mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-archive: forget future-dated snapshots before each prune; fix the grants case

Browse source 
A client chooses a snapshot's time, so snapshots dated ahead could fill
--keep-last and push the real ones out of a prune. The prune now forgets
snapshots dated more than an hour after now first, and logs their ids. The
VM test forges one and checks the real snapshot stays. The bao-grants case
that read a + path as a glob now names the literal path, and two cases that
pinned 'nothing else' list the archive grants. The ciRunner stanza is back
at its original indent.
This commit is contained in:
atlas 2026-11-10 08:32:54 +01:00
commit 793d987a88
1 changed files with 87 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

33
nix/module-eval/bao-grants.nix
View file

@ -1587,7 +1587,7 @@ let
# `update` on its own role and `read` on its own two cache facts and its own
# squid self-check credential, and each
# hive's block names neither the other's role nor its subject.
name = "each hive's gateway-leaf identity may issue from its own role and read its own two cache facts and squid self-check credential, and nothing else";
name = "each hive's gateway-leaf identity may issue from its own role, read its own two cache facts, squid self-check credential and archive grants, and list those grants, and nothing else";
ok =
let
s = baoGrantTwoHives.systemd.services.swarm-bao-hive-leaf-policy.script;
@ -1629,6 +1629,14 @@ let
path = "secret/data/swarm/hives/h1/squid-selfcheck";
caps = [ "read" ];
}
{
path = "secret/data/swarm/hives/h1/archive/*";
caps = [ "read" ];
}
{
path = "secret/metadata/swarm/hives/h1/archive/";
caps = [ "list" ];
}
{
path = "pki/issue/swarm-hive-leaf-h2";
caps = [ "update" ];
@ -1645,6 +1653,14 @@ let
path = "secret/data/swarm/hives/h2/squid-selfcheck";
caps = [ "read" ];
}
{
path = "secret/data/swarm/hives/h2/archive/*";
caps = [ "read" ];
}
{
path = "secret/metadata/swarm/hives/h2/archive/";
caps = [ "list" ];
}
]
&& issues "h1" "h1.t.local" h1
&& issues "h2" "h2.example.org" h2
@ -1853,7 +1869,7 @@ let
# segment, which keeps each stanza to its one leaf; a `*` is a glob only
# at the end of a path. Pinned as whole stanzas, so an added capability
# fails.
name = "the controller writes each hive's sender and forge tokens, creates its squid self-check credential, and nothing else under hives";
name = "the controller writes each hive's sender and forge tokens, creates its squid self-check credential, manages its archive grants, and nothing else under hives";
ok =
let
s = baoGrantHere.systemd.services.swarm-bao-controller-policy.script;
@ -1862,7 +1878,12 @@ let
&& lib.hasInfix "path \"secret/data/swarm/hives/+/forge/token\" {\n capabilities = [\"create\", \"read\", \"update\"]\n}" s
&& lib.hasInfix "path \"secret/data/swarm/hives/+/squid-selfcheck\" {\n capabilities = [\"create\", \"read\"]\n}" s
&& !(lib.hasInfix "secret/data/swarm/hives/*" s)
&& !(lib.hasInfix "secret/metadata/swarm/hives" s);
# The only metadata it reaches under hives is the archive grants: list and delete.
&& lib.hasInfix "path \"secret/metadata/swarm/hives/+/archive/\" {\n capabilities = [\"list\"]\n}" s
&& lib.hasInfix "path \"secret/metadata/swarm/hives/+/archive/+\" {\n capabilities = [\"delete\"]\n}" s
&& lib.all (g: lib.hasInfix "/archive/" g.path) (
lib.filter (g: lib.hasPrefix "secret/metadata/swarm/hives" g.path) (grantsIn s)
);
}
{
# `attic_copy` reads the cache's four facts and writes each into every
@ -2192,9 +2213,9 @@ let
&& lib.hasInfix "allowed_common_names=swarm-archive" s
&& lib.hasInfix "token_policies=swarm-archive" s
&& lib.elem "create" (grantFor c "secret/data/swarm/services/archive/users/atlas").caps
&& lib.elem "create" (grantFor c "secret/data/swarm/hives/h1/archive/atlas").caps
&& (grantFor c "secret/metadata/swarm/hives/h1/archive/atlas").caps == [ "delete" ]
&& (grantFor c "secret/metadata/swarm/services/archive/users/atlas").caps == [ "delete" ]
&& lib.elem "create" (grantFor c "secret/data/swarm/hives/+/archive/*").caps
&& (grantFor c "secret/metadata/swarm/hives/+/archive/+").caps == [ "delete" ]
&& (grantFor c "secret/metadata/swarm/services/archive/users/+").caps == [ "delete" ]
&& !(lib.elem "delete" (grantFor c "secret/data/swarm/services/archive/restic/atlas").caps);
}
{