mirror of
https://github.com/larksuite/cli.git
synced 2026-07-07 17:45:15 +08:00
e6c8fd546c
private_key_jwt shipped with only a macOS Keychain signer, so keysigner.Active() was nil on Linux/Windows and the secretless auth was unusable there (registration failed with "requires a TEE key signer"). Add a TPM 2.0 signer backed by github.com/facebookincubator/sks — the backend named in the keysigner docstring — behind the `sks_signer` build tag, mirroring the macOS `keychain_signer` gating. Signer (extension/keysigner/signer_sks.go, (linux||windows) && sks_signer): - Non-exportable ECDSA P-256 key in the TPM (/dev/tpmrm0 on Linux, CNG on Windows); ES256. - sks emits ASN.1 DER but JWS requires fixed-width r||s (RFC 7518 §3.4); add ecdsaDERToJOSE in the core and convert. Both sks backends emit DER. - EnsureKey creates-or-loads, PublicKey reads without creating, Sign hashes+signs+converts. - Silence sks's verbose flog (glog-fork) TPM logging in init() via flog.SetOutput(io.Discard); the CLI does not use flog and real failures are returned as errors. TEE diagnostics: - HardwareProber capability + ProbeActiveHardware in the core; sksSigner implements it via sks.GetSecureHardwareVendorData (prefix-collapsed error text). - `lark-cli doctor` gains a tee_signer check: a hard requirement for private_key_jwt apps, informational for client_secret. - doctor renders a human-readable report on a TTY and keeps JSON for pipes/scripts; add IOStreams.StdoutIsTerminal (stdout-based, unlike the stdin-based IsTerminal) so `doctor | jq` still emits JSON. Dependency: pin sks to its last go-1.20 commit (6823f23, before sks bumped its own go directive to 1.24) so the CLI module stays on go 1.23 and the golang.org/x/* packages are not force-upgraded. sks pulls a pure-Go TPM stack, compiled only under -tags sks_signer, so the default build stays free of it (client_secret only). Verified on linux/amd64 against a real TPM 2.0: key creation, ES256 signing with r||s verification, and the full private_key_jwt registration + tenant-token mint via TPM-signed client_assertion.