Locksmith: verify and load proofed V1 quorum bundles #11
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Current status — 2026-09-24
Proofed V1 loading is implemented; explicit legacy import/recovery is also available.
Published PR heads checked on 2026-09-24: Platform
1f7e296, Locksmith9f702bb, Bootproof821b5c6. Platform's dependency/model/mock/default-runtime pins are aligned at Locksmithd2876e9; subsequent Locksmith changes concern examples, configuration, documentation and terminology. These are published implementation states, not merged/deployed-state claims.Implemented: Historical proof verification, exact configured Keymaker PCR policy, complete V1 envelopes and typed holder associations are integrated. Separate holder-assisted ImportedV0 support preserves original recovery material and needs explicit opt-in. Raw V0 never becomes a silent fallback for malformed/failed V1; earlier incompatible V1 is not migrated.
Remaining: Complete current review/merge and the explicit unsupported/missing/wrong-typed field acceptance mapping. Attach exact deployed runtime/PCR and legacy/physical-holder evidence. Address affected parser/dependency findings where reachable; do not equate loader completion with recovery-transport hardening (#12).
Evidence: current implementation/documentation, V1 contract. The September 23 default release suite passed 11 tests; all 19 certificate-service cases passed across the initial run and socket-permission rerun. Those results apply to
c33e35e, not a fresh full-suite run of the later terminology change. Earlier generation/model/loader/synthetic results remain scoped to the revisions recorded in their documentation. Current PRs remain open/unmerged.Current Keymaker contract
The shared model defines:
GenerateQuorumRequest::V1, withbundle_id: [u8; 16],label,threshold,maxand structuredkeyring.GenerateQuorumResponse = Proofed<GenerateQuorumBundle>. The outer object is{data, necroproof};datais taggedversion: "V1"and includesbundle_id,label,keyring, requiredthreshold/max,shardfileandpublic_key.Key::OpenPGP { cert }orKey::WebAuthn { credential, cert }. Multiple credentials for one holder authorize one share.keyring_hashor inline payload proof is required. V0, unproofed and earlier V1 bundles missing required quorum parameters are unsupported.Required behavior
GenerateQuorumResponseproof envelope, verify its V1 data against the independently configured Keymaker PCR policy, and return the verified bundle.bundle_id,label, structuredkeyring, requiredthreshold/max,shardfile, andpublic_key.bundle_idas canonical 16-byte UUID bytes.max/participant count invariants at generation time in #10; at load time, reject stored v1 data that is missing required fields, has unsupported versions, has malformed key entries, or cannot provide the material needed by current consumers.Key::WebAuthn { credential, cert }entries without flattening them into plain OpenPGP entries; WebAuthn/Caution-backed transport uses that association.Acceptance criteria
bundle_id: [u8; 16]and structuredVec<Key>preserved.Key::OpenPGP { cert }andKey::WebAuthn { credential, cert }entries.bundle_id,label,keyring,shardfile, orpublic_keyfields produce clear load errors.keyring_hashor inline proof fields.Related work
Updated this issue against current
mainafter the public certificate service foundation from PR #13 was manually merged.Key corrections:
bundle_idis now[u8; 16]canonical UUID bytes, not[u8; 32].bundle_id; the route generates it and returns it in the proofed bundle.Key::WebAuthn { credential, cert }associations for future Caution-backed shard recryption.keyring_hashornecroprooffields unless a future Keymaker model adds them explicitly.Historical proof verification and Platform integration are implemented.
Commits: Bootproof
821b5c6, Locksmith07041e4/9322956, Platformd3b2dc0.V0 compatibility remains deferred. Earlier V1 bundles without the required
threshold/maxfields are also rejected; compatibility/migration remains unresolved.Current proof-wrapped V1 bundles load and support the demonstrated recovery flow. Historical proof verification, PCR-policy cutoffs and structured holder associations are implemented.
The central outstanding requirement remains V0 fallback/upgrade: the loader intentionally rejects V0. Earlier V1 bundles without threshold/max are also rejected, with no migration path.
Current model tests pass, including intentional V0 rejection and missing quorum-parameter rejection. This is not evidence of the compatibility acceptance criteria passing.
Before closure: