vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

drop the one-time migration: seed the store from a leftover file once, leave the file

Browse source 
A leftover plaintext client secret is stored once with -cas=0 when the store holds none, so nothing rotates. A store value wins over a different file. The file is no longer read back, compared or removed, and the migration unit is gone.
This commit is contained in:
atlas 2026-10-30 16:12:37 +01:00 • committed by mara
commit fcc9c8d0ba
1 changed files with 114 additions and 350 deletions
Download patch file Download diff file Expand all files Collapse all files

6
nix/checks.nix
View file

@ -88,9 +88,9 @@ in
# Runs ./host-modules/lib/store-seeded-secret.nix's seed, store-wins and mint
# decisions against a stub `bao` that keeps its leaves in files.
script-test-store-seeded-secret = import ./script-tests/store-seeded-secret.nix { inherit pkgs; };
# Runs ./host-modules/lib/oidc-client-secrets.nix's mint and migration
# decisions for authelia's client secrets against stub `bao` and `authelia`:
# what is minted, stored and removed, and what is left alone when the store
# Runs ./host-modules/lib/oidc-client-secrets.nix's mint decisions for
# authelia's client secrets against stub `bao` and `authelia`:
# what is minted, seeded from a leftover file or left alone when the store
# cannot answer.
script-test-oidc-client-secrets = import ./script-tests/oidc-client-secrets.nix { inherit pkgs; };
module-eval-nats-tls = import ./module-eval/nats-tls.nix {