aegis-devops 0.1.7__tar.gz → 0.2.1__tar.gz

{aegis_devops-0.1.7/src/aegis_devops.egg-info → aegis_devops-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aegis-devops
-Version: 0.1.7
+Version: 0.2.1
 Summary: Provenance-backed, authority-aware policy verifier for agentic DevOps actions.
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://github.com/moneytool/aegis-devops
@@ -33,7 +33,7 @@ Dynamic: license-file
 # Aegis-DevOps
 
 [![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.22950337.svg)](https://doi.org/10.5281/zenodo.22950337)
-[![PyPI](https://img.shields.io/pypi/v/aegis-devops)](https://pypi.org/project/aegis-devops/)
+[![PyPI](https://img.shields.io/pypi/v/aegis-devops?label=pypi)](https://pypi.org/project/aegis-devops/)
 
 **Stop AI agents from running `kubectl delete`, `terraform destroy` or `DROP TABLE` because a
 ticket told them to.**
@@ -104,7 +104,7 @@ BLOCK: kubernetes scale deployment/api-server
   citations: no-scale-prod-peak
   covered: True  latency_ms: 0.20
 PLAN BLOCK: 1 intent(s)
-STORE: loaded=29 quarantined=0 principals=3
+STORE: loaded=30 quarantined=0 principals=3
   warning: using example signing key
 ```
 
@@ -252,14 +252,14 @@ context a rule can arrive from a ticket or a chat message as easily as from you.
 
 The engine (constraint store, interceptor, environment mapping, dry-run handling, rate limits,
 plan-level constraints, and parsers for every tool in "Supported tools") is complete, and
-v0.1.3 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
+v0.2.1 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
 the API (cached in `results/llm-external.md`), Haiku through the Claude Code CLI, `gpt-6-astra`
 through the Codex CLI, and a local `mistral:latest`.
 
 What is *not* done is the part the threat model leans on hardest. See `docs/dev/PLAN.md §8`, but in
 short: a rule may now cite a signed commit in a policy repository, whose verified signer
 becomes its principal ([Git sources](docs/configuration.md#git-sources-signed-commits), SSH
-signatures only so far), but file sources, the key-to-principal list and the other policy
+or GPG signatures), but file sources, the key-to-principal list and the other policy
 files still rest on a shared signing secret rather than per-principal public keys, and there
 are no Slack/Jira connectors. Until those land, Aegis demonstrates that the *decision
 procedure* is sound; it proves the identities feeding it only for Git-sourced rules. Resource matching is also case-sensitive on names. It is not

{aegis_devops-0.1.7 → aegis_devops-0.2.1}/README.md

@@ -1,7 +1,7 @@
 # Aegis-DevOps
 
 [![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.22950337.svg)](https://doi.org/10.5281/zenodo.22950337)
-[![PyPI](https://img.shields.io/pypi/v/aegis-devops)](https://pypi.org/project/aegis-devops/)
+[![PyPI](https://img.shields.io/pypi/v/aegis-devops?label=pypi)](https://pypi.org/project/aegis-devops/)
 
 **Stop AI agents from running `kubectl delete`, `terraform destroy` or `DROP TABLE` because a
 ticket told them to.**
@@ -72,7 +72,7 @@ BLOCK: kubernetes scale deployment/api-server
   citations: no-scale-prod-peak
   covered: True  latency_ms: 0.20
 PLAN BLOCK: 1 intent(s)
-STORE: loaded=29 quarantined=0 principals=3
+STORE: loaded=30 quarantined=0 principals=3
   warning: using example signing key
 ```
 
@@ -220,14 +220,14 @@ context a rule can arrive from a ticket or a chat message as easily as from you.
 
 The engine (constraint store, interceptor, environment mapping, dry-run handling, rate limits,
 plan-level constraints, and parsers for every tool in "Supported tools") is complete, and
-v0.1.3 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
+v0.2.1 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonnet 5 through
 the API (cached in `results/llm-external.md`), Haiku through the Claude Code CLI, `gpt-6-astra`
 through the Codex CLI, and a local `mistral:latest`.
 
 What is *not* done is the part the threat model leans on hardest. See `docs/dev/PLAN.md §8`, but in
 short: a rule may now cite a signed commit in a policy repository, whose verified signer
 becomes its principal ([Git sources](docs/configuration.md#git-sources-signed-commits), SSH
-signatures only so far), but file sources, the key-to-principal list and the other policy
+or GPG signatures), but file sources, the key-to-principal list and the other policy
 files still rest on a shared signing secret rather than per-principal public keys, and there
 are no Slack/Jira connectors. Until those land, Aegis demonstrates that the *decision
 procedure* is sound; it proves the identities feeding it only for Git-sourced rules. Resource matching is also case-sensitive on names. It is not

{aegis_devops-0.1.7 → aegis_devops-0.2.1}/src/aegis_core/__init__.py

@@ -4,4 +4,4 @@ infrastructure actions of AI agents.
 See the README for what this does and, importantly, what it does not yet do.
 """
 
-__version__ = "0.1.7"
+__version__ = "0.2.1"

{aegis_devops-0.1.7 → aegis_devops-0.2.1}/src/aegis_core/_examples/constraints.example.yaml

@@ -451,3 +451,18 @@ constraints:
   rule_text: Escalate deleting Argo CD applications (with cascade this deletes the
     deployed resources) for human review.
   provenance_hash: dc24eb69ac5c8b66279284b6df19095e3f0096303f3ef18da712a53e5e339aeb
+- id: block-kubectl-impersonation
+  provider: kubernetes
+  resource_pattern: '*'
+  actions:
+  - impersonate
+  scope: {}
+  time_window: null
+  effect: BLOCK
+  constraint_class: configuration
+  principal: admin
+  source_ref: git-6009
+  source_timestamp: '2026-09-28T12:00:00+00:00'
+  rule_text: 'Block kubectl impersonation (--as, --as-group, --as-uid): the request
+    would run as another identity, outside the controls on the agent''s own.'
+  provenance_hash: 3c2382c07e085d7a10be92490d9b8905085e6996c5c4ef1aaf2ba43980a41fd1

aegis_devops-0.2.1/src/aegis_core/_examples/constraints.example.yaml.sig

@@ -0,0 +1,2 @@
+aegis-sig-v1
+1b135ef7b7ff50e078b96d0944ce3f771fb541c208a55d41f93f5f0bb65c01ab

aegis_devops-0.2.1/src/aegis_core/_examples/repos.example.yaml

@@ -0,0 +1,11 @@
+# Git sources (docs/configuration.md#git-sources-signed-commits).
+# Copy to repos.yaml to enable: a constraint may then cite
+#   source_ref: "git:<repo-id>@<full commit sha>:<path>"
+# and its principal becomes the verified signer of that commit.
+# Aegis never fetches: keep each clone up to date with your own `git fetch`,
+# and use full clones (shallow clones and grafts are refused).
+repos:
+  platform-policy:
+    path: /srv/aegis/platform-policy
+    ref: refs/remotes/origin/main   # the ref that defines "current"
+    rule_glob: rules/*.yaml         # one rule per file

aegis_devops-0.2.1/src/aegis_core/_examples/repos.example.yaml.sig

@@ -0,0 +1,2 @@
+aegis-sig-v1
+d3fdb081efd29c87dad98fd7ba59eb5522c31d6f86e8a4c672d902100c2339da

aegis_devops-0.2.1/src/aegis_core/_examples/signers.example.yaml

@@ -0,0 +1,13 @@
+# Which signing key speaks for which principal (the names authority.yaml uses).
+# Copy to signers.yaml alongside repos.yaml, then sign both with `aegis sign`.
+# Never list GitHub's web-flow key (it signs merges made in the GitHub UI):
+# it would make anyone who can press "Merge" any principal.
+signers:
+  - principal: admin
+    keys:
+      - type: ssh
+        key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIExampleOnlyReplaceWithARealPublicKey0000 alice@example.com"
+  - principal: sre_lead
+    keys:
+      - type: ssh
+        key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAnotherExampleKeyReplaceWithARealOne000 bob@example.com"

aegis_devops-0.2.1/src/aegis_core/_examples/signers.example.yaml.sig

@@ -0,0 +1,2 @@
+aegis-sig-v1
+e7b0ef862e5c7837f13ffcfe9d53bc710b73aecac64d3d801c0e9507155435fa

{aegis_devops-0.1.7 → aegis_devops-0.2.1}/src/aegis_core/_examples/sources/AEGIS-MANIFEST.sig

@@ -1,6 +1,6 @@
 {
   "files": {
-    "PRINCIPALS.yaml": "e2e7025a2092240acede6a88c7f1a4f22d3cdbf5821772fba9e0f91fbfcbcc8f",
+    "PRINCIPALS.yaml": "94a36ee80347de5ff022f103f9b1288a82d008351ce958d9a5764f1edda16ed5",
     "git-4001.json": "8be2dd6c37ef643b3bc375b15d5d97889b00456285f594e21a3b4d52521e21de",
     "git-6001.json": "6592ca4568f767d71a431490ff3cacdbc699ad92be966f57aed3b0a485844dc5",
     "git-6002.json": "e6286c5fb8a0d2b3c34ca0c841ccede2a477a02f4781115caf4650f4f7c019b8",
@@ -10,6 +10,7 @@
     "git-6006.json": "3f6fbfeb34afb3bcb8075f0864047b3641f0016b8817f67288db7f64afd36b58",
     "git-6007.json": "eb84394208274b79792e285c5143dde320a2f4755d9b2922ffb55df07e7c5b9e",
     "git-6008.json": "34d29df94b55a3fa29521246fa17e0966eda93f718a6c41082e6c648569aafa5",
+    "git-6009.json": "cadad3135121749b5dc1564e44dd2f97684782f2ebdb1cefbc6e08a319d88337",
     "git-789abc.json": "48ac500e13d36240ec5c72bf90e96b433a5873d636e9e36f99a73468e7fb5757",
     "git-abc123.json": "ee3751fdcd64cf1dd374bf9f7b73cda723a4aced5053f32501ba9416de89afc7",
     "git-bcd234.json": "a0de7b32bde75735c91504aa7156e7b2ba2ef961d0f439218507e40d0bdfd89a",
@@ -36,5 +37,5 @@
     "slack-perma-1.json": "2c8945a68e413c300ef58fc6a6d3daa8e4d0029a26a454dfad983e2091a188d1"
   },
   "header": "aegis-manifest-v1",
-  "sig": "034812f78b7f502ebcbb9183bfcf88023324ffcd83e82e5d698aee252cd3b824"
+  "sig": "5c28ed037b47840ab065c77c790d7a5807ac318a05ffa43393a3e6395d5f71e1"
 }

{aegis_devops-0.1.7 → aegis_devops-0.2.1}/src/aegis_core/_examples/sources/PRINCIPALS.yaml

@@ -37,3 +37,4 @@ principals:
   git-6006: admin
   git-6007: admin
   git-6008: admin
+  git-6009: admin

aegis_devops-0.2.1/src/aegis_core/_examples/sources/git-6009.json

@@ -0,0 +1,15 @@
+{
+  "provider": "kubernetes",
+  "resource_pattern": "*",
+  "actions": [
+    "impersonate"
+  ],
+  "scope": {},
+  "time_window": null,
+  "effect": "BLOCK",
+  "constraint_class": "configuration",
+  "principal": "admin",
+  "source_ref": "git-6009",
+  "source_timestamp": "2026-09-28T12:00:00+00:00",
+  "rule_text": "Block kubectl impersonation (--as, --as-group, --as-uid): the request would run as another identity, outside the controls on the agent's own."
+}

{aegis_devops-0.1.7 → aegis_devops-0.2.1}/src/aegis_core/cli.py

@@ -96,6 +96,7 @@ from aegis_core.environments import (
     resolve_current_context,
 )
 from aegis_core.gitsource import (
+    GIT_PREFIX,
     REPOS_FILE,
     SIGNERS_FILE,
     DispatchingSourceFetcher,
@@ -480,6 +481,13 @@ def _build_parser() -> argparse.ArgumentParser:
         "--out", default="aegis-signing.key", help="path to write the key to"
     )
 
+    sources_parser = subparsers.add_parser(
+        "sources",
+        help="Report every constraint's source verification: which transport (git, file), "
+        "the verified principal, or why it is quarantined; exit 1 if any is",
+    )
+    _add_common_options(sources_parser)
+
     hook_parser = subparsers.add_parser(
         "hook",
         help="Run as a coding agent's pre-tool hook: read its JSON payload on stdin, answer "
@@ -878,11 +886,12 @@ def _open_ledger(
     return ledger
 
 
-def _evaluate(intents: list[InfrastructureIntent], args: argparse.Namespace) -> int:
+def _load_policy(args: argparse.Namespace):
+    """Resolves the config, verifies and loads the authority map and the
+    constraint store (with file and git source verification). Returns
+    ``(store, authority_map, load, fetcher)``; shared by ``check`` and
+    ``sources``."""
     _resolve_config_paths(args)
-    now = _parse_now(args.now)
-    pretty = bool(args.pretty)
-
     if not os.path.exists(args.constraints):
         raise FileNotFoundError(2, "No such file or directory", args.constraints)
     key_warnings: list[str] = []
@@ -908,6 +917,13 @@ def _evaluate(intents: list[InfrastructureIntent], args: argparse.Namespace) ->
         "constraints",
     )
     store.warnings[:0] = key_warnings
+    return store, authority_map, load, fetcher
+
+
+def _evaluate(intents: list[InfrastructureIntent], args: argparse.Namespace) -> int:
+    now = _parse_now(args.now)
+    pretty = bool(args.pretty)
+    store, authority_map, load, _fetcher = _load_policy(args)
     plan_store = None
     if args.plan_constraints:
         plan_store = _load_or_data_error(
@@ -1076,9 +1092,59 @@ def _run_init(args: argparse.Namespace) -> int:
         f"  3. Replace the *.example.yaml files in {args.dir} with your own constraints.yaml / "
         "authority.yaml / ... (aegis prefers a real file over the .example one when both exist)"
     )
+    print(
+        "  4. Optional, rules backed by signed Git commits: copy repos.example.yaml and "
+        "signers.example.yaml to repos.yaml / signers.yaml (see docs/configuration.md), then "
+        "check them with: aegis sources --pretty"
+    )
     return 0
 
 
+def _transport(source_ref: str, fetcher) -> str:
+    if source_ref.startswith(GIT_PREFIX):
+        return "git"
+    has_file = fetcher is not None and getattr(fetcher, "file_fetcher", fetcher) is not None
+    return "file" if has_file else "unchecked"
+
+
+def _run_sources(args: argparse.Namespace) -> int:
+    """``aegis sources``: one line per constraint -- loaded (with the
+    principal its source verified) or quarantined (with the reason)."""
+    store, _authority, _load, fetcher = _load_policy(args)
+    rows = []
+    for c in store.constraints.values():
+        rows.append({"id": c.id, "status": "ok", "reason": None, "principal": c.principal,
+                     "transport": _transport(c.source_ref, fetcher),
+                     "source_ref": c.source_ref})
+    # Walk the quarantine log entry by entry, in order. Entries that parsed
+    # into a Constraint were appended to quarantined_constraints in the same
+    # order; "invalid: ..." entries (bad shape, duplicate id) never parsed.
+    # Matching by id instead would drop a duplicate-id entry whose id is
+    # also a loaded rule, and confuse two quarantined entries sharing an id.
+    parsed = iter(store.quarantined_constraints)
+    for q in store.health.quarantined:
+        c = None if q["reason"].startswith("invalid: ") else next(parsed, None)
+        rows.append({"id": q["id"], "status": "quarantined", "reason": q["reason"],
+                     "principal": None,
+                     "transport": _transport(c.source_ref, fetcher) if c else None,
+                     "source_ref": c.source_ref if c else None})
+    rows.sort(key=lambda r: (r["status"] != "quarantined", r["id"]))  # stable
+    if args.pretty:
+        for r in rows:
+            label = "OK" if r["status"] == "ok" else f"QUARANTINED ({r['reason']})"
+            print(f"{label:<44} {r['id']:<40} {r['principal'] or '-':<12} "
+                  f"{r['transport'] or '-':<9} {r['source_ref'] or ''}")
+        h = store.health
+        print(f"STORE: loaded={h.loaded} quarantined={len(h.quarantined)} "
+              f"principals={h.principals}")
+        for w in h.warnings:
+            print(f"  warning: {w}")
+    else:
+        for r in rows:
+            print(json.dumps(r))
+    return 1 if store.health.quarantined else 0
+
+
 def _run_keygen(args: argparse.Namespace) -> int:
     path = config_module.generate_signing_key(args.out)
     print(f"aegis: wrote signing key to {path}")
@@ -1095,6 +1161,8 @@ def _run(argv: list[str]) -> int:
         return _run_init(args)
     if args.command == "keygen":
         return _run_keygen(args)
+    if args.command == "sources":
+        return _run_sources(args)
     if args.command == "hook":
         return hook_module.main_hook(
             args.agent,

{aegis_devops-0.1.7 → aegis_devops-0.2.1}/src/aegis_core/gitsource.py

@@ -40,7 +40,7 @@ import shutil
 import subprocess
 import tempfile
 import time
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any
 
@@ -195,16 +195,36 @@ def load_repos(path: str | Path, *, key: bytes | None = None, insecure: bool = F
     return out
 
 
+_GPG_FPR_RE = re.compile(r"[0-9A-F]{40}")
+
+
+@dataclass
+class Signers:
+    """What ``signers.yaml`` trusts. ``ssh``: ``"<type> <base64>" ->
+    principal``; ``gpg``: primary-key fingerprint (40 hex, upper case) ->
+    principal, with ``gpg_keys`` the armored public keys to import."""
+
+    ssh: dict[str, str] = field(default_factory=dict)
+    gpg: dict[str, str] = field(default_factory=dict)
+    gpg_keys: list[str] = field(default_factory=list)
+
+    @property
+    def principals(self) -> set[str]:
+        return set(self.ssh.values()) | set(self.gpg.values())
+
+
 def load_signers(path: str | Path, *, key: bytes | None = None, insecure: bool = False,
-                 warnings: list[str] | None = None) -> dict[str, str]:
-    """``signers.yaml`` -> ``{"<ssh key type> <base64>": principal}``. A key
-    listed twice (under any principals) is a load error, not a guess."""
+                 warnings: list[str] | None = None) -> Signers:
+    """``signers.yaml`` -> :class:`Signers`. A key listed twice (under any
+    principals) is a load error, not a guess. GPG keys carry both the
+    armored public key and its fingerprint; the fingerprint is checked
+    against the key when it is imported."""
     path = Path(path)
     raw = _load_yaml_mapping(path, key, insecure, warnings if warnings is not None else [])
     entries = raw.get("signers")
     if not isinstance(entries, list) or not entries:
         raise ValueError(f"{path}: 'signers' must be a non-empty list")
-    out: dict[str, str] = {}
+    out = Signers()
     for entry in entries:
         if not isinstance(entry, dict):
             raise ValueError(f"{path}: every signer must be a mapping")
@@ -212,18 +232,34 @@ def load_signers(path: str | Path, *, key: bytes | None = None, insecure: bool =
         if not isinstance(principal, str) or not _PRINCIPAL_RE.fullmatch(principal):
             raise ValueError(f"{path}: invalid principal {principal!r}")
         for k in entry.get("keys") or []:
-            if not isinstance(k, dict) or k.get("type") != "ssh":
-                raise ValueError(
-                    f"{path}: {principal}: only 'type: ssh' keys are supported so far"
-                )
-            m = _SSH_KEY_RE.match(str(k.get("key", "")).strip())
-            if not m:
-                raise ValueError(f"{path}: {principal}: not an SSH public key: {k.get('key')!r}")
-            canonical = m.group(0)
-            if canonical in out:
-                raise ValueError(f"{path}: key listed twice ({out[canonical]} and {principal})")
-            out[canonical] = principal
-    if not out:
+            kind = k.get("type") if isinstance(k, dict) else None
+            if kind == "ssh":
+                m = _SSH_KEY_RE.match(str(k.get("key", "")).strip())
+                if not m:
+                    raise ValueError(
+                        f"{path}: {principal}: not an SSH public key: {k.get('key')!r}")
+                canonical = m.group(0)
+                if canonical in out.ssh:
+                    raise ValueError(
+                        f"{path}: key listed twice ({out.ssh[canonical]} and {principal})")
+                out.ssh[canonical] = principal
+            elif kind == "gpg":
+                fpr = re.sub(r"\s+", "", str(k.get("fingerprint", ""))).upper()
+                armored = str(k.get("key", ""))
+                if not _GPG_FPR_RE.fullmatch(fpr):
+                    raise ValueError(f"{path}: {principal}: a gpg key needs its full "
+                                     "40-hex primary fingerprint")
+                if "BEGIN PGP PUBLIC KEY BLOCK" not in armored:
+                    raise ValueError(f"{path}: {principal}: a gpg key needs its armored "
+                                     "public key in 'key'")
+                if fpr in out.gpg:
+                    raise ValueError(
+                        f"{path}: key listed twice ({out.gpg[fpr]} and {principal})")
+                out.gpg[fpr] = principal
+                out.gpg_keys.append(armored)
+            else:
+                raise ValueError(f"{path}: {principal}: key type must be 'ssh' or 'gpg'")
+    if not out.ssh and not out.gpg:
         raise ValueError(f"{path}: no keys")
     return out
 
@@ -244,11 +280,15 @@ class _Git:
     from the calling process could otherwise redirect it) and overrides
     for every setting that decides how signatures are verified."""
 
-    def __init__(self, repo: Path, allowed_signers: Path, empty_file: Path, home: Path):
+    def __init__(self, repo: Path, allowed_signers: Path, empty_file: Path, home: Path,
+                 gpg: str | None = None, gnupghome: Path | None = None):
         self.repo = repo
         self.git = _find("git")
         ssh_keygen = _find("ssh-keygen")
         false = shutil.which("false") or "/usr/bin/false"
+        # OpenPGP signatures are only checkable when signers.yaml lists gpg
+        # keys; the keyring is a private one holding exactly those keys
+        gpg_program = gpg or false
         self.env = {
             "PATH": os.pathsep.join(sorted({str(Path(self.git).parent),
                                              str(Path(ssh_keygen).parent), "/usr/bin", "/bin"})),
@@ -262,6 +302,8 @@ class _Git:
             # paths after "--" are literal, never ":(glob)"-style pathspec magic
             "GIT_LITERAL_PATHSPECS": "1",
         }
+        if gnupghome is not None:
+            self.env["GNUPGHOME"] = str(gnupghome)
         self.overrides = [
             f"safe.directory={repo}",
             "core.hooksPath=" + os.devnull,
@@ -273,8 +315,8 @@ class _Git:
             f"gpg.ssh.program={ssh_keygen}",
             f"gpg.ssh.allowedSignersFile={allowed_signers}",
             f"gpg.ssh.revocationFile={empty_file}",
-            f"gpg.program={false}",
-            f"gpg.openpgp.program={false}",
+            f"gpg.program={gpg_program}",
+            f"gpg.openpgp.program={gpg_program}",
             f"gpg.x509.program={false}",
             "log.showSignature=false",
         ]
@@ -295,6 +337,43 @@ class _Git:
 # --- the fetcher ------------------------------------------------------------------
 
 
+def _import_gpg_keys(gpg: str, home: Path, signers: Signers) -> None:
+    """Imports exactly the listed public keys into a private keyring and
+    marks them trusted (so git reports a good signature as ``G``). A key
+    block that holds any key other than the listed fingerprints is a load
+    error: the keyring must contain nothing else."""
+    env = {"GNUPGHOME": str(home), "PATH": os.environ.get("PATH", "/usr/bin:/bin"),
+           "LC_ALL": "C"}
+    base = [gpg, "--batch", "--no-tty", "--no-autostart", "--homedir", str(home)]
+    for armored in signers.gpg_keys:
+        subprocess.run([*base, "--import"], input=armored, text=True, env=env,
+                       capture_output=True, check=True, timeout=60)
+    listing = subprocess.run([*base, "--with-colons", "--fingerprint", "--list-keys"],
+                             env=env, capture_output=True, text=True, check=True,
+                             timeout=60).stdout
+    primaries, expect_fpr = set(), False
+    for line in listing.splitlines():
+        rec = line.split(":")
+        if rec[0] == "pub":
+            expect_fpr = True
+        elif rec[0] == "fpr" and expect_fpr:
+            primaries.add(rec[9].upper())
+            expect_fpr = False
+        elif rec[0] == "sub":
+            expect_fpr = False
+    if primaries != set(signers.gpg):
+        missing = set(signers.gpg) - primaries
+        extra = primaries - set(signers.gpg)
+        raise ValueError(
+            "signers.yaml: gpg keys do not match their fingerprints"
+            + (f"; missing {sorted(missing)}" if missing else "")
+            + (f"; unexpected {sorted(extra)}" if extra else "")
+        )
+    trust = "".join(f"{fpr}:6:\n" for fpr in signers.gpg)
+    subprocess.run([*base, "--import-ownertrust"], input=trust, text=True, env=env,
+                   capture_output=True, check=True, timeout=60)
+
+
 class GitSourceFetcher:
     """``SourceFetcher`` for ``git:`` references (see the module docstring).
 
@@ -306,12 +385,14 @@ class GitSourceFetcher:
     def __init__(
         self,
         repos: dict[str, RepoConfig],
-        signers: dict[str, str],
+        signers: Signers | dict[str, str],
         *,
         max_source_age: float | None = None,
         now: float | None = None,
     ):
         self.repos = repos
+        if isinstance(signers, dict):  # SSH keys only
+            signers = Signers(ssh=dict(signers))
         self.signers = signers
         self.max_source_age = max_source_age
         self.warnings: list[str] = []
@@ -320,13 +401,20 @@ class GitSourceFetcher:
         allowed = tmp / "allowed_signers"
         # principals are validated to [A-Za-z0-9_.@-], so no quoting needed
         allowed.write_text("".join(
-            f'{principal} namespaces="git" {k}\n' for k, principal in signers.items()
+            f'{principal} namespaces="git" {k}\n' for k, principal in signers.ssh.items()
         ))
         empty = tmp / "revoked"
         empty.write_text("")
         (tmp / "home").mkdir()
+        gpg, gnupghome = None, None
+        if signers.gpg:
+            gpg = _find("gpg")
+            gnupghome = tmp / "gnupg"
+            gnupghome.mkdir(mode=0o700)
+            _import_gpg_keys(gpg, gnupghome, signers)
         self._git = {
-            rid: _Git(cfg.path, allowed, empty, tmp / "home") for rid, cfg in repos.items()
+            rid: _Git(cfg.path, allowed, empty, tmp / "home", gpg, gnupghome)
+            for rid, cfg in repos.items()
         }
         self._stale: set[str] = set()
         self._principals: dict[str, str] = {}
@@ -385,6 +473,21 @@ class GitSourceFetcher:
             raise SourceRejected("unknown-commit", f"{sha}: unreadable commit header")
         return tree, parents
 
+    @staticmethod
+    def _signature_type(git: _Git, sha: str) -> str | None:
+        """``"ssh"``, ``"gpg"``, ``"other"`` or ``None`` (unsigned), from the
+        ``gpgsig`` header of the raw commit object."""
+        for line in git.run("cat-file", "commit", sha).split("\n"):
+            if not line:
+                return None  # end of headers, no signature
+            if line.startswith("gpgsig ") or line.startswith("gpgsig-sha256 "):
+                if "BEGIN SSH SIGNATURE" in line:
+                    return "ssh"
+                if "BEGIN PGP SIGNATURE" in line:
+                    return "gpg"
+                return "other"
+        return None
+
     @staticmethod
     def _is_ancestor(git: _Git, sha: str, ref: str) -> bool:
         try:
@@ -421,13 +524,27 @@ class GitSourceFetcher:
         if kind != "commit":
             raise SourceRejected("unknown-commit", ref.sha)
 
-        # 1. the signature, verified against signers.yaml only
-        status, _, signer = git.run("log", "-1", "--format=%G?%x00%GS", ref.sha).strip().partition(
-            "\x00")
-        if status == "N":
+        # 1. the signature, verified against signers.yaml only. Its type is
+        #    read from the commit object; SSH signers are named by the
+        #    allowed-signers file we wrote, OpenPGP ones by the primary-key
+        #    fingerprint of a key in our private keyring.
+        sig_type = self._signature_type(git, ref.sha)
+        fields = git.run("log", "-1", "--format=%G?%x00%GS%x00%GP%x00%GF", ref.sha).strip()
+        status, signer, primary, subkey = (fields.split("\x00") + ["", "", ""])[:4]
+        if status == "N" or sig_type is None:
             raise SourceRejected("unsigned-source", ref.sha)
-        if status != "G" or signer not in set(self.signers.values()):
+        if status != "G":
             raise SourceRejected("unknown-signer", f"{ref.sha} status {status}")
+        if sig_type == "ssh":
+            principal = signer if signer in set(self.signers.ssh.values()) else None
+        elif sig_type == "gpg":
+            principal = self.signers.gpg.get(primary.upper()) or self.signers.gpg.get(
+                subkey.upper())
+        else:
+            principal = None
+        if principal is None:
+            raise SourceRejected("unknown-signer", f"{ref.sha} ({sig_type})")
+        signer = principal
 
         # 2. the commit added or changed the rule's file (first-parent diff).
         #    Tree and parents are read from the signed commit object itself,

{aegis_devops-0.1.7 → aegis_devops-0.2.1}/src/aegis_core/interceptor.py

@@ -120,6 +120,16 @@ class AegisInterceptor:
         self.fail_closed = fail_closed
         self.on_untrusted_match = on_untrusted_match
 
+    def _untrusted_reason(self, c: Constraint) -> str | None:
+        """``"tampered"`` / ``"unauthorized"`` if this constraint may not
+        vote, else ``None`` (re-checked per decision; see REVIEW-4 L4
+        below)."""
+        if not c.verify_integrity():
+            return "tampered"
+        if not self.store.is_authorized(c.principal, c.constraint_class):
+            return "unauthorized"
+        return None
+
     def intercept(self, intent: InfrastructureIntent, now: datetime | None = None) -> Decision:
         """Evaluates an intent and returns a Decision.
 
@@ -167,12 +177,22 @@ class AegisInterceptor:
         notes: list[str] = []
         fail_closed = False
         verified = []
-        for c in env_unresolved:
-            fail_closed = True
-            notes.append(f"env-unresolved: {c.id}")
-        for c in time_window_unresolved:
+        # An unresolved condition only fails closed on behalf of a constraint
+        # that could vote: a tampered or unauthorized one is discarded here
+        # exactly as it is when it matches outright (below), so it cannot
+        # force ESCALATE just because the intent's environment or time zone
+        # could not be resolved.
+        for c, label in [*((c, "env-unresolved") for c in env_unresolved),
+                         *((c, "time-window-unresolved") for c in time_window_unresolved)]:
+            reason = self._untrusted_reason(c)
+            if reason is not None:
+                discarded.append({"id": c.id, "reason": reason})
+                if c.effect in _ENFORCING_EFFECTS and self.on_untrusted_match == "escalate":
+                    fail_closed = True
+                    notes.append(f"fail-closed: {c.id} ({reason})")
+                continue
             fail_closed = True
-            notes.append(f"time-window-unresolved: {c.id}")
+            notes.append(f"{label}: {c.id}")
         if unknown_target:
             fail_closed = True
             notes.append("unknown-target")
@@ -193,11 +213,7 @@ class AegisInterceptor:
             # rule, not per loaded rule -- see get_matching_constraints'
             # index), so we pay it on every decision instead of trusting a
             # verification result that may be stale by the time it matters.
-            reason = None
-            if not c.verify_integrity():
-                reason = "tampered"
-            elif not self.store.is_authorized(c.principal, c.constraint_class):
-                reason = "unauthorized"
+            reason = self._untrusted_reason(c)
             if reason is not None:
                 discarded.append({"id": c.id, "reason": reason})
                 if c.effect in _ENFORCING_EFFECTS and self.on_untrusted_match == "escalate":