Skip to content

fix: a workload credential carries no build seal (core #812) #71

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
antoinetoussaint-byte merged 2 commits into from
Oct 18, 2026
Merged

fix: a workload credential carries no build seal (core #812) #71

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
93d6f40
fix: a workload credential carries no build seal (core #812) — WIP, t…
antoinetoussaint-byte Oct 18, 2026
9a466b8
test: the sealed identity is the installation alone (core #812)
antoinetoussaint-byte Oct 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
132 changes: 3 additions & 129 deletions boot_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,8 +53,7 @@ const testFrontend = "title: " + testSolutionTitle + "\norder: 1\nexposed_module
// identities, so the seal this runtime logs and a test asserts is the live one
// that authority holds rather than a number invented here.
const (
testInstallation = corework.FixtureInstallation
testBuildIncarnation = uint64(corework.FixtureBuildIncarnation)
testInstallation = corework.FixtureInstallation
)

// authorityValues provisions the module-authority group the way the platform
Expand Down Expand Up @@ -105,17 +104,6 @@ type hostMint struct {
// through the real client rather than by calling the wrapper directly.
switchTo *hostMint
switchAfter int64
// digest and incarnation override the build this host attests, so a test
// can have a RENEWAL seal a different execution than the first credential.
digest string
incarnation uint64
// executionFree makes this host mint a credential sealing NO execution,
// which core allows: the sealed execution became optional because a
// principal that bears no approved build — a person at a terminal — must
// not have one invented for it. It is the shape of core's own
// execution-missing fixture, and it is not a shape a WORKLOAD credential
// may have.
executionFree bool
// installation overrides the installation it seals credentials to, so a
// test can have a renewal answer about a different one. Empty means
// testInstallation.
Expand Down Expand Up @@ -146,62 +134,6 @@ type hostMint struct {
func (mint *hostMint) prepareAuthority(t *testing.T) {
t.Helper()
mint.authority = standInAuthority()
if mint.executionFree {
// An issuer that mints a credential sealing NO execution, which core
// permits only for a principal bearing no approved build — a person at
// a terminal. Built by taking core's fixture seal source and recording
// the installation seal and epoch WITHOUT an approved build, which is
// the shape of core's own execution-missing fixture.
//
// Core refuses to mint execution-free for a principal that does bear
// one, which is why this cannot be done by simply omitting the field.
seals := corework.NewMemorySealSource()
if err := seals.Put(corework.FixturePrincipal, corework.Seal{
InstallationID: testInstallation,
InstallationRevision: corework.FixtureInstallationRevision,
}); err != nil {
t.Fatalf("seal an execution-free issuer: %v", err)
}
if err := seals.PutEpoch(corework.FixturePrincipal, corework.FixturePrincipalEpoch); err != nil {
t.Fatalf("record the principal's epoch: %v", err)
}
// Explicitly bearing no execution, which is core's own distinction:
// a principal with an approved build MUST attest it, one recorded as
// bearing none legitimately carries no execution, and one core knows
// nothing about is refused. This is the middle case — a person at a
// terminal — and it is the shape a WORKLOAD credential must never have.
if err := seals.PutBearsNoExecution(corework.FixturePrincipal); err != nil {
t.Fatalf("record the principal as bearing no execution: %v", err)
}
_, key := corework.FixtureKeyPair()
mint.authority = &corework.Authority{
Issuer: corework.FixtureIssuer,
KeyID: corework.FixtureKeyID,
Key: key,
Revisions: corework.FixtureRevisions(),
Seals: seals,
}
}
if mint.digest != "" || mint.incarnation != 0 {
// An issuer whose APPROVED BUILD has moved, which is the only way it
// can attest a different one: core refuses to seal an execution the
// issuer does not approve for that principal. Built from core's own
// fixture seal source with the approved build overridden.
seals := corework.FixtureSeals()
if err := seals.PutApprovedBuild(corework.FixturePrincipal,
cmp.Or(mint.digest, corework.FixtureImageDigest),
cmp.Or(mint.incarnation, uint64(corework.FixtureBuildIncarnation))); err != nil {
t.Fatalf("move the issuer's approved build: %v", err)
}
_, key := corework.FixtureKeyPair()
mint.authority = &corework.Authority{
Issuer: corework.FixtureIssuer,
KeyID: corework.FixtureKeyID,
Key: key,
Revisions: corework.FixtureRevisions(),
Seals: seals,
}
}
if mint.installation != "" {
// An issuer that seals to a different installation, for the renewal
// refusal. Built from CORE's fixture seal source with one entry
Expand Down Expand Up @@ -253,8 +185,6 @@ func newHostMint(t *testing.T, mint *hostMint) *hostMint {
return mint
}

// execution is the build this host attests for the credential it mints, or
// nothing at all when the test asks for an execution-free one.
// installationFor is the installation the shape in force seals to.
func (m *hostMint) installationFor() string {
if m.switchTo != nil && atomic.LoadInt64(&m.mints) > m.switchAfter {
Expand All @@ -263,16 +193,6 @@ func (m *hostMint) installationFor() string {
return m.installation
}

func (m *hostMint) execution() corework.Execution {
if m.executionFree {
return corework.Execution{}
}
return corework.Execution{
ImageDigest: cmp.Or(m.digest, corework.FixtureImageDigest),
BuildIncarnation: cmp.Or(m.incarnation, uint64(corework.FixtureBuildIncarnation)),
}
}

func (m *hostMint) serve(w http.ResponseWriter, r *http.Request) {
organization := testOrganization
m.mu.Lock()
Expand Down Expand Up @@ -316,9 +236,9 @@ func (m *hostMint) serve(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(m.status)
return
}
issuer, execution := m.authority, m.execution()
issuer := m.authority
if m.switchTo != nil && atomic.LoadInt64(&m.mints) > m.switchAfter {
issuer, execution = m.switchTo.authority, m.switchTo.execution()
issuer = m.switchTo.authority
}
token, _, err := issuer.Start(r.Context(), corework.StartInput{
TenantID: corework.FixtureTenant,
Expand All @@ -329,13 +249,6 @@ func (m *hostMint) serve(w http.ResponseWriter, r *http.Request) {
OrganizationID: organization,
InstallationID: cmp.Or(m.installationFor(), testInstallation),
TTL: m.ttl,
// Core v0.9.0 requires the caller to attest the build it is running:
// a principal that exercises an approved execution must name the image
// digest and incarnation, and the issuer checks them against the
// approved build it holds for that principal. The execution moved off
// the installation seal, where it described the OWNER's workload
// however many delegation hops had been added.
Execution: execution,
})
if err != nil {
m.signErr = err
Expand Down Expand Up @@ -947,45 +860,6 @@ func takeListener(server *Server) *Server {
return server
}

func TestABootedWorkRefusesARenewalToAnotherExecution(t *testing.T) {
t.Setenv(manifest.APIConsumesEnvironmentVariable, consumesThings)
mint := newHostMint(t, &hostMint{ttl: 2 * time.Second, switchAfter: 1, switchTo: &hostMint{incarnation: 99, ttl: 2 * time.Second}})
server := New(Manifest{ID: testSolutionID}).Consumes(passthroughModule()).Contract(ModuleContract{Ceilings: map[string]map[string][]Scope{
localProfile: {"things": {{ResourceKind: "things", Actions: []string{"read"}}}},
}}).Handle("/thing", func(ctx context.Context, gw *Gateway) (any, error) {
_, err := gw.ForModule(ctx, "things", Scope{ResourceKind: "things", Actions: []string{"read"}})
return map[string]string{"ok": "yes"}, err
})
solution := boot(t, server, mint)
request := func() int {
r, _ := http.NewRequest(http.MethodGet, solution.base+"/thing", nil)
r.Header.Set("authorization", viewerBearer())
r.Header.Set(orgHeader, testOrganization)
r.Header.Set(sessionHeader, "session")
r.Header.Set(workcontext.InstallationIDHeaderName, testInstallation)
response, err := solution.client.Do(r)
if err != nil {
t.Fatal(err)
}
defer response.Body.Close()
if response.StatusCode != 200 {
body, _ := io.ReadAll(response.Body)
t.Logf("work response: %s", body)
}
return response.StatusCode
}
if got := request(); got != 200 {
t.Fatalf("initial work = %d", got)
}
time.Sleep(2100 * time.Millisecond)
if got := request(); got != 503 {
t.Fatalf("changed execution = %d", got)
}
if getStatus(t, solution.client, solution.base+HealthPath) != 200 {
t.Fatal("scoped refusal ended process")
}
}

// localRun is the SDK's transport source for a test: a local run that asserts
// no mesh, so the only plaintext the mint client admits is loopback — the rule
// a booted runtime applies to its resolved gateway, answered the way a test's
Expand Down
12 changes: 7 additions & 5 deletions broker_credential_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -407,8 +407,10 @@ func TestBrokerHoldsAuthorityAndExecutionAcrossRenewals(t *testing.T) {
name string
after *hostMint
}{
{"execution missing", &hostMint{executionFree: true}},
{"execution changed", &hostMint{incarnation: 99}},
// A renewal sealed to another installation is another deployment: the one
// identity a credential still seals since the host stopped sealing a build
// (core #812) and binds it at every mint instead.
{"installation changed", &hostMint{installation: "installation-somewhere-else"}},
} {
t.Run(tc.name, func(t *testing.T) {
s, host, _ := brokerFixture(t)
Expand All @@ -421,18 +423,18 @@ func TestBrokerHoldsAuthorityAndExecutionAcrossRenewals(t *testing.T) {
s.brokerCredential.renewAt = time.Time{}
for range 2 {
if _, err := s.acquireCredential(context.Background()); !errors.Is(err, workcontext.ErrMintRefused) || !errors.Is(err, ErrCredentialRefused) {
t.Fatalf("execution change accepted or not terminal: %v", err)
t.Fatalf("installation change accepted or not terminal: %v", err)
}
}
if host.count() != 2 {
t.Fatalf("execution change retried: %d", host.count())
t.Fatalf("installation change retried: %d", host.count())
}
// Exercise the native broker through the controller without a
// socket. The booted test separately proves serve observes this
// signal and returns without cancellation by the test.

if terminal := s.controller.terminalErr.Load(); terminal == nil || !errors.Is(*terminal, workcontext.ErrMintRefused) {
t.Fatal("the execution refusal was not recorded for serve")
t.Fatal("the installation refusal was not recorded for serve")
}
})
}
Expand Down
4 changes: 2 additions & 2 deletions conformance_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,8 +49,8 @@ func TestCoreConformanceFixturesThroughTheCarrier(t *testing.T) {
if err != nil {
t.Fatalf("core conformance fixtures: %v", err)
}
if len(fixtures) < 40 {
t.Fatalf("core published %d fixtures; the kit is 40 at core v0.19.1, so this test is reading a trimmed set", len(fixtures))
if len(fixtures) < 35 {
t.Fatalf("core published %d fixtures; the kit is 35 at core b81d92e6 (core #812 removed the five build-seal fixtures), so this test is reading a trimmed set", len(fixtures))
}

var carriedCount, refusedCount int
Expand Down
19 changes: 5 additions & 14 deletions credential.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -186,11 +186,7 @@ func (a *authorityHeldSource) Credential(ctx context.Context) (workcontext.Crede
//
// Read through the SDK's own accessor on the verified seal. No decoder here.
func (a *authorityHeldSource) holdSealedIdentity(seal *workcontext.SealedValues) error {
held := sealedIdentity{
installation: seal.GetInstallationId(),
digest: seal.GetImageDigest(),
incarnation: seal.GetBuildIncarnation(),
}
held := sealedIdentity{installation: seal.GetInstallationId()}
a.mu.Lock()
defer a.mu.Unlock()
if a.sealed == (sealedIdentity{}) {
Expand All @@ -200,19 +196,14 @@ func (a *authorityHeldSource) holdSealedIdentity(seal *workcontext.SealedValues)
if a.sealed == held {
return nil
}
return fmt.Errorf("%w: this execution has been acting under installation %s, image %s, build incarnation %d, and its credential renewed sealed to installation %s, image %s, build incarnation %d. That is a different execution, not a renewal: every work context this process mints for a viewer is attested by this credential, so the mints before and after this point would name a different deployment or a different build — including one the host's approved-build ceiling was never applied to",
workcontext.ErrMintRefused,
a.sealed.installation, a.sealed.digest, a.sealed.incarnation,
held.installation, held.digest, held.incarnation)
return fmt.Errorf("%w: this execution has been acting under installation %s, and its credential renewed sealed to installation %s. That is a different deployment, not a renewal: every work context this process mints for a viewer is attested by this credential, so the mints before and after this point would name a different deployment",
workcontext.ErrMintRefused, a.sealed.installation, held.installation)
}

// sealedIdentity is what a credential is sealed to: which deployment, and
// which build inside it. Compared as one value, because a renewal that changed
// any part of it changed which execution is asking.
// sealedIdentity is what a credential is sealed to: which deployment. The
// build is no longer sealed (core #812): the host binds it at every mint.
type sealedIdentity struct {
installation string
digest string
incarnation uint64
}

// mintOptions binds the declared prefix and perimeter credential to the frozen
Expand Down
Loading
Loading