From b6cc9572f21c11538199405590f0819b877fabf4 Mon Sep 17 00:00:00 2001 From: jochen Date: Tue, 3 Nov 2026 11:36:05 +0100 Subject: [PATCH] A manifest may say its own secrets are the core's credentials (core-credentials), so a reader asks the module rather than a list here (issue 774, the operator 2026-11-03) --- go/catalogue/invokes_test.go | 13 +++++++++++++ go/catalogue/manifest.go | 6 ++++++ 2 files changed, 19 insertions(+) diff --git a/go/catalogue/invokes_test.go b/go/catalogue/invokes_test.go index c43bf47..3fcb3bd 100644 --- a/go/catalogue/invokes_test.go +++ b/go/catalogue/invokes_test.go @@ -1,6 +1,8 @@ package catalogue import ( + "encoding/json" + "strings" "testing" ) @@ -15,4 +17,15 @@ func TestAManifestMaySayWhatItInvokes(t *testing.T) { if len(m.Invokes) != 2 || m.Invokes[1] != "*" { t.Fatalf("invokes not read: %v", m.Invokes) } + // And that its own secrets are the core's credentials (issue 774): read, and written back as said. + for raw, core := range map[string]bool{`{"module":"bus","version":"1","core-credentials":true}`: true, `{"module":"app","version":"1"}`: false} { + m, err := decodeForTest([]byte(raw)) + if err != nil || m.CoreCredentials != core || m.UnknownField() != "" { + t.Errorf("%s: core credentials %v, %v, %q", raw, m.CoreCredentials, err, m.UnknownField()) + } + back, _ := json.Marshal(m) + if strings.Contains(string(back), "core-credentials") != core { + t.Errorf("%s written back as %s", raw, back) + } + } } diff --git a/go/catalogue/manifest.go b/go/catalogue/manifest.go index 897d053..adaea5a 100644 --- a/go/catalogue/manifest.go +++ b/go/catalogue/manifest.go @@ -801,6 +801,12 @@ type Manifest struct { // start, and is then replaced. OwnSecrets OwnSecrets `json:"own-secrets,omitempty"` + // CoreCredentials says this module's own secrets are the core's credentials (novox/hq ADR 0349 §16, issue 755): the + // vault seals each to the machine, and the node-engine writes the vault's box into its file, never a value of its + // own (Rendering.VaultSealed). Said by the module, never by a list in mesh-sdk (the operator, 2026-11-03: mesh-sdk names + // no module): the bus and the provisioner and its client say it. + CoreCredentials bool `json:"core-credentials,omitempty"` + // SecretsOwner is who the files holding this module's secrets belong to on the machine — // `uid:gid`, or a name — when its process is not root. //