Skip to content

loop/foundation 2026 06 22 204211 - #344

Merged
bordumb merged 12 commits into
mainfrom
loop/foundation-2026-06-22_204211
Jun 22, 2026
Merged

loop/foundation 2026 06 22 204211#344
bordumb merged 12 commits into
mainfrom
loop/foundation-2026-06-22_204211

Conversation

@bordumb

@bordumb bordumb commented Jun 22, 2026

Copy link
Copy Markdown
Contributor
  • fix(key): gate plaintext private-key export behind interactive confirmation
  • fix(init): require explicit confirmation before --force replaces a root identity
  • fix(ci): generate a random per-identity CI passphrase, remove the hardcoded constant
  • fix(init): honor --repo so init does not silently reuse the default identity
  • style: rustfmt the account-setup fixes (import ordering)
  • test(auths-keri): broaden the keripy KEL-verdict differential to all tamper variants
  • test(auths-keri): pin the CESR length table to cesride's encoding
  • ci: run the keripy KEL-verdict differential in the conformance job
  • style: rustfmt the CESR length-table test
  • deps: bump quinn-proto 0.11.14 -> 0.11.15 (RUSTSEC-2026-0185)
  • test(auths-keri): fail the keripy differential in CI when keripy is unreachable

bordumb and others added 12 commits June 22, 2026 19:42
@bordumb
fix(key): gate plaintext private-key export behind interactive confir…
1229d70 
…mation

key export --format pem dumped the unencrypted signing key to stdout with only
AUTHS_PASSPHRASE, so any process holding the env var could exfiltrate it silently. Add a
pure authorize_key_export policy (plaintext-private export requires interactive + confirmed),
unit-tested RED->GREEN, and enforce it at the CLI: pem export now prompts a confirmation and
is refused non-interactively. Public/encrypted exports unaffected. (account-setup A2)

Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Device: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Anchor-Seq: 1
@bordumb
fix(init): require explicit confirmation before --force replaces a ro…
c4c3cca 
…ot identity

init --force returned ForceNew with no confirmation and without even checking for an existing
identity, so a wrapper or CI re-running it silently minted a new root and repointed signing. Add a
pure authorize_identity_replacement policy (unit-tested RED->GREEN) and gate the CLI: over an
existing identity, --force now prompts interactively, or requires --confirm-replace when there is
no TTY; a fresh setup is unaffected. (account-setup A1)

Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Device: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Anchor-Seq: 1
@bordumb
fix(ci): generate a random per-identity CI passphrase, remove the har…
b36246c 
…dcoded constant

The CI profile encrypted its file-backed key with DEFAULT_CI_PASSPHRASE = "Ci-ephemeral-pass1!",
a constant public in the source tree, so anyone could decrypt any CI identity's exported key offline.
Replace it with generate_ci_passphrase() (ring SystemRandom, 192-bit, unique per identity, unit-tested
RED->GREEN). The value is already echoed into the env block, so the follow-up auths sign still works.
(account-setup A3)

Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Device: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Anchor-Seq: 1
@bordumb
fix(init): honor --repo so init does not silently reuse the default i…
56ad1f2 
…dentity

init --repo <dir> ignored the override: get_auths_repo_path() always returned the default ~/.auths,
so the existing-identity check ran against HOME and reused the HOME root instead of creating an
isolated identity under <dir>. Add a pure resolve_registry_path(override) helper (unit-tested
RED->GREEN) and thread it through the developer init (gather + registration), matching the CI path
which already honored --repo. (account-setup A4)

Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Device: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Anchor-Seq: 1
@bordumb
style: rustfmt the account-setup fixes (import ordering)
62ad09d 
Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Device: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Anchor-Seq: 1
@bordumb @claude
Merge branch 'loop/account-setup-fixes' — account-setup security hard…
6bb860f 
…ening (A1–A4)

Closes the four account-setup findings: gate plaintext key export (A2), require confirmation
before --force replaces a root (A1), randomize the CI passphrase (A3), honor --repo so init does
not silently reuse the default identity (A4). Each fix is unit-tested TDD RED->GREEN, the full
auths-sdk suite passes (355/355), and all five scenarios were re-run against the rebuilt binary.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Device: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Anchor-Seq: 1
@bordumb
test(auths-keri): broaden the keripy KEL-verdict differential to all …
4986651 
…tamper variants

The live cross-check against keripy 1.3.4 exercised only two inputs (a
valid accept and one forged signature). Broaden it to every universal
KERI rejection — forged signature, unmet signing threshold, a
non-self-addressing inception, and an altered rotation prior pointer —
each a byte-level tamper of the committed fixture so keripy stays the
independent oracle, asserting keripy refuses each exactly as auths does.

Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Device: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Anchor-Seq: 1
@bordumb
test(auths-keri): pin the CESR length table to cesride's encoding
aa19706 
The matter_full_len length-guard table mirrors cesride's matter sizage for
the codes auths parses. Add a test that encodes a primitive under each code
and asserts the table's length matches what cesride emits, so a cesride
version bump that shifts a primitive's size fails loudly instead of drifting
the guard against the decoder.

Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Device: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Anchor-Seq: 1
@bordumb
ci: run the keripy KEL-verdict differential in the conformance job
6cf2937 
The signed-KEL differential against keripy is gated on KERIPY_INTEROP, which
was set in no job, so the reject cases ran as a self-oracle. Run the Rust
differential in the conformance job under uv (which puts keri 1.3.4 on PATH
for the test's python subprocess) with the live cross-check enabled.

Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Device: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Anchor-Seq: 1
@bordumb
style: rustfmt the CESR length-table test
8031393 
Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Device: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Anchor-Seq: 1
@bordumb
deps: bump quinn-proto 0.11.14 -> 0.11.15 (RUSTSEC-2026-0185)
8e19d16 
quinn-proto 0.11.14 is vulnerable to remote memory exhaustion via unbounded
out-of-order stream reassembly. 0.11.15 fixes it. Lockfile-only patch bump;
quinn-proto reaches the tree through auths-keri's QUIC transport.

Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Device: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Anchor-Seq: 1
@bordumb
test(auths-keri): fail the keripy differential in CI when keripy is u…
a5f4078 
…nreachable

The cross-check skipped silently when keripy was not importable, so a venv
or PATH break would quietly revert the reject cases to a self-oracle while
the job stayed green. Add a KERIPY_REQUIRED flag (set by the conformance
job) that turns the skips into hard failures, so the differential either
runs against keripy or fails the build.

Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Device: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Anchor-Seq: 1
@vercel

vercel Bot commented Jun 22, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
auths Ready Ready Preview, Comment Jun 22, 2026 8:35pm

@bordumb
bordumb merged commit e3e34e8 into main Jun 22, 2026
19 of 23 checks passed
@github-actions

github-actions Bot commented Jun 22, 2026

Copy link
Copy Markdown

Auths Commit Verification

Commit Status Details
a5f4078d ❌ Failed No signature found
8e19d166 ❌ Failed No signature found
80313936 ❌ Failed No signature found
6cf29377 ❌ Failed No signature found
aa197068 ❌ Failed No signature found
49866518 ❌ Failed No signature found
62ad09dc ❌ Failed No signature found
56ad1f21 ❌ Failed No signature found
b36246cd ❌ Failed No signature found
c4c3ccaf ❌ Failed No signature found
1229d70d ❌ Failed No signature found
6bb860fb Skipped merge commit

Result: ❌ 0/12 commits verified (1 skipped)

How to fix

Commit a5f4078d has no Auths signature (no Auths-Id/Auths-Device trailer).

1. Install auths

macOS: brew install auths
Linux: Download from releases

2. One-time setup (creates your identity and configures Git)

auths init

3. Sign this branch and push

auths sign origin/main..HEAD
git push --force-with-lease

For CI to verify the signer, commit an identity bundle:

auths id export-bundle --alias main --output .auths/ci-bundle.json --max-age-secs 31536000

Quickstart →

This branch was successfully deployed

1 active deployment
Preview — a5f4078d Deployed Jun 22, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@bordumb