mirror of
https://github.com/rustfs/rustfs.git
synced 2026-08-19 11:06:17 +00:00
overtrue
3b5164032a
A RustFS cluster device needs a durable identity before it can exchange a one-time registration token for a certificate. This adds the device-side half of that exchange, which rustfs/connect already verifies. `connect::identity` builds the canonical registration transcript frozen by protocol/agent/v1/registration-proof.md, signs it as low-S ES256, and emits the PKCS#10 certificate request Connect consumes for its SubjectPublicKeyInfo. `connect::identity_store` seals the P-256 key at mode 0600 and publishes it through a no-clobber link, so a retry or a concurrent start returns the original identity rather than minting a second one, and a corrupt or widened key is refused rather than silently replaced. The protocol fixture set is copied here byte-identically because fixture-sets.json names this repository as the consumer copy; the tests verify it against its own manifests and cross-verify Connect-produced ECDSA proofs against transcripts rebuilt locally. Nothing starts a task or touches the S3 data path: an unenrolled deployment generates no key and holds no identity.
53 lines
1.7 KiB
JSON
53 lines
1.7 KiB
JSON
{
|
|
"protocolVersion": "v1",
|
|
"maxFilesPerSet": 12,
|
|
"manifestFile": "MANIFEST.sha256",
|
|
"consumerCopy": {
|
|
"repository": "rustfs/rustfs",
|
|
"path": "protocol/agent/v1/fixtures",
|
|
"requirement": "Byte-identical copy of every populated set, compared by make protocol-compat."
|
|
},
|
|
"sets": [
|
|
{
|
|
"name": "auth",
|
|
"status": "populated",
|
|
"purpose": "Client certificate profile, RFC 9440 header profile, authentication accept and reject vectors, surface separation, and the frozen error reason registry."
|
|
},
|
|
{
|
|
"name": "version",
|
|
"status": "populated",
|
|
"purpose": "Protocol version negotiation decisions, the frozen v1 negotiation field registry, and additive compatibility in both skew directions."
|
|
},
|
|
{
|
|
"name": "registration",
|
|
"status": "populated",
|
|
"purpose": "Registration token exchange, proof of possession, replay rejection, and certificate issuance."
|
|
},
|
|
{
|
|
"name": "heartbeat",
|
|
"status": "reserved",
|
|
"purpose": "Heartbeat payloads, Connect receive time, and freshness window behavior."
|
|
},
|
|
{
|
|
"name": "inventory",
|
|
"status": "populated",
|
|
"purpose": "Inventory snapshot payloads and their allow-listed collection fields."
|
|
},
|
|
{
|
|
"name": "offline-enrollment",
|
|
"status": "populated",
|
|
"purpose": "Air-gapped device enrolment and signed artifact exchange without a certificate."
|
|
},
|
|
{
|
|
"name": "bundle",
|
|
"status": "populated",
|
|
"purpose": "Support bundle manifests, upload authorization, and archive validation."
|
|
},
|
|
{
|
|
"name": "redaction",
|
|
"status": "populated",
|
|
"purpose": "Deterministic redaction of telemetry and support bundle content."
|
|
}
|
|
]
|
|
}
|