vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-bao: the CN-collision comments describe a hazard that is now guarded

Browse source 
Both places that warned about a hive named after the controller's cert-auth
subject still told the reader it was unmitigated, and the option's description
recommended a migration — "change this to something outside the hive-name
grammar, at the cost of a role rename in any store that has already run the
granting unit" — that is no longer the answer and is not cheap.

swarm.nix now feeds the subject into the guard on `swarm.hives`, so a
colliding roster fails evaluation. Both paragraphs get SHORTER saying so: a
guarded hazard needs the consequence ("reserved as a hive name") rather than
the threat model, and the write-site keeps only the sentence the next person
needs — a role added beside this one must join that list.

Found by sweeping for the claim rather than for the symbol: the change that
made these stale touched swarm.nix, swarm-otel.nix and module-eval.nix, so no
diff-context or doc-comment rule covers a paragraph two files away. Grepping
the tree for "would satisfy" and for prose about a hive named after a subject
turned up exactly these two and nothing in docs/.
This commit is contained in:
atlas 2026-09-11 22:31:58 +02:00 • committed by mara
commit f1e0d9c20e
1 changed files with 7 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

16
nix/host-modules/swarm-bao.nix
View file

@ -547,11 +547,10 @@ in
writes — not a credential belonging to the controller. Nothing outside writes — not a credential belonging to the controller. Nothing outside
the store needs it except whatever issues that leaf. the store needs it except whatever issues that leaf.
⚠️ The CA this role trusts also signs each hive's reader leaf, whose CN ⚠️ Reserved as a hive name. A hive's own leaf carries its name as the
is the hive's own name, so a hive named `swarm-controller` would satisfy CN, so a hive named after this subject would satisfy the role —
the role. Changing this to something outside the hive-name grammar ./swarm.nix feeds this value into the guard on
(`[a-z0-9-]`) rules that out — at the cost of a role rename in any store {option}`services.hyperhive.swarm.hives` to make that unrepresentable.
that has already run the granting unit.
''; '';
}; };
@ -947,10 +946,9 @@ in
esac esac
# `certificate=` is the CA, so this role trusts every leaf that # `certificate=` is the CA, so this role trusts every leaf that
# CA signed and `allowed_common_names` is the whole of what # CA signed and `allowed_common_names` is the whole narrowing —
# narrows it to one identity. ⚠️ The same CA signs each hive's # which is why ./swarm.nix reserves this subject as a hive name,
# reader leaf with CN = the hive's name, so a hive named # and why a role added beside this one must join that list.
# `${controllerCn}` would satisfy this role.
# #
# Named outside the `hive-*` namespace the policy grants, so the # Named outside the `hive-*` namespace the policy grants, so the
# controller cannot rewrite the role that constrains it. # controller cannot rewrite the role that constrains it.