78 lines
3.3 KiB
YAML
78 lines
3.3 KiB
YAML
# crypto-core import allowlist
|
|
#
|
|
# Packages on this list MAY import directly from any of:
|
|
# - @suaveplan/crypto-core (and subpaths)
|
|
# - @suaveplan/crypto-cipher (and subpaths)
|
|
# - @suaveplan/crypto-curve (and subpaths)
|
|
# - @suaveplan/crypto-hash MAC subpaths (hmac and similar)
|
|
#
|
|
# Every other package MUST go through @suaveplan/crypto's opinionated
|
|
# layer (Authority, Packer, Vault). Encoding helpers from
|
|
# @suaveplan/crypto-utils and pure-hash uses from @suaveplan/crypto-hash
|
|
# (sha256/sha384/sha512) remain open.
|
|
#
|
|
# Adding a package to this list requires reviewer approval and a
|
|
# documented rationale. The allowlist is intentionally short; the
|
|
# discipline this gate enforces is the single most important guarantee
|
|
# in restore-crypto-keychain-packer.
|
|
|
|
allowlist:
|
|
- "@suaveplan/crypto"
|
|
# The opinionated layer itself. Composes primitives into the
|
|
# Authority/Packer/Vault APIs and re-exports the primitive surface
|
|
# for ergonomic single-package imports.
|
|
|
|
- "@suaveplan/crypto-cli"
|
|
# The keychain CLI. Wraps the opinionated layer for operators.
|
|
# Imports are routed through @suaveplan/crypto's barrel only.
|
|
|
|
- "@suaveplan/crypto-sodium"
|
|
# libsodium engine adapter for @suaveplan/crypto-core. Implements
|
|
# the SignEngine / AgreeEngine / AeadEngine / AuthBoxEngine /
|
|
# SealedBoxEngine interfaces. Engine adapters are by design the
|
|
# only direct consumers of the primitive engine types.
|
|
|
|
- "@suaveplan/crypto-browser"
|
|
# WebCrypto engine adapter. Same rationale as crypto-sodium.
|
|
|
|
- "@suaveplan/bitpacker-crypto"
|
|
# SignedBitSchema / EnvelopeSchema / HashChainSchema build on
|
|
# primitives directly to provide bit-packed wire format building
|
|
# blocks. The opinionated layer (Vault, Packer) is built on top of
|
|
# bitpacker-crypto, so it cannot itself depend on the opinionated
|
|
# layer without a cycle.
|
|
|
|
- "@suaveplan/slsa"
|
|
# DSSE PAE signature verification. DSSE is governed by an external
|
|
# spec (in-toto.io/dsse) without Suaveplan domain tags; the PAE
|
|
# bytes ARE the message. Verifying via verifyAuthoritySignature
|
|
# would require fabricating a domain tag that the verifier
|
|
# contract doesn't have. Builder identity SIGNING (not verifying)
|
|
# goes through @suaveplan/crypto's Authority — separate concern.
|
|
|
|
- "@suaveplan/packer"
|
|
# Pre-existing chunked AEAD packer (legacy of restore-crypto). To
|
|
# be migrated to @suaveplan/crypto's Packer in a future change;
|
|
# allowlisted for now to keep slice 4 reviewable.
|
|
|
|
- "@suaveplan/drive-plugin-chunks"
|
|
# Legacy direct primitive use; same rationale as @suaveplan/packer.
|
|
|
|
- "@suaveplan/crypto-core"
|
|
# crypto-core IS the primitive layer. It composes the
|
|
# crypto-cipher / crypto-curve / crypto-hash selector packages
|
|
# internally to expose its public API. Self-imports.
|
|
|
|
- "@suaveplan/streams"
|
|
# streams/transforms/crypto consumes crypto-cipher selectors
|
|
# directly. Migration to Authority is tracked as a future change.
|
|
|
|
- "@suaveplan/audit-logging"
|
|
# chain-integrity uses HMAC for tamper-evidence. Audit-log MAC is
|
|
# a low-level primitive that doesn't fit the Authority model.
|
|
|
|
# Encoding helpers from @suaveplan/crypto-utils stay open for ALL
|
|
# packages. The gate does not flag imports of toHex/fromHex/toBase64/etc.
|
|
encoding_helpers_open:
|
|
- "@suaveplan/crypto-utils"
|