DongHyeonkaandClaude Opus 5
b2963105a8
The keycloak project ended with four open questions that design could not
settle. A two-VM lab was built to answer them by measurement, and this is
that material: 26 experiments, 125 raw command outputs, 22 browser captures.
Follows the import procedure in README.md.
source/ the originating repository verbatim — 78 documents, 28 SVGs,
8 manifests, plus .source-revision recording the commit
final/ the SSOT
document.md 729 lines written from the 29 experiment documents, not
concatenated: what was predicted, what was measured, and
where the measurement itself was wrong
evidence/raw 125 outputs, flattened to <experiment>__<file> because
the originals collided (01-baseline.txt appeared three
times) and the audit only globs the top level
evidence/meta one per raw file; command and exitCode are null and the
README says why rather than inventing them
evidence/browser 22 captures
assets/ three diagrams through techviz
.techviz/ their VizSpecs
A separate project rather than an addition to keycloak: the B-layer answers
that project's four questions, but the A, C and D layers are about cluster
failure, SSO and operations, and one document.md should hold one subject.
The four question records there can point here through 관계.
Recorded rather than papered over: only three of the 28 diagrams were
remade. The repository forbids hand-drawn SVG and forbids titles inside the
canvas; all 28 originals carry both, so converting them is redrawing, not
reformatting. They stay in source/ and the gap is written into the document.
verify-pipeline.py passes. audit-records.py reports no issues.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
151 lines
14 KiB
XML
151 lines
14 KiB
XML
<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="1580" viewBox="0 0 1200 1580" role="img">
|
|
<title>terminal evidence</title>
|
|
<desc>Terminal-style rendering generated from retained command output. Sensitive-looking values are redacted in the visual asset.</desc>
|
|
<rect x="1" y="1" width="1198" height="1578" rx="14" fill="#0d1117" stroke="#30363d"/>
|
|
<rect x="1" y="1" width="1198" height="44" rx="14" fill="#161b22"/>
|
|
<rect x="1" y="30" width="1198" height="14" fill="#161b22"/>
|
|
<circle cx="24" cy="22" r="6" fill="#ff5f57"/>
|
|
<circle cx="44" cy="22" r="6" fill="#febc2e"/>
|
|
<circle cx="64" cy="22" r="6" fill="#28c840"/>
|
|
<text x="92" y="27" fill="#8b949e" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace">terminal evidence</text>
|
|
<text x="24" y="68" fill="#c9d1d9" font-size="15" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">$ set -e
|
|
set -o pipefail
|
|
D=$(mktemp -d); trap 'rm -rf "$D"' EXIT
|
|
C=/shared/codebase/clean-architecture-backend-template
|
|
</tspan><tspan x="24" dy="22">N=$C/src/adapter/outbound/notification
|
|
CACHE=/root/.gradle/caches/modules-2/files-2.1
|
|
java -version 2>&1 | head -1
|
|
cp=""</tspan><tspan x="24" dy="22">
|
|
while IFS= read -r line; do
|
|
coord=${line%%=*}; confs=${line#*=}
|
|
case ",$confs," in *",runtimeClasspath,"*) ;; *) co</tspan><tspan x="24" dy="22">ntinue ;; esac
|
|
g=${coord%%:*}; rest=${coord#*:}; n=${rest%%:*}; v=${rest##*:}
|
|
jar=$(find "$CACHE/$g/$n/$v" -name '*.</tspan><tspan x="24" dy="22">jar' ! -name '*sources*' ! -name '*javadoc*' 2>/dev/null | head -1)
|
|
[ -n "$jar" ] && cp="$cp:$jar"
|
|
done < <(grep -E '^</tspan><tspan x="24" dy="22">[a-zA-Z0-9._-]+:[^=]+=' "$N/gradle.lockfile")
|
|
CP=$(find "$N/build/libs" "$C/src/application-core/build/libs" -name '*+21</tspan><tspan x="24" dy="22">234e38cdb9.jar' | tr '\n' ':')${cp#:}
|
|
cat > "$D/SignedHostProbe.java" <<'JAVA'
|
|
import com.sun.net.httpserver.HttpServer;</tspan><tspan x="24" dy="22">
|
|
import dev.caskeleton.adapter.outbound.notification.platform.provider.http.JdkNotificationHttpGateway;
|
|
import dev.caske</tspan><tspan x="24" dy="22">leton.adapter.outbound.notification.platform.provider.http.NotificationHttpRequest;
|
|
import java.net.InetSocketAddress;
|
|
i</tspan><tspan x="24" dy="22">mport java.net.URI;
|
|
import java.nio.charset.StandardCharsets;
|
|
import java.time.Duration;
|
|
import java.util.LinkedHashMap;</tspan><tspan x="24" dy="22">
|
|
import java.util.Map;
|
|
import java.util.concurrent.atomic.AtomicReference;
|
|
|
|
/** 매퍼가 서명하는 호스트 값과 JDK 가 실제</tspan><tspan x="24" dy="22">로 보내는 Host 헤더를 나란히 잰다. */
|
|
public final class SignedHostProbe {
|
|
|
|
private static final String PATH = "/v2/em</tspan><tspan x="24" dy="22">ail/outbound-emails";
|
|
|
|
/** SesRequestMapper:103 이 쓰는 식 그대로. */
|
|
private static String signedHost(URI endpoint)</tspan><tspan x="24" dy="22"> {
|
|
return endpoint.getHost();
|
|
}
|
|
|
|
/** ExternalRequestUrlResolver:57-63 이 쓰는 판정. 전선의 Host 가 따르는 규칙이</tspan><tspan x="24" dy="22">다. */
|
|
private static boolean defaultPort(String scheme, int port) {
|
|
return port < 0
|
|
|| ("https".equalsIgn</tspan><tspan x="24" dy="22">oreCase(scheme) && port == 443)
|
|
|| ("http".equalsIgnoreCase(scheme) && port == 80);
|
|
}
|
|
|
|
private static String</tspan><tspan x="24" dy="22"> expectedWireHost(URI endpoint) {
|
|
return defaultPort(endpoint.getScheme(), endpoint.getPort())
|
|
? endpoint.ge</tspan><tspan x="24" dy="22">tHost()
|
|
: endpoint.getHost() + ":" + endpoint.getPort();
|
|
}
|
|
|
|
public static void main(String[] args) throws Ex</tspan><tspan x="24" dy="22">ception {
|
|
HttpServer server = HttpServer.create(new InetSocketAddress("127.0.0.1", 0), 0);
|
|
AtomicReference<Strin</tspan><tspan x="24" dy="22">g> received = new AtomicReference<>("(받지 못함)");
|
|
server.createContext(PATH, exchange -> {
|
|
received.set(Stri</tspan><tspan x="24" dy="22">ng.valueOf(exchange.getRequestHeaders().getFirst("Host")));
|
|
byte[] ok = "{}".getBytes(StandardCharsets.UTF_8);
|
|
</tspan><tspan x="24" dy="22"> exchange.sendResponseHeaders(200, ok.length);
|
|
exchange.getResponseBody().write(ok);
|
|
exchange.close();
|
|
</tspan><tspan x="24" dy="22"> });
|
|
server.start();
|
|
int port = server.getAddress().getPort();
|
|
URI endpoint = URI.create("http://127.0.0.1:"</tspan><tspan x="24" dy="22"> + port);
|
|
String signed = signedHost(endpoint);
|
|
JdkNotificationHttpGateway gateway = new JdkNotificationHttpGate</tspan><tspan x="24" dy="22">way(Duration.ofSeconds(5));
|
|
|
|
try {
|
|
System.out.println();
|
|
System.out.println("[헤더 맵 세 모양으로 같은 </tspan><tspan x="24" dy="22">서버에 보낸다]");
|
|
Map<String, Map<String, String>> shapes = new LinkedHashMap<>();
|
|
shapes.put("매퍼가 실제로</tspan><tspan x="24" dy="22"> 보내는 넷", Map.of(
|
|
"content-type", "application/json", "x-amz-date", "20260903T000000Z",
|
|
"x-amz-co</tspan><tspan x="24" dy="22">ntent-sha256", "UNSIGNED-PAYLOAD", "authorization", "AWS4-HMAC-SHA256 ..."));
|
|
shapes.put("거기에 host 를 더한 것",</tspan><tspan x="24" dy="22"> Map.of("content-type", "application/json", "host", signed));
|
|
shapes.put("대문자 Host 로 더한 것", Map.of("content</tspan><tspan x="24" dy="22">-type", "application/json", "Host", signed));
|
|
for (var shape : shapes.entrySet()) {
|
|
received.set("(받지 못</tspan><tspan x="24" dy="22">함)");
|
|
NotificationHttpRequest request =
|
|
new NotificationHttpRequest("POST", URI.create(endpoint + P</tspan><tspan x="24" dy="22">ATH),
|
|
JdkNotificationHttpGateway.headers(shape.getValue()),
|
|
"{}".getBytes(StandardCharse</tspan><tspan x="24" dy="22">ts.UTF_8), Duration.ofSeconds(5));
|
|
int status = gateway.exchange(request).statusCode();
|
|
// 포트는 실행마</tspan><tspan x="24" dy="22">다 다르다. 재는 것은 두 값이 갈리느냐이므로 자리표시로 바꾼다.
|
|
System.out.printf(" %-22s 상태 %d · 서버가 받은</tspan><tspan x="24" dy="22"> Host %s%n",
|
|
shape.getKey(), status, received.get().replace(Integer.toString(port), "<포트>"));
|
|
}
|
|
</tspan><tspan x="24" dy="22"> System.out.printf(" %-22s %s%n", "서명 대상", signed);
|
|
System.out.printf(" %-22s %s%n", "둘이 같은가",
|
|
</tspan><tspan x="24" dy="22"> received.get().equals(signed) ? "예" : "아니오");
|
|
System.out.println();
|
|
|
|
System.out.println("[갈리는 조건</tspan><tspan x="24" dy="22"> — 위 규칙을 엔드포인트마다 적용한다]");
|
|
System.out.println(" 전선과 갈리면 서명이 어긋난다. 권한부는 갈려도 어</tspan><tspan x="24" dy="22">긋나지 않는 자리가 있다.");
|
|
System.out.printf(" %-46s %-14s %s%n", "엔드포인트", "전선과 갈리나", "권한부와 갈리</tspan><tspan x="24" dy="22">나");
|
|
URI[] endpoints = {
|
|
URI.create("https://email.eu-central-1.amazonaws.com"),
|
|
URI.create("http</tspan><tspan x="24" dy="22">s://email.eu-central-1.amazonaws.com:8443"),
|
|
URI.create("https://email.eu-central-1.amazonaws.com:443"),
|
|
</tspan><tspan x="24" dy="22"> URI.create("http://127.0.0.1:80"),
|
|
URI.create("https://user@email.example.com"),
|
|
URI.create("http://loc</tspan><tspan x="24" dy="22">alhost:4566"),
|
|
};
|
|
for (URI each : endpoints) {
|
|
String host = signedHost(each);
|
|
System.out.pr</tspan><tspan x="24" dy="22">intf(" %-46s %-16s %s%n", each,
|
|
host.equals(expectedWireHost(each)) ? "아니오" : "예",
|
|
host.equ</tspan><tspan x="24" dy="22">als(each.getAuthority()) ? "아니오" : "예");
|
|
}
|
|
} finally {
|
|
server.stop(0);
|
|
}
|
|
}
|
|
}
|
|
JAVA
|
|
javac -encod</tspan><tspan x="24" dy="22">ing UTF-8 -cp "$CP" -d "$D" "$D/SignedHostProbe.java"
|
|
java -Dstdout.encoding=UTF-8 -cp "$CP:$D" SignedHostProbe
|
|
</tspan></text>
|
|
<text x="24" y="1080" fill="#8b949e" font-size="13" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">cwd: /shared/codebase/clean-architecture-backend-template/src</tspan></text>
|
|
<text x="24" y="1102" fill="#8b949e" font-size="13" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">time: 2026-09-02T17:45:59+00:00 · exit 0</tspan></text>
|
|
<line x1="24" y1="1116" x2="1176" y2="1116" stroke="#30363d"/>
|
|
<text x="24" y="1156" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">openjdk version "21.0.12" 2026-07-21</tspan></text>
|
|
<text x="24" y="1178" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"></tspan></text>
|
|
<text x="24" y="1200" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">[헤더 맵 세 모양으로 같은 서버에 보낸다]</tspan></text>
|
|
<text x="24" y="1222" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> 매퍼가 실제로 보내는 넷 상태 200 · 서버가 받은 Host 127.0.0.1:<포트></tspan></text>
|
|
<text x="24" y="1244" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> 거기에 host 를 더한 것 상태 200 · 서버가 받은 Host 127.0.0.1:<포트></tspan></text>
|
|
<text x="24" y="1266" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> 대문자 Host 로 더한 것 상태 200 · 서버가 받은 Host 127.0.0.1:<포트></tspan></text>
|
|
<text x="24" y="1288" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> 서명 대상 127.0.0.1</tspan></text>
|
|
<text x="24" y="1310" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> 둘이 같은가 아니오</tspan></text>
|
|
<text x="24" y="1332" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"></tspan></text>
|
|
<text x="24" y="1354" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">[갈리는 조건 — 위 규칙을 엔드포인트마다 적용한다]</tspan></text>
|
|
<text x="24" y="1376" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> 전선과 갈리면 서명이 어긋난다. 권한부는 갈려도 어긋나지 않는 자리가 있다.</tspan></text>
|
|
<text x="24" y="1398" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> 엔드포인트 전선과 갈리나 권한부와 갈리나</tspan></text>
|
|
<text x="24" y="1420" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> https://email.eu-central-1.amazonaws.com 아니오 아니오</tspan></text>
|
|
<text x="24" y="1442" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> https://email.eu-central-1.amazonaws.com:8443 예 예</tspan></text>
|
|
<text x="24" y="1464" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> https://email.eu-central-1.amazonaws.com:443 아니오 예</tspan></text>
|
|
<text x="24" y="1486" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> http://127.0.0.1:80 아니오 예</tspan></text>
|
|
<text x="24" y="1508" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> https://user@email.example.com 아니오 예</tspan></text>
|
|
<text x="24" y="1530" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> http://localhost:4566 예 예</tspan></text>
|
|
</svg>
|