AIOS Governed Continuation
36ffb00ae9
2.0 KiB
Trusted-builder signer provisioning
trusted_builder_signer_provisioning.py provisions the purpose-bound
AIOS_TRUSTED_RELEASE_BUILDER signer only from an exact
aios.trusted-builder-signer-provisioning.v2 payload and detached SSH signature
for aios-task-grant-signer in namespace aios-owner-approval-v1.
A fresh payload is bound to the final common Gitea, authority, and governed
main OID; the protected merge tree; the ordered two parents; and the selected
PR head as the merge's second parent. The provisioner rechecks those facts in
the authority repository and rejects ancestry or source drift. It does not
reuse PR69, PR70, or a release-candidate recipe binding.
The payload evidence is an exact allowlist: provisioner, candidate builder,
policy, service, socket, model-API config template, launcher, and the versioned
package manifest. Missing, extra, modified, or mode-incompatible evidence is
rejected. The package manifest is non-secret and declares daemon reload plus
socket activation, with no credential installation or signer invocation. It
requires the installed launcher target mode to be 0755; source checkout mode
is treated separately from installed package mode. A controlled deterministic
worktree may hold ordinary source evidence at 0600, 0640, 0644, or 0664; the
installed package still enforces its declared target modes.
The provisioner generates the Ed25519 key and builder HMAC only on the host.
Plaintext exists only in its private temporary directory and is encrypted with
systemd-creds --with-key=host; the service receives encrypted credentials via
LoadCredentialEncrypted. The public keyring and service-principal binding
contain no private key.
Receipts append at
/var/lib/aios-gitops/trusted-builder/provisioning-receipts.jsonl. An exact
replay returns IDEMPOTENT_REPLAY_PASS; mismatched or unreceipted state fails
closed. Provisioning is configuration only: activation, restart persistence,
public-key verification and negative-capability tests are separate gates before
TRUSTED_BUILDER_SIGNER_READINESS=PASS.