refresh-local-auth: consume the validated local-auth-refresh projection #58

Merged

vnprc merged 2 commits from agent/credential-url-predicate into master

2026-09-20 16:31:42 +01:00

allod-agent commented

2026-09-18 23:46:29 +01:00

Member

refresh-local-auth stops re-deriving the credential-store URL rule itself. It now reads lib.localAuthRefreshSources from the secrets flake, a per-group projection of the refresh entries that the flake validates on the way out, so the jq copy of the https://user:token@host grammar and every comment claiming it matches allod/archetypes and allod/tools are gone. What changes for a running machine: a refresh needs a secrets checkout whose flake carries that export; an older checkout is refused by name, pointing at allod/secrets#29, before anything is decrypted. One check on the decrypted secret tightens: a line counts as blank only when it holds spaces and tabs, the same class the deployed netrc activation uses, so a secret ending in a carriage-return-only line is refused here instead of being installed and then refused at activation. What stays identical: which groups can be refreshed, the four files installed, their owners and modes, the preflight refusals, and the rollback on a failed install. What proves it is tests/refresh-local-auth.sh, 21 tests behind shellcheck in the flake's provisioning-contract check, plus a run of the real script against the real secrets flake from the allod/secrets PR, which reads the projection, selects the group, passes preflight and stops only at decryption. If this is wrong the symptom is a refresh refused with one of the named messages, and the fix is a straight revert of this one commit. A deployment's private fork of allod/secrets must merge the template change from allod/secrets#29 before this reaches its machines.

Merge of master at 6c782e5 (integrator, 2026-09-20): master had moved five commits, including the rotation-registry export rename, and the branch conflicted in the script and its test. Resolved keeping the projection read and this branch's fixtures; the merged tree differs from master only in the two files this PR owns, and from the branch tip only in one comment that now names lib.rotationRegistry instead of the renamed export. Re-run after the merge: bash tests/refresh-local-auth.sh — 21 passed; nix flake check . — all checks passed; the real-consumer run against current allod/secrets master (255af16) with IDENTITY_CONFIG, REFRESH_LOCAL_AUTH_HOSTNAME=allod-dev, a scratch REFRESH_LOCAL_AUTH_ROOT and no age key reads the projection, passes preflight, and stops at could not decrypt local auth source secret. A private secrets fork must export lib.localAuthRefreshSources before its deploy lock takes this; the script refuses an older checkout by name.

Refs allod/secrets#29

`refresh-local-auth` stops re-deriving the credential-store URL rule itself. It now reads `lib.localAuthRefreshSources` from the secrets flake, a per-group projection of the refresh entries that the flake validates on the way out, so the jq copy of the `https://user:token@host` grammar and every comment claiming it matches allod/archetypes and allod/tools are gone. What changes for a running machine: a refresh needs a secrets checkout whose flake carries that export; an older checkout is refused by name, pointing at allod/secrets#29, before anything is decrypted. One check on the decrypted secret tightens: a line counts as blank only when it holds spaces and tabs, the same class the deployed netrc activation uses, so a secret ending in a carriage-return-only line is refused here instead of being installed and then refused at activation. What stays identical: which groups can be refreshed, the four files installed, their owners and modes, the preflight refusals, and the rollback on a failed install. What proves it is `tests/refresh-local-auth.sh`, 21 tests behind shellcheck in the flake's `provisioning-contract` check, plus a run of the real script against the real secrets flake from the allod/secrets PR, which reads the projection, selects the group, passes preflight and stops only at decryption. If this is wrong the symptom is a refresh refused with one of the named messages, and the fix is a straight revert of this one commit. A deployment's private fork of allod/secrets must merge the template change from allod/secrets#29 before this reaches its machines. Merge of master at 6c782e5 (integrator, 2026-09-20): master had moved five commits, including the rotation-registry export rename, and the branch conflicted in the script and its test. Resolved keeping the projection read and this branch's fixtures; the merged tree differs from master only in the two files this PR owns, and from the branch tip only in one comment that now names `lib.rotationRegistry` instead of the renamed export. Re-run after the merge: `bash tests/refresh-local-auth.sh` — 21 passed; `nix flake check .` — all checks passed; the real-consumer run against current allod/secrets master (255af16) with `IDENTITY_CONFIG`, `REFRESH_LOCAL_AUTH_HOSTNAME=allod-dev`, a scratch `REFRESH_LOCAL_AUTH_ROOT` and no age key reads the projection, passes preflight, and stops at `could not decrypt local auth source secret`. A private secrets fork must export `lib.localAuthRefreshSources` before its deploy lock takes this; the script refuses an older checkout by name. Refs allod/secrets#29

allod-agent added 1 commit

2026-09-18 23:46:29 +01:00

refresh-local-auth: consume the validated local-auth-refresh projection f9d6892b03

Read lib.localAuthRefreshSources instead of lib.forgejoTokenGroups, so the
script trusts a projection the secrets flake has already validated instead
of re-deriving the credential-store URL grammar in jq. A secrets checkout
that predates the export gets a refusal naming it; any other eval failure
keeps the existing message shape.

validate_refresh_metadata and its jq predicate for the URL grammar are gone.
What remains is a minimal shape check on each projected entry (contract,
system, local_username, source_credential, secret_path), and refresh_entry
now reads secret_path straight off the projected entry instead of looking it
up in the group's credentials.

parse_credential_store_plaintext's blank-line test moves from POSIX
[:space:], which glibc widens under a UTF-8 locale, to a literal bash
pattern matching only space and tab, matching the class
archetypes/modules/netrc.nix's awk 'NF { print }' actually drops. A
carriage-return-only second line is therefore no longer treated as blank
padding and is refused.

Test fixtures now build the local-auth-refresh-sources projection directly,
in the shape the secrets flake exports it, rather than deriving it from a
raw registry via jq. The old template-mutation and registry-structure tests
that exercised the deleted jq predicate are gone; new tests cover the
missing-export refusal, an empty secret_path, a carriage-return-only second
line, and space/tab padding.

Refs allod/secrets#29

allod-agent referenced this pull request from allod/secrets

2026-09-18 23:46:54 +01:00

One credential-store URL predicate: stop hand-synchronising five spellings of one grammar #29

allod-agent commented

2026-09-20 15:53:50 +01:00

Author

Member

Merged master into this branch at 6c782e5 to clear the two conflicts master's rotation-registry rename caused in the script and its test. The resolution reproduces the branch tip exactly except for one comment that now names the renamed export; the 21-test suite, the flake check and the real-consumer run against current allod/secrets master are green again, recorded in the body's Validation section. Ready to merge; allod/secrets#29 closes on the allod/archetypes cutover PR that follows.

Merged master into this branch at 6c782e5 to clear the two conflicts master's rotation-registry rename caused in the script and its test. The resolution reproduces the branch tip exactly except for one comment that now names the renamed export; the 21-test suite, the flake check and the real-consumer run against current allod/secrets master are green again, recorded in the body's Validation section. Ready to merge; allod/secrets#29 closes on the allod/archetypes cutover PR that follows.

allod-agent added 1 commit

2026-09-20 15:53:50 +01:00

Merge master into agent/credential-url-predicate 6c782e5595

Master renamed the rotation registry export to lib.rotationRegistry
(c42fc59) and added rebuild-nexus. This branch replaces the registry read
with the validated lib.localAuthRefreshSources projection, so the two
conflicts in scripts/refresh-local-auth and tests/refresh-local-auth.sh
keep this branch's projection read and its projection fixture: the raw
registry the rename touched is no longer read here. The one comment on
this branch that still named the old export now names lib.rotationRegistry.

Refs allod/secrets#29

allod-agent referenced this pull request from allod/archetypes

2026-09-20 16:03:38 +01:00

credential-profiles: read the credential-store URL rule from allod/secrets #86

allod-agent referenced this pull request from allod/secrets

2026-09-20 16:04:00 +01:00

One credential-store URL predicate: stop hand-synchronising five spellings of one grammar #29