amadan
hostbox: verify box identity with boxid.Verifier.Enroll (main build fix)
Region HA plan 1b (3e12133f) replaced boxid.Bind and Verifier.Verify with Verifier.Enroll and landed between Plan 6's last main merge and its squash, so d649d8d4 did not build. The evidence loader now returns the exact record bytes, and the roster entry is the expected binding. Inert: nothing in production constructs an IdentityProvider yet.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+13
−7
internal/hostbox/identity.go+13 −7
CI passed — run details
diff --git a/internal/hostbox/identity.go b/internal/hostbox/identity.go| index 36e56a0c2..eaf55b2cc 100644 |
| --- a/internal/hostbox/identity.go |
| +++ b/internal/hostbox/identity.go |
| @@ -23,8 +23,10 @@ type CloudIdentity struct{ Provider, Account, Region, InstanceID string } |
| type Roster interface { |
| Actor(context.Context, string) (Actor, error) |
| } |
| + |
| +// BoxEvidence loads the exact bytes stored at boxid.Key(box). |
| type BoxEvidence interface { |
| - Load(context.Context, string) (boxid.Record, []byte, *boxid.Bind, error) |
| + Load(context.Context, string) ([]byte, error) |
| } |
| type IdentityProvider struct { |
| @@ -45,18 +47,22 @@ func (p IdentityProvider) Verify(ctx context.Context) (Actor, error) { |
| if a.Box != p.Box || a.Enrollment == "" || a.Revision == 0 || !a.Eligible || a.Quarantined || a.Region != p.Region || a.Bucket != p.Bucket || a.Namespace != p.Namespace || a.Cloud.Provider != "aws" || a.Cloud.Account != p.Account || a.Cloud.Region != p.Region || a.Cloud.InstanceID == "" { |
| return Actor{}, ErrChanged |
| } |
| - rec, raw, bind, err := p.Evidence.Load(ctx, p.Box) |
| + raw, err := p.Evidence.Load(ctx, p.Box) |
| if err != nil { |
| return Actor{}, err |
| } |
| - if rec.Box != p.Box { |
| - return Actor{}, ErrChanged |
| - } |
| - id, err := (boxid.Verifier{Account: p.Account, Certs: p.Certs}).Verify(rec, raw, bind) |
| + // The roster entry is the expected binding: Enroll refuses a record whose |
| + // signed instance is not the one this reference is enrolled as. |
| + cloud := boxid.Cloud{Provider: a.Cloud.Provider, Account: a.Cloud.Account, Region: a.Cloud.Region, InstanceID: a.Cloud.InstanceID} |
| + ev, err := (boxid.Verifier{Account: p.Account, Certs: p.Certs}).Enroll(raw, boxid.Expect{ |
| + Box: p.Box, |
| + AWSRegion: a.Cloud.Region, |
| + Roster: []boxid.Enrolled{{Box: a.Box, Cloud: cloud}}, |
| + }) |
| if err != nil { |
| return Actor{}, err |
| } |
| - if id.AccountID != a.Cloud.Account || id.Region != a.Cloud.Region || id.InstanceID != a.Cloud.InstanceID { |
| + if ev.Box != p.Box || ev.Cloud != cloud { |
| return Actor{}, ErrChanged |
| } |
| return a, nil |