Robert Allan JamesandClaude Sonnet 5
f6e2737f1e
capsule_mint_identity() (new capsule_mint.h/.c): mints a fresh identity onto a blank/unminted thumbdrive -- real Ed25519 keypair from virtio_rng, a fresh drive_uuid (independent random draw, not derived from the identity seed, per FABRIC-3.md §F.8 decision 3), a Zuse-signed DER cert in the CERTVERIFY format, and a small working default personality (a real WELCOME word, not a stub -- FABRIC-3.md §F.6/§F.8's own "default personality content" question stays open, but whatever mints today must actually do something when RUNCAP births it). Refuses to overwrite a drive that already reads as a recognized home-blocks drive, mirroring WRITE(10)'s own refuse-on-non-blank posture (decided now, not just "reasonable by analogy" as §F.8 left it). x509_build_user_cert() (x509_ed25519.h/.c): the encode-side counterpart to the existing decode functions (x509_extract_ed25519_pubkey(), x509_verify_signature(), x509_extract_serial()) -- a minimal DER TLV writer producing exactly the fields those functions read. Host-tested round-trip against the real decoder before trusting it in the kernel, including a high-bit-serial case that exercises the DER integer-padding rule; all assertions pass (pubkey/serial round-trip, signature verifies against the real issuer, correctly rejects the wrong key and a corrupted signature). New user_identity_seed_t (user_identity_seed.h): the on-disk record for a minted identity's own keypair, same magic+version+fields+pad-to-4096+ real-CRC convention as zuse_cert_devblock_t and homeblocks_sig_t. Fixed devblock layout: sig(1), cert(2), seed record(3), default personality(4). New MINT word (mama_forth_words.c) and a small accessor (sk_repl_get_attached_blk_dev(), repl.h/.c) exposing the currently attached USB device regardless of home-blocks recognition -- MINT's own target is a blank drive, which by definition never sets Phase D's sk_repl_get_homeblocks_dev(). Verified end-to-end live in QEMU: MINT on a genuinely blank test drive, then (after a detach/reattach so the sig cache picks up the fresh header -- a known workflow gap, not fixed here, flagged for whoever builds the real Console onboarding flow) RUNCAP birthed a VM from that drive's own newly-minted content, and VM-EXECing its WELCOME word printed the default personality banner. The full mint-to-birth Tripod identity flow works end to end for the first time. Clean 3-architecture regression boot confirms no side effects on normal boot. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019ZGkimpfyh63EZyRkNbkPD
95 lines
4.9 KiB
C
95 lines
4.9 KiB
C
/*
|
|
* x509_ed25519.h -- minimal, targeted DER walkers for Ed25519-signed X.509
|
|
* certificates (RFC 8410). Deliberately NOT a general ASN.1/X.509 parser
|
|
* (Milestone 6 decision, FABRIC-2.md): each function walks exactly as far
|
|
* into the DER structure as its own job needs, nothing more.
|
|
*
|
|
* x509_extract_ed25519_pubkey() only ever reads SubjectPublicKeyInfo --
|
|
* no signature verification, no chain validation, no extension parsing.
|
|
* That's the capsule-PKI use case (Milestone 6): the embedded snakeoil
|
|
* intermediate cert is trusted because it's baked into the trusted build,
|
|
* never re-verified against the offline root CA at boot.
|
|
*
|
|
* x509_verify_signature()/x509_extract_serial() (added 2026-08-28,
|
|
* FABRIC-3.md §F.7/§F.17) are for CERTVERIFY -- a regular user's cert,
|
|
* which unlike the capsule-PKI chain is signed by Zuse's own on-device
|
|
* key and genuinely needs its signature checked at attach time, not just
|
|
* trusted by embedding. Two separate trust roots, two separate reasons
|
|
* to exist in the same small file (shared DER-walking internals only).
|
|
*
|
|
* Freestanding C99, no libc beyond memcmp/memcpy (already provided by
|
|
* src/starkernel/vm/host/shim.c in the kernel build).
|
|
*/
|
|
#ifndef STARKERNEL_X509_ED25519_H
|
|
#define STARKERNEL_X509_ED25519_H
|
|
|
|
#include <stdint.h>
|
|
#include <stddef.h>
|
|
|
|
/* Returns 0 on success (pubkey_out[32] filled), -1 on any malformed
|
|
* encoding, unexpected structure, or non-Ed25519 algorithm. Never
|
|
* faults on malformed input -- every DER length/tag is bounds-checked
|
|
* against der_len before use. */
|
|
int x509_extract_ed25519_pubkey(const uint8_t *der, size_t der_len,
|
|
uint8_t pubkey_out[32]);
|
|
|
|
/* Verify a DER-encoded certificate's own outer Ed25519 signature (the
|
|
* signatureValue field) was produced by issuer_pubkey signing the raw,
|
|
* exactly-as-encoded tbsCertificate bytes (DER signs the octets, not a
|
|
* re-derived hash of "the fields" -- the TLV framing is part of what's
|
|
* signed). Rejects a non-Ed25519 signatureAlgorithm rather than guessing.
|
|
*
|
|
* Returns 0 if the signature verifies, -1 on any malformed encoding,
|
|
* unexpected structure, non-Ed25519 signature algorithm, or a signature
|
|
* that does not verify. Never faults on malformed input. */
|
|
int x509_verify_signature(const uint8_t *der, size_t der_len,
|
|
const uint8_t issuer_pubkey[32]);
|
|
|
|
/* Extract the raw serialNumber INTEGER content bytes from a DER-encoded
|
|
* certificate's tbsCertificate. A single leading 0x00 pad byte (DER adds
|
|
* one when the value's high bit would otherwise read as a negative
|
|
* INTEGER) is stripped before copying, so a 16-byte drive_uuid compares
|
|
* byte-for-byte regardless of whether DER happened to pad it.
|
|
*
|
|
* @param serial_out Caller-provided buffer.
|
|
* @param serial_out_cap Its size in bytes; returns -1 if the real
|
|
* (pad-stripped) serial is larger than this.
|
|
* @param serial_len_out Set to the real length actually copied.
|
|
* @return 0 on success, -1 on any malformed encoding or unexpected
|
|
* structure. Never faults on malformed input. */
|
|
int x509_extract_serial(const uint8_t *der, size_t der_len,
|
|
uint8_t *serial_out, size_t serial_out_cap,
|
|
size_t *serial_len_out);
|
|
|
|
/*
|
|
* x509_build_user_cert (added 2026-08-28, FABRIC-3.md §F.8/§F.19, MINT):
|
|
* the encode-side counterpart to x509_verify_signature()/x509_extract_*
|
|
* above. Builds a minimal DER-encoded X.509 certificate exercising
|
|
* exactly the fields those functions read -- serialNumber, an Ed25519
|
|
* SubjectPublicKeyInfo, an Ed25519-signed signatureValue -- and nothing
|
|
* else. issuer/validity/subject are each encoded as an empty SEQUENCE
|
|
* (valid, zero-length DER TLVs the decode side only ever skips, never
|
|
* reads the content of); version is omitted entirely (implicit v1,
|
|
* matching the decode side's own optional-version handling). This is
|
|
* deliberately not a general-purpose X.509 builder -- same scope
|
|
* discipline as the decode side's own doc comment above.
|
|
*
|
|
* @param out Caller-provided output buffer.
|
|
* @param out_cap Its size in bytes.
|
|
* @param subject_pubkey The new identity's own Ed25519 public key --
|
|
* becomes the cert's SubjectPublicKeyInfo.
|
|
* @param serial 16 bytes -- becomes the cert's serialNumber
|
|
* (CERTVERIFY/BINDSTEP compare this against
|
|
* homeblocks_sig_t.drive_uuid).
|
|
* @param issuer_seed The signer's own Ed25519 seed (Zuse's
|
|
* vm->zuse_cert_seed) -- signs the resulting
|
|
* tbsCertificate bytes.
|
|
* @return Number of bytes written to out, or 0 if out_cap was too small.
|
|
*/
|
|
size_t x509_build_user_cert(uint8_t *out, size_t out_cap,
|
|
const uint8_t subject_pubkey[32],
|
|
const uint8_t serial[16],
|
|
const uint8_t issuer_seed[32]);
|
|
|
|
#endif /* STARKERNEL_X509_ED25519_H */
|