wake-log

Overview ¶

Command wake-log checks a Wake signed log without trusting whoever wrote or serves it: the checkpoint's signature, that every entry is in the signed tree, and each event's signature and payload. With -entries it also prints every entry as a JSON line.

go run github.com/manikoa/wake/log/cmd/wake-log verify -log ./log -log-key keys/log.pub \
    -key keys/collector.pub -bundle identity/bundle.pem -signer proxy=spiffe://wake.local/proxy

-log is the log's directory, or an http(s) URL it's served from. -key is a note format public key for an event signer, such as the collector; -bundle is a PEM trust bundle that X.509-SVID signers, such as the proxy, must chain to; -signer says who may sign a capture, as <capture>=<SPIFFE ID>, or a path prefix ending in "/". A bundle vouches for every workload in its trust domain, agents included, so an SVID signature only counts for a capture -signer lists it under. All three repeat.

Each entry is compared with the collector's own check when it appended it:

• logged valid and still checks: fine.
• logged invalid and still fails: evidence the collector recorded, such as an event with a bad signature. Reported, but the log is fine.
• logged valid but fails now: changed after it was logged, or checked here with different trust from the collector's.
• logged invalid but checks now: checked here with wider trust than the collector's.

It exits 1 if the log doesn't hold together or any entry is in the last two classes, including one whose payload is missing or doesn't match its signed digest.