Harden production workflows and agent admission

agent/internal/agentkey/agentkey.go

@@ -0,0 +1,75 @@
+package agentkey
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+const (
+	fileName = "agent.key"
+	keyBytes = 32
+	keyLen   = keyBytes * 2
+)
+
+func LoadOrCreate(stateDir string) (string, error) {
+	if err := os.MkdirAll(stateDir, 0o700); err != nil {
+		return "", err
+	}
+	if err := os.Chmod(stateDir, 0o700); err != nil {
+		return "", err
+	}
+	path := filepath.Join(stateDir, fileName)
+	if info, err := os.Stat(path); err == nil {
+		if !info.Mode().IsRegular() {
+			return "", fmt.Errorf("agent key is not a regular file: %s", path)
+		}
+		if info.Mode().Perm() != 0o600 {
+			if err := os.Chmod(path, 0o600); err != nil {
+				return "", err
+			}
+		}
+		b, err := os.ReadFile(path)
+		if err != nil {
+			return "", err
+		}
+		return validate(strings.TrimSpace(string(b)), path)
+	} else if !os.IsNotExist(err) {
+		return "", err
+	}
+
+	key, err := generate()
+	if err != nil {
+		return "", err
+	}
+	tmp := fmt.Sprintf("%s.%d.tmp", path, os.Getpid())
+	defer os.Remove(tmp)
+	if err := os.WriteFile(tmp, []byte(key+"\n"), 0o600); err != nil {
+		return "", err
+	}
+	if err := os.Rename(tmp, path); err != nil {
+		return "", err
+	}
+	return key, nil
+}
+
+func validate(key string, path string) (string, error) {
+	if len(key) != keyLen {
+		return "", fmt.Errorf("invalid agent key in %s", path)
+	}
+	if _, err := hex.DecodeString(key); err != nil {
+		return "", fmt.Errorf("invalid agent key in %s", path)
+	}
+	return strings.ToLower(key), nil
+}
+
+func generate() (string, error) {
+	var b [keyBytes]byte
+	if _, err := rand.Read(b[:]); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(b[:]), nil
+}

agent/internal/agentkey/agentkey_test.go

@@ -0,0 +1,75 @@
+package agentkey
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestLoadOrCreatePersistsKey(t *testing.T) {
+	dir := t.TempDir()
+	k1, err := LoadOrCreate(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	k2, err := LoadOrCreate(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if k1 != k2 {
+		t.Fatal("key was not persisted")
+	}
+	if len(k1) != keyLen {
+		t.Fatalf("unexpected key length %d", len(k1))
+	}
+	info, err := os.Stat(filepath.Join(dir, fileName))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := info.Mode().Perm(); got != 0o600 {
+		t.Fatalf("unexpected key mode %o", got)
+	}
+}
+
+func TestLoadOrCreateRejectsInvalidExistingKey(t *testing.T) {
+	dir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(dir, fileName), []byte("bad\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := LoadOrCreate(dir); err == nil {
+		t.Fatal("expected invalid key error")
+	}
+}
+
+func TestLoadOrCreateRejectsInvalidHexExistingKey(t *testing.T) {
+	dir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(dir, fileName), []byte("zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := LoadOrCreate(dir); err == nil {
+		t.Fatal("expected invalid key error")
+	}
+}
+
+func TestLoadOrCreateRepairsKeyPermissions(t *testing.T) {
+	dir := t.TempDir()
+	key := "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+	path := filepath.Join(dir, fileName)
+	if err := os.WriteFile(path, []byte(key+"\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	got, err := LoadOrCreate(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != key {
+		t.Fatalf("unexpected key %q", got)
+	}
+	info, err := os.Stat(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := info.Mode().Perm(); got != 0o600 {
+		t.Fatalf("unexpected key mode %o", got)
+	}
+}