Robert Allan JamesandClaude Sonnet 5
f6e2737f1e
capsule_mint_identity() (new capsule_mint.h/.c): mints a fresh identity onto a blank/unminted thumbdrive -- real Ed25519 keypair from virtio_rng, a fresh drive_uuid (independent random draw, not derived from the identity seed, per FABRIC-3.md §F.8 decision 3), a Zuse-signed DER cert in the CERTVERIFY format, and a small working default personality (a real WELCOME word, not a stub -- FABRIC-3.md §F.6/§F.8's own "default personality content" question stays open, but whatever mints today must actually do something when RUNCAP births it). Refuses to overwrite a drive that already reads as a recognized home-blocks drive, mirroring WRITE(10)'s own refuse-on-non-blank posture (decided now, not just "reasonable by analogy" as §F.8 left it). x509_build_user_cert() (x509_ed25519.h/.c): the encode-side counterpart to the existing decode functions (x509_extract_ed25519_pubkey(), x509_verify_signature(), x509_extract_serial()) -- a minimal DER TLV writer producing exactly the fields those functions read. Host-tested round-trip against the real decoder before trusting it in the kernel, including a high-bit-serial case that exercises the DER integer-padding rule; all assertions pass (pubkey/serial round-trip, signature verifies against the real issuer, correctly rejects the wrong key and a corrupted signature). New user_identity_seed_t (user_identity_seed.h): the on-disk record for a minted identity's own keypair, same magic+version+fields+pad-to-4096+ real-CRC convention as zuse_cert_devblock_t and homeblocks_sig_t. Fixed devblock layout: sig(1), cert(2), seed record(3), default personality(4). New MINT word (mama_forth_words.c) and a small accessor (sk_repl_get_attached_blk_dev(), repl.h/.c) exposing the currently attached USB device regardless of home-blocks recognition -- MINT's own target is a blank drive, which by definition never sets Phase D's sk_repl_get_homeblocks_dev(). Verified end-to-end live in QEMU: MINT on a genuinely blank test drive, then (after a detach/reattach so the sig cache picks up the fresh header -- a known workflow gap, not fixed here, flagged for whoever builds the real Console onboarding flow) RUNCAP birthed a VM from that drive's own newly-minted content, and VM-EXECing its WELCOME word printed the default personality banner. The full mint-to-birth Tripod identity flow works end to end for the first time. Clean 3-architecture regression boot confirms no side effects on normal boot. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019ZGkimpfyh63EZyRkNbkPD
64 lines
2.4 KiB
C
64 lines
2.4 KiB
C
/*
|
||
StarForth — Steady-State Virtual Machine Runtime
|
||
|
||
Copyright (c) 2023–2025 Robert A. James
|
||
All rights reserved.
|
||
|
||
Licensed under the StarForth License, Version 1.0
|
||
*/
|
||
|
||
/**
|
||
* capsule_mint.h - MINT: mint a fresh identity onto a blank thumbdrive
|
||
* (FABRIC-3.md §F.8/§F.19), the last piece of the original Tripod
|
||
* vision. Writes a real keypair, a Zuse-signed cert, and a minimal
|
||
* working default personality -- everything RUNCAP (capsule_runcap.h)
|
||
* and CERTVERIFY need at a later attach.
|
||
*/
|
||
|
||
#ifndef STARKERNEL_CAPSULE_MINT_H
|
||
#define STARKERNEL_CAPSULE_MINT_H
|
||
|
||
#ifdef __STARKERNEL__
|
||
|
||
#include <stdint.h>
|
||
#include "vm.h"
|
||
|
||
struct blkio_dev;
|
||
|
||
typedef enum {
|
||
MINT_OK = 0,
|
||
MINT_ERR_ALREADY_MINTED, /* dev already reads as a recognized home-blocks
|
||
* drive -- refuses rather than overwrite,
|
||
* mirroring WRITE(10)'s own blank-media
|
||
* posture (§F.8, decided 2026-08-28). */
|
||
MINT_ERR_NO_ZUSE_CERT, /* issuer_vm->zuse_cert_installed is 0 -- no
|
||
* key to sign the new cert with. */
|
||
MINT_ERR_NO_ENTROPY, /* virtio_rng not ready. */
|
||
MINT_ERR_CERT_BUILD, /* x509_build_user_cert() failed (shouldn't
|
||
* happen with fixed-size fields, but not
|
||
* assumed away). */
|
||
MINT_ERR_WRITE_FAIL, /* a devblock write failed partway through --
|
||
* the drive may be left partially minted. */
|
||
} MintResult;
|
||
|
||
/**
|
||
* capsule_mint_identity - Mint a fresh identity onto dev.
|
||
*
|
||
* Layout written (devblock offsets from dev's own start; devblock 0 is
|
||
* left alone, reserved for the block-subsystem's own generic header):
|
||
* devblock 1 homeblocks_sig_t (HOMEBLOCKS_SIG_START_FBLOCK)
|
||
* devblock 2 DER cert, Zuse-signed (cert_offset)
|
||
* devblock 3 user_identity_seed_t (identity_src_offset)
|
||
* devblock 4 default personality source (identity_src_offset+1)
|
||
*
|
||
* @param dev Already-open block device for the target drive.
|
||
* @param issuer_vm The signing identity -- in practice always Hera's own
|
||
* VM (Zuse's cert lives there, vm.h's zuse_cert_seed).
|
||
* @return MINT_OK on success, an error code otherwise.
|
||
*/
|
||
MintResult capsule_mint_identity(struct blkio_dev *dev, VM *issuer_vm);
|
||
|
||
#endif /* __STARKERNEL__ */
|
||
|
||
#endif /* STARKERNEL_CAPSULE_MINT_H */
|