Record four generation gotchas from the microvm credential slice #41

Merged

vnprc merged 1 commit from agent/nix-credential-generation-gotchas into master

2026-08-06 17:25:15 +01:00

allod-agent commented

2026-08-06 16:02:40 +01:00

Member

Four facts from implementing allod/archetypes#29, each of which cost real time and none of which the repos record.

The LoadCredential one is the expensive one: it would have left every privacy microvm booting with a failed unit and no working nix, and it is invisible to a check that reads the generated shape instead of running it.

All four are public Nix, systemd and git behaviour at the current pins.

Four facts from implementing allod/archetypes#29, each of which cost real time and none of which the repos record. The LoadCredential one is the expensive one: it would have left every privacy microvm booting with a failed unit and no working nix, and it is invisible to a check that reads the generated shape instead of running it. All four are public Nix, systemd and git behaviour at the current pins.

allod-agent added 1 commit

2026-08-06 16:02:41 +01:00

Record four generation gotchas from the microvm credential slice 4905682773

A readOnly option that also has a default can never be set, because nixpkgs
folds the default into the definition list before enforcing readOnly.

Placeholder substitution into a shell script rewrites the placeholder where the
script's own comments name it, which turns a multi-line value into commands.

An empty LoadCredential leaves CREDENTIALS_DIRECTORY unset rather than empty,
so a unit generated with no credentials fails a guard meant to detect running
outside a unit. This one cost a boot loop on a whole archetype.

git-credential-store locks beside the credential file, so the file's owner needs
the containing directory, and its read path skips EACCES silently -- a shared
store looks fine until the first push.