Re-pin keep v0.7.5; assert fail-closed unlock stdout is byte-empty#98
Conversation
Signed-off-by: Kyle 🐆 <kyle@privkey.io>
WalkthroughThe flake updates the pinned ChangesKeep version and OPRF validation
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested labels: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tests/lib/oprf-common.nix`:
- Around line 124-134: The downstream test comment describing the shared helper
is stale: update the comment near the fail_closed call in tests/oprf-unlock.nix
to state that the helper asserts the captured stdout is exactly zero raw bytes,
without ANSI stripping. Keep the fail_closed invocation and test behavior
unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 0d721d70-b1cb-48d8-8292-917211535d44
⛔ Files ignored due to path filters (1)
flake.lockis excluded by!**/*.lock
📒 Files selected for processing (2)
flake.nixtests/lib/oprf-common.nix
| # property is "a failed unlock reconstructs no usable key." As of keep 0.7.5 (keep-node-95y) a | ||
| # fail-closed oprf-unlock exit writes NOTHING to stdout: the terminal alt-screen-exit escape | ||
| # (`\e[?1049l`) the SIGTERM/panic handler used to leak is now suppressed for non-TUI commands, so | ||
| # stdout is strictly empty -- no ANSI stripping needed, and we assert the raw bytes directly. (On | ||
| # the SUCCESS path stdout is exactly the 32-byte key -- verified in the 2-of-2 fixture -- so the | ||
| # frost-gate's key capture is unaffected.) Asserting byte-empty subsumes "no 32-byte key" and | ||
| # also catches any future stray write to the key-only stdout. | ||
| raw_size = node.succeed(f"stat -c %s {out_path}").strip() | ||
| assert raw_size != "32", f"fail-closed unlock leaked a 32-byte key ({raw_size} bytes, {out_path})" | ||
| assert raw_size == "0", ( | ||
| f"fail-closed unlock wrote {raw_size} bytes to stdout; it must be empty (no key, no control bytes) ({out_path})" | ||
| ) |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Stale comment in downstream tests/oprf-unlock.nix.
The updated fail_closed no longer strips ANSI escapes — it asserts raw byte count is zero. However, the call site in tests/oprf-unlock.nix (lines 212–213) still says: "The shared helper strips keep-cli's error-path terminal escape before asserting the remainder is empty." That comment is now inaccurate and should be updated to reflect the raw-byte-empty assertion.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@tests/lib/oprf-common.nix` around lines 124 - 134, The downstream test
comment describing the shared helper is stale: update the comment near the
fail_closed call in tests/oprf-unlock.nix to state that the helper asserts the
captured stdout is exactly zero raw bytes, without ANSI stripping. Keep the
fail_closed invocation and test behavior unchanged.
1 participant
What
Re-pin the
keepinput v0.7.4 → v0.7.5, and tighten the sharedfail_closedtest helper now that the fix it worked around has landed.Why
keep v0.7.5 (privkeyio/keep#740) stops the terminal alt-screen-exit escape (
\e[?1049l) from leaking ontooprf-unlock's key-only stdout when the frost gate SIGTERMs it on the fail-closed path. Previouslyfail_closedhad to strip ANSI escapes before asserting stdout was empty, tolerating that stray escape. With the fix, a fail-closed unlock writes nothing to stdout, so the helper now asserts the raw bytes are empty — dropping the workaround and, as a bonus, catching any future stray write to the key-only stdout (byte-empty subsumes the old "no 32-byte key" guard).Verification
Ran
oprf-unlock-2of3locally against keep-cli 0.7.5 (838s): its Leg C fail-closed path passes the tightenedraw_size == 0assertion — confirming the escape is gone end-to-end at the appliance level.duress-freeze(also usesfail_closed) is exercised by the full matrix.Closes keep-node-95y.
Summary by CodeRabbit
Bug Fixes
Chores
keepdependency to version 0.7.5 for the latest upstream improvements.