mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-c0re pulls closures through the nix daemon; hive-priv verifies the swarm signature before applying

Browse source
This commit is contained in:
atlas 2026-11-07 13:20:55 +01:00 • committed by mara
commit ecd4445680
1 changed files with 1257 additions and 584 deletions
Download patch file Download diff file Expand all files Collapse all files

24
hive-priv/src/container.rs
View file

@ -207,9 +207,10 @@ async fn destroy_container_with(host: &Host<impl Spawn>, name: &str) -> Result<(
}
/// Shared body for `CreateContainer` / `UpdateContainer`: validate the name
/// and that `toplevel` is the closure realised for the agent, and apply it (streaming line events to `writer` when
/// `stream` is set). Nothing is built here: `toplevel` is a closure already in
/// the store, which `RealiseClosure` put there.
/// and that `toplevel` is in the store with a signature by the swarm cache's
/// key, and apply it (streaming line events to `writer` when `stream` is set).
/// Nothing is built here: `toplevel` is a closure already in the store, which
/// hive-c0re pulled through the nix daemon.
///
/// `create` passes `--system-path` so `nixos-container`'s own `buildFlake()`
/// never runs; it builds to a relative `.tmp` out-link that concurrent calls
@ -228,12 +229,12 @@ pub(crate) async fn container_toplevel_action(
writer: &mut OwnedWriteHalf,
) -> Result<(String, String)> {
validate_agent_name(name)?;
let toplevel = crate::closure::applicable_for(name, toplevel)?;
let toplevel = crate::closure::applicable_for(name, toplevel).await?;
apply_toplevel(&Host::REAL, verb, name, toplevel, stream, writer).await
}
/// [`container_toplevel_action`] past the check that `toplevel` is the
/// closure realised for `name`.
/// [`container_toplevel_action`] past the check that `toplevel` is signed by
/// the swarm cache's key.
async fn apply_toplevel(
host: &Host<impl Spawn>,
verb: &str,
@ -987,11 +988,12 @@ mod host_tests {
// ---- the apply gate ----
/// Only the closure realised for the agent is applied. Nothing is
/// realised for these names, so each request is refused at the gate: the
/// message is the gate's, not a `nixos-container` failure.
/// Only a closure the swarm key signed is applied. A test has no swarm key
/// at the root path, so each request is refused at the gate: the message
/// is the gate's, not a `nixos-container` failure. The signed and unsigned
/// verdicts are tested in `closure`.
#[tokio::test]
async fn an_unrealised_or_foreign_closure_is_refused_at_the_gate() {
async fn a_closure_without_the_swarm_key_to_check_it_against_is_refused_at_the_gate() {
for verb in ["create", "update"] {
let (writer, _peer) = &mut pipe();
let err = container_toplevel_action(verb, "never-realised", TOPLEVEL, false, writer)
@ -999,7 +1001,7 @@ mod host_tests {
.unwrap_err();
let msg = format!("{err:#}");
assert!(
msg.contains("is not the closure realised for this agent (none)"),
msg.contains(&format!("never-realised: refusing {TOPLEVEL}")),
"{verb}: {msg}"
);
}