demo-secure

go service

A minimal HTTP service threaded through the Red Hat Advanced Developer Suite: RHDH golden-path scaffolding → Tekton build → RHTAS keyless signing → RHTPA SBOM scanning.

image signed (cosign + Fulcio) SBOM attested (CycloneDX) jwt-go vulnerable

Active JWT library: github.com/dgrijalva/jwt-go@v3.2.0+incompatible

GET /version

Build info plus the full dependency tree. Proves at runtime which jwt-go version is shipped.

GET /healthz

Liveness probe endpoint. Returns 200 OK while the process is up.

POST /verify

Send Authorization: Bearer <jwt> to exercise the JWT library — this is the call path RHTPA sees as in-use.