Update from upstream

.defaults.yml

@@ -0,0 +1,72 @@
+# default values for Vouch Proxy
+# this is related to Env Vars
+# https://github.com/vouch/vouch-proxy/issues/132
+# https://github.com/vouch/vouch-proxy/pull/134
+
+# you don't want to mess with these
+vouch:
+  logLevel: info
+  testing: false
+  listen: 0.0.0.0
+  port: 9090
+  socket_mode: 0660 
+  # document_root:
+  # domains:
+  allowAllUsers: false
+  publicAccess: false
+  # whiteList:
+  # teamWhitelist:
+  writeTimeout: 15
+  readTimeout: 15
+  idleTimeout: 15
+  tls:
+    # cert:
+    # key:
+    profile: intermediate
+
+  jwt:
+    #   secret:
+    issuer: Vouch
+    maxAge: 240
+    compress: true
+    signing_method: HS256
+
+  cookie:
+    name: VouchCookie
+    # domain:
+    secure: true
+    httpOnly: true
+    maxAge: 240
+    # sameSite:
+
+  session:
+    name: VouchSession
+    maxAge: 5
+    # key:
+
+  headers:
+    jwt: X-Vouch-Token
+    user: X-Vouch-User
+    success: X-Vouch-Success
+    error: X-Vouch-Error
+    querystring: access_token
+    redirect: X-Vouch-Requested-URI
+    # claims:
+    claimheader: X-Vouch-IdP-Claims-
+    # https://github.com/vouch/vouch-proxy/issues/287
+    # accesstoken: X-Vouch-IdP-AccessToken
+    # idtoken: X-Vouch-IdP-IdToken
+  # test_url:
+  # post_logout_redirect_uris:
+# oauth:
+#   provider:
+#   client_id:
+#   client_secret:
+#   callback_url:
+#   callback_urls:
+#   preferredDomain:
+#   auth_url:
+#   token_url:
+#   user_info_url:
+#   end_session_endpoint:
+#   scopes:

.dockerignore

@@ -0,0 +1,17 @@
+config/config.yml
+pkg/model/storage-test.db
+main
+config/google_config.json
+.vscode/*
+lasso
+config/config.yml_google
+config/config.yml_github
+config/secret
+config/config.yml_orig
+.dockerignore
+Dockerfile
+handlers/rice-box.go
+certs
+.cover/*
+.github
+.whitesource

.github/ISSUE_TEMPLATE/open-a-github-issue-to-receive-support.md

@@ -0,0 +1,39 @@
+---
+name: open a GitHub Issue to receive support
+about: Create a report to receive support with your config and to help us improve
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**First read the README**
+Specifically ***[Troubleshooting, Support and Feature Requests](https://github.com/vouch/vouch-proxy#troubleshooting-support-and-feature-requests-read-this-before-submitting-an-issue-at-github)***.
+
+And please turn on `vouch.testing` before you ask for support.
+
+
+
+** Please DO NOT post config and logs to this issue,  use a Gist**
+We prefer a [gist](https://gist.github.com/) but any reasonable paste service is fine.
+
+**Describe the problem**
+A clear and concise description of the behavior you are observing.
+Please include which OAuth provider you are using.
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Desktop (please complete the following information):**
+ - OS: [e.g. iOS]
+ - Browser [e.g. chrome, safari]
+ - Version [e.g. 22]
+
+**Smartphone (please complete the following information):**
+ - Device: [e.g. iPhone6]
+ - OS: [e.g. iOS8.1]
+ - Browser [e.g. stock browser, safari]
+ - Version [e.g. 22]
+
+**Additional context**
+Add any other context about the problem here.

.github/workflows/coverage.yml

@@ -0,0 +1,50 @@
+name: coverage
+
+on:
+  workflow_dispatch:
+  push:
+  pull_request:
+
+jobs:
+  coverage:
+    env:
+      GOPATH: ${{ github.workspace }}
+      VOUCH_ROOT: ${{ github.workspace }}/src/github.com/${{ github.repository }}
+    defaults:
+      run:
+        working-directory: ${{ env.GOPATH }}/src/github.com/${{ github.repository }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # go: ['1.14', '1.15']
+        go: ['1.26']
+
+    steps:
+      - uses: actions/setup-go@v2
+        with:
+          go-version: ${{ matrix.go }}
+      - name: checkout 
+        uses: actions/checkout@v2
+        with:
+          path: ${{ env.GOPATH }}/src/github.com/${{ github.repository }}
+      - name: goget
+        run: ./do.sh goget
+      - name: coverage test
+        run: ./do.sh coverage
+
+      - name: Send coverage
+        uses: shogo82148/actions-goveralls@v1
+        with:
+          path-to-profile: ${{ env.GOPATH }}/src/github.com/${{ github.repository }}/.cover/cover.out
+          flag-name: Go-${{ matrix.go }}
+          parallel: true
+
+  # notifies that all test jobs are finished.
+  finish:
+    needs: coverage
+    runs-on: ubuntu-latest
+    steps:
+      - uses: shogo82148/actions-goveralls@v1
+        with:
+          parallel-finished: true

.github/workflows/docker-release-arm.yml

@@ -0,0 +1,43 @@
+name: Docker build and push voucher/vouch-proxy:latest-arm
+
+on:
+  push:
+    branches:
+      - master
+
+jobs:
+  publish-to-docker-arm:
+    runs-on: ubuntu-latest
+    env:
+      DOCKER_TAG: latest-arm
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+      - name: Set up Docker Buildx
+        id: buildx
+        uses: crazy-max/ghaction-docker-buildx@v1
+        with:
+          version: latest
+      - name: List available platforms
+        run: echo ${{ steps.buildx.outputs.platforms }}
+      - name: Docker login (set DOCKER_USERNAME and DOCKER_PASSWORD in secrets)
+        if: ${{ success() && startsWith(github.repository, 'vouch/')}} # Remove this line, if you want everybody to publish to docker hub
+        run: docker login -u ${{ secrets.DOCKER_USERNAME }} -p ${{ secrets.DOCKER_PASSWORD }}
+      - name: Publish to docker as voucher/vouch-proxy
+        if: ${{ success() && startsWith(github.repository, 'vouch/')}}
+        run: |
+          docker buildx build \
+            --platform linux/arm/v7,linux/arm64 \
+            --push \
+            -t voucher/vouch-proxy:$DOCKER_TAG \
+            .
+    # Uncomment below to have github build to docker for every user. Watch out for indentation
+    #   -
+    #     name: Publish to docker as github_user/github_repo
+    #     if: ${{ success() && !startsWith(github.repository, 'vouch/')}}
+    #     run: |
+    #       docker buildx build \
+    #         --platform linux/amd64,linux/arm/v7,linux/arm64 \
+    #         --push \
+    #         -t $GITHUB_REPOSITORY:latest \
+    #         .

.github/workflows/docker-release-quayio-alpine.yml

@@ -0,0 +1,56 @@
+name: Publish Docker image to Quay.io using Dockerfile.alpine
+
+on:
+  push:
+    branches:
+      - master
+    tags:
+      - 'v*'
+
+
+jobs:
+  publish-to-docker-quayio:
+    runs-on: ubuntu-latest
+    env:
+      DOCKER_REPO: quay.io
+
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v2
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Docker repository
+        uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9
+        with:
+          registry: ${{ env.DOCKER_REPO }}
+          username: ${{ secrets.QUAYIO_ROBOT_USERNAME }}
+          password: ${{ secrets.QUAYIO_ROBOT_PASSWORD }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@a67f45cb0f8e65cf693a0bc5bfa1c5057c623030
+        with:
+          images: quay.io/vouch/vouch-proxy
+          flavor: |
+            prefix=alpine-,onlatest=true
+          tags: |
+            type=ref,event=branch
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+
+      - name: Build and push Docker image using Dockerfile.alpine
+        uses: docker/build-push-action@ad44023a93711e3deb337508980b4b5e9bcdc5dc
+        with:
+          file: Dockerfile.alpine
+          context: .
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          platforms: |
+            linux/amd64
+            linux/arm64

.github/workflows/docker-release-quayio.yml

@@ -0,0 +1,53 @@
+name: Publish Docker image to Quay.io
+
+on:
+  push:
+    branches:
+      - master
+    tags:
+      - 'v*'
+
+
+jobs:
+  publish-to-docker-quayio:
+    runs-on: ubuntu-latest
+    env:
+      DOCKER_REPO: quay.io
+
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v2
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Docker repository
+        uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9
+        with:
+          registry: ${{ env.DOCKER_REPO }}
+          username: ${{ secrets.QUAYIO_ROBOT_USERNAME }}
+          password: ${{ secrets.QUAYIO_ROBOT_PASSWORD }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
+        with:
+          images: quay.io/vouch/vouch-proxy
+          tags: |
+            type=ref,event=branch
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+
+      - name: Build and push Docker image using Dockerfile
+        uses: docker/build-push-action@ad44023a93711e3deb337508980b4b5e9bcdc5dc
+        with:
+          context: .
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          platforms: |
+            linux/amd64
+            linux/arm64

.github/workflows/notify-irc.yml

@@ -0,0 +1,35 @@
+name: "Push Notification"
+on: [push, pull_request, create]
+
+jobs:
+  notify-irc:
+    runs-on: ubuntu-latest
+    steps:
+      - name: irc push
+        uses: rectalogic/notify-irc@v1
+        if: github.event_name == 'push'
+        with:
+          channel: "#vouch"
+          server: irc.libera.chat
+          nickname: from-github
+          message: |
+            ${{ github.actor }} pushed ${{ github.event.ref }} ${{ github.event.compare }}
+            ${{ join(github.event.commits.*.message) }}
+      - name: irc pull request
+        uses: rectalogic/notify-irc@v1
+        if: github.event_name == 'pull_request'
+        with:
+          channel: "#vouch"
+          server: irc.libera.chat
+          nickname: from-github
+          message: |
+            ${{ github.actor }} opened PR ${{ github.event.html_url }}
+      - name: irc tag created
+        uses: rectalogic/notify-irc@v1
+        if: github.event_name == 'create' && github.event.ref_type == 'tag'
+        with:
+          channel: "#vouch"
+          server: irc.libera.chat
+          nickname: from-github
+          message: |
+            ${{ github.actor }} tagged ${{ github.repository }} ${{ github.event.ref }}

.gitignore

@@ -1,6 +1,19 @@
-config/config.yml
-data/lasso_bolt.db
-pkg/model/storage-test.db
+vouch
+vouch-proxy
 main
+config/config.yml
+config/*config.yml
+config/config.yml_*
+!config/config.yml_example_pocket-id
 config/google_config.json
-.vscode/*
+config/secret
+!config/testing/*
+pkg/model/storage-test.db
+.vscode/*
+certs/*
+coverage.out
+coverage.html.env_google
+.env*
+.cover
+config/testing/rsa.key
+config/testing/rsa.pub