Ockam is a framework for building secure, interconnected systems that provides identity-based end-to-end encrypted communication, secure channel establishment, and policy-based access control. The architecture features clear separation of concerns with modules for core types, identity management, secure channels, transport abstractions, vault cryptography, API orchestration, and a command-line interface. Implemented primarily in Rust with Elixir components, it uses async/await and OTP patterns for concurrency. Key entry points include the ockam CLI, node builder/context, and orchestrator API. The system enables secure multi-hop routing, message forwarding, and service integration with external systems like Kafka and InfluxDB.
Pomerium is an identity-aware access proxy that provides zero-trust security for internal web applications and services. It acts as a reverse proxy that authenticates users via OIDC/OAuth2 providers, authorizes access based on policy rules (Pomerium Policy Language evaluated via OPA/Rego), and proxies HTTP, gRPC, WebSocket, and SSH traffic. The system is built as a multi-service architecture with gRPC-based inter-service communication, using Envoy as the underlying proxy engine. Key components include an authentication service, authorization service with policy evaluator, a distributed databroker for session/config storage (with Raft consensus), and a control plane that generates Envoy configuration dynamically. It supports multiple identity providers (Google, Okta, Azure, Auth0, etc.), mTLS client certificates, WebAuthn, and SSH tunneling with a TUI client. The codebase also includes a Model Context Protocol (MCP) implementation for AI tool access control, and a 'Zero' cloud-managed mode for enterprise deployments. External dependencies include Envoy, PostgreSQL, Pebble (RocksDB), and cloud blob storage (S3, GCS, Azure Blob). Architecturally, Pomerium follows a modular design with clear separation of concerns: configuration management (layered sources, validation, envoy config builders), policy engine (parser, generator, criteria matchers), storage abstraction (in-memory, file, postgres, blob with caching and querier patterns), telemetry (OpenTelemetry, Prometheus, health checks), and utility packages (cryptography, HTTP, gRPC, protobuf, retry, fanout). The system is highly configurable with runtime flags and supports hot-reload via config diffing. The codebase demonstrates strong engineering practices with extensive unit, integration, and end-to-end tests (Playwright-based acceptance suites). Data flows: Incoming requests are intercepted by Envoy, which forwards them to the Pomerium proxy service. The proxy authenticates the user via the authenticate service (OIDC/OAuth2 flows), then authorizes via the authorize service (policy evaluation with OPA/Rego). Session and user data are stored in the databroker (distributed key-value store with Raft replication). Configuration is managed centrally and distributed to all services via gRPC streams. Telemetry data (traces, metrics, logs) is exported via OpenTelemetry and Prometheus.
This is a Go library implementing the SPIFFE Workload API for workload identity management and secure communication. It provides client libraries to fetch X.509-SVIDs, JWT-SVIDs, and trust bundles from a Workload API agent (typically SPIRE). The library offers high-level TLS dial/listen functions (spiffetls) with various authentication modes (mTLS, TLS with JWT), supporting both Unix sockets and Windows named pipes. Core packages include spiffeid (SPIFFE ID parsing and matching), svid (SVID parsing and validation), bundle (trust bundle management), workloadapi (Workload API client and credential source watchers), and federation (remote trust domain bundle fetching). The architecture is modular with clear interfaces (Source, Authorizer, Logger, Backoff) that allow swapping backends. The code is well-tested with extensive unit tests and integration test helpers. Experimental features include WIT-SVIDs and a Broker API. This library is a critical component for any workload that needs SPIFFE-based identity in a zero-trust environment.
GoTrue is a self-contained user registration and authentication API written in Go. It provides endpoints for signup, login (via email/password or OAuth2 providers like GitHub, GitLab, Google, Bitbucket, Facebook), token refresh, password recovery, email verification, and user management (CRUD for admin users). The architecture is a monolithic HTTP API using the chi router, backed by a MySQL database (via pop/v5 ORM) and a configurable mailer (SMTP or noop). It supports both single-tenant and multi-tenant deployments, with JWT-based authentication (HS256) and optional SAML SSO. The codebase is well-organized into packages: api for HTTP handlers, models for database entities, conf for configuration, mailer for email sending, and crypto for security utilities. It includes extensive unit tests and integration tests using a MySQL test database.
This repository provides a comprehensive Solidity implementation of the ERC-734 (Key Holder) and ERC-735 (Claim Holder) standards for decentralized on-chain identities. It includes a core Identity contract that manages cryptographic keys (management, action, claim, encryption) and claims (issuance, storage, revocation), along with a ClaimIssuer contract for issuing and revoking claims. The system supports proxy-based upgradeability via an ImplementationAuthority and IdentityProxy, allowing identity contracts to be upgraded without losing state. A factory contract (IdFactory) enables deterministic deployment of identity proxies using CREATE2, with support for wallet linking and token identity creation. A Gateway contract provides an off-chain authorization layer for identity deployment, managing approved signers and signature revocation. A Verifier contract allows other contracts to verify that an identity holds valid claims from trusted issuers for required topics. The architecture is modular, well-tested, and follows security best practices including signature malleability protection. It is designed for use in decentralized identity (DID) systems on EVM-compatible blockchains.
Ethr-DID is a TypeScript library that provides a high-level abstraction for creating, managing, and using `did:ethr` decentralized identifiers on Ethereum. It wraps the `ethr-did-resolver` and `did-jwt` libraries to enable operations such as signing and verifying JSON Web Tokens (JWTs), changing the owner of a DID, adding or revoking delegate signers, and setting or revoking public attributes (keys, services) on the Ethereum DID Registry smart contract. The library supports multiple Ethereum networks (mainnet, testnets, custom chains) and meta-transactions for gasless operations. It is designed for developers building self-sovereign identity solutions on Ethereum, particularly within the Veramo ecosystem. The codebase is well-tested with Jest and Ganache, uses modern ES modules and TypeScript, and follows semantic versioning with automated releases.
MaxKey is an enterprise-grade Identity and Access Management (IAM) / Single Sign-On (SSO) platform written in Java (Spring Boot) with Angular frontends. It supports a comprehensive set of authentication protocols (OAuth 2.0/OpenID Connect, SAML 2.0, CAS, JWT, form-based, token-based) and identity federation standards (SCIM 2.0, LDAP, Active Directory). The codebase is organized as a multi-module Maven project with clear separation between authentication providers, protocol implementations, persistence layer, and web UIs. Architecturally, it follows a service-oriented model with a custom OAuth2 stack (derived from Spring Security OAuth), MyBatis JPA for persistence, and Redis/Caffeine for caching. The frontends are built on NG-ALAIN (Angular 17) and share a common base for user portal and admin console. While the system is functionally rich and actively maintained, it contains some duplicated code across modules and relies on a legacy OAuth2 implementation that has been superseded by Spring Security 5+. The crypto utilities, OTP infrastructure, and adapter patterns are well-structured and demonstrate non-obvious craftsmanship.
This repository is a curated 'awesome' list of falsehoods programmers believe in. It is not a software application or data pipeline; it is a markdown-based collection of links to external articles, libraries, and resources organized by topic (dates, names, geography, etc.). The repository contains no executable code, no API endpoints, no CLI tools, and no data transformations. Its value lies in the curation and editorial quality of the links, along with a well-documented contribution guide and automated linting workflows (lychee for link checking, typos for spelling, awesome-lint for list formatting). The infrastructure includes GitHub Actions for autofix, autolock, docs, labels, and linting, all reused from a shared workflow repository (kdeldycke/repomatic). The pyproject.toml provides reusable configuration for link exclusion patterns and typo detection. While not a software project, the repository demonstrates high standards for maintaining a community-curated resource.