mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

attic-init: replace the stored public key with the one the cache reports

Browse source 
a re-created cache signs with a new key; the fact was only created once, so
every hive then rejected the swarm's closures. the cache's grant gains update
on that one leaf, and a store that refuses it leaves the key as it was.

Closes #6181
This commit is contained in:
atlas 2026-11-07 07:32:28 +01:00 • committed by mara
commit b0f6ccaa64
1 changed files with 159 additions and 75 deletions
Download patch file Download diff file Expand all files Collapse all files

10
nix/module-eval/bao-grants.nix
View file

@ -2129,10 +2129,10 @@ let
}
{
# The cache's host units create each of its six secrets and read them
# back, and may not replace one: no `update`. Its container's journal
# forwarder reads its own client secret, read only. The notification
# router's grant is the control that `grantsIn` reads a one-path grant too.
name = "the cache's grant is create and read on its signing key, its two tokens and its three public facts, read on its forwarder client, and nothing else";
# back, and replace only the public key: `update` there and nowhere else.
# Its container's journal forwarder reads its own client secret, read
# only. The notification router's grant is the control that `grantsIn` reads a one-path grant too.
name = "the cache's grant is create and read on its signing key, its two tokens and its three public facts, update on its public key only, read on its forwarder client, and nothing else";
ok =
let
s = baoGrantHere.systemd.services.swarm-bao-attic-policy.script;
@ -2147,7 +2147,7 @@ let
&& (grantFor grants "secret/data/swarm/services/attic/pull-token").caps == caps
&& (grantFor grants "secret/data/swarm/services/attic/url").caps == caps
&& (grantFor grants "secret/data/swarm/services/attic/cache").caps == caps
&& (grantFor grants "secret/data/swarm/services/attic/public-key").caps == caps
&& (grantFor grants "secret/data/swarm/services/attic/public-key").caps == caps ++ [ "update" ]
&&
(grantFor grants "secret/data/swarm/services/swarm-attic-collector/oidc/client").caps == [ "read" ]
&& lib.length grants == 7