vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

push green meta builds to the attic cache and record cached

Browse source
This commit is contained in:
atlas 2026-10-27 10:12:35 +01:00
commit 0849afec80
1 changed files with 779 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

11
nix/module-eval/bao-grants.nix
View file

@ -1743,17 +1743,18 @@ let
];
}
{
# The builder reads its forge token and its own queue client secret,
# each read-only and spelled to the leaf: `services/*` would reach every
# swarm service's secret.
name = "the swarm builder's grant is its forge token and its queue client secret, and nothing else";
# The builder reads its forge token, the cache push token and its own queue
# client secret, each read-only and spelled to the leaf: `services/*` would
# reach every swarm service's secret.
name = "the swarm builder's grant is its forge token, the cache push token and its queue client secret, and nothing else";
ok =
let
s = baoGrantHere.systemd.services.swarm-bao-builder-policy.script;
in
lib.hasInfix "path \"secret/data/swarm/services/builder/forge/token\" {\n capabilities = [\"read\"]\n}" s
&& lib.hasInfix "path \"secret/data/swarm/services/attic/push-token\" {\n capabilities = [\"read\"]\n}" s
&& lib.hasInfix "path \"secret/data/swarm/services/swarm-builder/oidc/client\" {\n capabilities = [\"read\"]\n}" s
&& lib.length (lib.filter lib.isList (builtins.split "path \"" s)) == 2
&& lib.length (lib.filter lib.isList (builtins.split "path \"" s)) == 3
&& !(lib.hasInfix "secret/data/swarm/services/*" s)
&& lib.hasInfix "auth/cert/certs/swarm-builder" s
&& lib.hasInfix "allowed_common_names=swarm-builder" s