zorin-access-broker

Verifier and operating-system bridge for Zorin Trust.

0.2

0.2 adds an opt-in PAM path for Linux. The broker can request an explicit owner approval from the local Host Agent and then independently verify the returned ZOWNER/1 proof against a root-owned trusted-phone registry.

The PAM helper does not receive or inspect the user’s password. It consumes the PAM context exported by pam_exec (PAM_USER, PAM_SERVICE, PAM_RHOST, PAM_TTY, PAM_TYPE) and maps it to a transaction-bound Zorin Trust action/resource.

sudo requests use:

os.sudo.authorize
user:<name>:service:sudo

Other PAM authentication requests use:

os.pam.authenticate
user:<name>:service:<pam-service>

Privileged enrollment

A root trust registry must exist before PAM can grant access. enroll-pam requests an explicit credential.owner-proof, requires the operator to provide the expected phone fingerprint, validates the proof, and only then writes the root-owned registry.

sudo zorin-access-broker enroll-pam \
  --state-dir /home/ivan/.config/ZorinTrust \
  --registry /etc/zorin-trust/trusted-phones.json \
  --expected-fingerprint '....'

The Linux desktop release wraps this in its opt-in PAM installer.

Standalone proof verification

The original server-side commands remain available:

• verify — verify a short-lived owner proof against a broker registry;
• trust-proof — explicitly enroll the phone identity carried by a proof;
• trust-phone — manually enroll a DER public key;
• list — list trusted phone fingerprints.

Source