novox/hq
9
0
Fork 0
Code Issues Pull Requests 2 Releases Wiki Activity

Issue 337: the store's reader can read the controller's signing key (critical) #230

Merged
mesh-admin merged 3 commits from issues/337-the-stores-reader-can-read-the-controllers-signing-key into main 2026-10-08 20:16:30 +00:00
Conversation 1 Commits 3 Files Changed 2
+226
mesh-admin commented 2026-10-08 19:46:09 +00:00
Contributor
Copy Link
Copy Source

Opens and diagnoses issue 337, status located.

  • Symptom: the login the store seat's query verb runs as is a member of pg_read_all_data, so it may read identity.signing_key.private (the key every node-engine trusts), the inventory's sealed secrets and operator keys, and every consumer's secrets. Confirmed by privileges and column names only; no value was read.
  • Cause: issue 193's fix chose pg_read_all_data to make the verb read-only; nothing said what it may read.
  • Was it read? Not knowable from the store: no statement log, no pg_stat_statements; since the server's last start the key table's sequential scans match the nightly dump exactly, but an index read would not show, and nothing before 2026-10-03 is recorded.
  • Rotation: recommended once the fix is taken; no mechanism exists (a node-engine trusts the one key its enrolment token carried; ADR 0004's overlapping rollover is unbuilt), so it needs a decision first. Nothing was rotated.
  • Fix: mesh-catalog PR 143 (deny by default, per-column grants a module declares as readable, secrets never granted, reconciled every minute, a probe that refuses queries while a secret is readable).

replay-none: is filled because the hole is a grant on a store; the module's live tests hold it fail-first.

Opens and diagnoses issue 337, status `located`. - **Symptom:** the login the store seat's `query` verb runs as is a member of `pg_read_all_data`, so it may read `identity.signing_key.private` (the key every node-engine trusts), the inventory's sealed secrets and operator keys, and every consumer's secrets. Confirmed by privileges and column names only; no value was read. - **Cause:** issue 193's fix chose `pg_read_all_data` to make the verb read-only; nothing said what it may read. - **Was it read?** Not knowable from the store: no statement log, no `pg_stat_statements`; since the server's last start the key table's sequential scans match the nightly dump exactly, but an index read would not show, and nothing before 2026-10-03 is recorded. - **Rotation:** recommended once the fix is taken; no mechanism exists (a node-engine trusts the one key its enrolment token carried; ADR 0004's overlapping rollover is unbuilt), so it needs a decision first. Nothing was rotated. - **Fix:** mesh-catalog PR 143 (deny by default, per-column grants a module declares as `readable`, secrets never granted, reconciled every minute, a probe that refuses queries while a secret is readable). `replay-none:` is filled because the hole is a grant on a store; the module's live tests hold it fail-first.
mesh-admin added 1 commit 2026-10-08 19:46:09 +00:00
Issue 337: the store's reader could read the controller's signing key and every secret the store holds
mesh/merge-gate pass: the change touches no module of the mesh's graph
Details
mesh/repo-check pass: its merge-check.sh passed
Details
mesh/delivery superseded: a newer head of the same pull request
Details
6c297214ad 
Opened and diagnosed: pg_read_all_data on the login the store seat's query
runs as. Says what the store can and cannot tell about whether the key was
read, why it should be rotated once the fix is taken, and that no rotation
mechanism exists yet. The fix is mesh-catalog PR 143.
mesh-admin commented 2026-10-08 19:46:22 +00:00
Author
Contributor
Copy Link
Copy Source

Delivery novox/hq@7f78016f0749 — delivered since 2026-10-08T20:16:36Z

Delivery plan — builds nothing: the change touches no module of the mesh's graph

Transitions

  • 2026-10-08 20:11 (new) → proposed (announced): novox/hq#230's head announced
  • 2026-10-08 20:12 proposed → checked (checked): the verdict names this commit
  • 2026-10-08 20:12 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
  • 2026-10-08 20:16 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
  • 2026-10-08 20:16 published → delivered (done): nothing for a walk to move

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/hq@7f78016f0749` — **delivered** since 2026-10-08T20:16:36Z **Delivery plan** — builds nothing: the change touches no module of the mesh's graph **Transitions** - 2026-10-08 20:11 (new) → proposed (announced): novox/hq#230's head announced - 2026-10-08 20:12 proposed → checked (checked): the verdict names this commit - 2026-10-08 20:12 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-08 20:16 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-08 20:16 published → delivered (done): nothing for a walk to move The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
jschoubben added 1 commit 2026-10-08 20:02:33 +00:00
Issue 337 after review: say control-node, drop the store's operational settings, and match the fix's revoke-by-grantor and read-back
mesh/delivery superseded: a newer head of the same pull request
Details
mesh/merge-gate pass: the change touches no module of the mesh's graph
Details
mesh/repo-check pass: its merge-check.sh passed
Details
b17839a7db 
Adds what the fix cannot see (definer functions and views; the name check
as a backstop) and, as a follow-up, that the reader's read-only session is a
default a statement can turn off, so the missing write grants are the guard.
jschoubben added 1 commit 2026-10-08 20:11:18 +00:00
Issue 337: say that only what is gone is reported revoked, and that a grant the reader passed on is taken back with CASCADE
mesh/merge-gate pass: the change touches no module of the mesh's graph
Details
mesh/repo-check pass: its merge-check.sh passed
Details
mesh/delivery delivered
Details
7f78016f07
mesh-admin merged commit d0be529194 into main 2026-10-08 20:16:30 +00:00
mesh-admin deleted branch issues/337-the-stores-reader-can-read-the-controllers-signing-key 2026-10-08 20:16:31 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
mesh/ready
Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)
No labels
Milestone
No items
No Milestone
Assignees
Clear assignees
agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: novox/hq#230