spiffe

Overview ¶

Sign an in-toto attestation with an X.509 SVID obtained from the SPIFFE Workload API, then verify it against a pinned SPIRE upstream root and apply a SPIFFE identity policy via the api/v1 layer.

Demonstrates the SignerSet/VerifierSet OptionsSet plumbing: a CLI surface registers --spiffe-* flags, the SPIFFE_ENDPOINT_SOCKET and SPIFFE_TRUST_BUNDLE env vars are picked up automatically as fallbacks, BuildSigner / BuildCredentialProvider produce the configured signer, and BuildVerifier the configured verifier.

To run against the local SPIRE fixture:

make spire-up   (start the spire server in a container)
export SPIFFE_ENDPOINT_SOCKET="unix://$(pwd)/hack/spire/socket/api.sock"
export SPIFFE_TRUST_BUNDLE="$(pwd)/hack/spire/bundle.pem"
go run ./_examples/spiffe
make spire-down (tear down the spire container)

The fixture registers a workload entry for the calling user's UID under the SPIFFE ID spiffe://test.local/workload — the policy check below pins that identity.