GKaszewski/k-os
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(storage): per-app/owner/system encryption live: gatekeeper hands seed + fresh flag, storage unlocks layer, init seeds areas from factory/ (empties on new key); rmdir op; test-qemu checks sealed home + reboot persistence

Browse Source
This commit is contained in:
Gabriel Kaszewski
2026-10-28 00:07:41 +01:00
parent e8191be160
commit 9dc751c466
20 changed files with 344 additions and 72 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
crates/servers/storage-server/src/tests/protocol.rs
View File

@@ -26,6 +26,8 @@ fn every_request_roundtrips() {
},
StorageRequest::Release,
StorageRequest::SetKey { half: 1, words: [7, 9] },
StorageRequest::SetSeed { half: 0, words: [1, 2] },
StorageRequest::Rmdir { path_len: 3 },
] {
assert_eq!(StorageRequest::decode(req.encode()), Some(req));
}

21
crates/servers/storage-server/src/tests/server.rs
View File

@@ -474,14 +474,19 @@ fn the_unbadged_holder_cannot_be_released() {
}
#[test]
fn only_init_sets_the_key_and_only_once() {
fn only_init_unlocks_and_only_once() {
let mut s = server();
let set = |s: &mut Srv, badge, half| call(s, badge, StorageRequest::SetKey { half, words: [1, 2] }).0;
assert_eq!(set(&mut s, 5, 0), StorageResponse::Error, "a client cannot");
assert_eq!(set(&mut s, 0, 0), StorageResponse::Ok);
assert!(!s.unlocked());
assert_eq!(set(&mut s, 0, 0), StorageResponse::Error, "nor can it be replaced");
assert_eq!(set(&mut s, 0, 2), StorageResponse::Error, "two halves only");
assert_eq!(set(&mut s, 0, 1), StorageResponse::Ok);
let set = |s: &mut Srv, badge, req| call(s, badge, req).0;
let key = |half| StorageRequest::SetKey { half, words: [1, 2] };
let seed = |half| StorageRequest::SetSeed { half, words: [3, 4] };
assert_eq!(set(&mut s, 5, key(0)), StorageResponse::Error, "a client cannot");
assert_eq!(set(&mut s, 0, key(0)), StorageResponse::Ok);
assert_eq!(set(&mut s, 0, key(0)), StorageResponse::Error, "nor can a half be replaced");
assert_eq!(set(&mut s, 0, key(2)), StorageResponse::Error, "two halves only");
assert_eq!(set(&mut s, 0, key(1)), StorageResponse::Ok);
assert_eq!(set(&mut s, 0, seed(0)), StorageResponse::Ok);
assert!(!s.unlocked(), "not without the whole seed");
assert_eq!(set(&mut s, 0, seed(1)), StorageResponse::Ok);
assert!(s.unlocked());
assert_eq!(set(&mut s, 0, key(0)), StorageResponse::Error, "once unlocked, never again");
}