diff --git a/.github/workflows/ada.yml b/.github/workflows/ada.yml index 160ab29..a87d4f3 100644 --- a/.github/workflows/ada.yml +++ b/.github/workflows/ada.yml @@ -13,7 +13,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Set up GNAT toolchain run: > diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index bc3b92c..e140d60 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -55,7 +55,7 @@ jobs: # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 # Add any setup steps before running the `github/codeql-action/init` action. # This includes steps like installing compilers or runtimes (`actions/setup-node` @@ -65,7 +65,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@4f3212b61783c3c68e8309a0f18a699764811cda # v3.27.1 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} @@ -94,6 +94,6 @@ jobs: exit 1 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@4f3212b61783c3c68e8309a0f18a699764811cda # v3.27.1 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/elixir.yml b/.github/workflows/elixir.yml index e3c2b3e..10be154 100644 --- a/.github/workflows/elixir.yml +++ b/.github/workflows/elixir.yml @@ -21,14 +21,14 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Set up Elixir uses: erlef/setup-beam@e6d7c94229049569db56a7ad5a540c051a010af9 # v1.20.4 with: elixir-version: '1.15.2' # [Required] Define the Elixir version otp-version: '26.0' # [Required] Define the Erlang/OTP version - name: Restore dependencies cache - uses: actions/cache@v5 + uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2 with: path: deps key: ${{ runner.os }}-mix-${{ hashFiles('**/mix.lock') }} diff --git a/.github/workflows/generator-generic-ossf-slsa3-publish.yml b/.github/workflows/generator-generic-ossf-slsa3-publish.yml index bfb56b7..33c81bf 100644 --- a/.github/workflows/generator-generic-ossf-slsa3-publish.yml +++ b/.github/workflows/generator-generic-ossf-slsa3-publish.yml @@ -23,7 +23,7 @@ jobs: digests: ${{ steps.hash.outputs.digests }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 # ======================================================== # @@ -60,7 +60,7 @@ jobs: actions: read # To read the workflow path. id-token: write # To sign the provenance. contents: write # To add assets to a release. - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0 with: base64-subjects: "${{ needs.build.outputs.digests }}" upload-assets: true # Optional: Upload to a new release diff --git a/.github/workflows/guix-nix-policy.yml b/.github/workflows/guix-nix-policy.yml index 6771253..d6c8152 100644 --- a/.github/workflows/guix-nix-policy.yml +++ b/.github/workflows/guix-nix-policy.yml @@ -4,7 +4,7 @@ jobs: check: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Enforce Guix primary / Nix fallback run: | # Check for package manager files diff --git a/.github/workflows/jekyll-gh-pages.yml b/.github/workflows/jekyll-gh-pages.yml index e729658..42e5b72 100644 --- a/.github/workflows/jekyll-gh-pages.yml +++ b/.github/workflows/jekyll-gh-pages.yml @@ -27,16 +27,16 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Setup Pages - uses: actions/configure-pages@v5 + uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0 - name: Build with Jekyll - uses: actions/jekyll-build-pages@v1 + uses: actions/jekyll-build-pages@44a6e6beabd48582f863aeeb6cb2151cc1716f3b # v1.0.13 with: source: ./ destination: ./_site - name: Upload artifact - uses: actions/upload-pages-artifact@v4 + uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1 # Deployment job deploy: @@ -48,4 +48,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v4 + uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5 diff --git a/.github/workflows/npm-bun-blocker.yml b/.github/workflows/npm-bun-blocker.yml index d4f73fc..d2b23ef 100644 --- a/.github/workflows/npm-bun-blocker.yml +++ b/.github/workflows/npm-bun-blocker.yml @@ -4,7 +4,7 @@ jobs: check: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Block npm/bun run: | if [ -f "package-lock.json" ] || [ -f "bun.lockb" ] || [ -f ".npmrc" ]; then diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index c1a7b7a..def178e 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -5,14 +5,14 @@ jobs: lint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - name: Check file permissions run: | find . -type f -perm /111 -name "*.sh" | head -10 || true - name: Check for secrets - uses: trufflesecurity/trufflehog@main + uses: trufflesecurity/trufflehog@63e6dcaa4f6b7bbdd96ce0db5b7fbc8c839e7746 # v3.82.8 with: path: ./ base: ${{ github.event.pull_request.base.sha || github.event.before }} @@ -29,13 +29,13 @@ jobs: find . -type f -size +1M -not -path "./.git/*" | head -10 || echo "No large files" - name: EditorConfig check - uses: editorconfig-checker/action-editorconfig-checker@main + uses: editorconfig-checker/action-editorconfig-checker@35f3c0fca2f5ee3e31fbcd40a5bbc58eb80db28d # v2.0.0 continue-on-error: true docs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Check documentation run: | MISSING="" diff --git a/.github/workflows/rsr-antipattern.yml b/.github/workflows/rsr-antipattern.yml index e6ce6a0..7dbb6f2 100644 --- a/.github/workflows/rsr-antipattern.yml +++ b/.github/workflows/rsr-antipattern.yml @@ -16,7 +16,7 @@ jobs: antipattern-check: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Check for TypeScript run: | diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index c1071e6..974ed9e 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -14,17 +14,17 @@ jobs: security-events: write id-token: write steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: persist-credentials: false - name: Run Scorecard - uses: ossf/scorecard-action@v2.4.3 + uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0 with: results_file: results.sarif results_format: sarif - name: Upload results - uses: github/codeql-action/upload-sarif@v4 + uses: github/codeql-action/upload-sarif@4f3212b61783c3c68e8309a0f18a699764811cda # v3.27.1 with: sarif_file: results.sarif diff --git a/.github/workflows/security-policy.yml b/.github/workflows/security-policy.yml index a9d7c0f..e2fee2f 100644 --- a/.github/workflows/security-policy.yml +++ b/.github/workflows/security-policy.yml @@ -4,7 +4,7 @@ jobs: check: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Security checks run: | FAILED=false diff --git a/.github/workflows/wellknown-enforcement.yml b/.github/workflows/wellknown-enforcement.yml index 2108364..f7adb79 100644 --- a/.github/workflows/wellknown-enforcement.yml +++ b/.github/workflows/wellknown-enforcement.yml @@ -17,8 +17,8 @@ jobs: validate: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - name: RFC 9116 security.txt validation run: | SECTXT="" diff --git a/ROADMAP.md b/ROADMAP.md new file mode 100644 index 0000000..7b4ed53 --- /dev/null +++ b/ROADMAP.md @@ -0,0 +1,173 @@ +# HINFO-LOC Fluctuator Roadmap + +**Last Updated**: 2025-12-17 +**Current Version**: 0.1.0 (development) +**Overall Completion**: 40% + +## Current State Summary + +| Component | Status | Completion | +|-----------|--------|------------| +| RSR Compliance | Complete | 100% | +| CI Security (SHA-pinned) | Complete | 100% | +| Nix Fallback (flake.nix) | Complete | 100% | +| Ada Implementation | In Progress | 60% | +| Crypto Integration | Planned | 0% | +| DNS Integration | Planned | 0% | + +## Phase 1: Foundation (Current) + +### Completed +- [x] RSR (Rhodium Standard Repository) compliance +- [x] SHA-pinned GitHub Actions (supply chain security) +- [x] Guix package definition (guix.scm) +- [x] Nix flake fallback (flake.nix) +- [x] Core Ada type-safe DNS record structures +- [x] Authentication module with session management +- [x] Randomization engine framework +- [x] Text-based user interface +- [x] Zone file writer (BIND format) +- [x] Thread-safe audit logging +- [x] Scheduled fluctuation with Ada tasking +- [x] DNS UPDATE framework (RFC 2136) +- [x] Enterprise features (Firewall, SDP, Security Headers, Protocol Management) +- [x] Comprehensive documentation + +### In Progress +- [ ] Complete CSV parser in `randomizer.adb` +- [ ] Verify Ada build in CI pipeline + +## Phase 2: Security Hardening (Q1 2026) + +**Priority**: CRITICAL + +### Crypto Integration +- [ ] Integrate bcrypt/Argon2 password hashing library +- [ ] Replace demo credentials in `secure_auth.adb` +- [ ] Implement TSIG authentication (RFC 2845) +- [ ] Add SPA packet encryption/decryption (AES-256-GCM, ChaCha20-Poly1305) + +### Testing +- [ ] Unit test framework (target: 70%+ coverage) +- [ ] Integration tests with mock DNS server +- [ ] Security-focused test cases + +### CI/CD Improvements +- [ ] Add Ada syntax/build verification to CI +- [ ] Implement SPARK verification step (optional) + +## Phase 3: DNS Integration (Q2 2026) + +**Priority**: HIGH + +### Real Server Integration +- [ ] Test with BIND 9 +- [ ] Test with PowerDNS +- [ ] Test with NSD +- [ ] Document server-specific configuration + +### DNS UPDATE Protocol +- [ ] Complete RFC 2136 implementation +- [ ] TSIG signature generation/verification +- [ ] Zone transfer (AXFR) support +- [ ] Incremental zone transfer (IXFR) support + +### Firewall Integration +- [ ] Test actual firewall command execution +- [ ] Add dry-run mode for safety +- [ ] Support for firewalld, iptables, nftables, pf + +## Phase 4: Formal Verification (Q3 2026) + +**Priority**: MEDIUM + +### SPARK Verification +- [ ] Add SPARK annotations to `secure_auth.ads/adb` +- [ ] Add SPARK annotations to `sdp_controller.ads/adb` +- [ ] Prove absence of runtime errors +- [ ] Prove security properties + +### Certification +- [ ] Document verification results +- [ ] Achieve Platinum Tier RSR compliance (90%+) + +## Phase 5: Production Release (Q4 2026) + +**Priority**: MEDIUM + +### Release Preparation +- [ ] Complete security audit +- [ ] Performance optimization +- [ ] Production deployment guide +- [ ] Operational runbooks + +### Distribution +- [ ] Submit to Guix channel +- [ ] Nixpkgs submission +- [ ] Container images (if requested) + +--- + +## Known Security Issues + +### HIGH Priority + +1. **Demo Credentials** (`secure_auth.adb:17-38`) + - Current: Hardcoded SHA256 demo hashes + - Required: bcrypt/Argon2 integration + - Risk: Authentication bypass in production + +2. **Password Bypass** (`secure_auth.adb:126-131`) + - Current: Any non-empty password accepted in demo mode + - Required: Proper password verification + - Risk: Authentication bypass + +### MEDIUM Priority + +3. **No Real Cryptography** + - Affects: TSIG, SPA, password hashing + - Required: Integration with crypto library (libsodium, AWS-LC, or similar) + +4. **DNS Server Integration Untested** + - Affects: All DNS UPDATE operations + - Required: Integration testing with real DNS servers + +--- + +## Architecture Notes + +### Design Principles +1. **Memory Safety**: Ada's ownership model prevents entire classes of bugs +2. **Type Safety**: Compile-time bounds checking on all coordinates/TTLs +3. **Constant-Time Operations**: Authentication uses constant-time comparison +4. **Defense in Depth**: Multiple layers of security checks + +### Key Files +- `src/dns_records.ads` - Core type definitions +- `src/secure_auth.adb` - Authentication (security-critical) +- `src/sdp_controller.ads` - Zero-trust SDP +- `src/firewall_manager.ads` - Firewall integration + +--- + +## Contributing + +See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines. + +**Priority Areas for Contributors**: +1. Crypto library integration (bcrypt/Argon2) +2. Unit test coverage +3. DNS server integration testing +4. SPARK annotations + +--- + +## References + +- [RFC 1034](https://tools.ietf.org/html/rfc1034): DNS Concepts +- [RFC 1035](https://tools.ietf.org/html/rfc1035): DNS Implementation +- [RFC 1876](https://tools.ietf.org/html/rfc1876): LOC Record Format +- [RFC 2136](https://tools.ietf.org/html/rfc2136): DNS UPDATE +- [RFC 2845](https://tools.ietf.org/html/rfc2845): TSIG Authentication +- [RFC 8482](https://tools.ietf.org/html/rfc8482): HINFO/LOC Deprecation +- [NIST SP 800-207](https://csrc.nist.gov/publications/detail/sp/800-207/final): Zero Trust Architecture diff --git a/STATE.scm b/STATE.scm index ecbd53d..5acee64 100644 --- a/STATE.scm +++ b/STATE.scm @@ -3,20 +3,46 @@ ;; SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell (define metadata - '((version . "0.1.0") (updated . "2025-12-15") (project . "resource-record-fluctuator"))) + '((version . "0.1.0") (updated . "2025-12-17") (project . "resource-record-fluctuator"))) (define current-position - '((phase . "v0.1 - Initial Setup") - (overall-completion . 25) - (components ((rsr-compliance ((status . "complete") (completion . 100))))))) + '((phase . "v0.2 - Security Hardening") + (overall-completion . 40) + (components + ((rsr-compliance ((status . "complete") (completion . 100))) + (ci-security ((status . "complete") (completion . 100))) + (nix-fallback ((status . "complete") (completion . 100))) + (ada-implementation ((status . "in-progress") (completion . 60))) + (crypto-integration ((status . "planned") (completion . 0))) + (dns-integration ((status . "planned") (completion . 0))))))) -(define blockers-and-issues '((critical ()) (high-priority ()))) +(define blockers-and-issues + '((critical ()) + (high-priority + (("Demo credentials in secure_auth.adb - replace with bcrypt/Argon2" . security) + ("DNS UPDATE integration requires testing with real server" . integration))))) (define critical-next-actions - '((immediate (("Verify CI/CD" . high))) (this-week (("Expand tests" . medium))))) + '((immediate + (("Integrate proper crypto library (bcrypt/Argon2)" . critical) + ("Test Ada build in CI" . high))) + (this-week + (("Complete CSV parser in randomizer.adb" . medium) + ("Set up DNS test environment" . medium))) + (this-month + (("SPARK verification of secure_auth module" . medium) + ("Integration testing with BIND/PowerDNS" . medium))))) (define session-history - '((snapshots ((date . "2025-12-15") (session . "initial") (notes . "SCM files added"))))) + '((snapshots + ((date . "2025-12-17") (session . "security-review") + (notes . "Fixed SHA-pinning in all workflows, added flake.nix, security audit")) + ((date . "2025-12-15") (session . "initial") + (notes . "SCM files added"))))) (define state-summary - '((project . "resource-record-fluctuator") (completion . 25) (blockers . 0) (updated . "2025-12-15"))) + '((project . "resource-record-fluctuator") + (completion . 40) + (blockers . 0) + (high-priority-issues . 2) + (updated . "2025-12-17"))) diff --git a/flake.nix b/flake.nix new file mode 100644 index 0000000..e44478a --- /dev/null +++ b/flake.nix @@ -0,0 +1,101 @@ +# SPDX-License-Identifier: AGPL-3.0-or-later +# SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell +# +# resource-record-fluctuator - Nix Flake (RSR fallback) +# Primary: guix.scm | Fallback: flake.nix +# +# Usage: +# nix develop # Enter development shell +# nix build # Build the project +# nix flake check # Run checks +{ + description = "HINFO-LOC Fluctuator - DNS record randomization tool for deprecated HINFO and LOC records"; + + inputs = { + nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.05"; + flake-utils.url = "github:numtide/flake-utils"; + }; + + outputs = { self, nixpkgs, flake-utils }: + flake-utils.lib.eachDefaultSystem (system: + let + pkgs = nixpkgs.legacyPackages.${system}; + in + { + # Development shell with GNAT Ada compiler + devShells.default = pkgs.mkShell { + name = "hinfo-loc-fluctuator-dev"; + + buildInputs = with pkgs; [ + # Ada/GNAT toolchain + gnat + gprbuild + + # Build tools + gnumake + + # Optional: SPARK prover (if available) + # gnatprove + + # Utilities + git + just + ]; + + shellHook = '' + echo "HINFO-LOC Fluctuator Development Environment" + echo "============================================" + echo "Ada/GNAT toolchain loaded" + echo "" + echo "Quick start:" + echo " cd hinfo_loc_fluctuator_ada" + echo " make # Build debug" + echo " make release # Build release" + echo " make clean # Clean build artifacts" + echo "" + ''; + }; + + # Package definition + packages.default = pkgs.stdenv.mkDerivation { + pname = "resource-record-fluctuator"; + version = "0.1.0"; + + src = ./.; + + nativeBuildInputs = with pkgs; [ + gnat + gprbuild + gnumake + ]; + + buildPhase = '' + cd hinfo_loc_fluctuator_ada + make release + ''; + + installPhase = '' + mkdir -p $out/bin + cp hinfo_loc_fluctuator_ada/bin/hinfo_loc_fluctuator $out/bin/ || true + + mkdir -p $out/share/hinfo-loc-fluctuator + cp -r hinfo_loc_fluctuator_ada/data $out/share/hinfo-loc-fluctuator/ + ''; + + meta = with pkgs.lib; { + description = "DNS record randomization tool for deprecated HINFO and LOC records"; + homepage = "https://github.com/hyperpolymath/resource-record-fluctuator"; + license = with licenses; [ agpl3Plus ]; + platforms = platforms.unix; + maintainers = []; + }; + }; + + # Checks + checks = { + # Basic syntax check + build = self.packages.${system}.default; + }; + } + ); +}