carlos / platform Public

activator: the legacy co-spawned sidecar on a replica host is gated as the worker is, and refusals name /etc/carlos/replica-home-keys (L21 fix round 1)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Paul Campbell pushed by claude 1 week ago 3ab3cbe19c3e0e21e6da2786c98812defa8f51ef parent 37d652d

8 files changed, +275 −30

internal/activator/backend_exec.go +6 −0
internal/activator/prepare.go +9 −9
internal/activator/replica_instancekey_linux_test.go +103 −0
internal/activator/replica_instancekey_test.go +83 −0
internal/activator/replicakey.go +27 −9
internal/host/replicahomekeys.go +4 −2
internal/host/replicahomekeys_test.go +35 −1
internal/instancekey/instancekey.go +8 −9

CI passed — run details

CI log

=== gate ===
cd launchctx && go vet ./... && go test ./... -count=1
ok  	amadan.net/carlos/platform.git/launchctx	0.015s
?   	amadan.net/carlos/platform.git/launchctx/controlname	[no test files]
?   	amadan.net/carlos/platform.git/launchctx/wireid	[no test files]
go vet ./...
gofmt -l .: clean
go test ./... -count=1 -timeout 30m
ok  	github.com/carlosframework/platform	328.231s
?   	github.com/carlosframework/platform/cmd/changelog	[no test files]
ok  	github.com/carlosframework/platform/cmd/console	5.320s
ok  	github.com/carlosframework/platform/internal/activator	200.778s
ok  	github.com/carlosframework/platform/internal/agentsock	0.053s
ok  	github.com/carlosframework/platform/internal/alerting	0.004s
ok  	github.com/carlosframework/platform/internal/analytics	0.116s
ok  	github.com/carlosframework/platform/internal/appconfig	2.555s
ok  	github.com/carlosframework/platform/internal/apperr	0.227s
ok  	github.com/carlosframework/platform/internal/applog	0.306s
ok  	github.com/carlosframework/platform/internal/awsinv	0.036s
ok  	github.com/carlosframework/platform/internal/boxchoice	0.043s
ok  	github.com/carlosframework/platform/internal/boxid	0.755s
?   	github.com/carlosframework/platform/internal/boxid/boxidtest	[no test files]
?   	github.com/carlosframework/platform/internal/boxid/internal/signtest	[no test files]
ok  	github.com/carlosframework/platform/internal/boxvolumes	0.023s
ok  	github.com/carlosframework/platform/internal/caps	0.035s
ok  	github.com/carlosframework/platform/internal/certwarm	0.035s
ok  	github.com/carlosframework/platform/internal/cgroup	0.233s
ok  	github.com/carlosframework/platform/internal/changelog	0.379s
ok  	github.com/carlosframework/platform/internal/clamd	0.057s
?   	github.com/carlosframework/platform/internal/cliflag	[no test files]
ok  	github.com/carlosframework/platform/internal/console	323.994s
?   	github.com/carlosframework/platform/internal/controlname	[no test files]
?   	github.com/carlosframework/platform/internal/controlsock	[no test files]
ok  	github.com/carlosframework/platform/internal/dbdoor	5.938s
ok  	github.com/carlosframework/platform/internal/dbdoor/dbdoortest	0.014s
ok  	github.com/carlosframework/platform/internal/dbverify	0.009s
ok  	github.com/carlosframework/platform/internal/dnsrec	0.006s
ok  	github.com/carlosframework/platform/internal/docsite	0.008s
ok  	github.com/carlosframework/platform/internal/domains	3.290s
ok  	github.com/carlosframework/platform/internal/doorkey	0.007s
ok  	github.com/carlosframework/platform/internal/economics	0.009s
ok  	github.com/carlosframework/platform/internal/edge	26.795s
?   	github.com/carlosframework/platform/internal/edgeproof	[no test files]
ok  	github.com/carlosframework/platform/internal/edgesfile	0.008s
ok  	github.com/carlosframework/platform/internal/fleetapi	0.163s
ok  	github.com/carlosframework/platform/internal/gate	2.217s
ok  	github.com/carlosframework/platform/internal/genselect	0.042s
ok  	github.com/carlosframework/platform/internal/geo	0.024s
ok  	github.com/carlosframework/platform/internal/geoip	0.088s
ok  	github.com/carlosframework/platform/internal/host	49.096s
ok  	github.com/carlosframework/platform/internal/hostactors	0.566s
ok  	github.com/carlosframework/platform/internal/hostbox	1.689s
ok  	github.com/carlosframework/platform/internal/hostclaim	0.567s
ok  	github.com/carlosframework/platform/internal/hostevidence	0.014s
ok  	github.com/carlosframework/platform/internal/hostexec	0.381s
ok  	github.com/carlosframework/platform/internal/hostfence	0.046s
ok  	github.com/carlosframework/platform/internal/hostfiles	4.139s
ok  	github.com/carlosframework/platform/internal/hostfloor	0.011s
ok  	github.com/carlosframework/platform/internal/hostguard	0.156s
ok  	github.com/carlosframework/platform/internal/hostops	2.357s
ok  	github.com/carlosframework/platform/internal/hostquarantine	0.004s
ok  	github.com/carlosframework/platform/internal/hostresolve	0.353s
ok  	github.com/carlosframework/platform/internal/hostwrite	0.006s
ok  	github.com/carlosframework/platform/internal/infraview	0.003s
ok  	github.com/carlosframework/platform/internal/instancectl	1.734s
ok  	github.com/carlosframework/platform/internal/instanceexec	2.935s
ok  	github.com/carlosframework/platform/internal/instancefs	0.010s
ok  	github.com/carlosframework/platform/internal/instancekey	0.003s
ok  	github.com/carlosframework/platform/internal/layout	1.987s
ok  	github.com/carlosframework/platform/internal/lease	9.518s
ok  	github.com/carlosframework/platform/internal/lease/leasetest	0.024s
ok  	github.com/carlosframework/platform/internal/ledger	0.037s
ok  	github.com/carlosframework/platform/internal/mail	0.508s
ok  	github.com/carlosframework/platform/internal/maintenance	0.078s
ok  	github.com/carlosframework/platform/internal/maintenanceexec	5.593s
ok  	github.com/carlosframework/platform/internal/maintenanceguard	0.176s
ok  	github.com/carlosframework/platform/internal/metrics	0.006s
ok  	github.com/carlosframework/platform/internal/moves	22.818s
ok  	github.com/carlosframework/platform/internal/moves/archive	1.320s
ok  	github.com/carlosframework/platform/internal/objstore	0.420s
ok  	github.com/carlosframework/platform/internal/ops	0.192s
ok  	github.com/carlosframework/platform/internal/park	0.352s
ok  	github.com/carlosframework/platform/internal/privatefile	0.003s
ok  	github.com/carlosframework/platform/internal/provision	4.040s
ok  	github.com/carlosframework/platform/internal/publicrelease	0.008s
ok  	github.com/carlosframework/platform/internal/registry	4.062s
ok  	github.com/carlosframework/platform/internal/relay	4.260s
ok  	github.com/carlosframework/platform/internal/release	20.829s
ok  	github.com/carlosframework/platform/internal/rollout	2.069s
ok  	github.com/carlosframework/platform/internal/rootaws	0.013s
ok  	github.com/carlosframework/platform/internal/s3compat	0.012s
ok  	github.com/carlosframework/platform/internal/safefile	0.004s
ok  	github.com/carlosframework/platform/internal/schedule	2.536s
ok  	github.com/carlosframework/platform/internal/sim/hostlife	6.862s
ok  	github.com/carlosframework/platform/internal/sim/litestreamfacts	4.190s
ok  	github.com/carlosframework/platform/internal/status	0.061s
ok  	github.com/carlosframework/platform/internal/steering	0.015s
ok  	github.com/carlosframework/platform/internal/stopevidence	0.199s
ok  	github.com/carlosframework/platform/internal/svcrole	0.002s
ok  	github.com/carlosframework/platform/internal/telemetry	0.004s
ok  	github.com/carlosframework/platform/internal/termfence	0.004s
ok  	github.com/carlosframework/platform/internal/tunnelclient	0.006s
ok  	github.com/carlosframework/platform/internal/unixdial	0.002s
ok  	github.com/carlosframework/platform/internal/updatewords	0.002s
ok  	github.com/carlosframework/platform/internal/usage	0.004s
ok  	github.com/carlosframework/platform/internal/version	0.002s
ok  	github.com/carlosframework/platform/internal/vet	1.870s
=== cross ===
--- shard 0 of 5 ---
cross-compiling darwin/arm64
--- shard 1 of 5 ---
cross-compiling darwin/amd64
--- shard 2 of 5 ---
cross-compiling linux/arm64
--- shard 3 of 5 ---
cross-compiling windows/amd64
--- shard 4 of 5 ---
cross-compiling windows/arm64
=== minio-contract ===
minio contract: arm64, minio RELEASE.2025-09-07T16-13-09Z, mc RELEASE.2025-08-13T08-35-41Z
  minio: cached, digest verified
  mc: cached, digest verified
  minio healthy on 127.0.0.1:20999
Added `local` successfully.
Bucket created successfully `local/contract-bucket`.
Bucket created successfully `local/denied-bucket`.
Created policy `contract-only` successfully.
Added user `scopeduser` successfully.
Attached Policies: [contract-only]
To User: scopeduser
  buckets and scoped user ready
=== RUN   TestDeliveredContractMinio
=== RUN   TestDeliveredContractMinio/put
=== RUN   TestDeliveredContractMinio/get_round-trips_the_body
=== RUN   TestDeliveredContractMinio/list_shows_the_key
=== RUN   TestDeliveredContractMinio/head_and_list_agree_on_the_version
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed
=== RUN   TestDeliveredContractMinio/delete_removes_it
=== RUN   TestDeliveredContractMinio/cross-bucket_denial
--- PASS: TestDeliveredContractMinio (0.02s)
    --- PASS: TestDeliveredContractMinio/put (0.00s)
    --- PASS: TestDeliveredContractMinio/get_round-trips_the_body (0.00s)
    --- PASS: TestDeliveredContractMinio/list_shows_the_key (0.00s)
    --- PASS: TestDeliveredContractMinio/head_and_list_agree_on_the_version (0.00s)
    --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload (0.00s)
    --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route (0.01s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed (0.00s)
    --- PASS: TestDeliveredContractMinio/delete_removes_it (0.00s)
    --- PASS: TestDeliveredContractMinio/cross-bucket_denial (0.00s)
PASS
ok  	github.com/carlosframework/platform/internal/objstore	0.023s
=== RUN   TestT4StorageProbeMinio
2026/10/11 16:27:00 moves: T4: STORE: list: operation error S3: ListObjectsV2, https response error StatusCode: 403, RequestID: 18DD866AD6C489E6, HostID: 7c420053e0fbcd7f41653fdd92ffa2802c903d05303b1aa15adc2e8bb65d183f, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
--- PASS: TestT4StorageProbeMinio (0.01s)
PASS
ok  	github.com/carlosframework/platform/internal/host	0.016s
minio contract: PASS

diff --git a/internal/activator/backend_exec.go b/internal/activator/backend_exec.go

index 7e04b249b..7566a90b3 100644

--- a/internal/activator/backend_exec.go

+++ b/internal/activator/backend_exec.go

@@ -2098,6 +2098,12 @@ func (b *ExecBackend) startSidecarChildFrom(_ context.Context, rt registry.Route

if err != nil {

return nil, fmt.Errorf("read sidecar env: %w", err)

}

+ // The sidecar runs the app binary with no control socket, so on a

+ // replica host it is gated as the worker is (ruling 26): its home's key,

+ // verified, or nothing runs. A key in its own file is checked too.

+ if err := b.replicaKeyGate(rt, fileEnv, sidecarKeyLayer(fileEnv), false); err != nil {

+ return nil, err

+ }

child, _, err := b.placeFor(spawnSidecar, 0)

if err != nil {

return nil, err

diff --git a/internal/activator/prepare.go b/internal/activator/prepare.go

index 83706e7f9..09ca41981 100644

--- a/internal/activator/prepare.go

+++ b/internal/activator/prepare.go

@@ -76,6 +76,7 @@ func (b *ExecBackend) prepareAt(rt registry.Route, role instancectl.Role, sock s

if err != nil {

return p, nil, nil, nil, err

}

+ keyLayer = sidecarKeyLayer(env)

}

// Stale exit records from earlier invocations of this role: a start

// that reads one would mis-word the very first exit line this

@@ -107,16 +108,15 @@ func (b *ExecBackend) prepareAt(rt registry.Route, role instancectl.Role, sock s

_ = os.Remove(sock)

ctl = b.listenControl(rt, sock+".control", p.envFile, gen)

}

- // A replica's run and seed roles are gated like a flat launch: the

- // seed has no control socket, the run role has the one just bound or

- // none (ruling 26). The sidecar role reads no instance env.

- if role == instancectl.RoleRun || role == instancectl.RoleSeed {

- if err := b.replicaKeyGate(rt, env, keyLayer, ctl != nil); err != nil {

- if ctl != nil {

- ctl.Close()

- }

- return p, nil, nil, nil, err

+ // A replica's roles are gated like a flat launch (ruling 26): the seed

+ // and the sidecar have no control socket, the run role has the one just

+ // bound or none. The sidecar's key, if its own file holds one, is

+ // checked as the flat sidecar's is (sidecarKeyLayer).

+ if err := b.replicaKeyGate(rt, env, keyLayer, ctl != nil); err != nil {

+ if ctl != nil {

+ ctl.Close()

}

+ return p, nil, nil, nil, err

}

logs, err := listenLogs(b.logSocketFor(rt.Host, role, gen), b.logEmitter(rt))

if err != nil {

diff --git a/internal/activator/replica_instancekey_linux_test.go b/internal/activator/replica_instancekey_linux_test.go

index 44929d652..d9f8bf65e 100644

--- a/internal/activator/replica_instancekey_linux_test.go

+++ b/internal/activator/replica_instancekey_linux_test.go

@@ -112,3 +112,106 @@ func TestNestedReplicaPrepareIsGated(t *testing.T) {

})

}

+// The nested legacy sidecar role is gated as the flat one is: a key in its

+// own file must be the home's, and a keyless one is refused (it has no

+// control socket).

+func TestNestedReplicaSidecarPrepareIsGated(t *testing.T) {

+ homeKey := strings.Repeat("H", 43) + "="

+ for _, tc := range []struct {

+ name, sidecar string

+ refused bool

+ }{

+ {"a keyless sidecar", "OTHER=1\n", true},

+ {"a sidecar with another key", InstanceKeyVar + "=configured-B\n", true},

+ {"a sidecar with the home's key", InstanceKeyVar + "=" + homeKey + "\n", false},

+ } {

+ t.Run(tc.name, func(t *testing.T) {

+ b, rt := nestedBackend(t, &fakeControl{inv: "inv1"}, &fakeUnit{})

+ rt.Replica = true

+ b.ReplicaHomeKeys = func(string) (string, bool) { return instancekey.Digest(homeKey), true }

+ b.ReplicaConfigKey = func(context.Context, registry.Route) (string, error) { return instancekey.Digest("configured-B"), nil }

+ dir := provision.InstanceDir(b.DataDir, rt.Host)

+ if err := os.MkdirAll(dir, 0o700); err != nil {

+ t.Fatal(err)

+ }

+ if err := os.WriteFile(filepath.Join(dir, rt.Host+"-sidecar.env"), []byte(tc.sidecar), 0o600); err != nil {

+ t.Fatal(err)

+ }

+ _, ctl, logs, env, err := b.prepare(rt, instancectl.RoleSidecar)

+ if tc.refused {

+ if !errors.Is(err, ErrReplicaKey) {

+ t.Fatalf("prepare = %v, want ErrReplicaKey", err)

+ }

+ return

+ }

+ if err != nil {

+ t.Fatalf("prepare: %v", err)

+ }

+ logs.Close()

+ if ctl != nil {

+ ctl.Close()

+ }

+ if env[InstanceKeyVar] != homeKey {

+ t.Fatal("the prepared sidecar env does not carry the home's key")

+ }

+ })

+ }

+// A refused replica launch closes the control listener it had bound: the

+// socket must not outlive the launch it was bound for, on the flat spawn or

+// the nested run role.

+func TestReplicaRefusalClosesTheControlListener(t *testing.T) {

+ if !socketsAllowed(t) {

+ t.Skip("needs unix sockets (run with the sandbox off)")

+ }

+ homeKey := strings.Repeat("H", 43) + "="

+ homes := func(string) (string, bool) { return instancekey.Digest(homeKey), true }

+ bucketB := func(context.Context, registry.Route) (string, error) { return instancekey.Digest("configured-B"), nil }

+ closed := func(t *testing.T, control string) {

+ t.Helper()

+ if c, err := net.Dial("unix", control); err == nil {

+ c.Close()

+ t.Fatalf("the control socket %s still accepts after the refusal", control)

+ }

+ t.Run("flat spawn", func(t *testing.T) {

+ b := testExecBackend(t)

+ rt := registry.Route{Host: "shop-au.example.com", Kind: "instance", Replica: true, Socket: tmpSock(t)}

+ if err := os.WriteFile(filepath.Join(b.DataDir, rt.Host+".env"), []byte("CARLOS_ADMIN_TOKEN="+strings.Repeat("c", 64)+"\n"), 0o600); err != nil {

+ t.Fatal(err)

+ }

+ if err := os.WriteFile(filepath.Join(b.DataDir, rt.Host+".config.env"), []byte(InstanceKeyVar+"=configured-B\n"), 0o600); err != nil {

+ t.Fatal(err)

+ }

+ b.ReplicaHomeKeys, b.ReplicaConfigKey = homes, bucketB

+ out := stageHelperApp(t, b, rt.Host, "v1")

+ ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)

+ defer cancel()

+ proc, _, err := b.Start(ctx, rt)

+ if proc != nil {

+ defer proc.Stop(context.Background())

+ }

+ if !errors.Is(err, ErrReplicaKey) || outcomeOf(out) != "" {

+ t.Fatalf("Start = %v; want ErrReplicaKey and no app", err)

+ }

+ closed(t, rt.Socket+".control")

+ })

+ t.Run("nested run role", func(t *testing.T) {

+ b, rt := nestedBackend(t, &fakeControl{inv: "inv1"}, &fakeUnit{})

+ rt.Replica = true

+ b.ReplicaHomeKeys, b.ReplicaConfigKey = homes, bucketB

+ dir := provision.InstanceDir(b.DataDir, rt.Host)

+ if err := os.MkdirAll(dir, 0o700); err != nil {

+ t.Fatal(err)

+ }

+ if err := os.WriteFile(filepath.Join(dir, rt.Host+".config.env"), []byte(InstanceKeyVar+"=configured-B\n"), 0o600); err != nil {

+ t.Fatal(err)

+ }

+ if _, _, _, _, err := b.prepare(rt, instancectl.RoleRun); !errors.Is(err, ErrReplicaKey) {

+ t.Fatalf("prepare = %v, want ErrReplicaKey", err)

+ }

+ closed(t, rt.Socket+".control")

+ })

diff --git a/internal/activator/replica_instancekey_test.go b/internal/activator/replica_instancekey_test.go

index 4e39304c9..21f28fb1e 100644

--- a/internal/activator/replica_instancekey_test.go

+++ b/internal/activator/replica_instancekey_test.go

@@ -332,3 +332,86 @@ func TestReplicaWorkerIsGatedLikeASeed(t *testing.T) {

})

}

+// The legacy co-spawned sidecar (<host>-sidecar.env, StartSidecar) runs the

+// app binary with no control socket, so on a replica host it is gated as

+// the worker is (ruling 26): the key in its own file, if any, must be the

+// home's verified key, and a keyless one is refused rather than left to

+// mint. A sidecar on a host that is not a replica is unaffected.

+func TestReplicaLegacySidecarIsGatedLikeTheWorker(t *testing.T) {

+ homeKey := strings.Repeat("H", 43) + "="

+ for _, tc := range []struct {

+ name string

+ replica bool

+ sidecar string // <host>-sidecar.env

+ want string // the helper's outcome; "" = refused, no sidecar ran

+ }{

+ {"a replica's sidecar with the home's key runs", true, InstanceKeyVar + "=" + homeKey + "\n", "key " + instancekey.Digest(homeKey)},

+ {"a replica's sidecar with another key is refused", true, InstanceKeyVar + "=configured-B\n", ""},

+ {"a replica's keyless sidecar is refused", true, "OTHER=1\n", ""},

+ {"a sidecar on a host that is not a replica is unaffected", false, InstanceKeyVar + "=configured-B\n", "key " + instancekey.Digest("configured-B")},

+ } {

+ t.Run(tc.name, func(t *testing.T) {

+ b := testExecBackend(t)

+ rt := registry.Route{Host: "shop-au.example.com", Kind: "instance", Replica: tc.replica}

+ sidecarEnv := filepath.Join(b.DataDir, rt.Host+"-sidecar.env")

+ if err := os.WriteFile(sidecarEnv, []byte(tc.sidecar), 0o600); err != nil {

+ t.Fatal(err)

+ }

+ if tc.replica {

+ b.ReplicaHomeKeys = func(h string) (string, bool) { return instancekey.Digest(homeKey), h == rt.Host }

+ // The bucket agrees with whatever the case holds, so only the

+ // home-key check decides.

+ b.ReplicaConfigKey = freshConfig(replicaCase{bucket: "configured-B"})

+ }

+ out := stageHelperApp(t, b, rt.Host, "v1")

+ proc, err := b.StartSidecar(context.Background(), rt)

+ if proc != nil {

+ defer proc.Stop(context.Background())

+ }

+ got := outcomeOf(out)

+ if tc.want == "" {

+ if !errors.Is(err, ErrReplicaKey) || proc != nil || got != "" {

+ t.Fatalf("StartSidecar = %v (proc %v), outcome %q; want ErrReplicaKey and no sidecar", err, proc != nil, got)

+ }

+ } else if err != nil || got != tc.want {

+ t.Fatalf("StartSidecar = %v, outcome %q; want %q", err, got, tc.want)

+ }

+ if raw, _ := os.ReadFile(sidecarEnv); string(raw) != tc.sidecar {

+ t.Fatal("a sidecar launch changed its env file: nothing mints there")

+ }

+ })

+ }

+// Two guards that a later check would otherwise back up: with no list entry

+// for the replica, or a bucket read that fails, the launch is refused for

+// that reason, named, and not merely because a digest compared against ""

+// failed. The refusal names the file an operator must fix.

+func TestReplicaGateNamesWhyItRefused(t *testing.T) {

+ keyA := strings.Repeat("A", 43) + "="

+ rt := registry.Route{Host: "shop-au.example.com", Kind: "instance", Replica: true}

+ env := map[string]string{InstanceKeyVar: keyA}

+ listed := func(string) (string, bool) { return instancekey.Digest(keyA), true }

+ bucketA := func(context.Context, registry.Route) (string, error) { return instancekey.Digest(keyA), nil }

+ for _, tc := range []struct {

+ name string

+ homes func(string) (string, bool)

+ bucket func(context.Context, registry.Route) (string, error)

+ want string

+ }{

+ {"no entry in the list", func(string) (string, bool) { return "", false }, bucketA, "no entry for it in /etc/carlos/replica-home-keys"},

+ {"no list reader at all", nil, bucketA, "no entry for it in /etc/carlos/replica-home-keys"},

+ {"the bucket read fails", listed, func(context.Context, registry.Route) (string, error) {

+ return "", errors.New("bucket unreachable")

+ }, "the bucket's configuration could not be read: bucket unreachable"},

+ } {

+ t.Run(tc.name, func(t *testing.T) {

+ b := &ExecBackend{DataDir: t.TempDir(), ReplicaHomeKeys: tc.homes, ReplicaConfigKey: tc.bucket}

+ err := b.replicaKeyGate(rt, env, instancekey.LayerConfig, false)

+ if !errors.Is(err, ErrReplicaKey) || !strings.Contains(err.Error(), tc.want) {

+ t.Fatalf("gate = %v; want ErrReplicaKey naming %q", err, tc.want)

+ }

+ })

+ }

diff --git a/internal/activator/replicakey.go b/internal/activator/replicakey.go

index 7905b5d9b..17da24047 100644

--- a/internal/activator/replicakey.go

+++ b/internal/activator/replicakey.go

@@ -4,7 +4,11 @@ package activator

// replica (#162) mirrors its home's data, sealed with the home's key, so

// the only key it may be handed is exactly the home's effective key. The

// platform never mints one on a replica row (ensureInstanceKeyFor), and

-// every replica launch passes replicaKeyGate before anything runs:

+// every replica launch passes replicaKeyGate before anything runs: the

+// flat seed and spawn (seedChild, spawnChildFrom), the nested run, seed

+// and sidecar roles (prepareAt), the worker (StartWorkerStaged) and the

+// legacy co-spawned sidecar (startSidecarChildFrom). The claim launch's

+// snapshot is gated by its own task (Task 4).

// - a replica whose env files deliver a key starts only when that key's

// digest is its entry in the box's verified list (ReplicaHomeKeys, which

@@ -14,16 +18,17 @@ package activator

// came from is decided by the same read that composed the env the child

// gets (instanceEnvLayer, ruling 29), never by reading the files again.

// A key that differs from either, or that cannot be checked, refuses

-// the launch with a log line. The fresh

-// read catches a configuration change that this box has not synced yet

-// while the home already holds the new key (ruling 27);

+// the launch with a log line. The fresh read catches a configuration

+// change that this box has not synced yet while the home already holds

+// the new key (ruling 27);

// - a replica whose env files deliver no key starts only with a control

// socket. There an app on rastrillo's InstanceKey with no key of its

// own gets ErrNoInstanceKey and refuses (step 3), and an app that never

-// asks for a key runs as before. Without a socket (a seed, a claim

-// launch before O6, a control bind that failed) the helper would fall

-// to step 4 and mint its own key over the home's data, so the agent

-// refuses the launch itself rather than leave that to the helper.

+// asks for a key runs as before. Without a socket (a seed, a worker, a

+// legacy sidecar, a claim launch before O6, a control bind that

+// failed) the helper would fall to step 4 and mint its own key over

+// the home's data, so the agent refuses the launch itself rather than

+// leave that to the helper.

// Delivering the home's key to a replica that has none is O8's, for a

// platform-minted home key only (ruling 28): until then, and always for a

@@ -60,6 +65,19 @@ func (b *ExecBackend) instanceEnvLayer(rt registry.Route) (map[string]string, in

return mergeEnv(cfgEnv, ownEnv), layer, nil

}

+// sidecarKeyLayer is the layer of the key in a legacy co-spawned sidecar's

+// env, its own hand-staged <host>-sidecar.env (one file, never merged with

+// the instance's layers): LayerOwn when that file holds a key, as the

+// instance's own <host>.env would. Nothing syncs that file from the bucket,

+// so a key there is checked against the home's listed digest with no fresh

+// read, and a keyless one is gated as any launch without a socket is.

+func sidecarKeyLayer(env map[string]string) instancekey.Layer {

+ if env[instancekey.Var] != "" {

+ return instancekey.LayerOwn

+ }

+ return instancekey.LayerNone

// replicaGateHook runs at the start of every replica gate, after the env

// was read. A test seam: it lets a test change the env files between the

// read and the gate, as a concurrent config sync can. Nil in production.

@@ -95,7 +113,7 @@ func (b *ExecBackend) replicaKeyGate(rt registry.Route, env map[string]string, l

}

switch {

case !ok:

- return refuse(instancekey.Var + " cannot be checked against its home's key (no entry in CARLOS_REPLICA_HOME_KEYS; O8)")

+ return refuse(instancekey.Var + " cannot be checked against its home's key (no entry for it in /etc/carlos/replica-home-keys; O8)")

case instancekey.Digest(key) != home:

return refuse(instancekey.Var + " is not its home's key")

}

diff --git a/internal/host/replicahomekeys.go b/internal/host/replicahomekeys.go

index a522fdc57..c1fbd2e2e 100644

--- a/internal/host/replicahomekeys.go

+++ b/internal/host/replicahomekeys.go

@@ -30,6 +30,8 @@ const replicaHomeKeysPath = "/etc/carlos/replica-home-keys"

// nothing. A list that cannot be read or parsed is logged by the error's

// position and reason, never its text, and verifies nothing, so every

// replica launch that would be handed a key is refused until it is fixed.

+// Its log lines name the file by replicaHomeKeysPath, the list it reads in

+// production, so an operator knows what to fix.

func replicaHomeKeys(read func() ([]byte, error)) func(host string) (string, bool) {

return func(host string) (string, bool) {

raw, err := read()

@@ -37,12 +39,12 @@ func replicaHomeKeys(read func() ([]byte, error)) func(host string) (string, boo

return "", false

}

if err != nil {

- log.Printf("agent: replica home keys: the list could not be read (no replica home key verifies): %v", err)

+ log.Printf("agent: replica home keys: %s could not be read (no replica home key verifies): %v", replicaHomeKeysPath, err)

return "", false

}

keys, err := instancekey.ParseHomeKeys(strings.ReplaceAll(string(raw), "\n", ","))

if err != nil {

- log.Printf("agent: replica home keys: %v (no replica home key verifies until it is fixed)", err)

+ log.Printf("agent: replica home keys: %s: %v (no replica home key verifies until it is fixed)", replicaHomeKeysPath, err)

return "", false

}

sha, ok := keys[host]

diff --git a/internal/host/replicahomekeys_test.go b/internal/host/replicahomekeys_test.go

index 3a321272d..c2939f532 100644

--- a/internal/host/replicahomekeys_test.go

+++ b/internal/host/replicahomekeys_test.go

@@ -69,7 +69,7 @@ func TestReplicaHomeKeysLogsAMalformedListWithoutItsText(t *testing.T) {

t.Fatal("a malformed list verified a key")

}

line := buf.String()

- if !strings.Contains(line, "CARLOS_REPLICA_HOME_KEYS entry 2") || strings.Contains(line, sha[:16]) || strings.Contains(line, "shop-au") {

+ if !strings.Contains(line, replicaHomeKeysPath) || !strings.Contains(line, "replica home keys entry 2") || strings.Contains(line, sha[:16]) || strings.Contains(line, "shop-au") {

t.Fatalf("log line %q: want the entry's position and reason, and none of its text", line)

}

buf.Reset()

@@ -119,3 +119,37 @@ func TestReplicaConfigKeyReadsTheBucketNow(t *testing.T) {

t.Fatal("no secrets key was not an error")

}

+// A failed first open is not kept: the same closure opens the store again

+// at the next replica launch, and reads the bucket once it opens.

+func TestReplicaConfigKeyRetriesAFailedOpen(t *testing.T) {

+ ctx := context.Background()

+ s := release.NewDirStore(t.TempDir())

+ priv, _, err := appconfig.GenerateKey()

+ if err != nil {

+ t.Fatal(err)

+ }

+ if err := appconfig.SetEnv(ctx, s, "acct", "shop", map[string]string{instancekey.Var: "key-A"}); err != nil {

+ t.Fatal(err)

+ }

+ rt := registry.Route{Host: "shop-au.example.com", Kind: "instance", App: "shop", Account: "acct", Replica: true}

+ opens := 0

+ read := replicaConfigKey(func(string) string { return priv }, func(context.Context) (release.Store, error) {

+ opens++

+ if opens == 1 {

+ return nil, errors.New("bucket unreachable")

+ }

+ return s, nil

+ })

+ if _, err := read(ctx, rt); err == nil {

+ t.Fatal("the failed first open was not an error")

+ }

+ for i := 0; i < 2; i++ {

+ if got, err := read(ctx, rt); err != nil || got != instancekey.Digest("key-A") {

+ t.Fatalf("read %d after the failure = %q, %v", i, got, err)

+ }

+ if opens != 2 {

+ t.Fatalf("the store was opened %d times, want twice: once failed, once kept", opens)

+ }

diff --git a/internal/instancekey/instancekey.go b/internal/instancekey/instancekey.go

index 825194d95..ae87ec793 100644

--- a/internal/instancekey/instancekey.go

+++ b/internal/instancekey/instancekey.go

@@ -209,11 +209,10 @@ func ValidDigest(s string) bool {

// separates entries with commas or newlines, but this splits on commas

// only, so its reader turns newlines into commas first (the agent's

// replicaHomeKeys). Whitespace around entries is ignored and "" is an

-// empty list. A

-// malformed entry, or a host named twice, fails the whole value: a list

-// that may be wrong is not a list to verify keys against. Its errors name

-// the entry by position and the reason, never the entry's text, which may

-// hold a digest.

+// empty list. A malformed entry, or a host named twice, fails the whole

+// value: a list that may be wrong is not a list to verify keys against.

+// Its errors name the entry by position and the reason, never the entry's

+// text, which may hold a digest.

func ParseHomeKeys(s string) (map[string]string, error) {

out := map[string]string{}

n := 0

@@ -227,14 +226,14 @@ func ParseHomeKeys(s string) (map[string]string, error) {

host, sha = strings.TrimSpace(host), strings.TrimSpace(sha)

switch {

case !ok:

- return nil, fmt.Errorf("instancekey: CARLOS_REPLICA_HOME_KEYS entry %d: no \"replica-host=\" before the digest", n)

+ return nil, fmt.Errorf("instancekey: replica home keys entry %d: no \"replica-host=\" before the digest", n)

case host == "" || strings.ContainsAny(host, " /=") || !strings.Contains(host, "."):

- return nil, fmt.Errorf("instancekey: CARLOS_REPLICA_HOME_KEYS entry %d: the host is empty or not a host name", n)

+ return nil, fmt.Errorf("instancekey: replica home keys entry %d: the host is empty or not a host name", n)

case !ValidDigest(sha):

- return nil, fmt.Errorf("instancekey: CARLOS_REPLICA_HOME_KEYS entry %d: the digest is not 64 lowercase hex characters", n)

+ return nil, fmt.Errorf("instancekey: replica home keys entry %d: the digest is not 64 lowercase hex characters", n)

}

if _, dup := out[host]; dup {

- return nil, fmt.Errorf("instancekey: CARLOS_REPLICA_HOME_KEYS entry %d: its host is listed by an earlier entry", n)

+ return nil, fmt.Errorf("instancekey: replica home keys entry %d: its host is listed by an earlier entry", n)

}

out[host] = sha

}