hypervisor-recipient-coverage skips a guest whose host-key secret has no rule, and its host-key half has no negative fixture #39

New issue

Closed

opened 2026-09-30 03:29:36 +01:00 by vnprc-agent · 1 comment

vnprc-agent commented

2026-09-30 03:29:36 +01:00

The hypervisor-recipient-coverage check does not cover a guest whose host-key secret has no rule in secrets.nix, and its host-key half has no negative fixture.

Found by a cold review of the landed range e0ed37f..master after allod/archetypes#89's secrets half merged. Evidence, verified against the source:

checks/hypervisor-recipient-coverage.nix:47-57: hostKeyGaps reports a gap only when secretsRules ? "secrets/vm-host-keys/<guest>-ssh.age". A guest that stays in machine-host-keys.json with its ciphertext on disk, but whose rule is removed from secrets.nix, falls through to []. The reviewer removed the template's privacy-1-ssh.age rule and both this check and credential-inventory accepted the tree.
checks/hypervisor-recipient-coverage.nix:147-157: every fixture asserts hostKeyGaps == []. No fixture removes the hypervisor key from a present host-key rule, so replacing the hostKeyGaps computation with [] leaves every fixture green.

The rule the check states (a guest's own host-key secret must be readable by the guest's host hypervisor) is the one a hypervisor needs to provision that guest.

Refs allod/archetypes#89

The `hypervisor-recipient-coverage` check does not cover a guest whose host-key secret has no rule in `secrets.nix`, and its host-key half has no negative fixture. Found by a cold review of the landed range `e0ed37f..master` after allod/archetypes#89's secrets half merged. Evidence, verified against the source: - `checks/hypervisor-recipient-coverage.nix:47-57`: `hostKeyGaps` reports a gap only when `secretsRules ? "secrets/vm-host-keys/<guest>-ssh.age"`. A guest that stays in `machine-host-keys.json` with its ciphertext on disk, but whose rule is removed from `secrets.nix`, falls through to `[]`. The reviewer removed the template's `privacy-1-ssh.age` rule and both this check and `credential-inventory` accepted the tree. - `checks/hypervisor-recipient-coverage.nix:147-157`: every fixture asserts `hostKeyGaps == []`. No fixture removes the hypervisor key from a present host-key rule, so replacing the `hostKeyGaps` computation with `[]` leaves every fixture green. The rule the check states (a guest's own host-key secret must be readable by the guest's host hypervisor) is the one a hypervisor needs to provision that guest. Refs allod/archetypes#89

vnprc referenced this issue from a commit

2026-09-30 04:05:46 +01:00

Report a guest whose host-key secret has no rule, and prove the host-key half can fail

vnprc referenced this issue from a commit

2026-09-30 04:05:46 +01:00

Check a present host-key rule whether or not the guest is registered

vnprc-agent commented

2026-09-30 04:30:22 +01:00

Author

Fixed on master: a registered guest with no host-key rule is reported as a missing rule, a present rule is checked whether or not the guest is registered, and both host-key cases have fixtures shown failing.

vnprc-agent closed this issue

2026-09-30 04:30:22 +01:00

vnprc-agent referenced this issue from allod/archetypes

2026-09-30 04:30:25 +01:00

Make the hypervisor identity plural so a deployment can run more than one #89