Files
LithosAnanake/logs
Robert Allan JamesandClaude Sonnet 5 0ec91b517a Implement CERTVERIFY -- real DER cert verification, tested against OpenSSL
Phase B of the identity pipeline (FABRIC-3.md §F.7/§F.17):

- x509_ed25519.c/.h: two new DER walkers alongside the existing pubkey
  extractor -- x509_verify_signature() (verifies a cert's outer Ed25519
  signature over the raw, exactly-as-encoded tbsCertificate bytes, real
  signature verification against issuer_pubkey, rejects non-Ed25519
  signatureAlgorithm) and x509_extract_serial() (extracts the
  serialNumber INTEGER, stripping a DER padding byte if present, for the
  drive_uuid binding decided in §F.7).

- vm_identity.c: vm_identity_from_cert(), ties the three DER primitives
  together into the actual CERTVERIFY check -- signature verifies against
  issuer_pubkey, serialNumber matches this drive's own drive_uuid,
  subject pubkey extracts cleanly -- and populates a VMIdentity on
  success. acl_caps is caller-supplied, not read from the cert (nothing
  in the decided cert fields encodes capabilities); deciding what a
  verified identity is allowed to do is policy for the caller (WIREBIND,
  not yet built), not this function's job.

Verified two ways: a standalone host-side test harness (not part of the
kernel build) links the real source files against a real openssl-
generated Ed25519 X.509 cert -- extracted pubkey, extracted serial, and
signature verification all match ground truth, plus two negative tests
(wrong issuer pubkey, corrupted signature) both correctly rejected. Then
the actual kernel build verified live on all three architectures: clean
compile, clean boot to ok>, Hermes/Artemis both live with no KILL. Same
pre-existing, unrelated Zuse fence-write anomaly observed on all three
(not caused by this change, not chased here).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019ZGkimpfyh63EZyRkNbkPD
2026-08-28 09:38:18 -04:00
..
2026-08-02 05:11:24 -04:00
2026-08-02 05:11:24 -04:00
2026-08-02 05:11:24 -04:00

logs/

QEMU acceptance-run history and Tripod smoke-test results.

  • <timestamp>/{amd64,aarch64,riscv64}/ — 255 timestamped three-arch QEMU acceptance run directories, one per invocation of the kernel QEMU acceptance workflow.
  • qemu-screenshot-*.png, qemu-screenshot-*.log, qemu-{amd64,aarch64,riscv64}-*.log, fbtest-console-*.png — loose timestamped QEMU serial captures and framebuffer screenshots from individual manual runs (not part of the timestamped-directory convention above).
  • hermes-tripod-smoke-results.md, hermes-channel-smoke-results.md — captured output from tools/hermes_tripod_smoke.sh and tools/hermes_channel_smoke.sh.
  • hermes-tripod-integration-design.md — design notes for the Tripod integration test.

Note: QEMU_BASELINE.log at the repo root (not in this directory) is the primary kernel regression baseline referenced by .claude/CLAUDE.md; the logs here are supplementary historical captures. See also logs2/ (a separate, flatter QEMU log archive) and experiments/bare_metal/runs/ (DoE-specific run output).