4 Commits

Include renames

Author	SHA1	Message	Date
jschoubben	cbe8528f91	Resolve ${secret:<name>} through this node's provision keys, and check the reference by the vault's own name (issue 1954 L6-E1, E2; ADR 0570 clauses 1, 6; ADR 0094) ... - A placeholder is `${secret:<name>}`, the name the module calls the credential (catalogue.SecretLocal): the local name where it keeps several values of one provision, else the provision. The `<provision>.<local>` form goes. - The engine finds the one key under `<node>.<module>.` of mesh-provisioner's `provisions` going by that name. That is what node.<node> may read, by a watch to its caught-up mark; plans are not read. - The reference's ID must be a credential name of that provision (provisions.VaultName). The vault's answer must carry exactly that name and generation. Anything else refuses the write, naming both. Pins mesh-sdk 66ff33d. Tests: rows in TestAWriteAndAnApplyOfTheSameFileSerialise (a local name, a name no provision goes by, a reference to no credential of the provision, a mismatched answer).	2026-10-29 22:41:44 +01:00
jschoubben	5497d362dd	Refuse a provision's value unless the vault's credential name and generation are the ones its reference names (issue 1954 L6-E1; ADR 0570 clauses 1, 6) ... The value written is the one the provision names: a1-47 makes Reference.ID the vault's credential name. A mismatch in either refuses the write, naming both. Test: a row in TestAWriteAndAnApplyOfTheSameFileSerialise.	2026-10-29 22:37:44 +01:00
jschoubben	6b32e07164	Fill a provision's ${secret:} at the write from the vault's value sealed to this machine, so the provisioner's client never holds it (issue 1954 L6-E1, E2; ADR 0570 clause 6) ... The provisioner's client fills a handed module's file but for each `${secret:<provision>}` (or a whole `secrets` file that is the placeholder alone). - The node-engine reads the provision's key `<node>.<consumer>.<provision>[.<local>]` in mesh-provisioner's `provisions`. The key must be `provided` and carry the vault's reference. - It asks the vault's `own` for that pair credential sealed to this machine, at least at the reference's generation, and opens it with the node's sealing key. - It writes the file as declared (its owner), 0600 when the declaration gives no mode. - Anything short of that refuses the write, naming the provision and why. A module the node composes itself already has its `secrets` files written so: its composition carries the vault's value from `own`, written 0600 with the declared owner. Pins mesh-sdk 4a96793 (go/provisions). Tests: rows in TestAWriteAndAnApplyOfTheSameFileSerialise.	2026-10-29 22:36:53 +01:00
mesh-tools	bff1ac14a1	Feature 57 (config and provisioning): release mesh-host, the reviewed release branch on top of main	2026-10-16 08:24:13 +00:00