Skip to content

Rust engine v0.1.32

Choose a tag to compare

View all tags
@markus-barta markus-barta released this 21 Aug 21:08
rust-engine-v0.1.32
f2dd1b7
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Rust engine v0.1.32 delivers JANUS-453: a reviewed, offline operator path for subject enrollment — no more hand-written registry records.

janusd-identity-admin (new authority-side binary beside janusd-identityd; not a runtime-plane action, so it needs no broker admission and can enroll the first subject):

  • enroll|revoke --review-evidence-file FILE consume signed, operation-bound review evidence (Ed25519 envelope binding verb, trust-domain fingerprint, target, single-use nonce, validity window ≤ 7 days, reviewer key reference) verified against the pinned JANUS_IDENTITY_REVIEW_VERIFYING_KEY_FILE; list prints opaque refs, class, status.
  • Guards, all fail closed: real UID == effective UID == registry-root owner; pre-owned exact 0700 registry root (never created); exclusive lifecycle lock beside the registry (identity_broker_running while the broker runs; list takes the shared lock); mutations refused under enforced_recorded (identity_posture_mutation_forbidden); evidence must verify, match context, be unexpired and never consumed (identity_review_invalid|_signature_invalid|_context_mismatch|_expired|_replayed); write-ahead authorized audit line synced before the record, applied/denied after (identity_admin_audit_unavailable fails closed).
  • Reviewer side: review-keys (create/pin reviewer key), review-sign --request-file R --signing-key-file K --out FILE (request is a file, never argv).

Broker: holds a shared lifecycle lock for its lifetime; optional pinned JANUS_ACCOUNTABILITY_CONFIG_FILE must agree with JANUS_ACCOUNTABILITY_POSTURE (runtime_authority_posture_config_mismatch).

Registry hardening (prerequisites from the design review): records, lock, and signing key are opened O_NOFOLLOW and validated on the descriptor (owner == effective UID, mode, regular, single link); private directories require the caller's ownership; new records fsync the directory entry, not only the file; review fingerprints are single-use across enrollments and revocations.

Smokes / docs: scripts/smoke-janusd-identity.sh and scripts/with-runtime-authority.sh enroll through the new tool and assert broker_lock=enforced, replay=denied, write-ahead audit; docs/identity-shadow-runbook.md gains "First host enrollment (janusd-identity-admin)"; reason-code table extended.

Feature + version PR: #89
Tickets: JANUS-453 (context: JANUS-442, NIX-377, NIX-380; design review recorded on the ticket)

Assets 11
Loading