@umbra-privacy/qos-ceremony 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +45 -0
- package/dist-cli/bin/qos_client-darwin-arm64 +0 -0
- package/dist-cli/bin/qos_client-linux-x64 +0 -0
- package/dist-cli/cli.js +33302 -0
- package/package.json +49 -0
package/README.md
ADDED
|
@@ -0,0 +1,45 @@
|
|
|
1
|
+
# @umbra-privacy/qos-ceremony
|
|
2
|
+
|
|
3
|
+
Operator CLI for QOS TEE ceremonies. Run the steps that require **your operator key** —
|
|
4
|
+
`keygen`, `share`, `approve`, `provision`, `status` — plus `shift-traffic` (blue-green
|
|
5
|
+
cutover). Your master seed never leaves your device; all crypto runs in `qos_client`.
|
|
6
|
+
|
|
7
|
+
Ships **no coordinator code**. `qos_client` is **embedded** for common platforms
|
|
8
|
+
(darwin-arm64, linux-x64); on others, install it and point `QOS_CLIENT_BIN` / `--qos-client`
|
|
9
|
+
at it.
|
|
10
|
+
|
|
11
|
+
## Install
|
|
12
|
+
|
|
13
|
+
```bash
|
|
14
|
+
npm i -g @umbra-privacy/qos-ceremony # provides the `ceremony` command
|
|
15
|
+
```
|
|
16
|
+
|
|
17
|
+
## Use
|
|
18
|
+
|
|
19
|
+
```bash
|
|
20
|
+
export CEREMONY_API=https://<coordinator>/ \
|
|
21
|
+
CEREMONY_NAMESPACE=<service> CEREMONY_NONCE=<nonce> \
|
|
22
|
+
CEREMONY_ALIAS=p1 CEREMONY_SECRET=/path/to/p1.secret
|
|
23
|
+
|
|
24
|
+
ceremony keygen # once, offline — generate your key; give the pubkey to an admin
|
|
25
|
+
ceremony share # shareSet: derive + upload your (encrypted) genesis share
|
|
26
|
+
ceremony approve --yes # manifestSet: review + sign the manifest (verify the pivot hash!)
|
|
27
|
+
ceremony provision # shareSet: re-encrypt your share to the enclave's ephemeral key
|
|
28
|
+
ceremony status # read-only phase + blockers
|
|
29
|
+
```
|
|
30
|
+
|
|
31
|
+
`shift-traffic` (ops, needs AWS creds): `ceremony shift-traffic --service arith --stack <s> --weights '{"<old>":0,"<new>":100}'`.
|
|
32
|
+
|
|
33
|
+
## Commands
|
|
34
|
+
|
|
35
|
+
| Command | Set | What |
|
|
36
|
+
|---|---|---|
|
|
37
|
+
| `keygen` | any | generate seed (local) + print pubkey to register |
|
|
38
|
+
| `share` | shareSet | derive quorum-key share from genesis; upload (ciphertext) |
|
|
39
|
+
| `approve` | manifestSet | review + sign the manifest |
|
|
40
|
+
| `provision` | shareSet | re-encrypt share to the enclave ephemeral key; post it |
|
|
41
|
+
| `status` | — | read-only phase + blockers |
|
|
42
|
+
| `shift-traffic` | ops | blue-green weighted ALB cutover across a service's colors |
|
|
43
|
+
|
|
44
|
+
Flags mirror env: `--api --namespace --nonce --alias --secret-path --yubikey
|
|
45
|
+
--pcr3-preimage-path --qos-release-dir --qos-client`.
|
|
Binary file
|
|
Binary file
|