mirror of
https://github.com/rustfs/rustfs.git
synced 2026-08-19 11:06:17 +00:00
overtrue
3b5164032a
A RustFS cluster device needs a durable identity before it can exchange a one-time registration token for a certificate. This adds the device-side half of that exchange, which rustfs/connect already verifies. `connect::identity` builds the canonical registration transcript frozen by protocol/agent/v1/registration-proof.md, signs it as low-S ES256, and emits the PKCS#10 certificate request Connect consumes for its SubjectPublicKeyInfo. `connect::identity_store` seals the P-256 key at mode 0600 and publishes it through a no-clobber link, so a retry or a concurrent start returns the original identity rather than minting a second one, and a corrupt or widened key is refused rather than silently replaced. The protocol fixture set is copied here byte-identically because fixture-sets.json names this repository as the consumer copy; the tests verify it against its own manifests and cross-verify Connect-produced ECDSA proofs against transcripts rebuilt locally. Nothing starts a task or touches the S3 data path: an unenrolled deployment generates no key and holds no identity.
85 lines
2.3 KiB
JSON
85 lines
2.3 KiB
JSON
{
|
|
"protocolVersion": "v1",
|
|
"fixtureSet": "auth",
|
|
"fixture": "accept-vectors",
|
|
"description": "Presented certificates that authenticate. Time offsets are seconds relative to the moment the request is evaluated.",
|
|
"vectors": [
|
|
{
|
|
"name": "current credential on an active cluster",
|
|
"clusterState": "ACTIVE",
|
|
"credential": {
|
|
"validFromOffsetSeconds": -3600,
|
|
"validUntilOffsetSeconds": 82800,
|
|
"transition": null
|
|
},
|
|
"presented": {
|
|
"credential": "current",
|
|
"serial": "matching",
|
|
"certificateFingerprint": "matching"
|
|
},
|
|
"expected": {
|
|
"credentialResolved": true,
|
|
"authenticationEffective": true,
|
|
"reason": null
|
|
}
|
|
},
|
|
{
|
|
"name": "first device authenticates while its cluster is still pending",
|
|
"clusterState": "PENDING",
|
|
"credential": {
|
|
"validFromOffsetSeconds": -60,
|
|
"validUntilOffsetSeconds": 86340,
|
|
"transition": null
|
|
},
|
|
"presented": {
|
|
"credential": "current",
|
|
"serial": "matching",
|
|
"certificateFingerprint": "matching"
|
|
},
|
|
"expected": {
|
|
"credentialResolved": true,
|
|
"authenticationEffective": true,
|
|
"reason": null
|
|
}
|
|
},
|
|
{
|
|
"name": "outgoing credential inside the bounded rotation overlap",
|
|
"clusterState": "ACTIVE",
|
|
"credential": {
|
|
"validFromOffsetSeconds": -3600,
|
|
"validUntilOffsetSeconds": 82800,
|
|
"transition": "rotate"
|
|
},
|
|
"presented": {
|
|
"credential": "outgoing",
|
|
"serial": "matching",
|
|
"certificateFingerprint": "matching"
|
|
},
|
|
"expected": {
|
|
"credentialResolved": true,
|
|
"authenticationEffective": true,
|
|
"reason": null
|
|
}
|
|
},
|
|
{
|
|
"name": "incoming credential immediately after rotation",
|
|
"clusterState": "ACTIVE",
|
|
"credential": {
|
|
"validFromOffsetSeconds": -3600,
|
|
"validUntilOffsetSeconds": 82800,
|
|
"transition": "rotate"
|
|
},
|
|
"presented": {
|
|
"credential": "current",
|
|
"serial": "matching",
|
|
"certificateFingerprint": "matching"
|
|
},
|
|
"expected": {
|
|
"credentialResolved": true,
|
|
"authenticationEffective": true,
|
|
"reason": null
|
|
}
|
|
}
|
|
]
|
|
}
|