admin/LithosAnanake
1
0
Fork 0
Code Issues Pull Requests Actions 18 Packages Projects Releases Wiki Activity

Phase E: MINT -- real keypair, Zuse-signed DER cert, working default identity

Browse Source 
capsule_mint_identity() (new capsule_mint.h/.c): mints a fresh identity
onto a blank/unminted thumbdrive -- real Ed25519 keypair from virtio_rng,
a fresh drive_uuid (independent random draw, not derived from the
identity seed, per FABRIC-3.md §F.8 decision 3), a Zuse-signed DER cert
in the CERTVERIFY format, and a small working default personality (a
real WELCOME word, not a stub -- FABRIC-3.md §F.6/§F.8's own "default
personality content" question stays open, but whatever mints today must
actually do something when RUNCAP births it). Refuses to overwrite a
drive that already reads as a recognized home-blocks drive, mirroring
WRITE(10)'s own refuse-on-non-blank posture (decided now, not just
"reasonable by analogy" as §F.8 left it).

x509_build_user_cert() (x509_ed25519.h/.c): the encode-side counterpart
to the existing decode functions (x509_extract_ed25519_pubkey(),
x509_verify_signature(), x509_extract_serial()) -- a minimal DER TLV
writer producing exactly the fields those functions read. Host-tested
round-trip against the real decoder before trusting it in the kernel,
including a high-bit-serial case that exercises the DER integer-padding
rule; all assertions pass (pubkey/serial round-trip, signature verifies
against the real issuer, correctly rejects the wrong key and a
corrupted signature).

New user_identity_seed_t (user_identity_seed.h): the on-disk record for
a minted identity's own keypair, same magic+version+fields+pad-to-4096+
real-CRC convention as zuse_cert_devblock_t and homeblocks_sig_t. Fixed
devblock layout: sig(1), cert(2), seed record(3), default personality(4).

New MINT word (mama_forth_words.c) and a small accessor
(sk_repl_get_attached_blk_dev(), repl.h/.c) exposing the currently
attached USB device regardless of home-blocks recognition -- MINT's own
target is a blank drive, which by definition never sets Phase D's
sk_repl_get_homeblocks_dev().

Verified end-to-end live in QEMU: MINT on a genuinely blank test drive,
then (after a detach/reattach so the sig cache picks up the fresh
header -- a known workflow gap, not fixed here, flagged for whoever
builds the real Console onboarding flow) RUNCAP birthed a VM from that
drive's own newly-minted content, and VM-EXECing its WELCOME word
printed the default personality banner. The full mint-to-birth Tripod
identity flow works end to end for the first time. Clean 3-architecture
regression boot confirms no side effects on normal boot.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019ZGkimpfyh63EZyRkNbkPD
This commit is contained in:
Robert Allan James
2026-08-28 14:44:59 -04:00
co-authored by Claude Sonnet 5
parent 21c143dd28
commit f6e2737f1e
13 changed files with 28317 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/starkernel/capsule/mama_forth_words.c
+50
View File
@@ -40,6 +40,7 @@
#include "starkernel/capsule.h"
#include "starkernel/capsule_birth.h"
#include "starkernel/capsule_runcap.h"
#include "starkernel/capsule_mint.h"
#include "starkernel/capsule_loader.h"
#include "starkernel/capsule_run.h"
#include "starkernel/capsule_loader.h"
@@ -770,6 +771,53 @@ static void mama_word_vm_call(VM *vm)
}
}
/**
* @brief MINT ( -- ok? )
* Mint a fresh identity onto the currently attached USB drive
* (FABRIC-3.md §F.8/§F.19). Deliberately no name/string argument despite
* F.8's original "S\" name\" MINT" sketch: this design never binds a VM
* name at mint time -- the drive holds an anonymous, self-contained
* identity, and a name is only assigned later, at RUNCAP birth (a
* WIREBIND decision, not MINT's). Refuses cleanly (prints why) if
* there's no attached drive, the drive already reads as a recognized
* home-blocks drive, Zuse has no installed cert to sign with, or there's
* no entropy source. Real, working code -- not the eventual Console
* onboarding flow (§D.6), which will call this same C function.
*/
static void mama_word_mint(VM *vm)
{
struct blkio_dev *dev = sk_repl_get_attached_blk_dev();
if (!dev) {
console_println("MINT: no drive attached");
vm_push(vm, 0);
return;
}
MintResult r = capsule_mint_identity(dev, vm);
switch (r) {
case MINT_OK:
console_println("MINT: identity minted");
vm_push(vm, 1);
return;
case MINT_ERR_ALREADY_MINTED:
console_println("MINT: refused -- drive already a recognized home-blocks drive");
break;
case MINT_ERR_NO_ZUSE_CERT:
console_println("MINT: refused -- Zuse has no installed cert to sign with");
break;
case MINT_ERR_NO_ENTROPY:
console_println("MINT: refused -- no entropy source");
break;
case MINT_ERR_CERT_BUILD:
console_println("MINT: FAILED -- cert construction error");
break;
case MINT_ERR_WRITE_FAIL:
console_println("MINT: FAILED -- devblock write error (drive may be partially minted)");
break;
}
vm_push(vm, 0);
}
/**
* @brief RUNCAP-TEST ( caddr u -- ok? rc )
* Diagnostic-only word (FABRIC-3.md §F.6/§F.18): calls
@@ -1168,6 +1216,7 @@ void register_mama_forth_words(VM *vm)
register_word(vm, "CAPSULE-LEN@", mama_word_capsule_len_fetch);
register_word(vm, "CAPSULE-BIRTH", mama_word_capsule_birth);
register_word(vm, "CAPSULE-RUN", mama_word_capsule_run);
register_word(vm, "MINT", mama_word_mint);
register_word(vm, "RUNCAP-TEST", mama_word_runcap_test);
register_word(vm, "MAMA-VM-ID", mama_word_mama_vm_id);
register_word(vm, "VM-COUNT", mama_word_vm_count);
@@ -1198,6 +1247,7 @@ void register_mama_forth_words(VM *vm)
register_word(vm, "CAPSULE-LEN@", mama_word_capsule_len_fetch);
register_word(vm, "CAPSULE-BIRTH", mama_word_capsule_birth);
register_word(vm, "CAPSULE-RUN", mama_word_capsule_run);
register_word(vm, "MINT", mama_word_mint);
register_word(vm, "RUNCAP-TEST", mama_word_runcap_test);
register_word(vm, "MAMA-VM-ID", mama_word_mama_vm_id);
register_word(vm, "VM-COUNT", mama_word_vm_count);