Repository navigation
Fix/review findings - #1
Merged
Merged
Conversation
The highest keyring generation seen was kept in plain JSON beside the keyring, and a missing file was read as "nothing seen". Anyone able to write the keys directory could put back an older, still validly sealed keyring and delete or edit that file, and Open accepted the older keyring without AcceptRollback, bringing back key versions that had been destroyed or undoing a rotation. The backup state file is now authenticated with HMAC-SHA-256 under a key derived from the root key with HKDF, and bound to the keyring's file name. Open refuses: - a state file that does not authenticate (ErrCorruptBackupState); - a missing state file beside a keyring past generation 1 (ErrBackupStateMissing); generation 1 is still accepted, since a crash during Create leaves exactly that; - a state file in the previous unauthenticated format (ErrUnauthenticatedBackupState). Each can be accepted with AcceptRollback, which rewrites the state authenticated and keeps any existing high-water mark and backup acknowledgement. Root key rotation authenticates the state under both the old and the new root key before replacing the keyring, so a crash on either side leaves state the surviving keyring's root key opens. BREAKING CHANGE: the first Open after upgrading fails with ErrUnauthenticatedBackupState until it is done once with AcceptRollback. Opening a keyring past generation 1 without its backup state file, for example after moving it to a new host, also needs AcceptRollback. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Policy validation accepted a retained-versions floor of 1, which let a deployment retire the previous key version and lose the rollback margin. Validate now rejects RetainVersions below 2, for the default and for every per-purpose override, so the active version and the previous one are always kept and only N-2 and older can be retired. A compromised version is still not counted by the floor and can be retired and destroyed at once. Tests that retired version 1 under a floor of 1 now rotate once more so that version 1 is N-2. BREAKING CHANGE: a policy with RetainVersions below 2, in the default or in a per-purpose override, is now rejected by Policy.Validate and Set.Validate, and so by rotate.New. Set RetainVersions to 2 or more, or leave it zero to inherit the default of 2. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Caution Review failedThe pull request is closed. Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.