M0: compilable skeleton — Kigi 0.1.0 fork surgery
Hard fork of xai-org/grok-build (Apache-2.0) re-targeted as Kigi, an
unofficial Kimi Code CLI community build.
Rename & identity
- 72 xai-*/xai-grok-* crates -> kigi-* (explicit: xai-grok-pager-bin ->
kigi-bin [binary `kigi`], xai-grok-pager -> kigi-tui; rest mechanical);
ptyctl, ptyctl-cli, third_party/ unchanged; proto package
xai.grok.tools.v1 -> kigi.tools.v1
- Config home ~/.kigi (KIGI_SHARE_DIR override), env prefix GROK_* ->
KIGI_*, `kigi --version` carries the unofficial-community-build notice
- clap identity, help text, startup banner, prompt templates rebranded
(templates re-encrypted)
Deletions (PRD removal list #5/#6/#7/#9/#10)
- voice input (xai-grok-voice) and all TUI wiring
- telemetry: Mixpanel client, external OTel stream, Sentry, OTLP layers,
trace/GCS/S3 upload queues (kigi-file-utils halved), workspace upload
module & dc_log, heap-profile uploader, auth-diagnostics uploader,
session-analytics halves of feedback; local zero-egress observability
preserved in new kigi-log crate (unified log, --debug firehose,
subsystem file logs, opt-in instrumentation)
- announcements (crate, remote-settings fields, TUI surfaces)
- plugin marketplace (crate, sources/browse/CTA/extensions-modal tab);
direct plugin install/uninstall/update via kigi-agent git_install kept
- relay/gateway/assets endpoints and features (agent relay, headless
relay transport, gateway bridge, LeaderEnvUrls); leader IPC socket now
~/.kigi/leader.sock + KIGI_LEADER_SOCKET, no ws-url derivation
- functional types rehomed instead of deleted: PermissionMode ->
kigi-config-types, McpInitStrategy -> kigi-mcp, PrCreationSource ->
session signals, TerminalDiagnostics -> kigi-pager-render, agent_id ->
shell util
Endpoints
- kigi-env rewritten: single production KigiEndpoints {coding_api_base_url
https://api.kimi.com/coding/v1 (KIGI_CODE_BASE_URL), oauth_host
https://auth.kimi.com (KIGI_OAUTH_HOST), update_base_url (GitHub
Releases API), upgrade_page_url}; GrokBuildEnvironment enum deleted
Toolchain & workspace hygiene
- Rust 1.97.0 pinned; edition 2024; full cargo update; git2 hoisted to
workspace at 0.21 (Option->Result API migration), quick-xml 0.41
- Root Cargo.toml hand-maintained (PRD §8.1): version 0.1.0 inherited by
all members, members sorted, unused deps pruned
- cargo-deny advisories gate (deny.toml with documented transitive
exceptions); CI workflow (check/clippy/fmt/deny/test, macOS+Linux)
- cross-crate test seams re-gated behind `test-support` cargo feature;
insta snapshot baselines renamed to the kigi_tui prefix
- clippy --workspace --all-targets: zero warnings; fmt clean
Fixes surfaced by the port
- updater probe/installer divergence (bin/kigi vs bin/grok symlink set)
- idle model-metadata refresh dead under KIGI_CODE_BASE_URL override
(new is_effective_coding_endpoint_url, loopback+override aware)
- macOS symlinked-TMPDIR fixture canonicalization (foreign_sessions,
fast-worktree); RSS measurement tests serialized via serial_test
Docs & legal (Apache §4)
- NOTICE added (upstream attribution + change statement); THIRD-PARTY
notices sustained; kigi-tools ported-code notices extended; README,
CONTRIBUTING, SECURITY, AGENTS.md rewritten
Out of scope for M0 (tracked): Kimi auth/inference (M1), search/fetch,
command parity, config import (M2), Computer Hub excision & final
brand-token sweep (M2), distribution & self-update rewrite (M3).
This commit is contained in:
ZacharyZhang-NY committed
commit
d6c20fc13f
2612 files changed
+1353757
No files matched your search
@@ -0,0 +1,459 @@
|
||||
//! Ed25519-signed, identity-bound managed-policy envelope.
|
||||
//!
|
||||
//! The server signs a canonical payload (the served policy, the bound principal,
|
||||
//! an expiry) with an Ed25519 private key; the client verifies it against a
|
||||
//! compiled-in trusted key set (selected by the signed `key_id`, so keys can
|
||||
//! rotate), binds it to the active principal, and checks the on-disk policy
|
||||
//! matches the signed bytes — so an in-place edit is caught, not just a deletion.
|
||||
//! Inert until a public key is provisioned: with no embedded keys the cache
|
||||
//! marker stays the (best-effort) authority.
|
||||
use base64::Engine;
|
||||
pub use prod_mc_cli_chat_proxy_types::{SignatureEnvelope, SignedPayload, now_unix};
|
||||
/// Compiled-in trusted Ed25519 public keys, `(key_id, raw 32 bytes)`; more than one
|
||||
/// entry only during a rotation. Empty ships dark (see [`verification_active`]).
|
||||
/// Compile-time, not an env flag: the local attacker controls their env.
|
||||
pub const EMBEDDED_DEPLOYMENT_CONFIG_PUBKEYS: &[(&str, &[u8])] = &[];
|
||||
const _: () = {
|
||||
let keys = EMBEDDED_DEPLOYMENT_CONFIG_PUBKEYS;
|
||||
let mut i = 0;
|
||||
while i < keys.len() {
|
||||
assert!(
|
||||
keys[i].1.len() == 32,
|
||||
"every embedded key must be exactly 32 raw Ed25519 bytes"
|
||||
);
|
||||
assert!(
|
||||
!keys[i].0.is_empty(),
|
||||
"every embedded key id must be non-empty"
|
||||
);
|
||||
let mut j = i + 1;
|
||||
while j < keys.len() {
|
||||
assert!(
|
||||
!const_str_eq(keys[i].0, keys[j].0),
|
||||
"embedded key ids must be unique"
|
||||
);
|
||||
j += 1;
|
||||
}
|
||||
i += 1;
|
||||
}
|
||||
};
|
||||
const fn const_str_eq(a: &str, b: &str) -> bool {
|
||||
let (a, b) = (a.as_bytes(), b.as_bytes());
|
||||
if a.len() != b.len() {
|
||||
return false;
|
||||
}
|
||||
let mut i = 0;
|
||||
while i < a.len() {
|
||||
if a[i] != b[i] {
|
||||
return false;
|
||||
}
|
||||
i += 1;
|
||||
}
|
||||
true
|
||||
}
|
||||
/// Run `f` over the trusted key set — the compiled-in [`EMBEDDED_DEPLOYMENT_CONFIG_PUBKEYS`],
|
||||
/// unless the compile-time-excluded test seam overrides it.
|
||||
fn with_embedded_keys<R>(f: impl FnOnce(&[(&str, &[u8])]) -> R) -> R {
|
||||
#[cfg(any(test, feature = "test-support"))]
|
||||
{
|
||||
let installed = test_seam::EMBEDDED_KEYS_OVERRIDE
|
||||
.read()
|
||||
.unwrap_or_else(|e| e.into_inner());
|
||||
if let Some(keys) = installed.as_ref() {
|
||||
let borrowed: Vec<(&str, &[u8])> = keys
|
||||
.iter()
|
||||
.map(|(id, key)| (id.as_str(), key.as_slice()))
|
||||
.collect();
|
||||
return f(&borrowed);
|
||||
}
|
||||
}
|
||||
f(EMBEDDED_DEPLOYMENT_CONFIG_PUBKEYS)
|
||||
}
|
||||
/// Test-only override of the compiled-in trusted key set.
|
||||
///
|
||||
/// Compiled out of production builds entirely: present only under `cfg(test)`
|
||||
/// or the `test-support` feature, which dependents enable exclusively via
|
||||
/// `[dev-dependencies]`. With the seam absent, [`with_embedded_keys`] is a
|
||||
/// direct read of [`EMBEDDED_DEPLOYMENT_CONFIG_PUBKEYS`] — the trust anchor
|
||||
/// stays compile-time in shipping binaries.
|
||||
#[cfg(any(test, feature = "test-support"))]
|
||||
pub mod test_seam {
|
||||
use std::sync::RwLock;
|
||||
/// `(key_id, raw public key bytes)` pairs forming a trusted key set.
|
||||
type EmbeddedKeys = Vec<(String, Vec<u8>)>;
|
||||
/// Installed override; `None` falls through to the compiled-in set.
|
||||
pub(super) static EMBEDDED_KEYS_OVERRIDE: RwLock<Option<EmbeddedKeys>> = RwLock::new(None);
|
||||
/// Install `(key_id, raw 32-byte Ed25519 public key)` pairs as the trusted
|
||||
/// key set for this process, arming verification (see
|
||||
/// [`verification_active`](super::verification_active)).
|
||||
pub fn set_embedded_keys(keys: &[(&str, &[u8])]) {
|
||||
*EMBEDDED_KEYS_OVERRIDE
|
||||
.write()
|
||||
.unwrap_or_else(|e| e.into_inner()) = Some(
|
||||
keys.iter()
|
||||
.map(|(id, key)| ((*id).to_owned(), key.to_vec()))
|
||||
.collect(),
|
||||
);
|
||||
}
|
||||
/// Remove the override, restoring the compiled-in key set.
|
||||
pub fn clear_embedded_keys() {
|
||||
*EMBEDDED_KEYS_OVERRIDE
|
||||
.write()
|
||||
.unwrap_or_else(|e| e.into_inner()) = None;
|
||||
}
|
||||
}
|
||||
/// Sidecar persisted next to the policy so the load-time gate can re-verify it offline.
|
||||
pub const SIGNATURE_SIDECAR_FILE: &str = "managed_config.sig.json";
|
||||
#[derive(Debug, thiserror::Error, PartialEq, Eq)]
|
||||
pub enum SigError {
|
||||
#[error("signature is not valid base64")]
|
||||
BadSignatureEncoding,
|
||||
#[error("signature does not verify against the provided public key")]
|
||||
SignatureMismatch,
|
||||
#[error("signed payload is not valid JSON")]
|
||||
BadPayload,
|
||||
#[error("signed payload names a key_id outside the trusted set")]
|
||||
UnknownKeyId,
|
||||
#[error("signed policy is bound to a different principal")]
|
||||
PrincipalMismatch,
|
||||
#[error("signed policy has expired")]
|
||||
Expired,
|
||||
#[error("on-disk {0} does not match the signed policy")]
|
||||
ContentMismatch(&'static str),
|
||||
/// The file exists but can't be read (EACCES etc. — never plain absence). Not
|
||||
/// tamper evidence: callers refetch but don't refuse on a read blip.
|
||||
#[error("on-disk {0} cannot be read")]
|
||||
Unreadable(&'static str),
|
||||
}
|
||||
/// Whether the client must require + verify a signature — true iff the key set is
|
||||
/// non-empty (no env toggle; see [`EMBEDDED_DEPLOYMENT_CONFIG_PUBKEYS`]).
|
||||
pub fn verification_active() -> bool {
|
||||
with_embedded_keys(|keys| !keys.is_empty())
|
||||
}
|
||||
/// Whether `key_id` names a trusted key. Only PICKS among served envelopes;
|
||||
/// verification re-selects the key from the signed bytes, so a lying hint can at
|
||||
/// most cause a verification failure.
|
||||
pub fn embedded_key_id_trusted(key_id: &str) -> bool {
|
||||
with_embedded_keys(|keys| keys.iter().any(|(id, _)| *id == key_id))
|
||||
}
|
||||
/// Verify `signature_b64` over `signed_payload` against `trusted_keys`, returning the
|
||||
/// parsed payload. The verifying key is selected by the SIGNED payload's `key_id` —
|
||||
/// safe to read pre-verification because selection can only land within the trusted
|
||||
/// set (a forged id either misses or picks a key the signature won't match). Pure:
|
||||
/// callers supply the keys so tests can use throwaway keypairs.
|
||||
pub fn verify_signed_payload(
|
||||
signed_payload: &str,
|
||||
signature_b64: &str,
|
||||
trusted_keys: &[(&str, &[u8])],
|
||||
) -> Result<SignedPayload, SigError> {
|
||||
let payload: SignedPayload =
|
||||
serde_json::from_str(signed_payload).map_err(|_| SigError::BadPayload)?;
|
||||
let (_, public_key) = trusted_keys
|
||||
.iter()
|
||||
.find(|(id, _)| *id == payload.key_id)
|
||||
.ok_or(SigError::UnknownKeyId)?;
|
||||
let sig = base64::engine::general_purpose::STANDARD
|
||||
.decode(signature_b64.trim())
|
||||
.map_err(|_| SigError::BadSignatureEncoding)?;
|
||||
ring::signature::UnparsedPublicKey::new(&ring::signature::ED25519, public_key)
|
||||
.verify(signed_payload.as_bytes(), &sig)
|
||||
.map_err(|_| SigError::SignatureMismatch)?;
|
||||
Ok(payload)
|
||||
}
|
||||
/// Fetch-time identity binding for a VERIFIED payload, expiry enforced: a
|
||||
/// deployment-signed payload is trusted on signature alone; a team-signed payload
|
||||
/// must match the active team. Lenient on a missing active team — an `auth.json`
|
||||
/// read blip must not brick a session (a cross-team attacker has a team of their
|
||||
/// own). The at-rest checks use [`signed_principal_matches`] instead.
|
||||
pub fn check_fetch_identity(
|
||||
payload: &SignedPayload,
|
||||
active_team_id: Option<&str>,
|
||||
now_unix: u64,
|
||||
) -> Result<(), SigError> {
|
||||
if now_unix > payload.expires_at {
|
||||
return Err(SigError::Expired);
|
||||
}
|
||||
if payload.deployment_id.is_some() {
|
||||
return Ok(());
|
||||
}
|
||||
if let (Some(signed), Some(active)) = (payload.team_id.as_deref(), active_team_id)
|
||||
&& signed != active
|
||||
{
|
||||
return Err(SigError::PrincipalMismatch);
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
/// Whether the payload's effective principal (`deployment_id`, else `team_id`) matches
|
||||
/// ours — the at-rest identity rule, so another tenant's cache reads foreign. Lenient
|
||||
/// when either side is unknown. Deliberately expiry-free: the gate orders identity
|
||||
/// BEFORE the `fail_closed` short-circuit and expiry after it (see [`SignedCacheFacts`]).
|
||||
fn signed_principal_matches(payload: &SignedPayload, expected_principal: Option<&str>) -> bool {
|
||||
let signed = payload
|
||||
.deployment_id
|
||||
.as_deref()
|
||||
.or(payload.team_id.as_deref());
|
||||
!matches!(
|
||||
(signed, expected_principal), (Some(signed), Some(expected)) if signed !=
|
||||
expected
|
||||
)
|
||||
}
|
||||
/// Full verification of a fetched envelope against the embedded trusted keys
|
||||
/// (signature, binding, expiry), returning the trusted payload to persist.
|
||||
pub fn verify_fetched(
|
||||
sidecar: &SignatureEnvelope,
|
||||
active_team_id: Option<&str>,
|
||||
now_unix: u64,
|
||||
) -> Result<SignedPayload, SigError> {
|
||||
with_embedded_keys(|keys| verify_fetched_with_keys(sidecar, keys, active_team_id, now_unix))
|
||||
}
|
||||
/// Key-injected core of [`verify_fetched`] so tests can supply throwaway keypairs.
|
||||
fn verify_fetched_with_keys(
|
||||
sidecar: &SignatureEnvelope,
|
||||
trusted_keys: &[(&str, &[u8])],
|
||||
active_team_id: Option<&str>,
|
||||
now_unix: u64,
|
||||
) -> Result<SignedPayload, SigError> {
|
||||
let payload = verify_signed_payload(&sidecar.signed_payload, &sidecar.signature, trusted_keys)?;
|
||||
check_fetch_identity(&payload, active_team_id, now_unix)?;
|
||||
Ok(payload)
|
||||
}
|
||||
/// True when something occupies `path` that is not a regular file — directory,
|
||||
/// symlink, fifo, … NO-FOLLOW, so even a symlink to a byte-identical file counts:
|
||||
/// a squatter blocks or redirects reads/rewrites, which is tamper, never a blip.
|
||||
/// The clearing side stays no-follow too (a symlink squat is removed as the link).
|
||||
fn non_regular_file_at(path: &std::path::Path) -> bool {
|
||||
std::fs::symlink_metadata(path).is_ok_and(|m| !m.is_file())
|
||||
}
|
||||
/// Confirm the on-disk artifacts match the signed payload byte-for-byte — an in-place
|
||||
/// edit is caught, not just a deletion. A signed-ABSENT slot must be empty on disk: a
|
||||
/// locally planted `requirements.toml` (the highest-precedence layer) is tamper, not
|
||||
/// noise. An unreadable file is [`SigError::Unreadable`] (refetch, don't refuse — a
|
||||
/// read blip); anything non-regular squatting the slot ([`non_regular_file_at`])
|
||||
/// reads as tamper.
|
||||
pub fn check_on_disk_matches(
|
||||
home: &std::path::Path,
|
||||
payload: &SignedPayload,
|
||||
) -> Result<(), SigError> {
|
||||
for (name, label, signed) in [
|
||||
(
|
||||
"managed_config.toml",
|
||||
"managed_config",
|
||||
payload.managed_config.as_deref(),
|
||||
),
|
||||
(
|
||||
"requirements.toml",
|
||||
"requirements",
|
||||
payload.requirements.as_deref(),
|
||||
),
|
||||
] {
|
||||
let path = home.join(name);
|
||||
if non_regular_file_at(&path) {
|
||||
return Err(SigError::ContentMismatch(label));
|
||||
}
|
||||
let on_disk = match std::fs::read_to_string(&path) {
|
||||
Ok(s) => Some(s),
|
||||
Err(e) if e.kind() == std::io::ErrorKind::NotFound => None,
|
||||
Err(_) => return Err(SigError::Unreadable(label)),
|
||||
};
|
||||
let matches = match signed.filter(|s| !s.is_empty()) {
|
||||
Some(signed) => on_disk.as_deref() == Some(signed),
|
||||
None => on_disk.as_deref().is_none_or(str::is_empty),
|
||||
};
|
||||
if !matches {
|
||||
return Err(SigError::ContentMismatch(label));
|
||||
}
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
pub(crate) fn sidecar_path(home: &std::path::Path) -> std::path::PathBuf {
|
||||
home.join(SIGNATURE_SIDECAR_FILE)
|
||||
}
|
||||
/// Outcome of reading the on-disk sidecar; mirrors the artifact-slot semantics of
|
||||
/// [`check_on_disk_matches`].
|
||||
enum SidecarRead {
|
||||
Present(SignatureEnvelope),
|
||||
/// NotFound, unparseable JSON, or a squatting non-regular file (directory,
|
||||
/// symlink, …) — not an authentic sidecar.
|
||||
Absent,
|
||||
/// EACCES-style transient failure on a regular file — not tamper evidence: the
|
||||
/// gate must not refuse on it, but the refetch trigger fires to self-heal.
|
||||
Unreadable,
|
||||
}
|
||||
fn read_sidecar(home: &std::path::Path) -> SidecarRead {
|
||||
let path = sidecar_path(home);
|
||||
if non_regular_file_at(&path) {
|
||||
return SidecarRead::Absent;
|
||||
}
|
||||
let json = match std::fs::read_to_string(&path) {
|
||||
Ok(json) => json,
|
||||
Err(e) if e.kind() == std::io::ErrorKind::NotFound => return SidecarRead::Absent,
|
||||
Err(_) => return SidecarRead::Unreadable,
|
||||
};
|
||||
match serde_json::from_str(&json) {
|
||||
Ok(sidecar) => SidecarRead::Present(sidecar),
|
||||
Err(_) => SidecarRead::Absent,
|
||||
}
|
||||
}
|
||||
/// Persist the sidecar atomically — a torn sidecar would fail the load-time gate.
|
||||
/// Written 0600 on unix: for a deployment-key principal the signed payload embeds
|
||||
/// the key, so the sidecar is a second at-rest copy of a bearer credential.
|
||||
pub fn write_sidecar(home: &std::path::Path, sidecar: &SignatureEnvelope) -> std::io::Result<()> {
|
||||
let json = serde_json::to_string(sidecar)
|
||||
.map_err(|e| std::io::Error::new(std::io::ErrorKind::InvalidData, e))?;
|
||||
crate::fs_atomic::write_atomically(&sidecar_path(home), &json, Some(0o600))
|
||||
}
|
||||
/// True when signature verification is active AND a cloud-cache policy on disk is
|
||||
/// NOT covered by a valid, in-date, identity-bound, content-matching signature.
|
||||
/// Dark build or no policy on disk → false (behavior unchanged until a key ships).
|
||||
pub fn cloud_cache_signature_invalid(
|
||||
home: &std::path::Path,
|
||||
expected_principal: Option<&str>,
|
||||
now_unix: u64,
|
||||
) -> bool {
|
||||
if !verification_active() {
|
||||
return false;
|
||||
}
|
||||
with_embedded_keys(|keys| {
|
||||
cloud_cache_signature_invalid_with_keys(home, keys, expected_principal, now_unix)
|
||||
})
|
||||
}
|
||||
/// Key-injected core of [`cloud_cache_signature_invalid`] so tests can supply throwaway keys.
|
||||
fn cloud_cache_signature_invalid_with_keys(
|
||||
home: &std::path::Path,
|
||||
trusted_keys: &[(&str, &[u8])],
|
||||
expected_principal: Option<&str>,
|
||||
now_unix: u64,
|
||||
) -> bool {
|
||||
let has_policy =
|
||||
home.join("requirements.toml").exists() || home.join("managed_config.toml").exists();
|
||||
if !has_policy {
|
||||
return false;
|
||||
}
|
||||
use SignedCacheEvaluation as Eval;
|
||||
match evaluate_signed_cache(home, trusted_keys, expected_principal, now_unix) {
|
||||
Eval::NoAuthenticSidecar | Eval::SidecarUnreadable => true,
|
||||
Eval::Facts(f) => !f.identity_ok || f.expired || f.disk != DiskStatus::Match,
|
||||
}
|
||||
}
|
||||
/// On-disk status of the signed artifact slots, from [`check_on_disk_matches`].
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
|
||||
enum DiskStatus {
|
||||
/// Every slot matches the signed payload (content and absence).
|
||||
Match,
|
||||
/// Tamper: edited, deleted-while-signed, planted, or a squatting non-file.
|
||||
Mismatch,
|
||||
/// A read blip (EACCES on a regular file) — stale for the refetch, lenient at
|
||||
/// the gate.
|
||||
Unreadable,
|
||||
}
|
||||
/// What one verification pass over the on-disk sidecar establishes. The two public
|
||||
/// checks are projections over the same facts: the refetch trigger flags ANY
|
||||
/// deviation; the gate applies the fail-closed rules.
|
||||
struct SignedCacheFacts {
|
||||
/// The payload's effective principal matches ours ([`signed_principal_matches`]).
|
||||
identity_ok: bool,
|
||||
expired: bool,
|
||||
/// The SIGNED opt-in — read from the payload, never the forgeable marker.
|
||||
fail_closed: bool,
|
||||
disk: DiskStatus,
|
||||
}
|
||||
/// One evaluation of the on-disk sidecar; both public checks project from this.
|
||||
enum SignedCacheEvaluation {
|
||||
/// No authentic sidecar: missing, corrupt, a squatting non-file, forged, or
|
||||
/// keyed outside the trusted set — never facts from unverified bytes.
|
||||
NoAuthenticSidecar,
|
||||
/// The sidecar exists but a transient IO error blocked the read
|
||||
/// ([`SidecarRead::Unreadable`]) — nothing verified, nothing tamper-shaped.
|
||||
SidecarUnreadable,
|
||||
Facts(SignedCacheFacts),
|
||||
}
|
||||
/// Read the sidecar, verify it against `trusted_keys`, reduce to a [`SignedCacheEvaluation`].
|
||||
fn evaluate_signed_cache(
|
||||
home: &std::path::Path,
|
||||
trusted_keys: &[(&str, &[u8])],
|
||||
expected_principal: Option<&str>,
|
||||
now_unix: u64,
|
||||
) -> SignedCacheEvaluation {
|
||||
let sidecar = match read_sidecar(home) {
|
||||
SidecarRead::Present(sidecar) => sidecar,
|
||||
SidecarRead::Absent => return SignedCacheEvaluation::NoAuthenticSidecar,
|
||||
SidecarRead::Unreadable => return SignedCacheEvaluation::SidecarUnreadable,
|
||||
};
|
||||
let Ok(payload) =
|
||||
verify_signed_payload(&sidecar.signed_payload, &sidecar.signature, trusted_keys)
|
||||
else {
|
||||
return SignedCacheEvaluation::NoAuthenticSidecar;
|
||||
};
|
||||
SignedCacheEvaluation::Facts(SignedCacheFacts {
|
||||
identity_ok: signed_principal_matches(&payload, expected_principal),
|
||||
expired: now_unix > payload.expires_at,
|
||||
fail_closed: payload.fail_closed,
|
||||
disk: match check_on_disk_matches(home, &payload) {
|
||||
Ok(()) => DiskStatus::Match,
|
||||
Err(SigError::Unreadable(_)) => DiskStatus::Unreadable,
|
||||
Err(_) => DiskStatus::Mismatch,
|
||||
},
|
||||
})
|
||||
}
|
||||
/// Verdict of the signed-sidecar check for the load-time gate.
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
|
||||
pub enum SignedVerdict {
|
||||
/// Verification is not active (no embedded keys — the dark build): the marker is
|
||||
/// the only signal. A distinct variant, not an `Option`, so a dark build can never
|
||||
/// be confused with [`Self::NoAuthenticSidecar`], whose absence rule must never
|
||||
/// fire keyless.
|
||||
Inactive,
|
||||
/// No sidecar, or one whose signature doesn't verify — not an authentic verdict.
|
||||
/// Under a fail-closed marker that recorded served policy, absence is itself
|
||||
/// tamper: stripping the sidecar must not downgrade enforcement to the forgeable
|
||||
/// marker path (a first keyed launch over a pre-signing cache also refuses until
|
||||
/// one online refetch writes it — deliberate). Residual: wiping the marker with
|
||||
/// the sidecar — inherent to user-writable state, covered by the root-owned
|
||||
/// /etc/kigi and MDM layers. Otherwise the marker decides.
|
||||
NoAuthenticSidecar,
|
||||
/// The sidecar exists but a transient IO error (EACCES-style, never plain absence
|
||||
/// or a squatting non-file) blocked the read. Not tamper evidence: the gate falls
|
||||
/// back to the marker decision, and the refetch trigger fires to rewrite it.
|
||||
SidecarUnreadable,
|
||||
/// Authentic sidecar; the policy is valid for this principal (or never opted into
|
||||
/// fail-closed enforcement).
|
||||
Trusted,
|
||||
/// Authentic sidecar proving an opted-in policy is no longer valid here: edited on
|
||||
/// disk, expired, or bound to a different principal. Refuse — always.
|
||||
Compromised,
|
||||
}
|
||||
/// The signed verdict for the on-disk cache; see [`SignedVerdict`]. The fail-closed
|
||||
/// opt-in is read from the SIGNED bytes, not the forgeable marker. `expected_principal`
|
||||
/// is the machine's managed principal (active team id, or the recorded deployment id);
|
||||
/// a payload bound elsewhere is a cross-tenant replay and reads compromised.
|
||||
pub fn signed_cache_compromised(
|
||||
home: &std::path::Path,
|
||||
expected_principal: Option<&str>,
|
||||
now_unix: u64,
|
||||
) -> SignedVerdict {
|
||||
if !verification_active() {
|
||||
return SignedVerdict::Inactive;
|
||||
}
|
||||
with_embedded_keys(|keys| {
|
||||
signed_cache_compromised_with_keys(home, keys, expected_principal, now_unix)
|
||||
})
|
||||
}
|
||||
/// Key-injected core of [`signed_cache_compromised`] so tests can supply throwaway keys.
|
||||
fn signed_cache_compromised_with_keys(
|
||||
home: &std::path::Path,
|
||||
trusted_keys: &[(&str, &[u8])],
|
||||
expected_principal: Option<&str>,
|
||||
now_unix: u64,
|
||||
) -> SignedVerdict {
|
||||
use SignedCacheEvaluation as Eval;
|
||||
match evaluate_signed_cache(home, trusted_keys, expected_principal, now_unix) {
|
||||
Eval::NoAuthenticSidecar => SignedVerdict::NoAuthenticSidecar,
|
||||
Eval::SidecarUnreadable => SignedVerdict::SidecarUnreadable,
|
||||
Eval::Facts(f) if !f.identity_ok => SignedVerdict::Compromised,
|
||||
Eval::Facts(f) if !f.fail_closed => SignedVerdict::Trusted,
|
||||
Eval::Facts(f) if f.expired || f.disk == DiskStatus::Mismatch => SignedVerdict::Compromised,
|
||||
Eval::Facts(_) => SignedVerdict::Trusted,
|
||||
}
|
||||
}
|
||||
#[cfg(test)]
|
||||
#[path = "signed_policy/tests.rs"]
|
||||
mod tests;
|
||||
Reference in new issue
Block a user