hanzo-dev
4cb56f6b8a
cloud/cek is deleted and github.com/hanzoai/cek v0.2.0 is the whole of
encryption at rest. A database's key is DERIVED from the deployment's master
and the namespace that owns it — HKDF(master, "hanzo/cek/v1/" + ns + "/" +
subsystem) — so it is not generated, not wrapped, not stored and not rotated
in place.
What that deletes, and why each one was a hazard rather than a feature:
- the per-file DEK and its .dek sidecar. Key material beside a file is
key material that can go missing, and it did: the sidecar had to be
framed into every durable snapshot so a successor could open what it
restored, and a successor that received the database without it had an
unreadable store.
- rewrap, and the self-heal retry in OrgDB that called it. A derivation
that must be migrated is a derivation that can be half-migrated; that is
what took the git plane and the mirror engine down in production, and
with them every deploy.
- cek.Global / cek.Org / cek.Principal. There was cloud's name for an
entity (namespace) and cek's name for the same entity (Principal), with
nsPrincipal translating between them. Now the namespace IS what the key
is derived from, so a file and its key cannot name different things.
- cek.Exists and its sidecar probe. A store is a file; asking the
filesystem is os.Stat, at the one call site that asks.
- replication.go, 84 lines of unwired design commentary. Replication is
hanzoai/replicate over hanzoai/vfs.
Callers pass a DIRECTORY and a SUBSYSTEM NAME, never a path — cek renders
the path from the namespace itself. Three hand-rolled org→slug encoders go
with that: finance's orgPattern, treasury's tenantSlug and team's seg were
each a second answer to "which file holds this tenant's data", and the
treasury one needed a reserved slug to keep a tenant out of the house fund.
The system namespace is a different KIND, so no tenant string can render to
it however it is spelled.
New, and small:
basedb.Open is the ONE opener: cek plus the directory the file lives in.
cek does not create it, and on the pure-Go codec the database is written
back at CLOSE — so a missing parent does not fail the open, it loses the
data at the end. Stated once, beside the open, instead of in ~50 stores.
internal/devmaster keys a test binary. cek reads no environment, so a
process with no KMS mints its own master; one blank import per test
package says so, replacing seventeen near-identical TestMains that set
CLOUD_KMS_MASTER_KEY_REF for a reader that no longer exists.
Two consequences worth naming. A store that is OPEN has no file yet on the
pure-Go codec, so OrgStore.Has is the union of the open set and the disk,
and Each and Stored both go through it. And apps/iam never closed its
*sql.DB at all (orm's AdaptSQLDB borrows the handle; its Close is a
documented no-op), which on that codec means the identity store was never
written back — it now has a Shutdown, wired like every other subsystem's.
Databases written under the old wrapping will not open under this
derivation. That is expected: there is no migration, no fallback and no
version probe, because a second derivation tried on failure is exactly what
made the old binding unenforceable.
Also fixes six test-only KMS fakes that never gained DeleteSecret and two
missing imports in apps/kms — pre-existing at origin/main, and the reason
eight packages could not be test-verified at all.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
8 lines
381 B
Go
8 lines
381 B
Go
package cloud
|
|
|
|
// The root package's store-backed tests (orgdb_test.go's per-org isolation and
|
|
// OrgStore.Each proofs, the audit middleware chain) open real databases, and cek
|
|
// opens nothing without a master. This test binary has no KMS, so it mints its
|
|
// own — the one line that says so, for every test in the package.
|
|
import _ "github.com/hanzoai/cloud/internal/devmaster"
|