mirror of
https://github.com/rustfs/rustfs.git
synced 2026-08-20 11:32:19 +00:00
overtrue
3b5164032a
A RustFS cluster device needs a durable identity before it can exchange a one-time registration token for a certificate. This adds the device-side half of that exchange, which rustfs/connect already verifies. `connect::identity` builds the canonical registration transcript frozen by protocol/agent/v1/registration-proof.md, signs it as low-S ES256, and emits the PKCS#10 certificate request Connect consumes for its SubjectPublicKeyInfo. `connect::identity_store` seals the P-256 key at mode 0600 and publishes it through a no-clobber link, so a retry or a concurrent start returns the original identity rather than minting a second one, and a corrupt or widened key is refused rather than silently replaced. The protocol fixture set is copied here byte-identically because fixture-sets.json names this repository as the consumer copy; the tests verify it against its own manifests and cross-verify Connect-produced ECDSA proofs against transcripts rebuilt locally. Nothing starts a task or touches the S3 data path: an unenrolled deployment generates no key and holds no identity.
8 lines
616 B
Plaintext
8 lines
616 B
Plaintext
d1a73b0a348845bf3ed9fb68301babc5abbc6e72243a610db1cd4794b1328070 canonical-hash.json
|
|
f1107d3e6accbaee468f1a1fdb79d7103fb2aadafd85c39020fbbca5173b03b4 field-registry.json
|
|
b3b2e7f761198d4823c94440637a48153437183f4cacec5118570e1920f73b29 old-agent-vectors.json
|
|
bec2f30dea2fd4839e501acd94c9d935817f4f1b67cd14d33cad59c0351a23ea reject-vectors.json
|
|
5493ba0d1477ad3762ed87c410d5830b47fe7aedac511f97b96385a51e258c32 secret-like-vectors.json
|
|
6e2df36bf266fcca4b2c9a856d0a9ca8ab7e2cfaf7534b9af176c6597cb38137 unknown-field-vectors.json
|
|
46e5d3398719a31dcc912379e66b4ab06a433d125366cce5239c49956fc4ab1b valid-vectors.json
|