vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

module-eval: bao-grants counts the eighteen granting units

Browse source
This commit is contained in:
atlas 2026-10-13 10:18:34 +02:00
commit 47d3ccfede
1 changed files with 8 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

16
nix/module-eval/bao-grants.nix
View file

@ -169,7 +169,7 @@ let
_: u: (u.environment.BAO_CLIENT_CERT or null) == granterCertFile
) baoGrantWithConsumers.systemd.services;
# The seventeen units that write a `swarm-*` grant, by name, for the discovery
# The eighteen units that write a `swarm-*` grant, by name, for the discovery
# control below.
grantingUnitNames = [
"swarm-bao-controller-policy"
@ -942,24 +942,24 @@ let
}
{
# A store host without the granter's pair writes its grants some other
# way, so none of the seventeen units may exist. Without this arm
# way, so none of the eighteen units may exist. Without this arm
# `lib.mkIf haveGranter` could be dropped from any of them and every other
# case here would still pass.
name = "without the granter's pair none of the seventeen granting units render";
name = "without the granter's pair none of the eighteen granting units render";
ok =
let
s = baoGranterOptOut.systemd.services;
in
lib.all (unit: !(s ? ${unit})) (grantingUnitNames ++ [ "swarm-bao-granter-role" ])
# The control: the same store with the pair renders all seventeen.
# The control: the same store with the pair renders all eighteen.
&& lib.all (unit: baoGrantHere.systemd.services ? ${unit}) grantingUnitNames;
}
{
# 🩸 What replaced the silent skip. With no bootstrap token the seventeen still
# 🩸 What replaced the silent skip. With no bootstrap token the eighteen still
# render, and a refused granter fails them with the step that fixes it.
# A store host that never named a token is told to name one, since the
# unit that sets the granter up renders only where it has.
name = "a store host without a bootstrap token renders the seventeen, each failing loudly with the one-time step";
name = "a store host without a bootstrap token renders the eighteen, each failing loudly with the one-time step";
ok =
let
s = baoGranterNoToken.systemd.services;
@ -1774,8 +1774,8 @@ let
}
{
# What makes the case above mean something: discovery by the granter's
# certificate reaches all seventeen units, and each yields calls.
name = "the granter-policy check sees all seventeen granting units, and parses calls from each";
# certificate reaches all eighteen units, and each yields calls.
name = "the granter-policy check sees all eighteen granting units, and parses calls from each";
ok =
lib.sort lib.lessThan (lib.attrNames granterUnits) == lib.sort lib.lessThan grantingUnitNames
&& lib.all (u: baoCalls u.script != [ ]) (lib.attrValues granterUnits)