vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-tls: keep ca-key.pem on disk, and re-issue a leaf that does not match its key

Browse source 
hive-tls-ca no longer deletes a ca-key.pem an earlier generation left:
nothing reads it, and leaving it means a rollback finds the old key instead
of minting a new anchor. Deleting it moves to PR 3, beside dropping ca.pem
from the trust bundle.

hive-tls-resign now also re-issues when the leaf's public key differs from
the key file's. The leaf and key are moved into place by two renames, and an
interrupted pair left a certificate beside the wrong key that the validity
check accepted.

Refs #4588
This commit is contained in:
atlas 2026-10-04 15:49:31 +02:00 • committed by mara
commit fc33a62bf8
4 changed files with 39 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

24
nix/module-eval/hive-tls.nix
View file

@ -4,7 +4,7 @@
# The swarm-services leaf's renewal: a timer that really re-runs the
# issuance, at a threshold read off the store role's lifetime. And the
# store's root on a hive that asks it for no leaf. And the gateway leaf,
# issued by the store through the hive's own role, with no hive CA key.
# issued by the store through the hive's own role, with no hive CA.
{
pkgs,
lib,
@ -231,9 +231,13 @@ let
&& lib.hasInfix "root-key.pem" rootScript;
}
{
name = "a retired hive CA key is deleted, and its public certificate stays in the trust bundle";
# Left for PR 3, beside dropping `ca.pem`, so a rollback finds the old
# key and does not mint a new anchor. The control is the bundle reading
# `ca.pem` in the same script.
name = "a retired hive CA key is left in place, and its public certificate stays in the trust bundle";
ok =
lib.hasInfix ''rm -f "$d/ca-key.pem"'' caUnit.script
!(lib.hasInfix "ca-key.pem" caUnit.script)
&& !(lib.hasInfix "ca-key.pem" leafUnit.script)
&& lib.hasInfix ''ca="$d/ca.pem"'' caUnit.script
&& lib.hasInfix ''if [ -s "$ca" ]; then anchors+=("$ca"); fi'' caUnit.script
&& lib.hasInfix ''if [ -s "$prev" ]; then anchors+=("$prev"); fi'' caUnit.script
@ -279,9 +283,19 @@ let
{
# A leaf the retired hive CA signed is re-issued from the store on the
# first run that reaches it; one that renews in time never is.
name = "the gateway leaf is re-issued when not chained to the store's root, and at half its role lifetime";
# A cert from one issuance beside the key of another, left by an
# interrupted pair of renames, is re-issued rather than left for
# `nginx -t` to refuse. Checked on the decision side of the exit.
name = "the gateway leaf is re-issued when not matching its key, not chained to the store's root, or at half its role lifetime";
ok =
lib.hasInfix ''openssl verify -CAfile "$svcroot" "$leaf"'' leafUnit.script
let
decision = lib.head (lib.splitString ''if [ "$reissue" = 0 ]'' leafUnit.script);
in
decision != leafUnit.script
&& lib.hasInfix ''openssl verify -CAfile "$svcroot" "$leaf"'' decision
&& lib.hasInfix ''leafpub="$(openssl x509 -in "$leaf" -noout -pubkey'' decision
&& lib.hasInfix ''keypub="$(openssl pkey -in "$leafk" -pubout'' decision
&& lib.hasInfix ''{ [ -n "$leafpub" ] && [ "$leafpub" = "$keypub" ]; } || reissue=1'' decision
&& lib.hasInfix (renewAt 720) leafUnit.script
&& lib.hasInfix (renewAt 48) shortTtl.systemd.services.hive-tls-resign.script
&& lib.hasInfix ''-in "$leaf" -noout -checkend "$renewat"'' leafUnit.script;