Replace Java authenticator with native eSignet 2.0 BREG provider

.dockerignore

@@ -0,0 +1,8 @@
+*
+!Dockerfile
+!go.mod
+!go.sum
+!provider/
+!provider/**
+!integration/
+!integration/**

.gitattributes

@@ -0,0 +1 @@
+*.patch -whitespace

.github/workflows/candidate.yml

@@ -0,0 +1,33 @@
+name: Candidate images
+
+# Candidate artifacts only. Publication and hosted cutover are separate actions.
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  candidate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+        with:
+          go-version: '1.26.0'
+          cache: true
+      - name: Verify core and adapter
+        run: |
+          go test -race ./...
+          go vet ./...
+          ./integration/test.sh
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      - name: Build both Linux architectures without publishing
+        run: ./integration/build.sh
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: esignet-breg-0.3.0-candidate
+          path: dist/
+          if-no-files-found: error
+          retention-days: 7

.github/workflows/ci.yml

@@ -2,19 +2,27 @@ name: CI
 
 on:
   push:
-    branches: [main, "claude/**"]
+    branches: [main]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
-      - name: Set up JDK 21
-        uses: actions/setup-java@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
-          distribution: temurin
-          java-version: "21"
-          cache: maven
-      - name: Build and test
-        run: mvn -B -ntp verify
+          go-version: '1.26.0'
+          cache: true
+      - name: Verify formatting
+        run: test -z "$(gofmt -l provider)"
+      - name: Core race tests and static checks
+        run: |
+          go test -race ./...
+          go vet ./...
+      - name: Pinned eSignet adapter checks
+        run: ./integration/test.sh

.gitignore

@@ -1,4 +1,9 @@
 target/
+build/
+dist/
+.cache/
+coverage.out
+*.test
 *.class
 *.jar
 *.log

CHANGELOG.md

@@ -0,0 +1,28 @@
+# Candidate changes
+
+## 0.3.0 candidate
+
+This breaking candidate replaces the unused Java/Maven authenticator with a
+native Go provider integrated into eSignet `v2.0.0-beta.1` at
+`df0d0e771dae16eb2597b8e5b5dc65e70baa7f86`.
+
+- BREG is the supported backend. A fixed governed lookup and explicit projection
+  replace Relay calls; Relay support is deferred.
+- Challenge verification precedes account lookup. Fresh consent gates all
+  demographic disclosure, including empty and restored flow states.
+- Stable pairwise subjects, bounded Mint private-key JWT authentication, and
+  JSON-safe encrypted host flow state replace custom KYC tokens.
+- eSignet owns signed and encrypted UserInfo. A minimal reviewed source patch
+  registers BREG, installs fresh consent, admits two required claim names, and
+  redacts OAuth query/referrer values from host access logs.
+- Strict YAML and mounted secret files replace Spring properties, signing
+  keystores and JAR injection. A synthetic OTP verifier is explicitly opt-in;
+  production verification is supplied through the Go interface.
+- Candidate build tooling exports Linux amd64 and arm64 OCI images with pinned
+  inputs, source metadata, checksums, SBOM and provenance. Local image loading
+  and a matching Solmara BREG journey are documented.
+
+No backwards compatibility with the Java configuration is provided. Historical
+release tags and published artifacts remain unchanged. This candidate does not
+publish images, deploy hosted services, implement production OTP delivery,
+enrollment, wallet login or identity assurance.

Dockerfile

@@ -0,0 +1,36 @@
+# syntax=docker/dockerfile:1@sha256:ecfaec9ed6d810b56388c508f4121597bfbba70d41a6dfeee4d8cad5f295fc32
+FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.26-bookworm@sha256:9fdc884aacc3bec89b20ffc69f4bb369c78210e3e4f600387b5128b12c199f81 AS build
+WORKDIR /src
+COPY go.mod go.sum ./
+COPY provider ./provider
+COPY integration ./integration
+RUN ./integration/prepare.sh /build/esignet
+WORKDIR /build/esignet/upstream/esignet-service
+RUN go mod download && go mod verify
+ARG TARGETOS
+ARG TARGETARCH
+RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -mod=readonly -trimpath -buildvcs=false -ldflags="-s -w" -o /out/esignet ./cmd/esignet
+
+FROM gcr.io/distroless/base-debian12:nonroot@sha256:7f0c72cd138b442ae0deeb69c08b1acf5525439ba251a49ad93c320a061567e5
+ARG CANDIDATE_SOURCE_SHA256=unrecorded
+ARG CANDIDATE_SOURCE_REVISION=unknown
+ARG CANDIDATE_SOURCE_STATE=unrecorded
+LABEL org.opencontainers.image.source="https://github.com/jeremi/esignet-relay-authenticator" \
+      org.opencontainers.image.version="0.3.0-candidate" \
+      org.opencontainers.image.revision=$CANDIDATE_SOURCE_REVISION \
+      io.registry.source.sha256=$CANDIDATE_SOURCE_SHA256 \
+      io.registry.source.state=$CANDIDATE_SOURCE_STATE \
+      io.registry.esignet.source="https://github.com/mosip/esignet" \
+      io.registry.esignet.revision="df0d0e771dae16eb2597b8e5b5dc65e70baa7f86" \
+      io.registry.esignet.version="2.0.0-beta.1"
+WORKDIR /home/mosip
+COPY --from=build --chown=65532:65532 /out/esignet /home/mosip/esignet
+COPY --from=build --chown=65532:65532 /build/esignet/upstream/esignet-service/data /home/mosip/data
+COPY --from=build /build/esignet/upstream/LICENSE /build/esignet/upstream/THIRD-PARTY-NOTICES.txt /licenses/esignet/
+ENV DATA_DIR=/home/mosip/data \
+    MOSIP_ESIGNET_AUTHN_PROVIDER=breg \
+    MOSIP_ESIGNET_AUTH_FLOW_ID=flow-breg-otp \
+    KEYMANAGER_KEYSTORE_TYPE=PKCS12
+USER 65532:65532
+EXPOSE 8080
+ENTRYPOINT ["/home/mosip/esignet"]