3 Commits

Include renames

Author	SHA1	Message	Date
jochen	1b502a37e0	Let only the authority's root hold lines, refuse every line end, and keep places off the runtime's data and any .ssh ... The review of hq issue 339 found the PEM exception too wide (any module, any key, any label, anything base64), \v, \f, NEL and the Unicode separators still let a value end a line in some readers, and the spool, /opt, the container runtimes' data and an account's .ssh still placeable. Lines are now taken only in step-ca's root setting, as certificates encoding/pem decodes and x509 parses; every line end is refused; and those paths are the machine's own. The test certificate is a real one, made for the tests with its key thrown away.	2026-10-09 00:28:08 +02:00
jochen	f5824b31c6	Keep places and accesses at the terminal, and refuse a line break in any setting ... Through the settings verb, or a settings line run by the generic command verb, any caller of the mesh's console could place a module's directory at /etc with an owner of its own and have the node-engine, as root, hand it over at the next push, or mount any of the machine's paths into a container (hq issue 339). A change to either key is now refused in every process a verb runs, the generic verb refuses settings writes outright, and neither key may name the machine's own trees from anywhere, the terminal included. A line break, carriage return or NUL in any setting, which a file it is written into reads as a line of the caller's own, is refused where a layer is kept and where it is composed; PEM blocks alone may hold lines.	2026-10-08 23:58:08 +02:00
jschoubben	17bbcc1596	An assignment places a module's directories and its accesses (hq 153) ... A definition names no host path (ADR 0112); an adopted machine keeps its data where the predecessor put it. Two settings, validated like endpoints: places: {<directory id>: <path> | {path, owner}} accesses: {<access id>: <path>} An access may now be declared by id (`{"id": "series", "mode": "read-write"}`) and named in mounts, env and content as ${access:<id>}; the assignment says where it is on this node, and an access nobody placed is refused by name. A definition still carrying a path keeps it as the default the assignment replaces. A placed directory takes the assignment's owner where it says one. Resolved in composition, so the host receives paths and owners exactly as before.	2026-09-30 22:42:50 +02:00