mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-c0re pulls closures through the nix daemon; hive-priv verifies the swarm signature before applying

Browse source
This commit is contained in:
atlas 2026-11-07 13:20:55 +01:00 • committed by mara
commit ecd4445680
1 changed files with 1257 additions and 584 deletions
Download patch file Download diff file Expand all files Collapse all files

17
hive-priv/README.md
View file

@ -46,15 +46,14 @@ Each module's `//!` header lists its ops.
`container_toplevel_action` (in `src/container.rs`) applies a closure that is
already in the store; hive-priv builds nothing. hive-c0re names the closure
(`toplevel` on `CreateContainer` / `UpdateContainer`), downloaded beforehand
with `RealiseClosure`. hive-priv remembers, per agent, the path its last
successful `RealiseClosure` returned (in memory), and applies only that path to
that agent. It refuses a path never realised for the agent, another agent's
and the host's own, and logs an error naming the agent and both paths. A
restart between the download and the apply empties the record, so the apply
fails and the job retries. hive-priv does not re-check the signature at apply
time: `RealiseClosure` enforces it, and the binding limits an apply to what that
call stored.
(`toplevel` on `CreateContainer` / `UpdateContainer`), pulled beforehand by
hive-c0re through the nix daemon. hive-priv applies a path only when
`nix store verify --no-contents --sigs-needed 1`, with the key in root-owned
`/run/hyperhive-priv/attic/public-key`, finds the swarm cache's signature on it.
It refuses a path that is absent, unsigned, signed by another key or not a store
path, and logs an error naming the agent and the path. hive-priv keeps no record
of what was pulled, so a restart between the pull and the apply loses nothing.
`RefreshCacheFacts` starts the root unit that refreshes the cache facts.
`create` passes the path to `nixos-container create --system-path`, so
`nixos-container`'s own `buildFlake()` never runs. Without the flag, it builds