diff --git a/main.go b/main.go index b4b2f80..ddb6355 100644 --- a/main.go +++ b/main.go @@ -48,18 +48,110 @@ func main() { func index(w http.ResponseWriter, _ *http.Request) { w.Header().Set("Content-Type", "text/html; charset=utf-8") + jwtLib := "unknown" + if bi, ok := debug.ReadBuildInfo(); ok { + for _, d := range bi.Deps { + if d.Path == "github.com/dgrijalva/jwt-go" || d.Path == "github.com/golang-jwt/jwt/v5" { + jwtLib = d.Path + "@" + d.Version + break + } + } + } + vulnerable := jwtLib == "github.com/dgrijalva/jwt-go@v3.2.0+incompatible" + pillClass := "pill-good" + pillText := "patched" + if vulnerable { + pillClass = "pill-bad" + pillText = "vulnerable" + } fmt.Fprintf(w, ` -demo-secure - -

demo-secure

-

A minimal Go service used to demonstrate the RHADS supply chain: -RHDH onboarding → RHTAS signing → RHTPA scanning → patch.

- -`) + + + + +demo-secure · RHADS supply-chain demo + + + +
+
+
+

demo-secure

+ go service +
+

A minimal HTTP service threaded through the Red Hat Advanced Developer Suite: RHDH golden-path scaffolding → Tekton build → RHTAS keyless signing → RHTPA SBOM scanning.

+
+ image signed (cosign + Fulcio) + SBOM attested (CycloneDX) + jwt-go %s +
+

Active JWT library: %s

+
+ +
+
+

GET /version

+

Build info plus the full dependency tree. Proves at runtime which jwt-go version is shipped.

+
+
+

GET /healthz

+

Liveness probe endpoint. Returns 200 OK while the process is up.

+
+
+

POST /verify

+

Send Authorization: Bearer <jwt> to exercise the JWT library — this is the call path RHTPA sees as in-use.

+
+
+ + +
+ +`, pillClass, pillText, jwtLib) } func version(w http.ResponseWriter, _ *http.Request) {