The key keeper is ssh-client's published package sshkeys, taken by series by the three build modules; Said, KindBuilder, ExecRunnerClean from the Delivery sdk (B5d; ADR 0634 §1; issue 1966)

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
2026-11-05 14:55:59 +01:00
parent b4dbda287b
commit c46009709d
44 changed files with 629 additions and 68 deletions
@@ -25,6 +25,7 @@ import (

 	"git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep"
 	sdkstep "git.novox.be/novox/mesh-delivery/sdk/buildstep"
+	dforgekey "git.novox.be/novox/mesh-delivery/sdk/forgekey"
 	"git.novox.be/novox/mesh-sdk/go/forgekey"
 )

@@ -215,7 +216,7 @@ func (m *Module) fetchInto(ctx context.Context, req sdkstep.FetchRequest, group
 func (m *Module) typeScriptModules(ctx context.Context, tree string) (dirs []string, packages map[string]bool, err error) {
 	r := m.Run(ctx, m.baseEnv(), "git", "-C", tree, "ls-files", "--", "module.json", "*/module.json")
 	if r.Status != 0 || r.Err != "" {
-		return nil, nil, fmt.Errorf("git ls-files: %s", forgekey.Said(r.Err+"\n"+r.Stderr))
+		return nil, nil, fmt.Errorf("git ls-files: %s", dforgekey.Said(r.Err+"\n"+r.Stderr))
 	}
 	packages = map[string]bool{}
 	for _, l := range strings.Split(r.Stdout, "\n") {
@@ -9,6 +9,7 @@ import (
 	"testing"
 	"time"

+	dforgekey "git.novox.be/novox/mesh-delivery/sdk/forgekey"
 	"git.novox.be/novox/mesh-sdk/go/forgekey"
 )

@@ -269,7 +270,7 @@ func TestNoCommandOfTheStepSeesATokenOfTheProcess(t *testing.T) {
 		}
 	}
 	// The runner main wires: what it hands a command is exactly what the step gave.
-	ran := forgekey.ExecRunnerClean(10*time.Second)(context.Background(), append(m.baseEnv(), "ONLY=this"), "env")
+	ran := dforgekey.ExecRunnerClean(10*time.Second)(context.Background(), append(m.baseEnv(), "ONLY=this"), "env")
 	if ran.Status != 0 || strings.Contains(ran.Stdout, "hunter") || !strings.Contains(ran.Stdout, "ONLY=this") {
 		t.Errorf("the clean runner printed %q", ran.Stdout)
 	}
@@ -14,6 +14,7 @@ import (
 	"strings"
 	"testing"

+	"git.novox.be/novox/mesh-catalog/modules/ssh-client/sshkeys"
 	"git.novox.be/novox/mesh-sdk/go/forgekey"
 )

@@ -235,7 +236,7 @@ func TestTheKeeperWritesTheModulesEntryWithKindBuilder(t *testing.T) {
 	if !ok || len(st.puts) != 1 {
 		t.Fatalf("entries = %v, want one at ace.%s", st.puts, forgeModule)
 	}
-	var e forgekey.KeyEntry
+	var e sshkeys.KeyEntry
 	if err := json.Unmarshal(raw, &e); err != nil {
 		t.Fatal(err)
 	}
@@ -18,6 +18,7 @@ import (
 	"time"

 	"git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep"
+	dforgekey "git.novox.be/novox/mesh-delivery/sdk/forgekey"
 	"git.novox.be/novox/mesh-sdk/go/forgekey"
 )

@@ -53,7 +54,7 @@ func (m *Module) stepRunner(root string, write bool) (forgekey.Runner, error) {
 func ProbeBubblewrap(ctx context.Context) (string, error) {
 	ctx, cancel := context.WithTimeout(ctx, 15*time.Second)
 	defer cancel()
-	r := forgekey.ExecRunnerClean(0)(ctx, []string{"PATH=" + defaultPath}, buildstep.Bubblewrap, "--version")
+	r := dforgekey.ExecRunnerClean(0)(ctx, []string{"PATH=" + defaultPath}, buildstep.Bubblewrap, "--version")
 	if r.Status != 0 || r.Err != "" {
 		return "", fmt.Errorf("`%s --version` failed: %s", buildstep.Bubblewrap, firstLine(r.Err+"\n"+r.Stderr))
 	}
@@ -13,14 +13,16 @@ import (
 	"strings"
 	"time"

+	"git.novox.be/novox/mesh-catalog/modules/ssh-client/sshkeys"
+	dforgekey "git.novox.be/novox/mesh-delivery/sdk/forgekey"
 	stdio "git.novox.be/novox/mesh-sdk/go"
 	"git.novox.be/novox/mesh-sdk/go/forgekey"
 )

 // keeperFor is this module's keeper: go/forgekey's, of kind builder, for account in home on node, whose entry lies
 // at <node>.<account> of the keys state.
-func keeperFor(home, node, account string, run forgekey.Runner, state forgekey.KeyPutter) *forgekey.KeyKeeper {
-	return &forgekey.KeyKeeper{Home: home, Node: node, Account: account, Kind: forgekey.KindBuilder, Run: run, State: state, Now: time.Now}
+func keeperFor(home, node, account string, run forgekey.Runner, state sshkeys.KeyPutter) *sshkeys.KeyKeeper {
+	return &sshkeys.KeyKeeper{Home: home, Node: node, Account: account, Kind: dforgekey.KindBuilder, Run: run, State: state, Now: time.Now}
 }

 // startKeeper runs the keeper when the runtime launched this process for a node: outside a launch — a build, a
@@ -15,9 +15,9 @@ import (
 	"strings"
 	"time"

+	dforgekey "git.novox.be/novox/mesh-delivery/sdk/forgekey"
 	stdio "git.novox.be/novox/mesh-sdk/go"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/forgekey"
 )

 // CacheDir is the cache directory, outside the account's home (ADR 0466 §1; module.json resource `cache`).
@@ -42,7 +42,7 @@ func main() {
 		Node:                strings.TrimSpace(os.Getenv("MESH_NODE")),
 		Reload:              func() (Recipe, error) { return ReadRecipe(paths.LockPath()) },
 		Probe:               ProbeNode,
-		Toolchain:           &Toolchain{Paths: paths, Run: forgekey.ExecRunnerClean(0), Registry: registry},
+		Toolchain:           &Toolchain{Paths: paths, Run: dforgekey.ExecRunnerClean(0), Registry: registry},
 		Toolchains:          stdio.State(delivery.ToolchainsState).Put,
 		Emit:                func(t string, b any) error { return stdio.Emit(t, b) },
 		Steps:               stdio.State(delivery.StepsState).Put,
@@ -51,7 +51,7 @@ func main() {
 		ReadPauses:          readOf(stdio.State(delivery.PausesState)),
 		ReadToolchainsState: readOf(stdio.State(delivery.ToolchainsState)),
 		Work:                WorkDir,
-		Run:                 forgekey.ExecRunnerClean(0),
+		Run:                 dforgekey.ExecRunnerClean(0),
 		Ctx:                 ctx,
 		Say:                 logf,
 		Bubblewrap:          ProbeBubblewrap,
@@ -46,6 +46,10 @@ func resource(t *testing.T, m catalogue.Manifest, id string) map[string]any {
 // home at mode 0700, requires user-namespaces and declares the four packages and carries toolchain/package-lock.json.
 func TestManifestDeclaresTheAccountTheCapabilityAndThePackages(t *testing.T) {
 	m := readManifest(t)
+	// The key keeper is ssh-client's published package, taken by its series (ADR 0634 §1).
+	if m.Packages["sshkeys"] != "0.1" {
+		t.Errorf("packages %v: want sshkeys of series 0.1", m.Packages)
+	}
 	if m.Module != "mesh-build-node" || m.RunsAs != "mesh-build-node" {
 		t.Errorf("module %q runs as %q, want mesh-build-node as itself", m.Module, m.RunsAs)
 	}
@@ -94,3 +94,7 @@ require (
 )

 replace git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep => ../mesh-build-go/buildstep
+
+require git.novox.be/novox/mesh-catalog/modules/ssh-client/sshkeys v0.0.0-00010101000000-000000000000
+
+replace git.novox.be/novox/mesh-catalog/modules/ssh-client/sshkeys => ../ssh-client/sshkeys
@@ -1,6 +1,9 @@
 {
  "module": "mesh-build-node",
  "version": "1",
+  "packages": {
+    "sshkeys": "0.1"
+  },
  "moved": true,
  "runs-as": "mesh-build-node",
  "capabilities": [