@voxgig/sdkgen 4.10.0 → 4.12.0

package/project/.sdk/tm/c/feature/secrets/plugins/secretspec.c

@@ -0,0 +1,125 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (c/plugins/secretspec.c)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* SecretSpec, through its CLI.
+ *
+ * A plugin because it spawns a child. `proc.c` is the only object in the
+ * library that forks, and only this kind and `boru` pull it into a link.
+ *
+ * A port of typescript/plugins/secretspec.ts, which is canonical.
+ */
+
+#define _POSIX_C_SOURCE 200809L
+
+#include <stdlib.h>
+#include <string.h>
+
+#include "support.h"
+
+typedef struct {
+  sek_pool *pool;
+  const char *command;
+  const char *file;
+  const char *profile;
+  const char *backend;
+  const char *reason;
+  const char *prefix;
+  char *described;
+} secretspecdata;
+
+/* Does this SecretSpec failure mean "no such secret" rather than "I could
+ * not answer"?
+ *
+ * MATCHED ON THE WHOLE PHRASE, NOT ON "not found". SecretSpec also says
+ * `Provider backend 'keyring' not found`, which is a store that could not
+ * answer at all - and reading that as a miss is the worst failure this
+ * library has, because the chain then falls through to a weaker store
+ * without saying so. The key is required to appear, so the two cannot be
+ * confused. */
+static int secretspecmiss(sek_pool *pool, const char *why, const char *key) {
+  return sek_contains(why, sek_fmt(pool, "Secret '%s' not found", key));
+}
+
+static sek_err secretspec_lookup(sek_provider *self, const char *name, char **out) {
+  secretspecdata *data = (secretspecdata *)self->data;
+  sek_pool *pool = data->pool;
+  char *key = NULL;
+  sek_err err = sek_envkey(pool, name, data->prefix, &key);
+  char *argv[12];
+  size_t at = 0;
+  sek_ran ran;
+  size_t len;
+
+  *out = NULL;
+
+  if (NULL != err) {
+    return err;
+  }
+
+  /* The order is exact: --file comes BEFORE the subcommand, and --reason
+   * is always sent, because SecretSpec audits every read and refuses
+   * without one. */
+  argv[at++] = (char *)data->command;
+  if (!sek_empty(data->file)) {
+    argv[at++] = (char *)"--file";
+    argv[at++] = (char *)data->file;
+  }
+  argv[at++] = (char *)"get";
+  argv[at++] = key;
+  if (!sek_empty(data->backend)) {
+    argv[at++] = (char *)"--provider";
+    argv[at++] = (char *)data->backend;
+  }
+  if (!sek_empty(data->profile)) {
+    argv[at++] = (char *)"--profile";
+    argv[at++] = (char *)data->profile;
+  }
+  argv[at++] = (char *)"--reason";
+  argv[at++] = (char *)sek_first(data->reason, "sekreto");
+  argv[at] = NULL;
+
+  err = sek_runcmd(pool, argv, data->command, NULL, NULL, &ran);
+  if (NULL != err) {
+    return err;
+  }
+
+  if (0 == ran.status) {
+    len = strlen(ran.out);
+    *out = 1 <= len && '\n' == ran.out[len - 1] ? sek_strndup(pool, ran.out, len - 1) : ran.out;
+    return NULL;
+  }
+
+  if (secretspecmiss(pool, ran.why, key)) {
+    return NULL;
+  }
+
+  return sek_fmt(pool, "sekreto: secretspec error: %s",
+                 sek_empty(ran.why) ? sek_fmt(pool, "exit %d", ran.status) : ran.why);
+}
+
+static const char *secretspec_describe(sek_provider *self) {
+  return ((secretspecdata *)self->data)->described;
+}
+
+/* ---- the definition ------------------------------------------------ */
+
+static sek_err secretspec_make(sek_pool *pool, const sek_spec *spec, sek_provider **out) {
+  secretspecdata *data = (secretspecdata *)sek_alloc(pool, sizeof(secretspecdata));
+  data->pool = pool;
+  data->command = sek_own(pool, sek_empty(spec->command) ? "secretspec" : spec->command);
+  data->file = sek_own(pool, spec->file);
+  data->profile = sek_own(pool, spec->profile);
+  data->backend = sek_own(pool, spec->backend);
+  data->reason = sek_own(pool, spec->reason);
+  data->prefix = sek_own(pool, spec->prefix);
+  data->described = sek_empty(spec->backend) ? sek_strdup(pool, "secretspec")
+                                             : sek_fmt(pool, "secretspec:%s", spec->backend);
+  *out = sek_provider_new(pool, secretspec_lookup, secretspec_describe, data);
+  return NULL;
+}
+
+static sek_providerkind SECRETSPEC_KIND;
+
+Definition *sek_plugin_secretspec(void) {
+  return sek_providerplugin(&SECRETSPEC_KIND, "secretspec", secretspec_make);
+}

package/project/.sdk/tm/c/feature/secrets/plugins/sekretoplugins.h

@@ -0,0 +1,125 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (c/plugins/sekretoplugins.h)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* The ten provider kinds that are NOT built in, each a voxgig/plugin
+ * definition, plus the transport and the SigV4 signing that come with
+ * them.
+ *
+ * What makes a kind a plugin is that it needs more of the platform than a
+ * local file: a socket, a signature or a child process. A chain of the
+ * four built-in kinds links none of this, which is the whole point of the
+ * split (docs/design/plugin-providers.md).
+ *
+ * LINKING IS THE BOUNDARY, AND A HEADER IS NOT LINKING. Declaring all ten
+ * here costs a consumer nothing: what a binary carries is the objects its
+ * link line names. A lean consumer links `plugins/hashicorp.o` and the
+ * transport it needs, hands `sek_plugin_hashicorp()` to sek_options, and
+ * never has AWS request signing, seven other vault clients or the child
+ * process launcher in its binary. `sek_allplugins` is the opposite trade
+ * and the honest one: it names all ten, so an object referencing it pulls
+ * every plugin in the library.
+ *
+ *     Definition *chain[] = {sek_plugin_hashicorp()};
+ *     sek_options opts = {0};
+ *     opts.plugins = chain;
+ *     opts.plugincount = 1;
+ */
+
+#ifndef VOXGIG_SEKRETO_PLUGINS_H
+#define VOXGIG_SEKRETO_PLUGINS_H
+
+#include <stddef.h>
+
+#include "sekreto.h"
+
+/* ---- the kinds ----------------------------------------------------- */
+
+/* HashiCorp Vault over its HTTP API: KV v1 and v2, a configured token or
+ * a login (kubernetes, approle, jwt), and Vault Enterprise namespaces. */
+Definition *sek_plugin_hashicorp(void);
+
+/* A boru vault: the `boru` CLI, or the same vault over its wire protocol
+ * when an address and a capability token are configured. */
+Definition *sek_plugin_boru(void);
+
+/* AWS Secrets Manager and SSM Parameter Store. Two kinds, one file: they
+ * share the credential resolution and the SigV4 signing. */
+Definition *sek_plugin_awssecrets(void);
+Definition *sek_plugin_awsparams(void);
+
+/* Google Secret Manager, with metadata-server login. */
+Definition *sek_plugin_gcpsecrets(void);
+
+/* Azure Key Vault, with client-credential or IMDS login. */
+Definition *sek_plugin_azuresecrets(void);
+
+/* 1Password Connect. */
+Definition *sek_plugin_onepassword(void);
+
+/* Doppler. */
+Definition *sek_plugin_doppler(void);
+
+/* Infisical, with universal-auth login. */
+Definition *sek_plugin_infisical(void);
+
+/* SecretSpec, through its CLI. */
+Definition *sek_plugin_secretspec(void);
+
+/* ---- the full set -------------------------------------------------- */
+
+/* Every plugin this library ships, in one call. Answers the count and
+ * points `*out` at a static array of the ten definitions.
+ *
+ * IT IS ALSO THE THING TO AVOID IF SIZE MATTERS. Naming this pulls every
+ * plugin object into the link - request signing and eight HTTP clients
+ * included - which is the cost the split exists to remove. It exists for
+ * the callers that genuinely want all ten: the CLI, the conformance
+ * suite, an app whose chain is decided at run time. */
+size_t sek_allplugins(Definition ***out);
+
+/* ---- transport ----------------------------------------------------- */
+
+/* One HTTP round-trip, published because a C consumer has no HTTP client
+ * of its own to reach the API it just fetched a token for - and the CLI
+ * every port ships is exactly such a consumer. Every other port calls its
+ * platform's client here.
+ *
+ * It is on the PLUGIN side because it is what a plugin is: a socket and a
+ * TLS handshake. A chain of built-ins links none of it.
+ *
+ * https is verified: chain, hostname, SNI, and `SEKRETO_CA_BUNDLE` for
+ * extra roots. A non-2xx status is returned rather than raised. */
+sek_err sek_fetch(sek_pool *pool, const char *method, const char *url, const sek_map *headers,
+                  const char *body, int *status, char **out);
+
+/* RFC 3986 escaping, stricter than any stdlib encoder. With the transport
+ * rather than with the signer: four stores that hash nothing build their
+ * URLs with it. */
+char *sek_uriescape(sek_pool *pool, const char *text);
+
+/* ---- sigv4 --------------------------------------------------------- */
+
+/* One request to sign. `datetime` is `YYYYMMDDTHHMMSSZ` and it is the
+ * caller's, so signing is a pure function of its input - which is what
+ * lets the shared spec carry known-answer cases. */
+typedef struct {
+  const char *method;
+  const char *url;
+  const char *service;
+  const char *region;
+  const char *keyid;
+  const char *secret;
+  const char *datetime;
+  sek_map *headers;
+  const char *body;
+  const char *session;
+} sek_signing;
+
+/* The headers to attach: authorization, x-amz-date, and
+ * x-amz-security-token when a session was given, in that order.
+ *
+ * It moved here with the aws plugin, and the core of no port imports a
+ * hash function any more. */
+sek_map *sek_sigv4(sek_pool *pool, const sek_signing *input);
+
+#endif /* VOXGIG_SEKRETO_PLUGINS_H */

package/project/.sdk/tm/c/feature/secrets/plugins/sha256.c

@@ -0,0 +1,270 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (c/plugins/sha256.c)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* SHA-256 and HMAC-SHA256, by hand.
+ *
+ * This port links libcrypto, and these are still written out. That is the
+ * rule and not an oversight: the dependency exception in AGENTS.md covers
+ * cryptographic TRANSPORT, and nothing else. Rust is the worked
+ * precedent - `ring` sits inside rustls's dependency closure and
+ * rust/src/crypto.rs carries both primitives anyway. Calling libcrypto's
+ * EVP_Digest for a SigV4 signature would quietly widen the exception from
+ * "we do not hand-roll TLS" to "we use whatever the TLS library ships",
+ * which is a different and much larger claim.
+ *
+ * THIS OBJECT EXISTS SO THAT ONLY THE SIGNER PULLS IT. The aws plugin is
+ * the only thing in the library that hashes anything, and a static
+ * archive is linked an object at a time - so keeping the digest here, and
+ * the base64 and percent encoders in `encode.c` where four non-signing
+ * stores can reach them, is what makes "a plugin that signs nothing does
+ * not link SHA-256" true rather than merely intended. `make check-core`
+ * measures it.
+ *
+ * Correctness is not asserted, it is proved: SigV4 is a chain of these
+ * primitives, so one wrong bit anywhere fails the five known-answer
+ * vectors in spec/sekreto.json - including AWS's own published
+ * `get-vanilla`.
+ *
+ * The digest is STREAMING (init/update/final) rather than one-shot,
+ * because HMAC hashes the key pad followed by the message and the message
+ * here is a whole request body. A one-shot digest would need those
+ * concatenated into one buffer, which for the 8 MiB body cap means an 8
+ * MiB allocation per signature - on the stack, if it were an alloca.
+ *
+ * A port of rust/src/crypto.rs.
+ */
+
+#define _POSIX_C_SOURCE 200809L
+
+#include <stdio.h>
+#include <string.h>
+
+#include "support.h"
+
+/* ---- SHA-256, FIPS 180-4 ------------------------------------------- */
+
+static const unsigned int K[64] = {
+    0x428a2f98u, 0x71374491u, 0xb5c0fbcfu, 0xe9b5dba5u, 0x3956c25bu, 0x59f111f1u, 0x923f82a4u,
+    0xab1c5ed5u, 0xd807aa98u, 0x12835b01u, 0x243185beu, 0x550c7dc3u, 0x72be5d74u, 0x80deb1feu,
+    0x9bdc06a7u, 0xc19bf174u, 0xe49b69c1u, 0xefbe4786u, 0x0fc19dc6u, 0x240ca1ccu, 0x2de92c6fu,
+    0x4a7484aau, 0x5cb0a9dcu, 0x76f988dau, 0x983e5152u, 0xa831c66du, 0xb00327c8u, 0xbf597fc7u,
+    0xc6e00bf3u, 0xd5a79147u, 0x06ca6351u, 0x14292967u, 0x27b70a85u, 0x2e1b2138u, 0x4d2c6dfcu,
+    0x53380d13u, 0x650a7354u, 0x766a0abbu, 0x81c2c92eu, 0x92722c85u, 0xa2bfe8a1u, 0xa81a664bu,
+    0xc24b8b70u, 0xc76c51a3u, 0xd192e819u, 0xd6990624u, 0xf40e3585u, 0x106aa070u, 0x19a4c116u,
+    0x1e376c08u, 0x2748774cu, 0x34b0bcb5u, 0x391c0cb3u, 0x4ed8aa4au, 0x5b9cca4fu, 0x682e6ff3u,
+    0x748f82eeu, 0x78a5636fu, 0x84c87814u, 0x8cc70208u, 0x90befffau, 0xa4506cebu, 0xbef9a3f7u,
+    0xc67178f2u};
+
+typedef struct {
+  unsigned int state[8];
+  unsigned char block[64];
+  size_t held;
+  unsigned long long bits;
+} sha256ctx;
+
+static unsigned int ror(unsigned int val, unsigned int by) {
+  return (val >> by) | (val << (32 - by));
+}
+
+static void compress(unsigned int state[8], const unsigned char block[64]) {
+  unsigned int w[64];
+  unsigned int a, b, c, d, e, f, g, h;
+  int step;
+
+  for (step = 0; step < 16; step++) {
+    w[step] = ((unsigned int)block[step * 4] << 24) | ((unsigned int)block[step * 4 + 1] << 16) |
+              ((unsigned int)block[step * 4 + 2] << 8) | (unsigned int)block[step * 4 + 3];
+  }
+
+  for (step = 16; step < 64; step++) {
+    unsigned int s0 = ror(w[step - 15], 7) ^ ror(w[step - 15], 18) ^ (w[step - 15] >> 3);
+    unsigned int s1 = ror(w[step - 2], 17) ^ ror(w[step - 2], 19) ^ (w[step - 2] >> 10);
+    w[step] = w[step - 16] + s0 + w[step - 7] + s1;
+  }
+
+  a = state[0];
+  b = state[1];
+  c = state[2];
+  d = state[3];
+  e = state[4];
+  f = state[5];
+  g = state[6];
+  h = state[7];
+
+  for (step = 0; step < 64; step++) {
+    unsigned int big1 = ror(e, 6) ^ ror(e, 11) ^ ror(e, 25);
+    unsigned int ch = (e & f) ^ ((~e) & g);
+    unsigned int temp1 = h + big1 + ch + K[step] + w[step];
+    unsigned int big0 = ror(a, 2) ^ ror(a, 13) ^ ror(a, 22);
+    unsigned int maj = (a & b) ^ (a & c) ^ (b & c);
+    unsigned int temp2 = big0 + maj;
+
+    h = g;
+    g = f;
+    f = e;
+    e = d + temp1;
+    d = c;
+    c = b;
+    b = a;
+    a = temp1 + temp2;
+  }
+
+  state[0] += a;
+  state[1] += b;
+  state[2] += c;
+  state[3] += d;
+  state[4] += e;
+  state[5] += f;
+  state[6] += g;
+  state[7] += h;
+}
+
+static void sha256init(sha256ctx *ctx) {
+  ctx->state[0] = 0x6a09e667u;
+  ctx->state[1] = 0xbb67ae85u;
+  ctx->state[2] = 0x3c6ef372u;
+  ctx->state[3] = 0xa54ff53au;
+  ctx->state[4] = 0x510e527fu;
+  ctx->state[5] = 0x9b05688cu;
+  ctx->state[6] = 0x1f83d9abu;
+  ctx->state[7] = 0x5be0cd19u;
+  ctx->held = 0;
+  ctx->bits = 0;
+  memset(ctx->block, 0, sizeof(ctx->block));
+}
+
+static void sha256update(sha256ctx *ctx, const unsigned char *data, size_t len) {
+  size_t at = 0;
+
+  ctx->bits += (unsigned long long)len * 8ull;
+
+  if (0 < ctx->held) {
+    size_t want = 64 - ctx->held;
+    size_t take = want < len ? want : len;
+
+    memcpy(ctx->block + ctx->held, data, take);
+    ctx->held += take;
+    at = take;
+
+    if (64 == ctx->held) {
+      compress(ctx->state, ctx->block);
+      ctx->held = 0;
+    }
+  }
+
+  while (len - at >= 64) {
+    compress(ctx->state, data + at);
+    at += 64;
+  }
+
+  if (at < len) {
+    memcpy(ctx->block, data + at, len - at);
+    ctx->held = len - at;
+  }
+}
+
+static void sha256final(sha256ctx *ctx, unsigned char out[SEK_SHA256_LEN]) {
+  unsigned long long bits = ctx->bits;
+  unsigned char tail[64];
+  size_t rest = ctx->held;
+  int step;
+
+  memset(tail, 0, sizeof(tail));
+  memcpy(tail, ctx->block, rest);
+  tail[rest] = 0x80;
+
+  /* The 64-bit length must fit in the final block; when it does not, the
+   * padded block goes out on its own first. */
+  if (56 < rest + 1) {
+    compress(ctx->state, tail);
+    memset(tail, 0, sizeof(tail));
+  }
+
+  for (step = 0; step < 8; step++) {
+    tail[63 - step] = (unsigned char)((bits >> (8 * step)) & 0xff);
+  }
+  compress(ctx->state, tail);
+
+  for (step = 0; step < 8; step++) {
+    out[step * 4] = (unsigned char)((ctx->state[step] >> 24) & 0xff);
+    out[step * 4 + 1] = (unsigned char)((ctx->state[step] >> 16) & 0xff);
+    out[step * 4 + 2] = (unsigned char)((ctx->state[step] >> 8) & 0xff);
+    out[step * 4 + 3] = (unsigned char)(ctx->state[step] & 0xff);
+  }
+}
+
+void sek_sha256(const unsigned char *data, size_t len, unsigned char out[SEK_SHA256_LEN]) {
+  sha256ctx ctx;
+
+  sha256init(&ctx);
+  sha256update(&ctx, data, len);
+  sha256final(&ctx, out);
+}
+
+/* ---- HMAC-SHA256, RFC 2104 ----------------------------------------- */
+
+/* The argument order is (key, data), which is this repository's
+ * convention. PHP's and Perl's stdlib take (data, key); a port that
+ * copies one of those without fixing the order at its wrapper produces a
+ * signature that is wrong in a way nothing but the vectors catches. */
+void sek_hmac_sha256(const unsigned char *key, size_t keylen, const unsigned char *data,
+                     size_t datalen, unsigned char out[SEK_SHA256_LEN]) {
+  unsigned char shortened[SEK_SHA256_LEN];
+  unsigned char pad[64];
+  unsigned char inner[SEK_SHA256_LEN];
+  sha256ctx ctx;
+  size_t index;
+
+  if (64 < keylen) {
+    sek_sha256(key, keylen, shortened);
+    key = shortened;
+    keylen = SEK_SHA256_LEN;
+  }
+
+  memset(pad, 0, sizeof(pad));
+  memcpy(pad, key, keylen);
+  for (index = 0; index < 64; index++) {
+    pad[index] = (unsigned char)(pad[index] ^ 0x36);
+  }
+
+  sha256init(&ctx);
+  sha256update(&ctx, pad, 64);
+  sha256update(&ctx, data, datalen);
+  sha256final(&ctx, inner);
+
+  for (index = 0; index < 64; index++) {
+    /* Back out the ipad and apply the opad: 0x36 ^ 0x5c flips exactly the
+     * bits that differ between them. */
+    pad[index] = (unsigned char)(pad[index] ^ 0x36 ^ 0x5c);
+  }
+
+  sha256init(&ctx);
+  sha256update(&ctx, pad, 64);
+  sha256update(&ctx, inner, SEK_SHA256_LEN);
+  sha256final(&ctx, out);
+}
+
+/* ---- hex ----------------------------------------------------------- */
+
+char *sek_hex(sek_pool *pool, const unsigned char *bytes, size_t len) {
+  static const char digits[] = "0123456789abcdef";
+  char *out = (char *)sek_alloc(pool, len * 2 + 1);
+  size_t index;
+
+  for (index = 0; index < len; index++) {
+    out[index * 2] = digits[(bytes[index] >> 4) & 0x0f];
+    out[index * 2 + 1] = digits[bytes[index] & 0x0f];
+  }
+  out[len * 2] = '\0';
+
+  return out;
+}
+
+char *sek_sha256hex(sek_pool *pool, const char *text) {
+  unsigned char digest[SEK_SHA256_LEN];
+  const char *use = NULL == text ? "" : text;
+
+  sek_sha256((const unsigned char *)use, strlen(use), digest);
+
+  return sek_hex(pool, digest, SEK_SHA256_LEN);
+}