auth: publish passkey foundations preview

scripts/check-dependencies.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: AGPL-3.0-only
+set -euo pipefail
+root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+cd "$root"
+
+if grep -Fq 'github.com/go-webauthn/webauthn' go.mod go.sum; then
+	echo 'go-webauthn must be compiled from the checked internal derivative, not resolved as a module' >&2
+	exit 1
+fi
+if grep -Eq '^replace[[:space:]]|^replace[[:space:]]*\(' go.mod; then
+	echo 'local replacements are forbidden in the public module' >&2
+	exit 1
+fi
+compiled_dependencies=$(go list -deps ./...)
+if grep -Fxq 'github.com/go-webauthn/webauthn' <<<"$compiled_dependencies"; then
+	echo 'upstream go-webauthn unexpectedly appears in the compiled dependency graph' >&2
+	exit 1
+fi
+grep -Fq 'de0a809e3027957ca15b72b252540317f9ba581b' THIRD_PARTY_NOTICES.md
+./scripts/check-vendored-webauthn.sh
+./scripts/check-embedded-webauthn.sh
+go mod verify

scripts/check-embedded-webauthn.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: AGPL-3.0-only
+set -euo pipefail
+root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+cd "$root"
+
+source_root=third_party/go-webauthn
+embedded_root=internal/webauthnvendored
+derived=$(mktemp -d)
+trap 'rm -rf "$derived"' EXIT
+
+packages=(
+	metadata
+	protocol
+	protocol/webauthncbor
+	protocol/webauthncose
+	webauthn
+)
+
+install -D -m 0644 "$source_root/LICENSE" "$derived/LICENSE"
+for package in "${packages[@]}"; do
+	while IFS= read -r source; do
+		relative=${source#"$source_root"/}
+		install -D -m 0644 "$source" "$derived/$relative"
+	done < <(find "$source_root/$package" -maxdepth 1 -type f -name '*.go' ! -name '*_test.go' | sort)
+done
+
+while IFS= read -r source; do
+	sed -i \
+		's#github.com/go-webauthn/webauthn#gamertan.com/web/internal/webauthnvendored#g' \
+		"$source"
+done < <(find "$derived" -type f -name '*.go' | sort)
+
+cmp -s LICENSES/BSD-3-Clause-go-webauthn.txt "$embedded_root/LICENSE"
+if ! diff -ru --no-dereference "$derived" "$embedded_root"; then
+	echo 'compiled WebAuthn verifier differs from its audited mechanical derivation' >&2
+	exit 1
+fi
+
+test "$(find "$embedded_root" -type f | wc -l)" -eq 57

scripts/check-licenses.sh

@@ -7,6 +7,7 @@ failed=0
 while IFS= read -r -d '' file; do
 	case $file in
 		./.git|./.git/*|./LICENSES/*|./go.sum) continue ;;
+		./third_party/go-webauthn/*|./third_party/go-webauthn.SHA256SUMS|./internal/webauthnvendored/*) continue ;;
 		./starters/*|./examples/*) expected=0BSD ;;
 		./scripts/*|./.gitea/*|./services/*) expected=AGPL-3.0-only ;;
 		*) expected=MPL-2.0 ;;
@@ -15,4 +16,6 @@ while IFS= read -r -d '' file; do
 		echo "license mismatch: $file expected $expected" >&2; failed=1
 	fi
 done < <(find . -type f -print0)
+./scripts/check-vendored-webauthn.sh || failed=1
+./scripts/check-embedded-webauthn.sh || failed=1
 exit "$failed"

scripts/check-vendored-webauthn.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: AGPL-3.0-only
+set -euo pipefail
+root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+cd "$root"
+
+test -f third_party/go-webauthn/LICENSE
+cmp -s LICENSES/BSD-3-Clause-go-webauthn.txt third_party/go-webauthn/LICENSE
+sha256sum -c third_party/go-webauthn.SHA256SUMS >/dev/null
+expected=$(sed -n 's#  third_party/go-webauthn/.*#&#p' third_party/go-webauthn.SHA256SUMS | wc -l)
+actual=$(find third_party/go-webauthn -type f | wc -l)
+test "$expected" -eq "$actual"

scripts/export-public.sh

@@ -11,11 +11,18 @@ cd "$root"
 mapfile -t files < <(grep -Ev '^[[:space:]]*(#|$)' scripts/public-snapshot.allow)
 [[ ${#files[@]} -gt 0 ]] || exit 1
 for file in "${files[@]}"; do
-	[[ $file != /* && $file != *..* && -f $file && ! -L $file ]] || { echo "invalid allowlisted path: $file" >&2; exit 1; }
-	git ls-files --error-unmatch -- "$file" >/dev/null
+	[[ $file != /* && $file != *..* ]] || { echo "invalid allowlisted path: $file" >&2; exit 1; }
+	if [[ $file = */ ]]; then
+		directory=${file%/}
+		[[ -d $directory && ! -L $directory ]] || { echo "invalid allowlisted directory: $file" >&2; exit 1; }
+		[[ -n $(git ls-files -- "$directory/") ]] || { echo "empty allowlisted directory: $file" >&2; exit 1; }
+	else
+		[[ -f $file && ! -L $file ]] || { echo "invalid allowlisted path: $file" >&2; exit 1; }
+		git ls-files --error-unmatch -- "$file" >/dev/null
+	fi
 done
 mkdir -m 0700 "$output"
 git archive --format=tar HEAD -- "${files[@]}" | tar -x -C "$output"
 find "$output" -type d -exec chmod 0755 {} +
 "$output/scripts/check-licenses.sh"
-echo "exported ${#files[@]} reviewed files"
+echo "exported ${#files[@]} reviewed paths"

scripts/public-snapshot.allow

@@ -9,9 +9,11 @@ CONTRIBUTING.md
 LICENSES.md
 LICENSES/0BSD.txt
 LICENSES/AGPL-3.0-only.txt
+LICENSES/BSD-3-Clause-go-webauthn.txt
 LICENSES/MPL-2.0.txt
 README.md
 SECURITY.md
+THIRD_PARTY_NOTICES.md
 abuse/abuse.go
 abuse/abuse_test.go
 access/access.go
@@ -27,16 +29,26 @@ auth/password_test.go
 auth/service_test.go
 authhttp/authhttp.go
 authhttp/authhttp_test.go
+authhttp/passkey.go
+authhttp/passkey_test.go
 authsqlite/store.go
 authsqlite/store_test.go
 authsqlite/access.go
 authsqlite/organizations.go
+authsqlite/passkey.go
+authsqlite/passkey_test.go
+authwebauthn/fuzz_test.go
+authwebauthn/service.go
+authwebauthn/service_test.go
+authwebauthn/types.go
+internal/webauthnvendored/
 docs/ADOPTION.md
 docs/ARCHITECTURE.md
 docs/DEPENDENCIES.md
 docs/GETTING_STARTED.md
 docs/MODULES.md
 docs/ORGANIZATIONS.md
+docs/PASSKEYS.md
 docs/PUBLIC_SNAPSHOT.md
 docs/SANDWICH_HIME.md
 docs/SERVICES_ROADMAP.md
@@ -52,6 +64,9 @@ requestmeta/requestmeta_test.go
 organizations/organizations.go
 organizations/organizations_test.go
 scripts/check-licenses.sh
+scripts/check-dependencies.sh
+scripts/check-vendored-webauthn.sh
+scripts/check-embedded-webauthn.sh
 scripts/export-public.sh
 scripts/public-snapshot.allow
 scripts/test-public-snapshot.sh
@@ -59,6 +74,8 @@ scripts/verify.sh
 starters/basic/.env.example
 starters/basic/README.md
 starters/basic/main.go
+third_party/go-webauthn.SHA256SUMS
+third_party/go-webauthn/
 websec/ratelimit.go
 websec/websec.go
 websec/websec_test.go

scripts/test-public-snapshot.sh

@@ -7,7 +7,13 @@ temporary=$(mktemp -d)
 trap 'rm -rf "$temporary"' EXIT
 ./scripts/export-public.sh "$temporary/export"
 (cd "$temporary/export" && find . -type f -printf '%P\n' | sort) >"$temporary/actual"
-grep -Ev '^[[:space:]]*(#|$)' scripts/public-snapshot.allow | sort >"$temporary/expected"
+while IFS= read -r path; do
+	if [[ $path = */ ]]; then
+		find "${path%/}" -type f -printf '%p\n'
+	else
+		echo "$path"
+	fi
+done < <(grep -Ev '^[[:space:]]*(#|$)' scripts/public-snapshot.allow) | sort >"$temporary/expected"
 diff -u "$temporary/expected" "$temporary/actual"
 private_word='PRI''VATE'
 token_word='to''ken'

scripts/verify.sh

@@ -4,10 +4,22 @@ set -euo pipefail
 root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
 cd "$root"
 ./scripts/check-licenses.sh
-test -z "$(gofmt -l .)"
+./scripts/check-dependencies.sh
+test -z "$(find . \( -path ./third_party -o -path ./internal/webauthnvendored \) -prune -o -name '*.go' -print0 | xargs -0 gofmt -l)"
 go test ./...
 go test -race ./...
-go vet ./...
+set +e
+vet_output=$(go vet ./... 2>&1)
+vet_status=$?
+set -e
+if test "$vet_status" -ne 0; then
+	known='internal/webauthnvendored/protocol/webauthncose/webauthncose.go:33:2: struct field _struct has json tag but is not exported'
+	test "$(grep -Fxc "$known" <<<"$vet_output")" -eq 1
+	test -z "$(grep -Fvx "$known" <<<"$vet_output")"
+elif test -n "$vet_output"; then
+	printf '%s\n' "$vet_output" >&2
+	exit 1
+fi
 build_dir=$(mktemp -d)
 trap 'rm -rf "$build_dir"' EXIT
 go build -buildvcs=false -trimpath -o "$build_dir/basic" ./starters/basic