
|
|
GOWORK=off GOEXPERIMENT=$(GOEXPERIMENT) go build -o lux-mpc-cli ./cmd/lux-mpc-cli
|
|
|
|
# Install lux-mpc-bridge (bridge compatibility)
|
|
lux-mpc-bridge:
|
|
GOWORK=off GOEXPERIMENT=$(GOEXPERIMENT) go build -o lux-mpc-bridge ./cmd/lux-mpc-bridge 2>/dev/null || true
|
|
|
|
# Run all tests (json1 enables SQLite JSON functions for ORM JSONB queries)
|
|
test:
|
|
CGO_ENABLED=1 GOEXPERIMENT=$(GOEXPERIMENT) go test -tags json1 ./...
|
|
|
|
# Run tests with verbose output
|
|
test-verbose:
|
|
CGO_ENABLED=1 GOEXPERIMENT=$(GOEXPERIMENT) go test -tags json1 -v ./...
|
|
|
|
# Run tests with coverage report
|
|
test-coverage:
|
|
CGO_ENABLED=1 GOEXPERIMENT=$(GOEXPERIMENT) go test -tags json1 -v -coverprofile=coverage.out ./...
|
|
go tool cover -html=coverage.out -o coverage.html
|
|
|
|
# Run E2E integration tests
|
|
e2e-test: build
|
|
@echo "Running E2E integration tests..."
|
|
cd e2e && make test
|
|
|
|
# Run E2E tests with coverage
|
|
e2e-test-coverage: build
|
|
@echo "Running E2E integration tests with coverage..."
|
|
cd e2e && make test-coverage
|
|
|
|
# Clean up E2E test artifacts
|
|
e2e-clean:
|
|
@echo "Cleaning up E2E test artifacts..."
|
|
cd e2e && make clean
|
|
|
|
# Comprehensive cleanup of test environment (kills processes, removes artifacts)
|
|
cleanup-test-env:
|
|
@echo "Performing comprehensive test environment cleanup..."
|
|
cd e2e && ./cleanup_test_env.sh
|
|
|
|
# Run all tests (unit + E2E)
|
|
test-all: test e2e-test
|
|
|
|
# Wipe out manually built binaries if needed (not required by go install)
|
|
clean:
|
|
rm -rf $(BIN_DIR)
|
|
rm -f coverage.out coverage.html
|
|
|
|
# Full clean (including E2E artifacts)
|
|
clean-all: clean e2e-clean
|
|
|
|
# Run local development environment with Docker
|
|
run-local: build
|
|
@echo "Starting local MPC environment..."
|
|
docker-compose up -d
|
|
@echo "Waiting for services to be ready..."
|
|
@sleep 5
|
|
@echo ""
|
|
@echo "Services running:"
|
|
@echo " - NATS: http://localhost:8222"
|
|
@echo " - Consul: http://localhost:8500"
|
|
@echo ""
|
|
@echo "To start MPC nodes, run:"
|
|
@echo " ./lux-mpc --node-id node0 --config config.yaml"
|
|
|
|
# Stop local environment
|
|
stop-local:
|
|
@echo "Stopping local MPC environment..."
|
|
docker-compose down
|
|
|
|
# View logs
|
|
logs:
|
|
docker-compose logs -f
|
|
|
|
# Run a single MPC node (example)
|
|
run-node0: build
|
|
@echo "Starting MPC node0..."
|
|
./lux-mpc --node-id node0 --config config.yaml.template
|
|
|
|
# Quick start - build and run everything
|
|
start: build run-local
|
|
@echo "Environment ready! Run 'make run-node0' in another terminal to start a node."
|