[FEATURE] Verify ML-DSA signatures embedded in provider docs (x-stackql-signature), with .sig fallback
还没有人认领这个 Issue。
评估
- 难度
- 5/5
- 预计耗时
- 一周以上
- 新手友好度
- 38/100
- Issue 类型
- 功能
- 描述清晰度
- 描述清楚
- 活跃度
- 活跃
- 技术栈
- go
- 领域
- cryptography, security
调研方向
Start with internal/anysdk/registry.go and the VerifierConfig definition, then check whether stackql/stackql-provider-registry#482 has released the signing/pqsig package this work depends on. Follow the existing .sig verification path and use canonicalisation from the shared registry package. Done means the listed ML-DSA cases pass per document, legacy fallback is configurable, and verification remains off by default.
由索引模型根据 Issue 内容生成。
描述
Middle step of the registry's move to quantum-safe, embedded provider-doc signatures: stackql/stackql-provider-registry#482 (signing package) -> this issue (verification) -> stackql/stackql#856 (bump, config, docs). Verification is off by default in stackql (nopVerify: true), so this ships without changing user-facing behaviour. omnisdk, which is replacing any-sdk, gets the same verifier under stackql-labs/omnisdk#17.
NOTE: Must be compliant with at least FIPS 204.
What changes
internal/anysdk/registry.go:getVerifiedDocBytesfetches<doc>.sig(local path, local cache or remote) and callsedcrypto.VerifyFileFromCertificateBytes. New path, tried first: if the doc carriesx-stackql-signature, pop it, canonicalise the remainder with the registry's shared package (RFC 8785 JSON),mldsa.Verifyagainst the embedded public key selected bykid, contextstackql-provider-doc-v1. No key: fall back to the.sigpath. Both present: embedded wins.- Dependency: bump
github.com/stackql/stackql-provider-registryfromv0.0.2-alpha01to the release that shipssigning/pqsig.go.modtogo 1.27forcrypto/mldsa(currently 1.26.10). VerifierConfig: addallowLegacySig(default true for the transition) so the.sigfallback can be switched off later.nopVerifyuntouched.- Canonicalisation comes from the shared registry package. Do not reimplement it here or signatures will not match.
- Tests: fixtures signed at test time with ephemeral ML-DSA keys. Cases: valid, tampered after signing, unknown
kid, no key with and without.sig, both present.
Sequence and dependencies
- Blocked by stackql/stackql-provider-registry#482 step 1 (package release).
- This issue, then an any-sdk release.
- Unblocks stackql/stackql#856, which in turn unblocks the registry dropping
.sigfiles.
Notes
- Verification stays at doc-read time. Archive pull stays unverified; that is stackql/stackql#832's scope.
- Provider docs drive execution (
local_templatedand friends), so coverage must stay per doc, not onlyprovider.yaml.
- 主要语言
- Go
- 星标
- 0
- 派生
- 1
- 平均合并
- 33 分钟
- 30 天内合并 PR
- 7
环境准备
这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
stackql/any-sdk 的其他 Issue
-
enhancement
难度 3/5 1-2 天 新手友好度 78/100
-
[FEATURE] GraphQL mutation support (operationType, variables payload, errors-in-200 selection)可能重新可做 @jeffreyaven 于 39 天前认领，目前没有进行中的 PR。 未关闭enhancement
-
[FEATURE] Carry the naked upstream HTTP status code through the provider invoker boundary可能重新可做 @jeffreyaven 于 112 天前认领，目前没有进行中的 PR。 未关闭enhancement
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 78/100
-
status:needs-review type:bug
难度 2/5 1-3 小时 新手友好度 78/100
Gentleman-Programming/engram#2079 ·
维护者通常 1 天内回复
-
bug triage/pending
难度 1/5 1 小时以内 新手友好度 66/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 77/100
limitlessprojects/Go-Hybrid#1377 ·
维护者通常 1 天内回复
-
bug report
难度 2/5 1-3 小时 新手友好度 76/100
维护者通常 3 天内回复