aegis-devops 0.1.7__tar.gz → 0.2.0__tar.gz

{aegis_devops-0.1.7/src/aegis_devops.egg-info → aegis_devops-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aegis-devops
-Version: 0.1.7
+Version: 0.2.0
 Summary: Provenance-backed, authority-aware policy verifier for agentic DevOps actions.
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://github.com/moneytool/aegis-devops
@@ -252,14 +252,14 @@ context a rule can arrive from a ticket or a chat message as easily as from you.
 
 The engine (constraint store, interceptor, environment mapping, dry-run handling, rate limits,
 plan-level constraints, and parsers for every tool in "Supported tools") is complete, and
-v0.1.3 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
+v0.2.0 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
 the API (cached in `results/llm-external.md`), Haiku through the Claude Code CLI, `gpt-6-astra`
 through the Codex CLI, and a local `mistral:latest`.
 
 What is *not* done is the part the threat model leans on hardest. See `docs/dev/PLAN.md §8`, but in
 short: a rule may now cite a signed commit in a policy repository, whose verified signer
 becomes its principal ([Git sources](docs/configuration.md#git-sources-signed-commits), SSH
-signatures only so far), but file sources, the key-to-principal list and the other policy
+or GPG signatures), but file sources, the key-to-principal list and the other policy
 files still rest on a shared signing secret rather than per-principal public keys, and there
 are no Slack/Jira connectors. Until those land, Aegis demonstrates that the *decision
 procedure* is sound; it proves the identities feeding it only for Git-sourced rules. Resource matching is also case-sensitive on names. It is not

{aegis_devops-0.1.7 → aegis_devops-0.2.0}/README.md

@@ -220,14 +220,14 @@ context a rule can arrive from a ticket or a chat message as easily as from you.
 
 The engine (constraint store, interceptor, environment mapping, dry-run handling, rate limits,
 plan-level constraints, and parsers for every tool in "Supported tools") is complete, and
-v0.1.3 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
+v0.2.0 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
 the API (cached in `results/llm-external.md`), Haiku through the Claude Code CLI, `gpt-6-astra`
 through the Codex CLI, and a local `mistral:latest`.
 
 What is *not* done is the part the threat model leans on hardest. See `docs/dev/PLAN.md §8`, but in
 short: a rule may now cite a signed commit in a policy repository, whose verified signer
 becomes its principal ([Git sources](docs/configuration.md#git-sources-signed-commits), SSH
-signatures only so far), but file sources, the key-to-principal list and the other policy
+or GPG signatures), but file sources, the key-to-principal list and the other policy
 files still rest on a shared signing secret rather than per-principal public keys, and there
 are no Slack/Jira connectors. Until those land, Aegis demonstrates that the *decision
 procedure* is sound; it proves the identities feeding it only for Git-sourced rules. Resource matching is also case-sensitive on names. It is not

{aegis_devops-0.1.7 → aegis_devops-0.2.0}/src/aegis_core/__init__.py

@@ -4,4 +4,4 @@ infrastructure actions of AI agents.
 See the README for what this does and, importantly, what it does not yet do.
 """
 
-__version__ = "0.1.7"
+__version__ = "0.2.0"

aegis_devops-0.2.0/src/aegis_core/_examples/repos.example.yaml

@@ -0,0 +1,11 @@
+# Git sources (docs/configuration.md#git-sources-signed-commits).
+# Copy to repos.yaml to enable: a constraint may then cite
+#   source_ref: "git:<repo-id>@<full commit sha>:<path>"
+# and its principal becomes the verified signer of that commit.
+# Aegis never fetches: keep each clone up to date with your own `git fetch`,
+# and use full clones (shallow clones and grafts are refused).
+repos:
+  platform-policy:
+    path: /srv/aegis/platform-policy
+    ref: refs/remotes/origin/main   # the ref that defines "current"
+    rule_glob: rules/*.yaml         # one rule per file

aegis_devops-0.2.0/src/aegis_core/_examples/repos.example.yaml.sig

@@ -0,0 +1,2 @@
+aegis-sig-v1
+d3fdb081efd29c87dad98fd7ba59eb5522c31d6f86e8a4c672d902100c2339da

aegis_devops-0.2.0/src/aegis_core/_examples/signers.example.yaml

@@ -0,0 +1,13 @@
+# Which signing key speaks for which principal (the names authority.yaml uses).
+# Copy to signers.yaml alongside repos.yaml, then sign both with `aegis sign`.
+# Never list GitHub's web-flow key (it signs merges made in the GitHub UI):
+# it would make anyone who can press "Merge" any principal.
+signers:
+  - principal: admin
+    keys:
+      - type: ssh
+        key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIExampleOnlyReplaceWithARealPublicKey0000 alice@example.com"
+  - principal: sre_lead
+    keys:
+      - type: ssh
+        key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAnotherExampleKeyReplaceWithARealOne000 bob@example.com"

aegis_devops-0.2.0/src/aegis_core/_examples/signers.example.yaml.sig

@@ -0,0 +1,2 @@
+aegis-sig-v1
+e7b0ef862e5c7837f13ffcfe9d53bc710b73aecac64d3d801c0e9507155435fa

{aegis_devops-0.1.7 → aegis_devops-0.2.0}/src/aegis_core/cli.py

@@ -96,6 +96,7 @@ from aegis_core.environments import (
     resolve_current_context,
 )
 from aegis_core.gitsource import (
+    GIT_PREFIX,
     REPOS_FILE,
     SIGNERS_FILE,
     DispatchingSourceFetcher,
@@ -480,6 +481,13 @@ def _build_parser() -> argparse.ArgumentParser:
         "--out", default="aegis-signing.key", help="path to write the key to"
     )
 
+    sources_parser = subparsers.add_parser(
+        "sources",
+        help="Report every constraint's source verification: which transport (git, file), "
+        "the verified principal, or why it is quarantined; exit 1 if any is",
+    )
+    _add_common_options(sources_parser)
+
     hook_parser = subparsers.add_parser(
         "hook",
         help="Run as a coding agent's pre-tool hook: read its JSON payload on stdin, answer "
@@ -878,11 +886,12 @@ def _open_ledger(
     return ledger
 
 
-def _evaluate(intents: list[InfrastructureIntent], args: argparse.Namespace) -> int:
+def _load_policy(args: argparse.Namespace):
+    """Resolves the config, verifies and loads the authority map and the
+    constraint store (with file and git source verification). Returns
+    ``(store, authority_map, load, fetcher)``; shared by ``check`` and
+    ``sources``."""
     _resolve_config_paths(args)
-    now = _parse_now(args.now)
-    pretty = bool(args.pretty)
-
     if not os.path.exists(args.constraints):
         raise FileNotFoundError(2, "No such file or directory", args.constraints)
     key_warnings: list[str] = []
@@ -908,6 +917,13 @@ def _evaluate(intents: list[InfrastructureIntent], args: argparse.Namespace) ->
         "constraints",
     )
     store.warnings[:0] = key_warnings
+    return store, authority_map, load, fetcher
+
+
+def _evaluate(intents: list[InfrastructureIntent], args: argparse.Namespace) -> int:
+    now = _parse_now(args.now)
+    pretty = bool(args.pretty)
+    store, authority_map, load, _fetcher = _load_policy(args)
     plan_store = None
     if args.plan_constraints:
         plan_store = _load_or_data_error(
@@ -1076,9 +1092,59 @@ def _run_init(args: argparse.Namespace) -> int:
         f"  3. Replace the *.example.yaml files in {args.dir} with your own constraints.yaml / "
         "authority.yaml / ... (aegis prefers a real file over the .example one when both exist)"
     )
+    print(
+        "  4. Optional, rules backed by signed Git commits: copy repos.example.yaml and "
+        "signers.example.yaml to repos.yaml / signers.yaml (see docs/configuration.md), then "
+        "check them with: aegis sources --pretty"
+    )
     return 0
 
 
+def _transport(source_ref: str, fetcher) -> str:
+    if source_ref.startswith(GIT_PREFIX):
+        return "git"
+    has_file = fetcher is not None and getattr(fetcher, "file_fetcher", fetcher) is not None
+    return "file" if has_file else "unchecked"
+
+
+def _run_sources(args: argparse.Namespace) -> int:
+    """``aegis sources``: one line per constraint -- loaded (with the
+    principal its source verified) or quarantined (with the reason)."""
+    store, _authority, _load, fetcher = _load_policy(args)
+    rows = []
+    for c in store.constraints.values():
+        rows.append({"id": c.id, "status": "ok", "reason": None, "principal": c.principal,
+                     "transport": _transport(c.source_ref, fetcher),
+                     "source_ref": c.source_ref})
+    # Walk the quarantine log entry by entry, in order. Entries that parsed
+    # into a Constraint were appended to quarantined_constraints in the same
+    # order; "invalid: ..." entries (bad shape, duplicate id) never parsed.
+    # Matching by id instead would drop a duplicate-id entry whose id is
+    # also a loaded rule, and confuse two quarantined entries sharing an id.
+    parsed = iter(store.quarantined_constraints)
+    for q in store.health.quarantined:
+        c = None if q["reason"].startswith("invalid: ") else next(parsed, None)
+        rows.append({"id": q["id"], "status": "quarantined", "reason": q["reason"],
+                     "principal": None,
+                     "transport": _transport(c.source_ref, fetcher) if c else None,
+                     "source_ref": c.source_ref if c else None})
+    rows.sort(key=lambda r: (r["status"] != "quarantined", r["id"]))  # stable
+    if args.pretty:
+        for r in rows:
+            label = "OK" if r["status"] == "ok" else f"QUARANTINED ({r['reason']})"
+            print(f"{label:<44} {r['id']:<40} {r['principal'] or '-':<12} "
+                  f"{r['transport'] or '-':<9} {r['source_ref'] or ''}")
+        h = store.health
+        print(f"STORE: loaded={h.loaded} quarantined={len(h.quarantined)} "
+              f"principals={h.principals}")
+        for w in h.warnings:
+            print(f"  warning: {w}")
+    else:
+        for r in rows:
+            print(json.dumps(r))
+    return 1 if store.health.quarantined else 0
+
+
 def _run_keygen(args: argparse.Namespace) -> int:
     path = config_module.generate_signing_key(args.out)
     print(f"aegis: wrote signing key to {path}")
@@ -1095,6 +1161,8 @@ def _run(argv: list[str]) -> int:
         return _run_init(args)
     if args.command == "keygen":
         return _run_keygen(args)
+    if args.command == "sources":
+        return _run_sources(args)
     if args.command == "hook":
         return hook_module.main_hook(
             args.agent,

{aegis_devops-0.1.7 → aegis_devops-0.2.0}/src/aegis_core/gitsource.py

@@ -40,7 +40,7 @@ import shutil
 import subprocess
 import tempfile
 import time
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any
 
@@ -195,16 +195,36 @@ def load_repos(path: str | Path, *, key: bytes | None = None, insecure: bool = F
     return out
 
 
+_GPG_FPR_RE = re.compile(r"[0-9A-F]{40}")
+
+
+@dataclass
+class Signers:
+    """What ``signers.yaml`` trusts. ``ssh``: ``"<type> <base64>" ->
+    principal``; ``gpg``: primary-key fingerprint (40 hex, upper case) ->
+    principal, with ``gpg_keys`` the armored public keys to import."""
+
+    ssh: dict[str, str] = field(default_factory=dict)
+    gpg: dict[str, str] = field(default_factory=dict)
+    gpg_keys: list[str] = field(default_factory=list)
+
+    @property
+    def principals(self) -> set[str]:
+        return set(self.ssh.values()) | set(self.gpg.values())
+
+
 def load_signers(path: str | Path, *, key: bytes | None = None, insecure: bool = False,
-                 warnings: list[str] | None = None) -> dict[str, str]:
-    """``signers.yaml`` -> ``{"<ssh key type> <base64>": principal}``. A key
-    listed twice (under any principals) is a load error, not a guess."""
+                 warnings: list[str] | None = None) -> Signers:
+    """``signers.yaml`` -> :class:`Signers`. A key listed twice (under any
+    principals) is a load error, not a guess. GPG keys carry both the
+    armored public key and its fingerprint; the fingerprint is checked
+    against the key when it is imported."""
     path = Path(path)
     raw = _load_yaml_mapping(path, key, insecure, warnings if warnings is not None else [])
     entries = raw.get("signers")
     if not isinstance(entries, list) or not entries:
         raise ValueError(f"{path}: 'signers' must be a non-empty list")
-    out: dict[str, str] = {}
+    out = Signers()
     for entry in entries:
         if not isinstance(entry, dict):
             raise ValueError(f"{path}: every signer must be a mapping")
@@ -212,18 +232,34 @@ def load_signers(path: str | Path, *, key: bytes | None = None, insecure: bool =
         if not isinstance(principal, str) or not _PRINCIPAL_RE.fullmatch(principal):
             raise ValueError(f"{path}: invalid principal {principal!r}")
         for k in entry.get("keys") or []:
-            if not isinstance(k, dict) or k.get("type") != "ssh":
-                raise ValueError(
-                    f"{path}: {principal}: only 'type: ssh' keys are supported so far"
-                )
-            m = _SSH_KEY_RE.match(str(k.get("key", "")).strip())
-            if not m:
-                raise ValueError(f"{path}: {principal}: not an SSH public key: {k.get('key')!r}")
-            canonical = m.group(0)
-            if canonical in out:
-                raise ValueError(f"{path}: key listed twice ({out[canonical]} and {principal})")
-            out[canonical] = principal
-    if not out:
+            kind = k.get("type") if isinstance(k, dict) else None
+            if kind == "ssh":
+                m = _SSH_KEY_RE.match(str(k.get("key", "")).strip())
+                if not m:
+                    raise ValueError(
+                        f"{path}: {principal}: not an SSH public key: {k.get('key')!r}")
+                canonical = m.group(0)
+                if canonical in out.ssh:
+                    raise ValueError(
+                        f"{path}: key listed twice ({out.ssh[canonical]} and {principal})")
+                out.ssh[canonical] = principal
+            elif kind == "gpg":
+                fpr = re.sub(r"\s+", "", str(k.get("fingerprint", ""))).upper()
+                armored = str(k.get("key", ""))
+                if not _GPG_FPR_RE.fullmatch(fpr):
+                    raise ValueError(f"{path}: {principal}: a gpg key needs its full "
+                                     "40-hex primary fingerprint")
+                if "BEGIN PGP PUBLIC KEY BLOCK" not in armored:
+                    raise ValueError(f"{path}: {principal}: a gpg key needs its armored "
+                                     "public key in 'key'")
+                if fpr in out.gpg:
+                    raise ValueError(
+                        f"{path}: key listed twice ({out.gpg[fpr]} and {principal})")
+                out.gpg[fpr] = principal
+                out.gpg_keys.append(armored)
+            else:
+                raise ValueError(f"{path}: {principal}: key type must be 'ssh' or 'gpg'")
+    if not out.ssh and not out.gpg:
         raise ValueError(f"{path}: no keys")
     return out
 
@@ -244,11 +280,15 @@ class _Git:
     from the calling process could otherwise redirect it) and overrides
     for every setting that decides how signatures are verified."""
 
-    def __init__(self, repo: Path, allowed_signers: Path, empty_file: Path, home: Path):
+    def __init__(self, repo: Path, allowed_signers: Path, empty_file: Path, home: Path,
+                 gpg: str | None = None, gnupghome: Path | None = None):
         self.repo = repo
         self.git = _find("git")
         ssh_keygen = _find("ssh-keygen")
         false = shutil.which("false") or "/usr/bin/false"
+        # OpenPGP signatures are only checkable when signers.yaml lists gpg
+        # keys; the keyring is a private one holding exactly those keys
+        gpg_program = gpg or false
         self.env = {
             "PATH": os.pathsep.join(sorted({str(Path(self.git).parent),
                                              str(Path(ssh_keygen).parent), "/usr/bin", "/bin"})),
@@ -262,6 +302,8 @@ class _Git:
             # paths after "--" are literal, never ":(glob)"-style pathspec magic
             "GIT_LITERAL_PATHSPECS": "1",
         }
+        if gnupghome is not None:
+            self.env["GNUPGHOME"] = str(gnupghome)
         self.overrides = [
             f"safe.directory={repo}",
             "core.hooksPath=" + os.devnull,
@@ -273,8 +315,8 @@ class _Git:
             f"gpg.ssh.program={ssh_keygen}",
             f"gpg.ssh.allowedSignersFile={allowed_signers}",
             f"gpg.ssh.revocationFile={empty_file}",
-            f"gpg.program={false}",
-            f"gpg.openpgp.program={false}",
+            f"gpg.program={gpg_program}",
+            f"gpg.openpgp.program={gpg_program}",
             f"gpg.x509.program={false}",
             "log.showSignature=false",
         ]
@@ -295,6 +337,43 @@ class _Git:
 # --- the fetcher ------------------------------------------------------------------
 
 
+def _import_gpg_keys(gpg: str, home: Path, signers: Signers) -> None:
+    """Imports exactly the listed public keys into a private keyring and
+    marks them trusted (so git reports a good signature as ``G``). A key
+    block that holds any key other than the listed fingerprints is a load
+    error: the keyring must contain nothing else."""
+    env = {"GNUPGHOME": str(home), "PATH": os.environ.get("PATH", "/usr/bin:/bin"),
+           "LC_ALL": "C"}
+    base = [gpg, "--batch", "--no-tty", "--no-autostart", "--homedir", str(home)]
+    for armored in signers.gpg_keys:
+        subprocess.run([*base, "--import"], input=armored, text=True, env=env,
+                       capture_output=True, check=True, timeout=60)
+    listing = subprocess.run([*base, "--with-colons", "--fingerprint", "--list-keys"],
+                             env=env, capture_output=True, text=True, check=True,
+                             timeout=60).stdout
+    primaries, expect_fpr = set(), False
+    for line in listing.splitlines():
+        rec = line.split(":")
+        if rec[0] == "pub":
+            expect_fpr = True
+        elif rec[0] == "fpr" and expect_fpr:
+            primaries.add(rec[9].upper())
+            expect_fpr = False
+        elif rec[0] == "sub":
+            expect_fpr = False
+    if primaries != set(signers.gpg):
+        missing = set(signers.gpg) - primaries
+        extra = primaries - set(signers.gpg)
+        raise ValueError(
+            "signers.yaml: gpg keys do not match their fingerprints"
+            + (f"; missing {sorted(missing)}" if missing else "")
+            + (f"; unexpected {sorted(extra)}" if extra else "")
+        )
+    trust = "".join(f"{fpr}:6:\n" for fpr in signers.gpg)
+    subprocess.run([*base, "--import-ownertrust"], input=trust, text=True, env=env,
+                   capture_output=True, check=True, timeout=60)
+
+
 class GitSourceFetcher:
     """``SourceFetcher`` for ``git:`` references (see the module docstring).
 
@@ -306,12 +385,14 @@ class GitSourceFetcher:
     def __init__(
         self,
         repos: dict[str, RepoConfig],
-        signers: dict[str, str],
+        signers: Signers | dict[str, str],
         *,
         max_source_age: float | None = None,
         now: float | None = None,
     ):
         self.repos = repos
+        if isinstance(signers, dict):  # SSH keys only
+            signers = Signers(ssh=dict(signers))
         self.signers = signers
         self.max_source_age = max_source_age
         self.warnings: list[str] = []
@@ -320,13 +401,20 @@ class GitSourceFetcher:
         allowed = tmp / "allowed_signers"
         # principals are validated to [A-Za-z0-9_.@-], so no quoting needed
         allowed.write_text("".join(
-            f'{principal} namespaces="git" {k}\n' for k, principal in signers.items()
+            f'{principal} namespaces="git" {k}\n' for k, principal in signers.ssh.items()
         ))
         empty = tmp / "revoked"
         empty.write_text("")
         (tmp / "home").mkdir()
+        gpg, gnupghome = None, None
+        if signers.gpg:
+            gpg = _find("gpg")
+            gnupghome = tmp / "gnupg"
+            gnupghome.mkdir(mode=0o700)
+            _import_gpg_keys(gpg, gnupghome, signers)
         self._git = {
-            rid: _Git(cfg.path, allowed, empty, tmp / "home") for rid, cfg in repos.items()
+            rid: _Git(cfg.path, allowed, empty, tmp / "home", gpg, gnupghome)
+            for rid, cfg in repos.items()
         }
         self._stale: set[str] = set()
         self._principals: dict[str, str] = {}
@@ -385,6 +473,21 @@ class GitSourceFetcher:
             raise SourceRejected("unknown-commit", f"{sha}: unreadable commit header")
         return tree, parents
 
+    @staticmethod
+    def _signature_type(git: _Git, sha: str) -> str | None:
+        """``"ssh"``, ``"gpg"``, ``"other"`` or ``None`` (unsigned), from the
+        ``gpgsig`` header of the raw commit object."""
+        for line in git.run("cat-file", "commit", sha).split("\n"):
+            if not line:
+                return None  # end of headers, no signature
+            if line.startswith("gpgsig ") or line.startswith("gpgsig-sha256 "):
+                if "BEGIN SSH SIGNATURE" in line:
+                    return "ssh"
+                if "BEGIN PGP SIGNATURE" in line:
+                    return "gpg"
+                return "other"
+        return None
+
     @staticmethod
     def _is_ancestor(git: _Git, sha: str, ref: str) -> bool:
         try:
@@ -421,13 +524,27 @@ class GitSourceFetcher:
         if kind != "commit":
             raise SourceRejected("unknown-commit", ref.sha)
 
-        # 1. the signature, verified against signers.yaml only
-        status, _, signer = git.run("log", "-1", "--format=%G?%x00%GS", ref.sha).strip().partition(
-            "\x00")
-        if status == "N":
+        # 1. the signature, verified against signers.yaml only. Its type is
+        #    read from the commit object; SSH signers are named by the
+        #    allowed-signers file we wrote, OpenPGP ones by the primary-key
+        #    fingerprint of a key in our private keyring.
+        sig_type = self._signature_type(git, ref.sha)
+        fields = git.run("log", "-1", "--format=%G?%x00%GS%x00%GP%x00%GF", ref.sha).strip()
+        status, signer, primary, subkey = (fields.split("\x00") + ["", "", ""])[:4]
+        if status == "N" or sig_type is None:
             raise SourceRejected("unsigned-source", ref.sha)
-        if status != "G" or signer not in set(self.signers.values()):
+        if status != "G":
             raise SourceRejected("unknown-signer", f"{ref.sha} status {status}")
+        if sig_type == "ssh":
+            principal = signer if signer in set(self.signers.ssh.values()) else None
+        elif sig_type == "gpg":
+            principal = self.signers.gpg.get(primary.upper()) or self.signers.gpg.get(
+                subkey.upper())
+        else:
+            principal = None
+        if principal is None:
+            raise SourceRejected("unknown-signer", f"{ref.sha} ({sig_type})")
+        signer = principal
 
         # 2. the commit added or changed the rule's file (first-parent diff).
         #    Tree and parents are read from the signed commit object itself,

{aegis_devops-0.1.7 → aegis_devops-0.2.0/src/aegis_devops.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aegis-devops
-Version: 0.1.7
+Version: 0.2.0
 Summary: Provenance-backed, authority-aware policy verifier for agentic DevOps actions.
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://github.com/moneytool/aegis-devops
@@ -252,14 +252,14 @@ context a rule can arrive from a ticket or a chat message as easily as from you.
 
 The engine (constraint store, interceptor, environment mapping, dry-run handling, rate limits,
 plan-level constraints, and parsers for every tool in "Supported tools") is complete, and
-v0.1.3 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
+v0.2.0 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
 the API (cached in `results/llm-external.md`), Haiku through the Claude Code CLI, `gpt-6-astra`
 through the Codex CLI, and a local `mistral:latest`.
 
 What is *not* done is the part the threat model leans on hardest. See `docs/dev/PLAN.md §8`, but in
 short: a rule may now cite a signed commit in a policy repository, whose verified signer
 becomes its principal ([Git sources](docs/configuration.md#git-sources-signed-commits), SSH
-signatures only so far), but file sources, the key-to-principal list and the other policy
+or GPG signatures), but file sources, the key-to-principal list and the other policy
 files still rest on a shared signing secret rather than per-principal public keys, and there
 are no Slack/Jira connectors. Until those land, Aegis demonstrates that the *decision
 procedure* is sound; it proves the identities feeding it only for Git-sourced rules. Resource matching is also case-sensitive on names. It is not

{aegis_devops-0.1.7 → aegis_devops-0.2.0}/src/aegis_devops.egg-info/SOURCES.txt

@@ -29,6 +29,10 @@ src/aegis_core/_examples/environments.example.yaml.sig
 src/aegis_core/_examples/example-signing.key
 src/aegis_core/_examples/plan_constraints.example.yaml
 src/aegis_core/_examples/plan_constraints.example.yaml.sig
+src/aegis_core/_examples/repos.example.yaml
+src/aegis_core/_examples/repos.example.yaml.sig
+src/aegis_core/_examples/signers.example.yaml
+src/aegis_core/_examples/signers.example.yaml.sig
 src/aegis_core/_examples/__pycache__/__init__.cpython-312.pyc
 src/aegis_core/_examples/sources/AEGIS-MANIFEST.sig
 src/aegis_core/_examples/sources/PRINCIPALS.yaml

{aegis_devops-0.1.7 → aegis_devops-0.2.0}/tests/test_gitsource.py

@@ -327,8 +327,13 @@ def test_configuration_errors_fail_the_load(repo, tmp_path):
     gpg = tmp_path / "gpg.yaml"
     gpg.write_text(yaml.safe_dump({"signers": [
         {"principal": "admin", "keys": [{"type": "gpg", "fingerprint": "ABCD"}]}]}))
-    with pytest.raises(ValueError, match="only 'type: ssh'"):
+    with pytest.raises(ValueError, match="40-hex"):
         load_signers(gpg, insecure=True)
+    other = tmp_path / "x509.yaml"
+    other.write_text(yaml.safe_dump({"signers": [
+        {"principal": "admin", "keys": [{"type": "x509", "key": "..."}]}]}))
+    with pytest.raises(ValueError, match="'ssh' or 'gpg'"):
+        load_signers(other, insecure=True)
     repos = tmp_path / "repos.yaml"
     repos.write_text(yaml.safe_dump({"repos": {"policy": {"path": str(repo.path),
                                                           "ref": "main"}}}))
@@ -526,3 +531,199 @@ def test_git_citation_with_only_file_sources_is_unknown_repo(repo, tmp_path, cap
 
     line = json.loads(capsys.readouterr().out.splitlines()[0])
     assert {"id": "r1", "reason": "unknown-repo"} in line["decision"]["discarded"]
+
+
+# --- aegis sources and aegis init ---------------------------------------------------
+
+
+def test_sources_report_lists_principals_and_quarantine_reasons(repo, tmp_path, capsys):
+    import json
+
+    from aegis_core.cli import main
+
+    conf = _cli_setup(repo, tmp_path, "admin")
+    assert main(["sources", "--config-dir", str(conf), "--insecure", "--sources", ""]) == 0
+    rows = {r["id"]: r for r in map(json.loads, capsys.readouterr().out.splitlines())}
+    assert rows["r1"]["status"] == "ok"
+    assert (rows["r1"]["principal"], rows["r1"]["transport"]) == ("admin", "git")
+    assert rows["f1"]["transport"] == "unchecked"
+
+
+def test_sources_report_exits_1_and_names_the_reason(tmp_path, capsys):
+    from aegis_core.cli import main
+
+    other = tmp_path / "other"
+    other.mkdir()
+    r = Repo(other)
+    r.write_rule("seed", {**RULE, "rule_text": "seed"})
+    r.commit("seed", "admin")
+    conf = _cli_setup(r, other, "mallory")
+    assert main(["sources", "--config-dir", str(conf), "--insecure", "--sources", "",
+                 "--pretty"]) == 1
+    out = capsys.readouterr().out
+    assert "QUARANTINED (unknown-signer)" in out
+    assert "STORE: loaded=1 quarantined=1" in out
+
+
+def test_init_writes_inert_git_examples(tmp_path, capsys):
+    from aegis_core.cli import main
+
+    target = tmp_path / ".aegis"
+    main(["init", str(target)])
+    assert (target / "repos.example.yaml").exists()
+    assert (target / "signers.example.yaml").exists()
+    assert not (target / "repos.yaml").exists()  # examples are never loaded
+    assert "aegis sources" in capsys.readouterr().out
+
+
+# --- OpenPGP signatures -------------------------------------------------------------
+
+GPG = shutil.which("gpg")
+needs_gpg = pytest.mark.skipif(GPG is None, reason="needs gpg")
+
+
+class GpgKey:
+    """A throwaway OpenPGP key in its own GNUPGHOME. The home is a short
+    path under /tmp: gpg-agent's socket path must fit in 104 bytes on
+    macOS, which pytest's tmp_path does not."""
+
+    homes: list[Path] = []
+
+    def __init__(self, root: Path, name: str, *, expire: str = "0"):
+        import tempfile
+
+        self.home = Path(tempfile.mkdtemp(prefix="agpg-", dir="/tmp"))
+        self.home.chmod(0o700)
+        GpgKey.homes.append(self.home)
+        self.env = {**os.environ, "GNUPGHOME": str(self.home)}
+        gen = subprocess.run([GPG, "--batch", "--passphrase", "", "--quick-gen-key",
+                              f"{name} <{name}@example.com>", "ed25519", "sign", expire],
+                             env=self.env, check=False, capture_output=True, text=True)
+        if gen.returncode != 0:  # say why, not just "exit status 2"
+            raise RuntimeError(f"gpg key generation failed (home {self.home}):\n{gen.stderr}")
+        colons = subprocess.run([GPG, "--with-colons", "--fingerprint", "--list-keys"],
+                                env=self.env, check=True, capture_output=True,
+                                text=True).stdout
+        self.fpr = next(line.split(":")[9] for line in colons.splitlines()
+                        if line.startswith("fpr:"))
+        self.armored = subprocess.run([GPG, "--armor", "--export", self.fpr], env=self.env,
+                                      check=True, capture_output=True, text=True).stdout
+
+    def commit(self, repo: Repo, message: str) -> str:
+        env = {**repo.env, "GNUPGHOME": str(self.home)}
+        subprocess.run(["git", "-c", "user.name=g", "-c", "user.email=g@example.com",
+                        "-c", "gpg.format=openpgp", "-c", f"user.signingkey={self.fpr}",
+                        "commit", "-q", "-S", "-m", message], cwd=repo.path, env=env,
+                       check=True, capture_output=True)
+        return repo.git("rev-parse", "HEAD")
+
+
+@pytest.fixture(autouse=True)
+def _cleanup_gpg_homes():
+    yield
+    while GpgKey.homes:
+        home = GpgKey.homes.pop()
+        if GPG:
+            subprocess.run(["gpgconf", "--homedir", str(home), "--kill", "all"],
+                           capture_output=True, check=False)
+        shutil.rmtree(home, ignore_errors=True)
+
+
+def gpg_signers(*pairs):
+    from aegis_core.gitsource import Signers
+
+    out = Signers()
+    for key, principal in pairs:
+        out.gpg[key.fpr.upper()] = principal
+        out.gpg_keys.append(key.armored)
+    return out
+
+
+@needs_gpg
+def test_gpg_signed_commit_backs_the_rule(repo, tmp_path):
+    alice = GpgKey(tmp_path, "alice")
+    path = repo.write_rule("r1")
+    sha = alice.commit(repo, "alice adds r1")
+    f = fetcher(repo, gpg_signers((alice, "admin")))
+    store = load(tmp_path, [constraint_for(ref(sha, path), "admin")], f)
+    assert list(store.constraints) == ["r1"]
+
+
+@needs_gpg
+def test_gpg_key_not_in_signers_is_unknown(repo, tmp_path):
+    alice, mallory = GpgKey(tmp_path, "alice"), GpgKey(tmp_path, "mallory")
+    path = repo.write_rule("r1")
+    sha = mallory.commit(repo, "mallory adds r1")
+    store = load(tmp_path, [constraint_for(ref(sha, path), "admin")],
+                 fetcher(repo, gpg_signers((alice, "admin"))))
+    assert reasons(store) == {"r1": "unknown-signer"}
+
+
+@needs_gpg
+def test_gpg_signer_mapped_to_another_principal(repo, tmp_path):
+    dev = GpgKey(tmp_path, "dev")
+    path = repo.write_rule("r1")
+    sha = dev.commit(repo, "dev adds r1")
+    store = load(tmp_path, [constraint_for(ref(sha, path), "admin")],
+                 fetcher(repo, gpg_signers((dev, "developer"))))
+    assert reasons(store) == {"r1": "principal-mismatch"}
+
+
+@needs_gpg
+def test_gpg_key_block_must_match_its_fingerprint(repo, tmp_path):
+    from aegis_core.gitsource import Signers
+
+    alice, mallory = GpgKey(tmp_path, "alice"), GpgKey(tmp_path, "mallory")
+    # declares alice's fingerprint but ships mallory's key
+    bad = Signers(gpg={alice.fpr.upper(): "admin"}, gpg_keys=[mallory.armored])
+    with pytest.raises(ValueError, match="do not match"):
+        fetcher(repo, bad)
+
+
+@needs_gpg
+def test_ssh_and_gpg_signers_side_by_side(repo, tmp_path):
+    alice = GpgKey(tmp_path, "alice")
+    sig = gpg_signers((alice, "admin"))
+    sig.ssh.update(signers(repo, bob="sre_lead"))
+    p1 = repo.write_rule("r1")
+    s1 = alice.commit(repo, "alice, gpg")
+    p2 = repo.write_rule("r2", {**RULE, "rule_text": "second", "constraint_class": "scaling"})
+    s2 = repo.commit("bob, ssh", "bob")
+    store = load(tmp_path, [
+        constraint_for(ref(s1, p1), "admin"),
+        constraint_for(ref(s2, p2), "sre_lead", cid="r2", rule_text="second",
+                       constraint_class="scaling"),
+    ], fetcher(repo, sig))
+    assert sorted(store.constraints) == ["r1", "r2"]
+
+
+@needs_gpg
+def test_repository_config_cannot_swap_the_gpg_program(repo, tmp_path):
+    mallory = GpgKey(tmp_path, "mallory")
+    alice = GpgKey(tmp_path, "alice")
+    path = repo.write_rule("r1")
+    sha = mallory.commit(repo, "mallory")
+    repo.git("config", "gpg.program", "/usr/bin/true")
+    repo.git("config", "gpg.openpgp.program", "/usr/bin/true")
+    store = load(tmp_path, [constraint_for(ref(sha, path), "admin")],
+                 fetcher(repo, gpg_signers((alice, "admin"))))
+    assert reasons(store) == {"r1": "unknown-signer"}
+
+
+def test_sources_report_keeps_a_duplicate_id_quarantine(repo, tmp_path, capsys):
+    """Review of #12: a duplicate of a loaded rule's id was dropped from the
+    report because rows were matched by id."""
+    import json
+
+    from aegis_core.cli import main
+
+    conf = _cli_setup(repo, tmp_path, "admin")
+    doc = yaml.safe_load((conf / "constraints.yaml").read_text())
+    doc["constraints"].append(dict(doc["constraints"][0]))  # same id "r1" again
+    (conf / "constraints.yaml").write_text(yaml.safe_dump(doc, sort_keys=False))
+    assert main(["sources", "--config-dir", str(conf), "--insecure", "--sources", ""]) == 1
+    rows = [json.loads(line) for line in capsys.readouterr().out.splitlines()]
+    r1 = [r for r in rows if r["id"] == "r1"]
+    assert sorted(r["status"] for r in r1) == ["ok", "quarantined"]
+    assert [r["reason"] for r in r1 if r["status"] == "quarantined"] == [
+        "invalid: duplicate id"]

{aegis_devops-0.1.7 → aegis_devops-0.2.0}/tests/test_signing.py

@@ -175,6 +175,8 @@ def test_shipped_example_and_corpus_files_verify_under_the_example_key():
         "data/authority.example.yaml",
         "data/environments.example.yaml",
         "data/plan_constraints.example.yaml",
+        "data/repos.example.yaml",
+        "data/signers.example.yaml",
         "data/sources/PRINCIPALS.yaml",
         "data/sources/jira-1001.json",
         "data/corpus/constraints.yaml",
@@ -188,4 +190,4 @@ def test_shipped_example_and_corpus_files_verify_under_the_example_key():
     ):
         assert verify_file(path, key), path
     assert not any(p.name.endswith(".json.sig") for p in Path("data").rglob("*.sig"))
-    assert len(list(Path("data").rglob("*.sig"))) <= 9
+    assert len(list(Path("data").rglob("*.sig"))) <= 11