Raven Scott
d286ce19b5
test(protocol): add deterministic MBR failover-key coverage docs(protocol): align package-bare-os-protocol version to 0.9.1 test(booter): add MBR corruption and wrong-topic smoke fixtures test(peer-seed): add strict pre-MBR bare_os.capabilities negotiation check feat(seeder): validate BARE_OS_SEED_REQUIRE_MBR_LABELS feat(seeder): validate BARE_OS_SEED_CAPABILITY_ATTESTATION_JSON schema docs(boot-policy): add requireProtocolPackageMin 0.9.1 example test(kernel): cover boot.policy denySeedRpcMethods behavior test(protocol): add app/cap/chat/meshdrop channel compatibility fixture test(swarm-disk): cover duplicate Protomux channel null-return path test(protocol): add 11-word kernelCapabilityWords round-trip fixture docs(schema): add mbr-layout schema and validate seeder examples test(protocol): add topicKey() golden hash fixture docs(trust): document block-0 trust assumptions in boot docs feat(seeder): add discovery.flushed readiness logging feat(booter): record peer discovery timings in boot-perf.json feat(integration): add local testnet mode to integration lab smoke test(booter): add Hyperswarm connection-budget env regression coverage test(booter): add swarm plus Corestore suspend/resume integration coverage feat(booter): mirror swarm ban events into host audit logs feat(booter): add direct-peer boot via BARE_OS_BOOT_JOIN_PEER_HEX feat(seeder): pass BARE_OS_SEED_MAX_PEERS to Hyperswarm feat(seeder): log drive.version and discoveryKey at startup test(booter): add Hyperdrive.checkout read-only boot probe coverage feat(booter): prefetch /boot/init.js before kernel handoff feat(booter): add optional /bin warm replication via downloadDiff feat(seeder): add manifestPaths SHA-256 generation in stage-kernel-tree test(peer-seed): cover helper-served block-0 after seeder exit feat(protocol): add Protomux cork batching for initial channel sends test(boot-graph): compare kernel/init labels with booter graph proc docs(boot-policy): add v9-v11 schema examples feat(release): add requireInitJsSha256 fixture generation step test(vfs): add BARE_OS_VFS_SYSTEM_RO_ALIAS coverage test(vfs): strengthen system-drive write-deny path coverage feat(identity): add personal-drive namespace export/import docs and tests test(booter): add guest-to-login warm cache invalidation regression test(vfs): add guest deny coverage for /.bare sensitive paths test(coreutils): add cross-drive mv failure injection coverage test(vfs): add .bareos_empty round-trip coverage across mkdir/rmdir/cp/git-fs test(vfs): add /dev/shm quota enforcement coverage test(proc): add /proc/bare_os/index.json sortedness and schema checks test(vfs): add warm read cache invalidation on replication growth docs(ctx): document bareOsInvalidateWarmReadCaches(reason) test(kernel): add BARE_OS_BOOT_DRY_RUN behavior coverage docs(posix): add dashboard rows for all COREUTILS_COMMANDS feat(curl): expand -w variables beyond http_code/url_effective/size_download feat(wget): mark -N timestamping as explicit unsupported error feat(curl): plumb mutual TLS cert/key intent to ctx.httpFetch metadata feat(shuf): add deterministic seed mode via BARE_OS_SHUF_SEED docs(sort): document -M month-sort as unsupported feat(grep): add explicit -E and -G mode handling test(sed): add Open Group Issue 7 golden fixtures test(awk): add getline VFS regressions for missing/repeat/boundary cases test(shell): add non-interactive here-doc coverage test(shell): add trap delivery coverage for synthetic PIDs/job IDs test(shell): add set -e compound-body behavior coverage docs(shell): strengthen read builtin opt-in guidance test(env): add Bare-runtime coverage for -S and --env-file docs(man): add examples for pathcap-verify pkg-swarm-index corestorectl test(identity): add account/vault backup-restore smoke coverage feat(audit): add tamper detection verification for audit chain rows test(peer-admission): cover strict empty allowlist deny behavior test(peer-admission): add denylist precedence over allowlist coverage test(peer-admission): add BARE_OS_PEER_REQUIRE_CAPS_JSON metadata checks docs(identity): add trusted-key rotation example for path capabilities feat(schema): tighten extensionSignerPinsV2-V4 hash validation test(delegate): add allowlist negative cases for curl/wget/git/hrpc/systemctl test(proc): extend /proc/self/environ redaction key coverage docs(security): add peer-assisted block-0 mirroring threat-model notes feat(bench): add boot budget trend output from real booter phases test(baretop): align fixture coverage with /proc snapshot key set test(metrics): validate /proc/bare_os/metrics.prom OpenMetrics shape docs(ops): add structured seeder NDJSON examples test(replication): add live stall-hint coverage for no_peers/length_unavailable/ok docs(release): add corestore-snapshot workflow to checklist docs(ops): add mirror-drive experiment utility to maintainer workflow test(booter): add monitor progress coverage for replication live sketch feat(seeder): validate DHT bootstrap address class JSON inputs docs(network): add HYPERSWARM_BOOTSTRAP testnet operator guidance chore(root): add deterministic test:integration script docs(ci): add local CI runbook for no-.github environments docs(release): add npm run test:bare after npm test feat(verify): add protocol docs/package version parity checker feat(verify): enforce feature-roadmap canonical path consistency feat(lockfile-drift): add tier-1 strict fail option for mismatches docs(lockfile-drift): add udx-native and blind-peering upgrade workflow notes docs(cli-parity): add bare-fetch upstream issue tracking row feat(bundle-health): generate per-tier bundle size regression thresholds feat(doc-contracts): verify handbook references to current proc schema versions feat(pretest): add validate-mermaid-syntax gate feat(probe): add bare-runtime top-25 critical command lane docs(protocol): update capability-word prose from bits..bits5 to current words docs(two-drive): document /tmp /var/log and account-prefix routing docs(security): add concise boot trust model page and links docs(dev-guide): add P2P lab cookbook section docs(dev-guide): add how-to for adding seed RPCs docs(dev-guide): add how-to for adding /proc/bare_os nodes docs(dev-guide): add /bin utility checklist for man/posix/build/parity/tests docs(user-manual): add short What BareOS is not section
34 lines
5.0 KiB
Markdown
34 lines
5.0 KiB
Markdown
# Vault and key-rotation threat model (Bare OS)
|
|
|
|
Bare OS keeps **Ed25519** account material sealed for the personal Hyperdrive using **`bare-crypto`** (see **`identity-session.js`**). This note is intentionally short: it records **what the guest trusts** and **what operators must still verify on the host**.
|
|
|
|
## Trust boundaries
|
|
|
|
- **Guest image (`/bin`, kernel, booter)** is assumed **integrity-checked** by your release process (manifest signing, Pear channel policy, or offline LKG keys). Compromised image ⇒ full session compromise regardless of vault design.
|
|
- **Personal drive** is writable by the unlocked session. In **guest** mode the stock VFS **denies** read/write/chmod/unlink on **`/.bare/account`**, **`/.bare/vault/`****, and **`/.bare/vault-rotation-audit.ndjson`** so ciphertext and rotation logs are not visible without unlocking (**`BARE_OS_GUEST_BARE_READ_ALL=1`** lifts this for tests). **`ctx.bareOsAppendVaultRotationCheckpoint`** appends **plaintext NDJSON audit rows** to **`/.bare/vault-rotation-audit.ndjson`** — useful for continuity evidence, **not** a secret store. Do not place raw private keys there. After **`saveVaultToDrive`** / **`logout --save`**, a row with **`kind`**: **`vault_save`** and **`fileCount`** is appended when the personal drive is writable.
|
|
- Host audit mirrors can be hash-chained; tampering with any row should invalidate downstream hashes. Use chain verification checks during incident response and release forensics.
|
|
- **Host Corestore / filesystem** holds material the guest cannot fully audit. Treat disk encryption, backups, and multi-device signing policy as **operator responsibilities**.
|
|
|
|
## Rotation
|
|
|
|
- **`BARE_OS_ACCOUNT_KEY_ROTATION_STATE_JSON`** (env) may describe overlapping validity windows for signing keys. Checkpoints on disk should list **which key** signed **which artifact** and **when**, so rollback does not silently accept stale trust.
|
|
- **`/proc/bare_os/security_posture.json`** (**`accountKeyRotationContinuity`**, schema **2**) mirrors only **structural** hints (**`stateKeyCount`**, **`rotationHintPresent`**) — never raw private material — so operators can audit continuity without exposing vault bytes.
|
|
|
|
## Operational guidance
|
|
|
|
- Prefer **short-lived** guest-visible hints over long-lived secrets in proc or env.
|
|
- When experimenting with **`BARE_OS_VFS_ENFORCE_ACL`**, remember ACL sidecars are **metadata**, not a hardware root of trust.
|
|
|
|
## Crypto parameters (audit checklist)
|
|
|
|
- **Ed25519** is used for **boot manifest verification** (**`verifyBootManifestEd25519`**), **extension signer pins**, **stable `hostid**` derivation from the unlocked identity public key, and **Hyperdrive discovery** material. Regression tests in **`packages/bare-os-booter/test.js`** cover manifest signature rejection; keep algorithm names and key lengths aligned across those surfaces when rotating governance tooling.
|
|
- **AEAD / sealing** for vault snapshots should use **`bare-crypto`** primitives (ChaCha20-Poly1305 or documented equivalents) with **unique nonces per seal** and KDF parameters (PBKDF2 iteration counts or Argon2id when adopted) aligned with current **`bare-crypto`** release notes. **`bare-crypto`**-backed **tamper rejection** for sealed blobs (**`openBytes`** after flipping an authentication tag byte) is covered in **`packages/bare-os-booter/test.identity.js`** (run via **`brittle-bare`**, same as account encode/decode).
|
|
- Compare envelope layout with Holepunch **`safe-sodium-buffer`** guidance where applicable: avoid reusing `(key, nonce)` pairs; zeroize sensitive `Uint8Array` copies in host bridges when the runtime allows.
|
|
- **`savevault` / `logout --save`**: verify `bareOsKeySchema` version bumps include migration notes in the booter changelog when ciphertext layout changes. **`identity-session.js`** keeps a single-session Ed25519 account model: **`logout --save`** persists the encrypted vault snapshot and mirrors a **`vault_save`** audit row when the personal drive is writable; `**login` / `unlock**` rehydrate keys through the same **`bare-crypto`** paths used for **`hostid`** and boot-manifest verification. Extension **`kernel.ext.d`** scripts pinned by **`extensionSignerPins`** in **`boot.policy.json`** must ship a **`signaturePointer`** and verify with **`ctx.bareOsVerifyBootManifestSignature`** before execution (strict boot fails closed) so vault-bearing sessions do not load unsigned extension code when pins are declared.
|
|
|
|
## Seeder multisig verification (guest-visible hint)
|
|
|
|
The Pear seeder may set **`BARE_OS_SEEDER_MULTISIG_VERIFY_RESULT`** (**`ok`** / **`failed`** / **`skipped`**) when **`logPearMultisigKernelHint`** runs. The stock booter copies a redacted sketch into **`/proc/bare_os/security_posture.json`** under **`pearMultisigSeeder.verifyResult`** so operators can see **whether** multisig verification ran — not the signing keys or raw **`pear.multisig.json`** payload.
|
|
|
|
See also: [environment appendix](environment-and-posix-appendix.md), [handbook ch.4 — booter runtime](../../handbook/04-the-booter-runtime.md).
|