ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Validate persisted network readiness fingerprints

Browse source
This commit is contained in:
ms2k 2026-07-15 17:12:07 +09:00
commit 27bc3d835e
3 changed files with 21 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
crates/lazaret-core/src/records/network.rs
View file

@ -353,6 +353,8 @@ impl NetworkReadinessEvidence {
) -> bool {
self.generation_id == generation_id
&& self.readiness_fingerprint == readiness_fingerprint
&& crate::network::readiness_fingerprint(&self.readiness_identity)
.is_ok_and(|canonical| canonical == readiness_fingerprint)
&& self.domain_id == self.attestation.domain_id
&& self.domain_id == self.readiness_identity.domain_id
&& self.domain_id == self.reachability_probe.domain_id

11
crates/lazaret-core/tests/schema_records.rs
View file

@ -14,6 +14,7 @@ use lazaret_core::identity::{
ReadinessFingerprint, RequestDigest, RequestId, SandboxId, SelectedManifestDigest,
SessionAnchorId, SessionId, SourceIdentity, StreamDigest, TrustManifestDigest,
};
use lazaret_core::network::readiness_fingerprint as derive_readiness_fingerprint;
use lazaret_core::records::*;
use serde::de::DeserializeOwned;
use serde::{Deserialize, Serialize};
@ -345,13 +346,14 @@ fn reachability_probe() -> NetworkReachabilityProbe {
}
fn readiness_evidence() -> NetworkReadinessEvidence {
let readiness_identity = readiness_identity();
NetworkReadinessEvidence {
domain_id: domain_id(),
generation_id: generation_id(),
network_sidecar_id: sidecar_id(),
readiness_fingerprint: ReadinessFingerprint::new(opaque(23)),
readiness_fingerprint: derive_readiness_fingerprint(&readiness_identity).unwrap(),
attestation: readiness_attestation(),
readiness_identity: readiness_identity(),
readiness_identity,
reachability_probe: reachability_probe(),
}
}
@ -368,10 +370,11 @@ fn prepared_ownership() -> PreparedLowerOwnership {
}
fn network_ownership() -> NetworkOwnership {
let readiness_evidence = readiness_evidence();
NetworkOwnership {
derived_policy_digest: Some(DerivedPolicyDigest::new(opaque(20))),
readiness_fingerprint: Some(ReadinessFingerprint::new(opaque(23))),
readiness_evidence: Some(readiness_evidence()),
readiness_fingerprint: Some(readiness_evidence.readiness_fingerprint),
readiness_evidence: Some(readiness_evidence),
namespace: Some(namespace()),
runtime_supervisor: owned_process(21),
}

12
crates/lazaret-core/tests/schema_records/process_evidence.rs
View file

@ -333,6 +333,18 @@ fn active_network_rejects_every_mismatched_readiness_relation() {
ownership.readiness_fingerprint = Some(other_fingerprint);
}),
),
(
"consistently repeated noncanonical readiness fingerprint",
generation_id(),
mutate_network_ownership(|ownership| {
ownership.readiness_fingerprint = Some(other_fingerprint);
ownership
.readiness_evidence
.as_mut()
.unwrap()
.readiness_fingerprint = other_fingerprint;
}),
),
(
"attestation domain",
generation_id(),