Repository navigation
id: F12.17 module trust gate — admin trust list + install-time signature check (#1069, partial) - #4088
Conversation
…ure check (#1069, partial) Lands the implementation found uncommitted in this worktree so it is preserved on the branch: --world-module-trust-key (repeatable, hex Ed25519, requires --world) flows ServeOptions -> ServeWorlds -> WorldService.with_module_trust_keys; InstallBegin carries an optional ModuleSignature (Ed25519 over the domain-separated BLAKE3 digest of the module bytes); install paths refuse with InstallError:: UntrustedModule when the trust list is non-empty and the artifact is unsigned, untrusted, or badly signed; empty list keeps legacy behavior. Includes CLI parse test + world_session trust tests. REMAINING for #1069 (not in this commit): compiler-version field in observed module provenance, and journal-recorded trust decisions (accepted/refused + key + module). Tests for this slice not yet run when committed — see task 4945 checkpoints for the verdict.
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 39 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fceea9d597
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…st exemption, startup combo guard, shell-contract signature field, F12.17 design record (#1069)
Partial implementation of #1069 (F12.17 module trust), from task 4945. This PR lands the trust-gate core; the remaining #1069 acceptance items are split out on #1069 (compiler-version provenance + journal-recorded trust decisions) so this verified slice does not sit unmerged.
What lands
serve --world-module-trust-key <hex>CLI flag, wired throughServeOptions/ServeWorldsintoWorldService::with_module_trust_keys.install_wasm_reserved): when the trust list is non-empty, an unsigned, untrusted-key, or bad-signature upload is refused with the newInstallError::UntrustedModule("module signature is not trusted" on the session surface). Signatures are Ed25519 over a domain-separated BLAKE3 digest (developing-today/id-world-module/v1\0+ digest), carried as an optionalsignaturefield on the install frame (ModuleSignature { public_key, signature }, hex).Tests
module_trust_list_allows_empty_refuses_unsigned_and_accepts_trusted_signer(world_session): empty list loads, non-empty list refuses unsigned, trust-listed signer installs.module_trust_keys_are_repeatable_and_require_world_mode(cli parse).Not in this PR (split on #1069)
Refs #1069, task 4945.
Need help on this PR? Tag
@codesmith-botwith what you need.