Repository navigation
Add GitHub sign-in and enclave release verification - #47
Merged
Merged
Conversation
getGitHubOAuthUrl starts a PKCE login and refuses an authorization URL that does not carry this login's challenge. handleCallback trades the GitHub grant inside the attested enclave for a token bound to the login secret, used like a Google id_token. The modal offers "Continue with GitHub" when 'github' is in providers.
The SDK no longer needs a new version for every enclave deploy. An attested PCR0 that is not pinned is accepted when the backend serves a Sigstore bundle, signed by the cavos-recovery release workflow on a vN tag and logged in Rekor, whose statement names the same PCR0, PCR1 and PCR2, a version at or above the SDK's minimum and an expiry in the future. The pinned PCR0 list remains for strict integrators and the images deployed before signed releases.
2 of 3 tasks
adrianvrj
changed the title
adrianvrj
marked this pull request as ready for review
October 28, 2026 20:45
This was referenced Oct 28, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Enclave release verification
{backendUrl}/api/enclave/releases/{pcr0}serves a Sigstore v0.3 bundle that verifies with@freedomofpress/sigstore-browser0.1.15 (exact pin; unaudited) against the bundled public-good trusted root (one TUF refresh on failure, then fail closed), signed by GitHub Actions for repo id 1333734222 / owner id 216094156, workflow.github/workflows/release.ymlon arefs/tags/vNpush, github-hosted runner; whose in-toto statement names PCR0/1/2 equal to the attestation, version N ≥minVersionand an unexpiredexpiresAt. All-zero PCR0 is rejected.pcr0stays for strict integrators and for the currently deployed unsigned image (7f32a8…,f388b0…).Summary
CavosAuth.getGitHubOAuthUrl(): keeps a login secret and a PKCE verifier insessionStorage, asks the backend for the authorize URL, and refuses it unless it goes tohttps://github.com/login/oauth/authorizewith this login'scode_challengeandS256. A code issued without our challenge could otherwise be redeemed without this browser.handleCallback: when the exchange returnsgithub_grant, runsverify_githubinside the attested enclave and uses the returned token exactly like a Google id_token: login binding, registry bearer and social recovery credential.enclaveLoginhelper; email behaviour and messages are unchanged.githubadded toIdentity.provider, the social recovery providers,requiresLoginBindingandproviderFromClaims.providersincludes'github'. The default providers are unchanged. React Native does not offer GitHub, since it cannot verify enclave attestations (same as email).Before merge
Merging to
mainpublishes to npm. Wait for the enclave deploy (cavos-labs/cavos-recovery#11) and add its PCR0 tosrc/recovery/attestationDefaults.tsfirst.Test plan
npm test: 465 passed, 2 skipped (16 new)tsc --noEmit,npm run buildcode_challengethrows, against the real backend🤖 Generated with Claude Code