From f1e0d9c20eafaecb7d1c443f794b2c17893779fd Mon Sep 17 00:00:00 2001 From: atlas Date: Fri, 11 Sep 2026 22:31:58 +0200 Subject: [PATCH] swarm-bao: the CN-collision comments describe a hazard that is now guarded MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both places that warned about a hive named after the controller's cert-auth subject still told the reader it was unmitigated, and the option's description recommended a migration — "change this to something outside the hive-name grammar, at the cost of a role rename in any store that has already run the granting unit" — that is no longer the answer and is not cheap. swarm.nix now feeds the subject into the guard on `swarm.hives`, so a colliding roster fails evaluation. Both paragraphs get SHORTER saying so: a guarded hazard needs the consequence ("reserved as a hive name") rather than the threat model, and the write-site keeps only the sentence the next person needs — a role added beside this one must join that list. Found by sweeping for the claim rather than for the symbol: the change that made these stale touched swarm.nix, swarm-otel.nix and module-eval.nix, so no diff-context or doc-comment rule covers a paragraph two files away. Grepping the tree for "would satisfy" and for prose about a hive named after a subject turned up exactly these two and nothing in docs/. --- nix/host-modules/swarm-bao.nix | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/nix/host-modules/swarm-bao.nix b/nix/host-modules/swarm-bao.nix index d5d45470..d18b825c 100644 --- a/nix/host-modules/swarm-bao.nix +++ b/nix/host-modules/swarm-bao.nix @@ -547,11 +547,10 @@ in writes — not a credential belonging to the controller. Nothing outside the store needs it except whatever issues that leaf. - ⚠️ The CA this role trusts also signs each hive's reader leaf, whose CN - is the hive's own name, so a hive named `swarm-controller` would satisfy - the role. Changing this to something outside the hive-name grammar - (`[a-z0-9-]`) rules that out — at the cost of a role rename in any store - that has already run the granting unit. + ⚠️ Reserved as a hive name. A hive's own leaf carries its name as the + CN, so a hive named after this subject would satisfy the role — + ./swarm.nix feeds this value into the guard on + {option}`services.hyperhive.swarm.hives` to make that unrepresentable. ''; }; @@ -947,10 +946,9 @@ in esac # `certificate=` is the CA, so this role trusts every leaf that - # CA signed and `allowed_common_names` is the whole of what - # narrows it to one identity. ⚠️ The same CA signs each hive's - # reader leaf with CN = the hive's name, so a hive named - # `${controllerCn}` would satisfy this role. + # CA signed and `allowed_common_names` is the whole narrowing — + # which is why ./swarm.nix reserves this subject as a hive name, + # and why a role added beside this one must join that list. # # Named outside the `hive-*` namespace the policy grants, so the # controller cannot rewrite the role that constrains it.