Repository navigation
settings_adoption: an owner's adoption taken from the settings at boot - #4
Merged
Merged
Conversation
The boot half of an adoption delivered on the cable (JN3): `apply`
reads `adopt` from the settings store and, whatever happens, removes it,
so a reflash of the settings slot can neither replay it nor leave it to
be read twice.
- Accepted: the container stored verbatim in identity (mid.adopt, its
kind in mid.adopt.kind), the owner pinned (mid.owner), the pin marked
provisional (mid.owner.prov).
- Rehomed: the pinned owner's grant at a roster version >= the pin.
- Refused, with a reason for the log: malformed, another device, another
owner than the pinned one, an older roster, longer than 8 KiB. Never
silently rebound.
The kind is mata-statement-v1, the wallet's {"content","jws"} container,
checked STRUCTURALLY: header ES256/JWT, context janus-adoption-v1,
content_hash = b64url(sha256(content)), content v1 with device_did this
device and owner_did == the payload's iss, a key did:mata. Signature and
roster chain wait for a no_std mid-verify; until then the pin is
provisional and the first boot with the verifier re-checks it. Writes
are ordered so a power cut between any two is redone harmlessly.
Generic over `Kv + ?Sized`, so a firmware's boxed stores go straight in.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The boot half of an adoption delivered on the cable with a device's settings:
rusty_esp_mid_core::settings_adoption::apply(settings, identity, my_did).Reads
adoptfrom the settings store and always removes it. Then:mid.adopt, kind inmid.adopt.kind), the owner pinned (mid.owner), the pin marked provisional (mid.owner.prov).The kind is
mata-statement-v1(a wallet's{"content","jws"}container), checked structurally: header ES256/JWT,context=janus-adoption-v1,content_hash= b64url(sha256(content)), content v1 withdevice_did= this device andowner_did= the payload'siss, a keydid:mata. The signature and roster chain wait for ano_stdmid-verify; until then the pin is provisional and is re-checked once the verifier exists. Writes are ordered so a power cut is redone harmlessly.Generic over
Kv + ?Sizedso a firmware's boxed stores go straight in. Tests: 6 (first adoption stored byte for byte and cleared; rehome; older roster refused; another owner refused and cleared; each structural refusal; oversize; unsized stores). mid-core 64 pass, clippy clean, no_std+alloc builds for riscv32imac.🤖 Generated with Claude Code