fix(archon): secure renderer TLS/QUIC transport (cert pinning, peer auth) - #486
Merged
Conversation
…uth) - #389: replace the accept-any InsecureVerifier with a pinned-fingerprint verifier — a constant-time SHA-256 leaf pin plus real rustls signature verification (proof-of-possession); fail-closed on a malformed or absent pin. No accept-any path remains. - #413: authenticate the QUIC peer — a constant-time shared-secret check on SessionInit before any session-id, SessionAccept, or registry state; an unconfigured or empty server key rejects every renderer (fail-closed). - #414: renderer secret files (TLS private key + credentials.toml) are written 0600 via an O_EXCL atomic-rename helper (no TOCTOU window) and tightened on load. - #415: parse listen_addr as an IpAddr and fail startup loudly instead of silently widening the bind to 0.0.0.0. Adds horismos ParocheConfig.renderer_api_key. Closes #389 Closes #413 Closes #414 Closes #415 Gate-Passed: kanon 0.1.5 +stages:fmt,check,clippy,nextest,lint sha:ca44ae21e4ba7c5a495a4e0ceb49ade4cef3aa67
forkwright
force-pushed
the
fix/archon-tls-quic
branch
from
July 1, 2026 22:43
788d373 to
114c2e5
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #389, #413, #414, #415.
Changes
InsecureVerifierthat accepted any certificate. Replaced with a pinned-fingerprint verifier: a constant-time SHA-256 leaf pin and realrustls::cryptosignature verification (so a MITM cannot replay the pinned public cert without its key). Fail-closed on a malformed or absent pin;InsecureVerifieris deleted. No accept-any path remains.SessionInitnow runs before any session-id,SessionAccept, or registry mutation. An unconfigured or empty server key rejects every renderer (fail-closed).credentials.tomlwere written world-readable. A sharedsecret.rshelper now writes them 0600 via anO_EXCLatomic rename (no TOCTOU window) and repairs loose permissions on load.listen_addrparse failure silently widened the QUIC (and HTTP) bind to 0.0.0.0. It now parses asIpAddrfirst and aborts startup loudly.Adds
horismos::ParocheConfig.renderer_api_key.Verification
kanon gate --fullgreen (fmt, check, advisory-parity, cargo-deny, clippy workspace, nextest, kanon lint). Pinning, peer-auth, and permission paths have unit + real-QUIC-handshake integration coverage.Note
Peer provisioning is currently the operator setting a shared key server-side and in the renderer credentials; the richer per-renderer DB pairing flow exists but wiring it over this transport is a separate follow-up.