SPIRE

Try it in 3 steps

1. 1

   Clone v1.15.3 into a private area and build

   Provide Go 1.26.6 or later, make, Python 3, and GNU timeout (gtimeout from coreutils on macOS), then build the fixed tag in a unique private temporary area.

   umask 077 && spire_demo_dir=$(mktemp -d "${TMPDIR:-/tmp}/spire-demo.XXXXXX") && cd "$spire_demo_dir" && git clone --branch v1.15.3 --depth 1 https://github.com/spiffe/spire.git && cd spire && go_version=$(go env GOVERSION) && awk -v v="${go_version#go}" 'BEGIN{split(v,a,".");exit !((a[1]>1)||(a[1]==1&&a[2]>26)||(a[1]==1&&a[2]==26&&a[3]>=6))}' && timeout_bin=$(command -v timeout || command -v gtimeout) && test -n "$timeout_bin" && make bin/spire-server bin/spire-agentCopy
2. 2

   Prepare an isolated localhost configuration

   Create evaluation configs with unique data directories, sockets, and a free localhost port, without shared PID or token files.

   spire_port=$(python3 -c 'import socket;s=socket.socket();s.bind(("127.0.0.1",0));print(s.getsockname()[1]);s.close()') && run_dir="$spire_demo_dir/run" && server_conf="$spire_demo_dir/server.conf" && agent_conf="$spire_demo_dir/agent.conf" && mkdir -p "$run_dir" "$spire_demo_dir/server-data" "$spire_demo_dir/agent-data" && cp conf/server/server.conf "$server_conf" && cp conf/agent/agent.conf "$agent_conf" && sed -i.bak -e "s#bind_port = \"8081\"#bind_port = \"$spire_port\"#" -e "s#/tmp/spire-server/private/api.sock#$run_dir/server.sock#" -e "s#data_dir = \"./.data\"#data_dir = \"$spire_demo_dir/server-data\"#" "$server_conf" && sed -i.bak -e "s#server_port = \"8081\"#server_port = \"$spire_port\"#" -e "s#/tmp/spire-agent/public/api.sock#$run_dir/agent.sock#" -e "s#data_dir = \"./.data\"#data_dir = \"$spire_demo_dir/agent-data\"#" "$agent_conf"Copy
3. 3

   Fetch an SVID and always reap the owned processes

   Start both processes inside one subshell, bound each request with GNU timeout, and fetch an X.509-SVID. On success or failure, cleanup kills and waits only for the owned PIDs, while the caller's trap remains intact.

   ( set -e; s= a=; cleanup(){ for p in "$a" "$s"; do test -z "$p" || kill "$p" 2>/dev/null || true; done; for p in "$a" "$s"; do test -z "$p" || wait "$p" 2>/dev/null || true; done; }; ready(){ for i in 1 2 3 4 5 6 7 8 9 10; do "$timeout_bin" 2s "$@" >/dev/null 2>&1 && return; sleep 1; done; return 1; }; trap cleanup EXIT INT TERM; ./bin/spire-server run -config "$server_conf" >"$spire_demo_dir/server.log" 2>&1 & s=$!; ready ./bin/spire-server healthcheck -socketPath "$run_dir/server.sock"; token=$("$timeout_bin" 5s ./bin/spire-server token generate -socketPath "$run_dir/server.sock" -spiffeID spiffe://example.org/myagent | awk '/Token:/{print $2}'); test -n "$token"; ./bin/spire-agent run -config "$agent_conf" -joinToken "$token" >"$spire_demo_dir/agent.log" 2>&1 & a=$!; ready ./bin/spire-agent healthcheck -socketPath "$run_dir/agent.sock"; "$timeout_bin" 5s ./bin/spire-server entry create -socketPath "$run_dir/server.sock" -parentID spiffe://example.org/myagent -spiffeID spiffe://example.org/demo -selector "unix:uid:$(id -u)"; "$timeout_bin" 10s ./bin/spire-agent api fetch x509 -socketPath "$run_dir/agent.sock" )Copy

Built with

• Go

Categories and tags

GitHub data

Share a guide or use case for this OSS in Markdown. Articles are published after administrator approval.

Explore next

• Passbolt6,147 Stars

  2 shared tag(s) · 1 shared category(s)

  share and audit team credentials with user-owned keys and end-to-end encryption

  PHP
• Defguard2,856 Stars

  2 shared tag(s) · 1 shared category(s)

  combine WireGuard, identity, MFA, and firewall policy in a self-hosted access platform

  Rust
• FreeIPA1,288 Stars

  2 shared tag(s) · 1 shared category(s)

  centralize Linux identity and access with LDAP, Kerberos, PKI, DNS, sudo, and access-control policy

  Python
• ZITADEL15,189 Stars

  1 shared tag(s) · 2 shared category(s) · Same language

  manage SSO, MFA, passkeys, and B2B multi-tenancy through an API-first IAM

  Go
• Trivy38,215 Stars

  1 shared tag(s) · 1 shared category(s) · Same language

  Scan images, filesystems, repositories, VMs, and Kubernetes for CVEs, secrets, IaC issues, and licenses

  Go
• HashiCorp Vault36,337 Stars

  1 shared tag(s) · 1 shared category(s) · Same language

  manage secret storage, issuance, encryption, leases, and revocation under one policy model

  Go