mirror of
https://github.com/luxfi/mpc.git
synced 2026-09-24 00:26:24 +00:00
zeekay
3bb399cbdd
Adds the topology contract that lets a fund run mpcd as its own private
cluster — no Lux primary network registration, no shared M-Chain audit
ledger — using the same code path and the same operator surface.
Mode flag at cmd/mpcd/main.go:
--network=primary|private # registration target
--audit-store=mchain|local-worm|... # audit log destination
--registrar-url, --registrar-auth # primary-mode announcement
--audit-worm-path, --audit-mchain-url # backend selectors
pkg/audit:
- Append-only Merkle hash chain. Tampering with any historical event
invalidates every subsequent hash. Canonical bytes use fixed-order
concatenation (json.Marshal map ordering is non-deterministic).
- WORMDispatcher: NDJSON append, replay-on-start, fsync per Append.
- MChainDispatcher: batched POST of (batchHash, fromSeq, toSeq) to a
configurable anchor RPC.
- compositeDispatcher: fan-out to multiple legs with per-leg sealing.
- S3 Glacier Vault / Azure Immutable / GCS Object Lock dispatchers
fail closed — wired into the flag surface but gated behind the
cloud-audit build tag, no silent fallback.
pkg/identity/bootstrap.go: identity creation + (primary-mode only)
registrar announcement. Same on-disk format as the previous
loadOrGenerateIdentity (which is now removed); private mode is silent.
deployments/k8s-private: fund-only Kustomize overlay. Standalone
namespace, NetworkPolicy that blocks egress to anything outside the
fund's VPC, hardware-WORM PVC for the audit log, KMS-driven secret
template.
deployments/k8s-primary: env-var patch overlay on the existing lux-mpc
base. composite(local-worm,mchain) by default.
deployments/terraform/{aws,gcp,azure}: VPC + audit storage modules.
terraform validate passes; EKS/GKE/AKS + HSM modules are stubbed and
not yet plan-tested.
deployments/onprem/README.md: WORM storage + PKCS#11 HSM checklist.
Tests (14 total, all passing):
pkg/audit: 6/6 (chain, WORM replay, MChain batching, composite,
cloud stubs fail loud, double-seal rejected)
pkg/identity: 4/4 (private no-call, primary call, primary empty
URL no-op, primary registrar 503 surfaces)
internal/privatemode: 4/4 (no registrar traffic, restart, tamper-detect,
cloud stubs fail loud)
Companion runbook in lux/papers/lux-private-mpc-deployment/
(LaTeX, 5 pages, tectonic-clean).
115 lines
2.9 KiB
Go
115 lines
2.9 KiB
Go
package identity
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"path/filepath"
|
|
"sync/atomic"
|
|
"testing"
|
|
)
|
|
|
|
func TestBootstrap_PrivateMode_NoRegistrarCalled(t *testing.T) {
|
|
dir := t.TempDir()
|
|
var hits int32
|
|
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
|
|
atomic.AddInt32(&hits, 1)
|
|
w.WriteHeader(200)
|
|
}))
|
|
defer srv.Close()
|
|
|
|
id, err := Bootstrap(context.Background(), Config{
|
|
NodeID: "node0",
|
|
KeysDir: dir,
|
|
Mode: ModePrivate,
|
|
RegistrarURL: srv.URL, // present but must NOT be hit
|
|
})
|
|
if err != nil {
|
|
t.Fatalf("bootstrap: %v", err)
|
|
}
|
|
if got := atomic.LoadInt32(&hits); got != 0 {
|
|
t.Fatalf("registrar hits=%d want 0 in private mode", got)
|
|
}
|
|
if id.Mode != ModePrivate {
|
|
t.Fatalf("mode=%q want %q", id.Mode, ModePrivate)
|
|
}
|
|
if len(id.PublicKey) != 32 {
|
|
t.Fatalf("pubkey len=%d want 32", len(id.PublicKey))
|
|
}
|
|
}
|
|
|
|
func TestBootstrap_PrimaryMode_RegistrarHitOnce(t *testing.T) {
|
|
dir := t.TempDir()
|
|
var hits int32
|
|
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
|
|
atomic.AddInt32(&hits, 1)
|
|
w.WriteHeader(200)
|
|
}))
|
|
defer srv.Close()
|
|
|
|
cfg := Config{
|
|
NodeID: "node0",
|
|
KeysDir: dir,
|
|
Mode: ModePrimary,
|
|
RegistrarURL: srv.URL,
|
|
}
|
|
if _, err := Bootstrap(context.Background(), cfg); err != nil {
|
|
t.Fatalf("bootstrap: %v", err)
|
|
}
|
|
// Reinvoke — second call announces too (registrar is responsible for
|
|
// idempotency). What the second call MUST NOT do is regenerate keys.
|
|
id2, err := Bootstrap(context.Background(), cfg)
|
|
if err != nil {
|
|
t.Fatalf("bootstrap 2: %v", err)
|
|
}
|
|
if got := atomic.LoadInt32(&hits); got != 2 {
|
|
t.Fatalf("registrar hits=%d want 2", got)
|
|
}
|
|
if id2.Mode != ModePrimary {
|
|
t.Fatalf("mode=%q want %q", id2.Mode, ModePrimary)
|
|
}
|
|
|
|
id3, err := loadIdentity(filepath.Join(dir, "node0_identity.json"))
|
|
if err != nil || id3 == nil {
|
|
t.Fatalf("load: %v", err)
|
|
}
|
|
for i := range id2.PublicKey {
|
|
if id2.PublicKey[i] != id3.PublicKey[i] {
|
|
t.Fatalf("pubkey changed across reload")
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestBootstrap_PrimaryMode_NoRegistrarURLIsNoop(t *testing.T) {
|
|
dir := t.TempDir()
|
|
id, err := Bootstrap(context.Background(), Config{
|
|
NodeID: "node0",
|
|
KeysDir: dir,
|
|
Mode: ModePrimary,
|
|
})
|
|
if err != nil {
|
|
t.Fatalf("bootstrap with empty URL must succeed (air-gapped staging): %v", err)
|
|
}
|
|
if id.Mode != ModePrimary {
|
|
t.Fatalf("mode=%q want %q", id.Mode, ModePrimary)
|
|
}
|
|
}
|
|
|
|
func TestBootstrap_PrimaryMode_RegistrarFailureSurfaces(t *testing.T) {
|
|
dir := t.TempDir()
|
|
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
|
|
w.WriteHeader(503)
|
|
}))
|
|
defer srv.Close()
|
|
|
|
_, err := Bootstrap(context.Background(), Config{
|
|
NodeID: "node0",
|
|
KeysDir: dir,
|
|
Mode: ModePrimary,
|
|
RegistrarURL: srv.URL,
|
|
})
|
|
if err == nil {
|
|
t.Fatal("expected error from 503 registrar")
|
|
}
|
|
}
|