| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
feat: add --content option to res create/update for direct backend writes; enable SQLite auto-create via mode=rwc and add bilingual usage manuals | 6 天前 | |
feat(cli): enhance GTA attestation management commands | 22 天前 | |
feat(rbs-cli): add verbose tracing and refresh client command docs - wire up rbs-cli -v/--quiet logging initialization with tracing - add request/response tracing to rbs-admin-client - fix global provider type resolution for evidence/token providers - update rbs/rbc CLI docs for get-token and attest-token workflows - add rbs-cli test command guide and adjust related tests/headers | 3 个月前 | |
fix(rbs-cli): standardize argument validation errors | 12 天前 | |
fix(rbs-cli): standardize argument validation errors | 12 天前 | |
Refactor RBC and tools client command flow | 3 个月前 | |
feat(rbs): add SM2(SM3) token signing and verification with standard user ID Add SM2 (SM3 digest) support across token and key paths: - Bearer token verification: per-user SM2 public keys (PEM or JWK with crv "sm2p256v1"), compact JWS with alg "SM2" - Attest token verification: PEM public_key_path and JWKS (kid lookup) routes, both under the standard user ID - rbs-cli 'token gen --alg SM2': manual compact JWS assembly (neither jsonwebtoken nor josekit supports SM2) - rbc TEE key type Sm2 (generate/from_pem/JWK); JWE rejects SM2 keys - admin key ingestion: classify SM2 keys via EcKey curve_name and accept crv "sm2p256v1" JWKs All SM2 operations pin the GM/T 0009 default user ID "1234567812345678" by calling EVP_PKEY_CTX_set1_id() right after EVP_Digest{Sign,Verify}Init (declared directly against libcrypto; openssl-sys does not bind it). OpenSSL >= 3.5 (the vendored build is 3.6.2) no longer applies the default implicitly, so plain Signer/Verifier with MessageDigest::sm3() would produce empty-ID signatures that no standard SM2 implementation (OpenSSL <= 3.4, GmSSL, Tongsuo, BouncyCastle, hardware SM2 modules) interoperates with. Signatures with non-standard user IDs are rejected. Docs: OpenBao HTTPS configuration (system trust store; the vault backend has no per-backend ca_file), GTA one-way TLS as the default with optional mTLS, and nonce_type is verifier-only on POST /rbs/v0/attest (OpenAPI artifacts regenerated). Verified by the GB/T 32918.2-2012 appendix A.2 official test vector, negative tests for non-standard user IDs on both token paths, JWKS-path unit tests, cross-verification against the system OpenSSL CLI in both directions (RBS verifies CLI-signed tokens; the CLI verifies RBS signatures), key-form generality (SEC1, PKCS#8, id-ecPublicKey SPKI, cert-extracted public keys), and full workspace tests. | 3 天前 | |
Add CLI docs and unit tests for RBC and tools | 3 个月前 | |
feat(tools): expand admin CLI resource and user management | 4 个月前 |