Repository navigation
feat(security): 本地控制台签名的备份退役证明（#68 切片） - #154
Merged
Merged
Conversation
…ement records backup_retired now needs one exact root-signed record bound to the subject and both old key IDs, imported behind require_local_console and re-verified on every read; server_key_retired additionally needs online retirement. Missing, altered, expired, misbound or pre-rotation records fail closed. Slice of #68. Co-authored-by: Cursor <cursoragent@cursor.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
概要
这是 #68 的一个切片：本地控制台签名的备份退役证明。本 PR 不关闭 #68，也不声称生产备份已销毁。
msg.security.backup_retirement：root 签名记录（purposecustodial-backup-retirement-v1）绑定主体、旧签名钥 id、旧加密钥 id、非空的备份集清单，以及最长 400 天的有效期。每次读取都会用当前有效且未吊销的 root 凭据（active root certificate 对应的凭据）重新验签。msg.admin.backup_retirement.import_record，以及RootAdmin.sign_backup_retirement/RootAdmin.import_backup_retirement，两者都经过require_local_console，并要求输入摘要确认。导入只接受已签名的记录，不接受调用方传入的布尔值；导入时还要求存在该主体下与旧钥精确匹配的 completed 迁移，并写入审计root.custodial.backup_retirement。retirement_view/retirement_evidence/snapshot：只有针对这一条精确记录验签通过，才返回backup_retired=True；没有记录时仍为 False。server_key_retired只有在线退役与备份证明同时成立时才为 True（phaseserver_key_retired）。网络可写的迁移 body 里的backup_retirement字段会被忽略，也不再回显。now=None）时，一律视为未退役，backup_status为local_attestation_invalid或local_attestation_expired。ctx.now传入snapshot用于判断是否过期。证明的范围仅限所列备份集的操作者声明，不能证明其他副本不存在。按约束没有改
cli.py，所以暂时没有msg-admin命令行接线。测试
tests/test_backup_retirement_attestation.py（20 个用例，含一个 PostgreSQL 集成用例：网络 inventory 只在本地导入后才报告backup_retired=True，篡改后回落为 False，网络请求带入的记录会被拒绝）。pytest：1797 passed。test_legacy_ledger_snapshot.py需设置MSG_TEST_LEGACY_SOURCE指向ac083b3的检出后单独运行。Refs #68（不关闭）