chris/OSVauco
1
0
Fork 0
Code Issues 1 Pull Requests Actions 2 Packages Projects Releases Wiki Activity

feat(tyr): activate binary authorization policy and update docs

Browse Source
This commit is contained in:
Chris Christiansen 2026-09-02 19:17:36 +00:00
parent e6c131758b
commit 221b055f95
3 changed files with 3 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
project/roadmap.md
View File

@ -9,7 +9,7 @@ This document tracks the high-level goals and future development milestones for
## Phase 1: TYR Service Identity (SPIFFE/SVID) ## Phase 1: TYR Service Identity (SPIFFE/SVID)
- [x] Deploy step-ca - [x] Deploy step-ca
- [x] Bootstrap SPIRE - [x] Bootstrap SPIRE
- [~] Establish Binary Authorization Infrastructure (staged, pending attestor creation) - [x] Establish Binary Authorization Infrastructure
## Phase 3: Memory Bank & Project Management ## Phase 3: Memory Bank & Project Management
- [x] Implement `read_memory_bank` and `write_memory_bank` MCP tools. - [x] Implement `read_memory_bank` and `write_memory_bank` MCP tools.

4
tyr/memory_bank/completed.md
View File

@ -9,5 +9,5 @@
- Notes: `install_spire.sh` executed and daemons are running. - Notes: `install_spire.sh` executed and daemons are running.
- **Phase 1.4: Binary Authorization** - **Phase 1.4: Binary Authorization**
- Status: **Staged** - Status: **Complete**
- Notes: Policy YAML drafted, but blocked on creation of a KMS-based attestor resource. - Notes: KMS key, attestor, and policy are created and active.

11
tyr/policy/binauthz.yaml
View File

@ -5,14 +5,3 @@ defaultAdmissionRule:
- projects/propane-will-491900-m5/attestors/tyr-kms-attestor - projects/propane-will-491900-m5/attestors/tyr-kms-attestor
globalPolicyEvaluationMode: ENABLE globalPolicyEvaluationMode: ENABLE
name: projects/propane-will-491900-m5/policy name: projects/propane-will-491900-m5/policy
attestationAuthorities:
"projects/propane-will-491900-m5/attestors/tyr-kms-attestor":
userOwnedGrafeasNote:
noteReference: "projects/propane-will-491900-m5/notes/cosign-attestor-note" # NOTE: This is a placeholder
publicKeys:
- pkixPublicKey:
publicKeyPem: |-
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEk7BUor5+RImB5EiI7imet3Xwm4vj
j0Fg0sXKY8icZfinWr3hwyGwSGmd/vq22OLjIhlhChTp10xXzKIVZyzQAA==
-----END PUBLIC KEY-----