feat(identity): record identity/ownership verifiable claims - #2125
Draft
ramizpolic wants to merge 3 commits into
Draft
ramizpolic wants to merge 3 commits into
ramizpolic wants to merge 3 commits into
Conversation
…ntity.v1) Introduces IdentityClaim/OwnershipClaim proto messages and IdentityService (GetIdentityStatus, Resolve), plus the api/identity/v1 Go package: claim construction, detached-JWS signing/verification (ES256/ES384/EdDSA/RS256, mandatory SPIFFE trust bundles), and OCI referrer marshaling. Adds Record.GetIdentity/GetOwner/GetIdentityType/GetOwnerType annotation accessors and Record.GetDigest (sha256:hex form, for OCI/ai-catalog.io interop). Registers the two new referrer types in the CEL validator allowlist, and adds identity/owner search query types.
…tion Adds server/identity: a Resolver registry plus dns/, did/, wellknown/, and spiffe/ implementations that verify a claim's detached JWS against a resolved public key (DNS TXT record, DID document, .well-known JWKS, or a mandatory per-trust-domain SPIFFE CA bundle — no silent fallback). Adds the SSRF-safe utils/safefetch HTTP client (https-only, blocks private/loopback/link-local/metadata addresses, re-checked post-DNS-resolve to close the rebinding window) used by the dns/wellknown/did resolvers. Adds server/database/gorm's claims table (one row per record_cid + role, composite unique index) replacing the old identity_claims/ownership_claims split, with search filters (WithIdentities/WithOwners/*Verified) and record-association preloading. Wires eager claim verification into the ingest path and identity config into server startup.
…ication task Adds client.SignAndAttachIdentityClaim/OwnershipClaim, GetIdentityStatus(ByName), and ResolveIdentity to the Go SDK. Adds `dirctl identity claim/status/resolve` and identity/owner search flags (--identity, --owner, --identity-verified, --owner-verified) to `dirctl search`. Adds reconciler/tasks/identity: periodically re-verifies identity/ownership claim referrers (catching key rotation, expiry, and revoked SPIFFE trust bundles that eager ingest-time verification can't observe later). Updates the trust-model, records-validation, Go SDK, and skill-reference docs for the new identity/ownership claim model. This PR is purely additive: naming.v1 (NamingServiceClient, its DB API, CLI, and reconciler task) is left fully intact and untouched. The new identity resolve method is named ResolveIdentity (not Resolve) specifically to avoid colliding with naming.v1's existing Client.Resolve; a couple of other naming-clashes (a duplicated expandNameWithProtocols helper, the DatabaseAPI interface embed) were resolved the same way, by renaming/re-adding rather than removing anything. naming.v1's removal is a separate follow-up PR.
Contributor
|
The latest Buf updates on your PR. Results from workflow Buf CI / verify-proto (pull_request).
|
4 tasks
This was referenced Sep 14, 2026
|
Do we have any ETA when this will merge? |
This was referenced Sep 22, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a verifiable identity/ownership claim system for OASF records (identity.v1), purely additive — naming.v1 is left fully intact and untouched in this PR (removed in a follow-up stacked PR).
IdentityClaim/OwnershipClaimmessages,IdentityService(GetIdentityStatus,Resolve), and theapi/identity/v1Go package: claim construction, detached-JWS signing/verification (ES256/ES384/EdDSA/RS256), mandatory per-trust-domain SPIFFE trust bundles (no silent fallback), and OCI referrer marshaling. AddsRecord.GetIdentity/GetOwner/GetIdentityType/GetOwnerTypeannotation accessors andRecord.GetDigest(sha256:hex form, for OCI/ai-catalog.io interop).server/identityresolvers (dns/did/wellknown/spiffe) behind a commonResolverregistry, the SSRF-safeutils/safefetchHTTP client they share, a unifiedclaimsDB table (record_cid + role), and eager claim verification wired into ingest.SignAndAttachIdentityClaim/OwnershipClaim,GetIdentityStatus(ByName),Resolve),dirctl identity claim/status/resolve, identity/owner search flags, and a reconciler task that periodically re-verifies claims (catching key rotation, expiry, and revoked SPIFFE trust bundles).Design note
This PR is deliberately additive-only so it builds and passes tests standing alone: naming.v1's
NamingServiceClient, its DB API (NameVerificationDatabaseAPI), CLI, and reconciler task are untouched. A couple of naming collisions between the old and new code were resolved by keeping both (e.g. anexpandNameWithProtocolshelper duplicated under a different name) rather than removing anything — naming.v1's actual removal happens in the follow-up stacked PR (feat/identity-remove-legacy).Verification
go build && go vet && go testpass acrossapi,server,client,cli,reconciler,tests,samples/ard-over-ads.