capauth 0.3.12__tar.gz → 0.3.14__tar.gz

{capauth-0.3.12 → capauth-0.3.14}/.github/workflows/ci.yml

@@ -37,11 +37,16 @@ jobs:
       # `import skcapstone` succeeds without it while
       # `from skcapstone.coordination import Board` does not. --no-deps means we
       # have to name it ourselves.
+      # skcapstone requires Python 3.11+, capauth supports 3.10: on 3.10 the
+      # integration tests skip (pytest.importorskip); on 3.11+ the import is
+      # asserted here so those tests can never skip silently.
       - name: Install skcapstone (optional integration backbone) from source
+        if: matrix.python-version != '3.10'
         run: |
           pip install --no-deps --no-cache-dir \
             "skcapstone @ git+https://github.com/smilinTux/skcapstone" \
             "skcoord @ git+https://github.com/smilinTux/skcoord"
+          python -c "from skcapstone.scheduler_jobs import load_jobs_with_dropins"
       - name: Run tests with coverage
         run: python -m pytest tests/ -v --tb=short --cov=capauth --cov-report=xml --cov-report=term-missing
       - name: Upload coverage

capauth-0.3.14/.github/workflows/image.yml

@@ -0,0 +1,90 @@
+name: Container image
+
+# Publishes the CapAuth service image (the OIDC IdP and verify service) for a
+# release tag as ghcr.io/smilintux/capauth:<version>, and records its digest.
+# Consumers pin <version>@sha256:<digest> (SKStacks sksso.CAPAUTH_IMAGE refuses
+# anything else). A published version is never overwritten.
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Existing release tag to (re)build if its image is missing, e.g. v0.3.13"
+        required: true
+
+permissions:
+  contents: read
+  packages: write
+
+concurrency:
+  group: image-${{ inputs.tag || github.ref }}
+  cancel-in-progress: false
+
+env:
+  IMAGE: ghcr.io/smilintux/capauth
+
+jobs:
+  image:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag || github.ref }}
+          fetch-depth: 0
+          fetch-tags: true
+      - name: Resolve the version and refuse a tag that is not on main
+        id: v
+        env:
+          TAG: ${{ inputs.tag || github.ref_name }}
+        run: |
+          set -euo pipefail
+          case "$TAG" in v[0-9]*.[0-9]*.[0-9]*) ;; *) echo "::error::not a release tag: $TAG"; exit 1 ;; esac
+          version="${TAG#v}"
+          if ! [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::error::not a release version: $version"; exit 1
+          fi
+          git fetch --no-tags origin main:refs/remotes/origin/main
+          sha="$(git rev-parse "refs/tags/$TAG^{commit}")"
+          git merge-base --is-ancestor "$sha" refs/remotes/origin/main || {
+            echo "::error::$TAG ($sha) is not on main"; exit 1; }
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "sha=$sha" >> "$GITHUB_OUTPUT"
+      - name: Log in to ghcr.io
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: echo "$TOKEN" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
+      - name: Refuse to overwrite a published version
+        run: |
+          if docker manifest inspect "$IMAGE:${{ steps.v.outputs.version }}" >/dev/null 2>&1; then
+            echo "::error::$IMAGE:${{ steps.v.outputs.version }} already exists; versions are immutable"
+            exit 1
+          fi
+      - name: Build
+        run: |
+          docker build \
+            --build-arg CAPAUTH_VERSION="${{ steps.v.outputs.version }}" \
+            --label org.opencontainers.image.source="https://github.com/${{ github.repository }}" \
+            --label org.opencontainers.image.revision="${{ steps.v.outputs.sha }}" \
+            --label org.opencontainers.image.version="${{ steps.v.outputs.version }}" \
+            -t "$IMAGE:${{ steps.v.outputs.version }}" .
+      - name: Smoke test (version, service answers)
+        run: |
+          set -euo pipefail
+          v="${{ steps.v.outputs.version }}"
+          docker run --rm "$IMAGE:$v" capauth --version | tee /dev/stderr | grep -F "$v"
+          docker run -d --name smoke -p 18420:8420 "$IMAGE:$v"
+          for i in $(seq 1 30); do
+            curl -fsS http://127.0.0.1:18420/capauth/v1/status >/dev/null && break
+            sleep 2
+          done
+          curl -fsS http://127.0.0.1:18420/capauth/v1/status >/dev/null
+          docker rm -f smoke
+      - name: Push and record the digest
+        run: |
+          set -euo pipefail
+          v="${{ steps.v.outputs.version }}"
+          docker push "$IMAGE:$v"
+          ref="$(docker inspect --format '{{index .RepoDigests 0}}' "$IMAGE:$v")"
+          echo "Pinned reference: \`$IMAGE:$v@${ref#*@}\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "pinned: $IMAGE:$v@${ref#*@}"

capauth-0.3.14/AGENTS.md

@@ -0,0 +1,99 @@
+# AGENTS.md (capauth)
+
+CapAuth: PGP-based sovereign identity and authentication for the SK stack (Python library, `capauth`
+CLI and FastAPI verification service). Overview: [README.md](./README.md). Operations:
+[SOP.md](./SOP.md). Architecture: [ARCHITECTURE.md](./ARCHITECTURE.md). This file follows
+[AGENT_INSTRUCTIONS_STANDARD](https://github.com/smilinTux/sk-standards/blob/main/standards/AGENT_INSTRUCTIONS_STANDARD.md).
+There is no `CLAUDE.md` or `.cursorrules`: every agent reads this file.
+
+## Source of truth and invariants
+
+- **CapAuth owns the one canonical agent identity resolver**, `resolve_agent_identity` in
+  `src/capauth/agent_identity.py` (re-exported from `capauth`). skchat, skcomms, skmemory and
+  skcapstone delegate to it; never reimplement identity logic elsewhere. It returns a dual URI:
+  `capauth_uri` (`capauth:<agent>@<domain>`, the wire identity, always derivable) and `fqid`
+  (`<agent>@<operator>.<realm>`, read from `~/.skcapstone/cluster.json`).
+- **Operator vs agents:** the shared `~/.skcapstone/identity/identity.json` holds the operator
+  identity (`role: operator`); each agent's wire identity resolves per agent. No identity carries an
+  `@capauth.local` placeholder (`skcapstone doctor` `identity:*` checks).
+- **DID documents, three tiers** (`src/capauth/did.py`): `did:key` (self-contained), mesh-private
+  `did:web`, and public `did:web` (minimal: key, name, org). `from_profile()` reads only
+  `public_key_armor`; a private key is never touched; no tailnet IPs and no `memory`, `journal` or
+  detailed `soul` fields appear in any document; the public tier respects
+  `publish_to_skworld: false` in `~/.capauth/config.yaml`.
+- **Crypto goes through a backend**, never hand-rolled primitives: `src/capauth/crypto/`
+  (`pgpy_backend.py`, `gnupg_backend.py`, `sequoia_backend.py`). Only `sequoia_backend.py` (the `sq`
+  CLI) can sign post-quantum; GnuPG is signing-disqualified for PQC. Hybrid combiners are HKDF over
+  both shared secrets, never XOR and never pure PQ.
+- **The live root identity is still classical.** PQC root migration is additive-first and
+  reversible, gated on a root-rotation ceremony (epic `PQC-MIGRATION`). Do not claim a PQC root.
+  Per-surface status: [docs/CRYPTO_SPEC.md](./docs/CRYPTO_SPEC.md).
+
+## Commands
+
+CI: `.github/workflows/ci.yml` (test on 3.10 to 3.12, lint, build), `pytest.yml`, `secret-scan.yml`,
+`docs-check.yml` (sk-standards gate, tiers 1 to 3).
+
+```bash
+pip install -e ".[dev,service]"
+python -m pytest tests/ -v --tb=short --cov=capauth             # CI test
+pip install "ruff==0.15.4"
+ruff format --check src/ tests/                                  # CI lint, step 1
+ruff check src/                                                  # CI lint, step 2
+python -m build && twine check dist/*                            # CI build
+scripts/gitleaks-scope.sh full                                   # CI secret scan
+```
+
+On 3.11+ CI also installs `skcapstone` and `skcoord` from git with `--no-deps` so
+`tests/test_integration.py` runs instead of skipping; skcapstone is an optional backbone, never a
+dependency (skcapstone depends on capauth, not the other way round). Ruff config is in
+`pyproject.toml` (line length 99, rules `E,F,I,N,W`, `E501` ignored).
+
+## Start here
+
+1. `src/capauth/cli.py`: every `capauth` command.
+2. `src/capauth/agent_identity.py`: the unified identity resolver.
+3. `src/capauth/identity.py` and `src/capauth/did.py`: challenge-response and DID generation.
+4. `src/capauth/crypto/`: the crypto backends.
+5. `src/capauth/service/`: the FastAPI service (`app.py`, `server.py`, `keystore.py`).
+
+## Rules
+
+- **Writing style:** no em dashes (U+2014) and no en dashes (U+2013) anywhere: code, comments,
+  docs, commits, PR bodies. Use commas, parentheses, colons or a new sentence. Hyphens are fine.
+- **Branch and commit:** never commit to `main`. Branch, commit as soon as a fast check passes and
+  before the full suite, then open a PR. Add an `## [Unreleased]` entry to
+  [CHANGELOG.md](./CHANGELOG.md) for any user-visible change.
+- **Attribution:** a `Co-Authored-By` trailer names the agent that actually did the work, or is
+  left out. Never one you cannot evidence.
+- **Code style:** Python 3.11+ for new code (the package still supports 3.10), type hints, pydantic
+  models, Google-style docstrings, at most 500 lines per file. Tests in `tests/` cover happy path,
+  edge case and failure.
+- **Coordination:** run `skcapstone coord briefing` at the start of a session; claim work with
+  `skcapstone coord claim <id> --agent <you>`. SK packages install into `~/.skenv/`.
+- **Generated files:** none checked in; build artefacts come from `python -m build`.
+
+## Privacy
+
+This repo is public. Never put host names, LAN or tailnet IPs, estate names, personal names or data,
+real key fingerprints, private keys or credentials in code, docs, tests, fixtures or commits.
+Enforced by `secret-scan.yml` (`scripts/gitleaks-scope.sh`) and, for
+DID output, by the invariants in `did.py`; the rest is on review.
+
+## Hazards
+
+- **Environment-gated tests:** `pytest.yml` ignores `tests/test_integration.py` and deselects a few
+  Sequoia and QR-login tests that need tools CI lacks. A green `pytest.yml` is not the full suite;
+  `ci.yml` is.
+- **No `capauth did` CLI group:** the identity card is a library and MCP surface (see SOP section 7).
+- **Stray tracked files:** `ruff-0.15.4-*.whl` and `urllib.error` at the repo root are accidental
+  commits, not inputs; do not depend on them or add more like them.
+
+## See also
+
+- [skcapstone](https://github.com/smilinTux/skcapstone): agent framework, coordination board,
+  `skcapstone doctor`.
+- [skcomms](https://github.com/smilinTux/skcomms) and [skchat](https://github.com/smilinTux/skchat):
+  consumers of the identity resolver.
+- [sk-standards](https://github.com/smilinTux/sk-standards): `CRYPTOGRAPHY_STANDARD`,
+  `SK_REPO_DOC_STANDARD`, `AGENT_INSTRUCTIONS_STANDARD`.

{capauth-0.3.12 → capauth-0.3.14}/CHANGELOG.md

@@ -6,6 +6,47 @@ All notable changes to `capauth` are documented here. The format is based on
 
 ## [Unreleased]
 
+- Agent instructions live in one file, `AGENTS.md`, reshaped to the sk-standards
+  AGENT_INSTRUCTIONS_STANDARD. `CLAUDE.md` and `.cursorrules` are removed (Claude Code reads
+  `AGENTS.md` natively and skips it when a `CLAUDE.md` sits next to it).
+
+- OIDC login asks for the vault passphrase in a masked in-page dialog instead of
+  a browser `prompt()`, which showed the passphrase as it was typed.
+
+- Service discovery no longer invents a nonexistent CapAuth PID file. Without
+  an explicit daemon-owned PID path, health remains unknown.
+
+- Release tags (`v*`) now also publish the service image
+  `ghcr.io/smilintux/capauth:<version>` (`.github/workflows/image.yml`): the
+  tag must be on main, a published version is never overwritten, the image is
+  smoke-tested (`capauth --version`, `/capauth/v1/status`) before the push,
+  and the job summary records the digest to pin (`<version>@sha256:...`).
+
+- `capauth sign-challenge`: reads the CapAuth login challenge from the
+  clipboard (or `--stdin`), refuses anything that is not a complete
+  `CAPAUTH_NONCE_V1`/`V2` challenge, signs it with gpg (gpg-agent's pinentry
+  asks for the passphrase; the tool never handles it) and puts the armored
+  signature back on the clipboard (or `--stdout`), printing only
+  `signed, paste it now`. Key: `--key`, `$CAPAUTH_SIGN_KEY`, or the profile.
+  The OIDC login page gains a "Paste signature and continue" button, names
+  the command in its steps and remembers the fingerprint of the last manual
+  login, so a repeat login is copy, sign, paste. Docs: `docs/SIGN_CHALLENGE.md`.
+
+- Service image builds from a plain checkout again: the Dockerfile takes
+  `--build-arg CAPAUTH_VERSION=<version>` (default `0.0.0+docker`) for
+  setuptools-scm, because `.dockerignore` keeps `.git` out of the context.
+
+- OIDC IdP: a static client may set `require_nonce: false` so stock
+  Authentik's OAuth source, which never sends an OIDC `nonce`, can use the
+  authorization code flow. State, PKCE S256 and the confidential client secret
+  stay mandatory; the default is unchanged (nonce required), and a nonce that
+  is sent must still be well formed.
+
+- CI: green on main again. `ruff format` (pinned 0.15.4) applied to
+  `tests/test_backup_fallback.py`; the Python 3.10 job no longer installs
+  skcapstone (it requires 3.11+), and the skcapstone integration tests skip
+  there while 3.11+ asserts the import so they cannot skip silently.
+
 - Raise operator proof absolute and idle ceilings to 24 hours while keeping
   access capabilities bounded to five minutes (card `4af0ae7f`).
 
@@ -542,6 +583,7 @@ All notable changes to `capauth` are documented here. The format is based on
 
 ### Security
 
+- Raised `python-multipart` to `>=0.0.31`, `PyJWT` to `>=2.15.0` and `zeroconf` to `>=0.149.16` to clear the 2026-11-13 dependency sweep findings.
 - **Revoked / expired signing-key rejection**: the `pgpy` and `gnupg` verify
   paths now reject a signing key that carries a revocation signature or is expired
   **before** the signature check (`KeyRevokedError` / `KeyExpiredError`), closing

{capauth-0.3.12 → capauth-0.3.14}/Dockerfile

@@ -16,6 +16,10 @@ COPY src/ ./src/
 # resolves these relative to the package root → /app/phone-signer.
 COPY phone-signer/ ./phone-signer/
 
+# The build context has no .git (.dockerignore), so setuptools-scm cannot
+# derive a version: pass one with --build-arg CAPAUTH_VERSION=<version>.
+ARG CAPAUTH_VERSION=0.0.0+docker
+ENV SETUPTOOLS_SCM_PRETEND_VERSION=${CAPAUTH_VERSION}
 RUN pip install --no-cache-dir -e ".[service]"
 RUN pip install --no-cache-dir python-multipart>=0.0.6
 

{capauth-0.3.12 → capauth-0.3.14}/Dockerfile.authentik-capauth

@@ -4,16 +4,26 @@
 #
 #  Build:
 #    docker build -f Dockerfile.authentik-capauth \
-#      -t ghcr.io/smilintux/authentik-capauth:2026.5.3 \
-#      -t ghcr.io/smilintux/authentik-capauth:latest .
+#      -t skgit.skstack01.douno.it/skadmin/authentik-capauth:2025.12.6 \
+#      -t skgit.skstack01.douno.it/skadmin/authentik-capauth:latest .
 #
 #  Push:
-#    docker push ghcr.io/smilintux/authentik-capauth:2026.5.3
-#    docker push ghcr.io/smilintux/authentik-capauth:latest
+#    docker push skgit.skstack01.douno.it/skadmin/authentik-capauth:2025.12.6
+#    docker push skgit.skstack01.douno.it/skadmin/authentik-capauth:latest
 #
 #  AK_VERSION tracks the latest STABLE Authentik release (override with --build-arg).
+#
+#  2026-10-23 (Chef decision, tactical patch): pinned to 2025.12.6, the latest
+#  2025.12.x patch, same major line as nor prod's running 2025.12.3. This is the
+#  SAME-LINE security patch (fixes GHSA-xp7f-xjjx-gwm8 Critical SourceStage bypass
+#  and GHSA-c3m2-jqmq-pvp3 SAML XML signature wrapping), not the full 2026.8.5
+#  migration. The 2025.12.x line does not receive the later privilege-escalation
+#  (GHSA-h6c5-mpvq-j4jc) or SAML-DoS (GHSA-cxwx-9x59-28qm) backports -- those land
+#  only with the full upgrade (see docs/AUTHENTIK_STRATEGY_DECISION.md, option b,
+#  decision 2026-10-23: retire this fork for CAPAUTH_ENABLED on stock Authentik as
+#  part of that upgrade).
 # ──────────────────────────────────────────────────────────────────────
-ARG AK_VERSION=2026.5.3
+ARG AK_VERSION=2025.12.6
 
 # ── Stage 1: Rebuild Authentik frontend with ak-stage-capauth ────────
 FROM node:24-bookworm AS web-builder
@@ -60,6 +70,13 @@ USER root
 # instead of hardcoding it — otherwise capauth lands on the wrong path and Django can't import
 # it (ModuleNotFoundError: capauth, live-proven on .13 against 2026.5.3).
 COPY . /app/capauth
+# capauth's pyproject.toml uses setuptools_scm (dynamic version from git tags),
+# but .dockerignore excludes .git from the build context, so `pip install
+# /app/capauth` cannot infer a version and fails with "setuptools-scm was
+# unable to detect version" (hit rebuilding this image 2026-10-23, unrelated
+# to the AK_VERSION bump -- would fail the same way at any Authentik version
+# until this is set). Pin it explicitly to the latest released tag.
+ENV SETUPTOOLS_SCM_PRETEND_VERSION_FOR_CAPAUTH=0.3.13
 RUN VENV_SP="$(ls -d /ak-root/.venv/lib/python3.*/site-packages | head -1)" && \
     echo "Installing capauth into $VENV_SP" && \
     pip install --no-cache-dir --no-deps --target "$VENV_SP" /app/capauth && \

{capauth-0.3.12/src/capauth.egg-info → capauth-0.3.14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: capauth
-Version: 0.3.12
+Version: 0.3.14
 Summary: Capability-based Authentication — decentralized, PGP-based identity and authorization
 Author-email: smilinTux <admin@smilintux.org>
 License: GPL-3.0-or-later
@@ -37,8 +37,8 @@ Requires-Dist: python-gnupg>=0.5; extra == "gnupg"
 Provides-Extra: service
 Requires-Dist: fastapi>=0.110; extra == "service"
 Requires-Dist: uvicorn[standard]>=0.27; extra == "service"
-Requires-Dist: python-multipart>=0.0.6; extra == "service"
-Requires-Dist: PyJWT>=2.8; extra == "service"
+Requires-Dist: python-multipart>=0.0.31; extra == "service"
+Requires-Dist: PyJWT>=2.15.0; extra == "service"
 Requires-Dist: python-gnupg>=0.5; extra == "service"
 Requires-Dist: httpx>=0.25; extra == "service"
 Requires-Dist: segno>=1.6; extra == "service"
@@ -53,7 +53,7 @@ Requires-Dist: fastapi>=0.110; extra == "dev"
 Requires-Dist: python-gnupg>=0.5; extra == "dev"
 Requires-Dist: black>=24.0; extra == "dev"
 Requires-Dist: ruff>=0.3; extra == "dev"
-Requires-Dist: zeroconf>=0.38; extra == "dev"
+Requires-Dist: zeroconf>=0.149.16; extra == "dev"
 Requires-Dist: webauthn>=2.0; extra == "dev"
 Requires-Dist: soft-webauthn>=0.1; extra == "dev"
 Requires-Dist: pywebpush>=1.14; extra == "dev"
@@ -254,6 +254,7 @@ capauth pqc-report                           # live PQC posture per surface
 
 # Auth & integration
 capauth login <service_url> [--no-claims]    # passwordless PGP login (caches OIDC token)
+capauth sign-challenge                        # sign the copied browser login challenge, paste the result
 capauth setup forgejo --capauth-url <url>    # generate Forgejo OIDC app.ini block
 
 # Mesh & membership
@@ -294,6 +295,7 @@ rides in the payload `event` field so routing stays severity-based.
 | **[Integration Blueprint](docs/INTEGRATION_BLUEPRINT.md)** | third-party integration guide |
 | **[Cold-Machine Bootstrap & DR](docs/COLD_MACHINE_BOOTSTRAP_AND_DR.md)** | standing capauth back up on a blank box + disaster recovery: the restore-not-regenerate rule, the ordered restore chain, and the operator checklist |
 | **[authentik-capauth](docs/authentik-capauth.md)** | the custom Authentik image with the CapAuth PGP stage baked in — build (`AK_VERSION`, version-agnostic venv install, frontend rebuild), SKStacks deploy + `lifecycle.migrate` override, and the four build/migrate gotchas |
+| **[Sign a login: copy, sign, paste](docs/SIGN_CHALLENGE.md)** | `capauth sign-challenge`: the four-step browser login with your gpg key, one-time setup, desktop shortcut |
 | **[AI Advocate](AI-ADVOCATE.md)** | how AI advocates manage a sovereign profile on your behalf |
 
 ## Why it matters

{capauth-0.3.12 → capauth-0.3.14}/README.md

@@ -191,6 +191,7 @@ capauth pqc-report                           # live PQC posture per surface
 
 # Auth & integration
 capauth login <service_url> [--no-claims]    # passwordless PGP login (caches OIDC token)
+capauth sign-challenge                        # sign the copied browser login challenge, paste the result
 capauth setup forgejo --capauth-url <url>    # generate Forgejo OIDC app.ini block
 
 # Mesh & membership
@@ -231,6 +232,7 @@ rides in the payload `event` field so routing stays severity-based.
 | **[Integration Blueprint](docs/INTEGRATION_BLUEPRINT.md)** | third-party integration guide |
 | **[Cold-Machine Bootstrap & DR](docs/COLD_MACHINE_BOOTSTRAP_AND_DR.md)** | standing capauth back up on a blank box + disaster recovery: the restore-not-regenerate rule, the ordered restore chain, and the operator checklist |
 | **[authentik-capauth](docs/authentik-capauth.md)** | the custom Authentik image with the CapAuth PGP stage baked in — build (`AK_VERSION`, version-agnostic venv install, frontend rebuild), SKStacks deploy + `lifecycle.migrate` override, and the four build/migrate gotchas |
+| **[Sign a login: copy, sign, paste](docs/SIGN_CHALLENGE.md)** | `capauth sign-challenge`: the four-step browser login with your gpg key, one-time setup, desktop shortcut |
 | **[AI Advocate](AI-ADVOCATE.md)** | how AI advocates manage a sovereign profile on your behalf |
 
 ## Why it matters