vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

remove the hive-c0re forge-credential chain nothing reads any more

Browse source 
With no nix build on the hive, the boot publish of the forge token for nix has no reader. Removes the ForgeSweep node, the token file, the git credential helper and hive-c0re's forge gitconfig sections.
This commit is contained in:
atlas 2026-10-29 22:55:31 +01:00
commit 221c3f35a1
1 changed files with 69 additions and 310 deletions
Download patch file Download diff file Expand all files Collapse all files

13
docs/integrations/forge.md
View file

@ -69,14 +69,11 @@ forge container:
- seeding `proposed` from `agent-configs/<agent>` on first deploy
- cloning and pulling `/knowledge`
The builds read as the hive's account too. nix fetches the config inputs and
`internal/meta` with `git`, and `git` gets its credential from
`git-credential-hive-forge`, which reads `/run/hyperhive/forge-hive-token`.
hive-c0re writes that file (account on the first line, token on the second)
from the hive's store token at each boot and each `internal/meta` read, when its
content differs. A hive whose store holds no token has no such file, fetches
nothing private through nix and fails its builds: they have no other flake than
`internal/meta`. This also holds on a hive with no forge container.
The hive builds nothing, so no nix process reads the forge as the hive's
account. hive-c0re hands the token to each `git` command it runs
(`http.extraHeader`) and keeps no copy on disk. A hive whose store holds no token
reads nothing private from the forge. This also holds on a hive with no forge
container.
Roll a change to any of this out store host first (its granter writes the
controller's grant on `swarm/hives/+/forge/token`), then the controller host,