amadan
fix/hostbox-boxid-enroll
Squashed from fix/hostbox-boxid-enroll into main.
1 file changed,
+13
−7
internal/hostbox/identity.go+13 −7
CI passed — run details
diff --git a/internal/hostbox/identity.go b/internal/hostbox/identity.go| index 36e56a0c2..eaf55b2cc 100644 |
| --- a/internal/hostbox/identity.go |
| +++ b/internal/hostbox/identity.go |
| @@ -23,8 +23,10 @@ type CloudIdentity struct{ Provider, Account, Region, InstanceID string } |
| type Roster interface { |
| Actor(context.Context, string) (Actor, error) |
| } |
| + |
| +// BoxEvidence loads the exact bytes stored at boxid.Key(box). |
| type BoxEvidence interface { |
| - Load(context.Context, string) (boxid.Record, []byte, *boxid.Bind, error) |
| + Load(context.Context, string) ([]byte, error) |
| } |
| type IdentityProvider struct { |
| @@ -45,18 +47,22 @@ func (p IdentityProvider) Verify(ctx context.Context) (Actor, error) { |
| if a.Box != p.Box || a.Enrollment == "" || a.Revision == 0 || !a.Eligible || a.Quarantined || a.Region != p.Region || a.Bucket != p.Bucket || a.Namespace != p.Namespace || a.Cloud.Provider != "aws" || a.Cloud.Account != p.Account || a.Cloud.Region != p.Region || a.Cloud.InstanceID == "" { |
| return Actor{}, ErrChanged |
| } |
| - rec, raw, bind, err := p.Evidence.Load(ctx, p.Box) |
| + raw, err := p.Evidence.Load(ctx, p.Box) |
| if err != nil { |
| return Actor{}, err |
| } |
| - if rec.Box != p.Box { |
| - return Actor{}, ErrChanged |
| - } |
| - id, err := (boxid.Verifier{Account: p.Account, Certs: p.Certs}).Verify(rec, raw, bind) |
| + // The roster entry is the expected binding: Enroll refuses a record whose |
| + // signed instance is not the one this reference is enrolled as. |
| + cloud := boxid.Cloud{Provider: a.Cloud.Provider, Account: a.Cloud.Account, Region: a.Cloud.Region, InstanceID: a.Cloud.InstanceID} |
| + ev, err := (boxid.Verifier{Account: p.Account, Certs: p.Certs}).Enroll(raw, boxid.Expect{ |
| + Box: p.Box, |
| + AWSRegion: a.Cloud.Region, |
| + Roster: []boxid.Enrolled{{Box: a.Box, Cloud: cloud}}, |
| + }) |
| if err != nil { |
| return Actor{}, err |
| } |
| - if id.AccountID != a.Cloud.Account || id.Region != a.Cloud.Region || id.InstanceID != a.Cloud.InstanceID { |
| + if ev.Box != p.Box || ev.Cloud != cloud { |
| return Actor{}, ErrChanged |
| } |
| return a, nil |