Skip to content

0.15.0 — the key material leaves the filesystem

Choose a tag to compare

View all tags
@slabbdev slabbdev released this 13 Oct 10:36
· 41 commits to main since this release
v0.15.0
7ab889e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

The version the roadmap now describes: the keyholder (#85) — ADR 020's "keys are per PROCESS" as a runtime property.

What it closes

The floor howcani named (3hif9): the operator's key was a PEM file (db_path + ".key", chmod 600) or an env var — "a premise, not a cipher." An agent on the same machine could cat the key and BE the registrar the v0.2.7 pin names.

The shape

  • noirebox keyholder — the PEM loads ONCE into a dedicated daemon and never leaves it. The unix socket (noirebox-keyholder/0.1) answers sign and describe, nothing else — there is no export op; oversized lines are dropped by disconnection.
  • SocketSigner — duck-types .sign() + .public_hex(): every writer path (store, seal_writer, journal_report) signs THROUGH the daemon unchanged. Ed25519 is deterministic — the daemon's signatures are byte-identical to the key's own, and every existing verifier reads the journal as before.
  • --allow-uid — gates the peer by uid (SO_PEERCRED, Linux) and fails closed where the peer is not checkable: asking for a check and not getting one is a refusal, never an assumption.
  • noirebox keyholder-status — the out-of-band read of the pin value: the public key from the process that holds it, never from the journal it sealed. With v0.2.7's pin, the pair is complete: one names the authority, the other moves the material.

The honest boundary

Reachability of ONE socket path replaces readability of the key bytes. A deployment that wants "the agent cannot sign" mounts everything EXCEPT the socket — and after start, the PEM file can be removed from the agent-reachable volume entirely (the daemon holds the material in memory only). Where agent and operator share a uid AND the socket, the gate is the filesystem's — stated, not hidden. HSM/PKCS#11 rides the same signer interface later.

Install

pip install noirebox        # 0.15.0

Verified in a clean venv from the PyPI wheel: journal sealed through the socket, chain valid, signatures byte-identical, the gate refuses a foreign uid and fails closed when it cannot check, and there is no op that returns the material.

337 tests. ADR 020 amendment. README roadmap: the item ships, hardware custody (HSM/PKCS#11) remains on the same signer interface.

Assets 2
Loading