carlos / platform Public

Clarify result decryption is not worker authentication

Paul Campbell pushed by paul@keymail.dev 1 month ago e8fbf9e285f006ed63686ec5ff8db14275d2eaaf parent c9961ae

1 file changed, +3 −0

diff --git a/internal/maintenance/result.go b/internal/maintenance/result.go

index 112acf059..6374ad256 100644

--- a/internal/maintenance/result.go

+++ b/internal/maintenance/result.go

@@ -68,6 +68,9 @@ func SealResult(pub *ecdh.PublicKey, binding Binding, body []byte) (string, erro

return sealed, nil

}

+// OpenResult decrypts bytes for the recipient. Encryption alone does not prove

+// which worker produced them; callers must verify the authenticated operation

+// outcome before treating these bytes as execution or completion evidence.

func OpenResult(priv *ecdh.PrivateKey, binding Binding, sealed string) ([]byte, error) {

const overhead = len(envelopePrefix) + ephemeralBytes + nonceBytes + tagBytes

if binding.Direction != DirectionResult || len(sealed) > base64.StdEncoding.EncodedLen(overhead+MaxResultBytes) {