blackice

module

v0.0.0-...-3fabec7 Latest Latest Go to latest Published: May 27, 2025 License: MIT

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/TFMV/blackice

Links

Open Source Insights

README ¶

BlackIce

Betrayal-resilient data infrastructure that plans for compromise – and survives it.

BlackIce is a zero-trust data platform built around the conviction that compromise is inevitable. Instead of pretending attacks will never land, BlackIce designs for the aftermath: immediate containment, cryptographic provenance, adaptive degradation and forensic-first recovery – all while keeping the data moving.

Not fail-safe. Breach-resilient. Tamper-aware. Unafraid.

✨ Highlights

Feature	What it buys you
🚀 Zero-Trust Flight Gateway	PQ-TLS, Merkle integrity & adaptive circuit-breakers without sacrificing throughput.
🛰 Control Plane	Signed config ledger, real-time fleet health, live policy pushes.
🌀 Mutation-Aware Storage	Iceberg-style versioning with cryptographic commits & predictive rollback.
🔍 Self-Doubt Pipelines	Behaviour + content anomaly detection that can auto-isolate or burn-back.
🌩 Decentralised Fallback	Reed-Solomon / Shamir-sharded backups—survive region loss or legal seizure.

🏗️ Layered Architecture

┌─────────────────────────────────────────────────────────────┐
│           Control Plane  (gRPC + Signed Ledger)             │
└─────────────────────────────────────────────────────────────┘
            ▲                      ▲                  
            │                      │                  
            │ Health / Policy      │ Panic Escalation 
            │                      │                  
┌───────────┴──────────┐   ┌───────┴───────┐    ┌──-──────-────────┐
│  Secure Flight GW    │ ← │ Anomaly Engine │ ← │  Panic Service   │
│  (pkg/flightgw)      │   └────────────────┘   └──────────────────┘
│  HMAC ▪ PQ-TLS ▪ CB  │                                     
└─────────┬────────────┘                                     
          │  Arrow Flight                                    
┌─────────┴────────────┐                                     
│    Data Stores       │  🗄️  Iceberg ▪ DuckDB ▪ S3 ▪ Storj/IPFS
└──────────────────────┘

Every layer can operate independently, yet all layers sign each other's work – creating an immutable chain-of-custody from raw ingress to long-term archive.

🚀 Quick Start

set -euo pipefail

# 1. Install CLI tools
go install github.com/TFMV/blackice/cmd/flightdata@latest
go install github.com/TFMV/blackice/cmd/flightclient@latest

# 2. Start an in-memory Secure Flight Gateway
flightdata --listen 0.0.0.0:8815 --ttl 10m

# 3. In another terminal, push & fetch a demo Arrow RecordBatch
flightclient put --file demo.arrow
flightclient get --ticket demo.arrow

Docker one-liner:

docker run -p 8815:8815 -p 9090:9090 ghcr.io/tfmv/blackice/flightdata:latest

🧩 Core Components

Component	Purpose	Key Features
Secure Flight Gateway `pkg/flightgw`	Drop-in Arrow Flight proxy with zero-trust defaults	• Post-Quantum gRPC-TLS (Kyber-x25519-HMAC) • SHA-256 HMAC per batch, optional Merkle stream verification • Battle-tested circuit-breaker with five-tier postures • Dynamic Trust Scoring across ten behavioural dimensions
Control Plane `pkg/controlplane`	Central nervous system that keeps every BlackIce node honest	• AuthN/Z pluggable providers, hardware-rooted attestations • Real-time component registry with heartbeat-based liveness • Signed configuration ledger with provenance and diffs • gRPC API from `proto/blackice/v1/controlplane.proto`
Telemetry & Anomaly Detection `pkg/flightgw/telemetry`	Multi-modal threat detection	• OpenTelemetry pipelines, Prometheus/Grafana export • High-dimensional detectors (Isolation Forest, VAEs, DBSCAN) • <0.1% false-positive rate, MITRE ATT&CK mapping
Panic Service `proto/blackice/v1/panic.proto`	Coordinated incident response	• Tier-0 … Tier-5 escalation, burn-back coordination • Multi-party attestation, immutable forensic ledger

📊 Stability Matrix

Component	Status	Notes
Flight Gateway	Beta	Production-ready, API stable
Control Plane	Alpha	Core features complete, API evolving
Anomaly Detection	Beta	High accuracy, tuning ongoing
Panic Service	Alpha	Protocol stable, implementation maturing
CLI Tools	Stable	Ready for daily use

📂 Repository Map

art/                 ↳ Vision documents, logos, diagrams
cmd/                 ↳ CLI entry-points (flightdata, flightserver, flightclient …)
proto/               ↳ gRPC / protobuf contracts
pkg/                 ↳ Production Go packages
  ├── controlplane/  ↳ Fleet orchestration & policy engine
  └── flightgw/      ↳ Zero-trust Arrow Flight gateway & helpers
       ├── server/        ↳ Flight server implementations
       ├── proxy/         ↳ Reverse proxy logic
       ├── crypto/        ↳ HMAC, PQ-TLS, Merkle, attestations
       ├── trust/         ↳ Dynamic trust scoring
       ├── anomaly/       ↳ Detectors & alert lifecycle
       └── telemetry/     ↳ Metrics, tracing, logging

🛠 Development

Prerequisites: Go 1.24+ and buf (for protobuf)
Build & Test: make lint test – runs golangci-lint, unit tests and race detector
Protobuf: make proto to regenerate gRPC stubs
Dev Environment: make dev-shell for containerized development

Linter config lives in .golangci.yml; CI runs on GitHub Actions.

🤝 Contributing

Bug reports, feature ideas and pull requests are welcome!

📖 Documentation: GitHub Pages
💬 Chat: Join #blackice on Matrix
🐛 Good First Issues: Help wanted

Please see CONTRIBUTING.md for guidelines.

📜 License

SPDX-License-Identifier: MIT

Directories ¶

Path	Synopsis
cmd
anomalyclient command anomalyclient is a test client for the anomaly detection service	anomalyclient is a test client for the anomaly detection service
anomalyservice command main is the entry point for the anomaly detection service	main is the entry point for the anomaly detection service
controlplane command
flightclient command
flightdata command
flightgw command
flightserver command
keygen command
pkg
controlplane
controlplane/audit
controlplane/auth
controlplane/config
controlplane/crypto
controlplane/gateway
controlplane/server
flightgw/anomaly Package anomaly provides anomaly detection and response capabilities for the BlackIce system.	Package anomaly provides anomaly detection and response capabilities for the BlackIce system.
flightgw/config
flightgw/crypto Package crypto provides military-grade cryptographic functionality for BlackIce	Package crypto provides military-grade cryptographic functionality for BlackIce
flightgw/integration Package integration provides components to integrate various Flight servers	Package integration provides components to integrate various Flight servers
flightgw/proxy
flightgw/server Package server provides core server functionality for the BlackIce Flight Gateway	Package server provides core server functionality for the BlackIce Flight Gateway
flightgw/telemetry Package telemetry provides a secure framework for collecting and exposing metrics	Package telemetry provides a secure framework for collecting and exposing metrics
flightgw/trust Package trust provides trust scoring and evaluation for data sources	Package trust provides trust scoring and evaluation for data sources
proto
blackice/v1

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL