mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

store_seeded: report a failed read instead of minting over it

Browse source
This commit is contained in:
atlas 2026-11-03 13:26:02 +01:00 • committed by mara
commit 5f9629dfc7
1 changed files with 113 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

27
nix/host-modules/lib/store-seeded-secret.nix
View file

@ -5,7 +5,8 @@
#
# `store_seeded` prints the value and never rotates one: the store is written
# with `-cas=0`, so only a leaf that holds nothing takes a value, and a lost
# race reads the winner's back.
# race reads the winner's back. A read of the leaf that fails for any reason
# but "No value found" prints the store's error and neither mints nor writes.
#
# Pure function — NOT a NixOS module. Call it from a module's `let`:
#
@ -17,7 +18,7 @@
# key="$(store_seeded secret/swarm/services/foo/key /var/lib/foo/key mint_key)" || exit 1
# '';
#
# Needs `bao` and `coreutils` on the caller's `path` and the `BAO_*` client
# Needs `bao`, `coreutils` and `gnugrep` on the caller's `path` and the `BAO_*` client
# environment set. Takes the EXIT trap, to remove its scratch file.
{ }:
''
@ -48,15 +49,31 @@
}
# <leaf> <earlier file> <mint command…>. The value on stdout; status 1 when
# neither the store nor the file can give one.
# neither the store nor the file can give one. `kv get` exits 2 both for a
# leaf that holds nothing ("No value found at <path>") and for a refused
# read, so only that message means absent. Any other failure of the first
# read, the `timeout` (124) included, neither mints nor writes: the file's
# value is used when it has one, and the call fails when it has none.
store_seeded() {
local leaf="$1" earlier="$2" value candidate
local leaf="$1" earlier="$2" value candidate rc=0
shift 2
if [ "$STORE_UP" = 1 ]; then
if value="$(store_bao kv get -field=value "$leaf" 2>"$STORE_ERR")" && [ -n "$value" ]; then
value="$(store_bao kv get -field=value "$leaf" 2>"$STORE_ERR")" || rc=$?
if [ "$rc" = 0 ] && [ -n "$value" ]; then
printf '%s' "$value"
return 0
fi
if [ "$rc" != 0 ] && ! grep -q '^No value found at ' "$STORE_ERR"; then
echo "could not read $leaf from the swarm secret store (exit status $rc):" >&2
cat "$STORE_ERR" >&2
if [ -s "$earlier" ]; then
echo "using the value of $earlier for $leaf; nothing is written to the store." >&2
printf '%s' "$(< "$earlier")"
return 0
fi
echo "no value for $leaf in the store or at $earlier." >&2
return 1
fi
if [ -s "$earlier" ]; then
candidate="$(< "$earlier")"
echo "storing the value of $earlier in $leaf." >&2