vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

module-eval: accept the agent's live bao pair as a store path

Browse source 
`agent-matrix`'s "handed store paths and never store values" case
required every `BAO_*` entry on hive-matrix-daemon to be `BAO_ADDR` or a
`%d/` credential path. The daemon now presents the live pair that
hive-agent-bao-identity keeps in /run/hive-agent-bao-identity/current,
because a `LoadCredential=` copy is taken at unit start and would never
see a re-issued leaf. So the case failed on a path, not on a value.

It now also accepts exactly that pair: BAO_CLIENT_CERT must be
.../current/cert and BAO_CLIENT_KEY .../current/key, spelled out rather
than read from the option. Any other entry, including a value, a
different path, the two swapped, or the pair under another variable,
still fails.

Refs #5017
This commit is contained in:
atlas 2026-10-11 03:27:56 +02:00 • committed by mara
commit 609657f1ff
1 changed files with 13 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

18
nix/module-eval/agent-matrix.nix
View file

@ -140,16 +140,24 @@ let
&& !(lib.any (lib.hasInfix "swarm/agents") (lib.attrValues e));
}
{
# 🩸 A secret is a path: every `BAO_*` entry is the store's address or a
# file under this unit's own credentials directory, never bytes in an
# environment `/proc/<pid>/environ` publishes.
# 🩸 A secret is a path: every `BAO_*` entry is the store's address, a
# file under this unit's own credentials directory, or the one file of
# the live pair ./bao.nix keeps that its name stands for — never bytes
# in an environment `/proc/<pid>/environ` publishes. The live pair is
# spelled out rather than read from the option, so a default that
# turned into a value would fail here too.
name = "the matrix daemon is handed store paths and never store values";
ok =
let
store = lib.filterAttrs (n: _: lib.hasPrefix "BAO_" n) (daemon agentMatrixBao).environment;
livePair = {
BAO_CLIENT_CERT = "/run/hive-agent-bao-identity/current/cert";
BAO_CLIENT_KEY = "/run/hive-agent-bao-identity/current/key";
};
isPath =
n: n == "BAO_ADDR" || lib.hasPrefix "%d/" store.${n} || (livePair.${n} or null) == store.${n};
in
store != { }
&& lib.all (n: n == "BAO_ADDR" || lib.hasPrefix "%d/" store.${n}) (lib.attrNames store);
store != { } && lib.all isPath (lib.attrNames store);
}
{
# A token the swarm mints or replaces in the store changes no file, so