Keep source ciphertext off the hosts - #24
Merged
Merged
Conversation
A host carried two ciphertexts of every secret it used: the cache entry, encrypted to its own key, and the source .age, encrypted to the admin identity that opens every secret on every host. Nothing on a host can read the second one. It was there so deploy could hash it into the name of the first, and it travelled with the system closure to wherever that goes, a binary cache included. Cache entries are now named <id>-<hash>, so deploy finds one by the id it already has, and the profile it reads names no source file at all. seal and check keep a profile that does, which is theirs to hold: seal runs where the identity is, and system.checks are build dependencies that stay out of the closure. Entry names change, so this needs one `seal` before the next rebuild.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A host carried two ciphertexts of every secret it used: the cache entry, encrypted to its own key, and the source
.age, encrypted to the admin identity — the one that opens every secret on every host. Nothing on a host can read the second. It was there only sodeploycould hash it into the name of the first, and it travelled with the system closure to wherever that closure goes, a binary cache included.Cache entries are now named
<id>-<hash>.deployfinds one by the id it already has, and the profile it reads names no source file at all.sealandcheckkeep a profile that does, which is theirs to hold:sealruns where the identity already is, andsystem.checksare build dependencies that stay out of the closure.Verified on the store paths themselves — the profile a host installs now references only its own sealed cache, while the source
.ageappears in the admin profile alone.Entry names change, so this needs one
nix run .#kix-sealbefore the next rebuild.checkblocks the build until then.Fixes #23