Repository navigation
fix(hosts): make identity persistence durable and check the CA file - #92
Merged
Merged
Conversation
wstein
force-pushed
the
fix/86-identity-durability
branch
from
October 16, 2026 10:35
ef314ad to
c1a30d9
Compare
Owner
Author
|
Review CLEAR on |
wstein
force-pushed
the
pilot/installable-pilot-pr
branch
from
October 16, 2026 10:42
75526bb to
7656115
Compare
wstein
force-pushed
the
fix/86-identity-durability
branch
from
October 16, 2026 10:42
c1a30d9 to
dd6be58
Compare
Owner
Author
wstein
marked this pull request as ready for review
October 16, 2026 10:55
Owner
Author
|
Ready per owner: review CLEAR on this head; local |
wstein
force-pushed
the
pilot/installable-pilot-pr
branch
from
October 16, 2026 11:19
7656115 to
866e46c
Compare
wstein
force-pushed
the
fix/86-identity-durability
branch
from
October 16, 2026 11:19
dd6be58 to
8038ad3
Compare
Owner
Author
|
Restacked onto pilot |
wstein
force-pushed
the
pilot/installable-pilot-pr
branch
from
October 16, 2026 11:31
866e46c to
2235c20
Compare
wstein
force-pushed
the
fix/86-identity-durability
branch
from
October 16, 2026 11:32
8038ad3 to
cb0ecb6
Compare
Owner
Author
Fsync the parent directory on every Prepare, including when the identity directory already exists, so a retry after a failed sync never reports success for an entry that may not be durable. Remove the .identity-* temp name before the directory fsync on the exclusive link path so one sync makes link and removal durable and a crash cannot leave a second copy of the private key. Refs: #86 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Require the server CA path to be absolute and clean in Prepare and validate. Open the CA with O_NOFOLLOW, Fstat the descriptor and apply the regular-file, size, mode (no group/other write) and owner (root or the agent's effective user) checks to it, then read from the same descriptor with a 32 KiB limit, closing the stat-then-open race. Known limitation: ancestor-directory ownership of the CA path is not checked; out of scope for #86. Refs: #86 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
wstein
force-pushed
the
fix/86-identity-durability
branch
from
October 16, 2026 11:37
cb0ecb6 to
cd36caa
Compare
4 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements #86: durable identity persistence and a safe server CA file.
e4d94ec: fsync the identity directory's parent afterMkdir, including on retry; remove the exclusive-link temp name before the directory fsync.ef314ad: CA path must be absolute and clean; the CA file is opened withO_NOFOLLOW|O_NONBLOCK, checked on the open descriptor (regular file, size, not group/other-writable, owned by root or the agent user) and read from that descriptor.Known limitation: ownership of the directories above the CA file is not checked (outside #86).
Review: CLEAR (Opus 5.5) on ef314ad after four rounds.
make checkon this head is pending. Stacked on the pilot PR (H51:b).🤖 Generated with Claude Code