mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

derive a missing client digest from the secret that exists

Browse source 
A client with a secret in the store or in a leftover file but no digest gets the digest of that secret instead of stopping the unit. The password reaches authelia's prompt through a pty, not argv. A lost mint race takes the winner's secret. Also name the mint, not the publisher, in the remaining rust docs.
This commit is contained in:
atlas 2026-10-30 04:17:29 +01:00 • committed by mara
commit 05665c05f3
1 changed files with 127 additions and 57 deletions
Download patch file Download diff file Expand all files Collapse all files

8
swarm-secret-client/src/queue.rs
View file

@ -44,8 +44,9 @@ pub fn agent_queue_path(agent: &str) -> Result<String, Error> {
/// Under [`Kind::Controller`] because no hive's policy reads that kind, and
/// this client may read every hive's status.
///
/// The nix half is `swarm-secret-publisher.nix`, which writes it, and
/// `swarm-bao.nix`'s `controllerPolicyText`, which grants the read.
/// The nix half is `swarm-secret-publisher.nix`, which lists the path
/// authelia's mint writes it at, and `swarm-bao.nix`'s `controllerPolicyText`,
/// which grants the read.
///
/// # Errors
/// Never in practice: the name segment is a constant. The `Result` is
@ -70,7 +71,8 @@ pub struct ControllerCredential {
/// Under the hive's own prefix, which the hive's policy reads
/// ([`crate::policy::render_shared_hives`]).
///
/// The nix half is `swarm-secret-publisher.nix`, which writes it.
/// The nix half is `swarm-secret-publisher.nix`, which lists the path authelia's
/// mint writes it at.
///
/// # Errors
/// [`Error::PathSegment`] when `hive` contains anything but `[A-Za-z0-9_-]`.