|
1
|
+ |
defmodule OpenAgents.Forge.KeyRotationTest do
|
|
2
|
+ |
@moduledoc """
|
|
3
|
+ |
Rehearsal 4 of `docs/forge-exit-rehearsals.md`, which had no executable
|
|
4
|
+ |
proof at all until #180 performed it.
|
|
5
|
+ |
|
|
6
|
+ |
The rehearsal asks two things of every key-like secret this forge holds:
|
|
7
|
+ |
that rotating it leaves already-issued receipts verifiable, and that a
|
|
8
|
+ |
rotation performed in the wrong order is refused rather than silently
|
|
9
|
+ |
invalidating history.
|
|
10
|
+ |
|
|
11
|
+ |
The first holds everywhere. The second holds in one of the four families,
|
|
12
|
+ |
and the two places it does not are pinned here with the issues that carry
|
|
13
|
+ |
them, so a fix turns a test red instead of passing unnoticed. A rehearsal
|
|
14
|
+ |
that recorded only the half that works would be the kind of claim `EXIT-006`
|
|
15
|
+ |
exists to prevent.
|
|
16
|
+ |
|
|
17
|
+ |
| Family | Rotation loses nothing | Wrong order refused |
|
|
18
|
+ |
| --- | --- | --- |
|
|
19
|
+ |
| Forge operator token | yes — the principal is a literal, not a derivation | not applicable; there is no order |
|
|
20
|
+ |
| Account `oa_pat_` tokens | yes — digest-only, no key under them | not applicable |
|
|
21
|
+ |
| Reputation issuer key | forward, yes | **no** — #191 |
|
|
22
|
+ |
| GitHub token vault | yes — key id in the envelope, keyring for the old ones | yes |
|
|
23
|
+ |
| Machine pairing vault | **no** — #192 | no |
|
|
24
|
+ |
| Voice recording vault | **no** — no key id, no keyring | no |
|
|
25
|
+ |
|
|
26
|
+ |
Forge push receipts sit underneath all of it and depend on none of it:
|
|
27
|
+ |
`OpenAgents.Forge.WAL`'s chain is unkeyed `sha256` and
|
|
28
|
+ |
`OpenAgents.Forge.Verification` reads no secret, so no rotation in this
|
|
29
|
+ |
table can change a `verify/1` verdict. That is asserted rather than assumed,
|
|
30
|
+ |
because "rotation leaves every already-issued receipt verifiable" is only
|
|
31
|
+ |
worth publishing if something checks that receipts never acquired a key
|
|
32
|
+ |
dependency.
|
|
33
|
+ |
"""
|
|
34
|
+ |
|
|
35
|
+ |
use OpenAgents.DataCase, async: false
|
|
36
|
+ |
|
|
37
|
+ |
import OpenAgents.CompensationFixtures
|
|
38
|
+ |
import OpenAgents.IssuesFixtures
|
|
39
|
+ |
|
|
40
|
+ |
alias OpenAgents.Accounts.TokenVault, as: GitHubVault
|
|
41
|
+ |
alias OpenAgents.Forge.{Verification, WAL}
|
|
42
|
+ |
alias OpenAgents.Machines.TokenVault, as: MachineVault
|
|
43
|
+ |
alias OpenAgents.Reputation
|
|
44
|
+ |
alias OpenAgents.Reputation.Claim
|
|
45
|
+ |
alias OpenAgents.Voice.RecordingVault
|
|
46
|
+ |
|
|
47
|
+ |
describe "forge receipts depend on no key, so no rotation can invalidate one" do
|
|
48
|
+ |
test "the WAL chain link is unkeyed and reproducible from the entry alone" do
|
|
49
|
+ |
entry = %{
|
|
50
|
+ |
"seq" => 1,
|
|
51
|
+ |
"object" => "entries/00000001-abcdef012345",
|
|
52
|
+ |
"format" => "receive_pack",
|
|
53
|
+ |
"principal" => "operator:forge-token",
|
|
54
|
+ |
"pushed_at" => "2026-08-24T00:00:00.000000Z",
|
|
55
|
+ |
"refs" => %{"refs/heads/main" => String.duplicate("a", 40)}
|
|
56
|
+ |
}
|
|
57
|
+ |
|
|
58
|
+ |
assert {:ok, link} = WAL.chain_link("", entry)
|
|
59
|
+ |
assert {:ok, ^link} = WAL.chain_link("", entry)
|
|
60
|
+ |
assert link =~ ~r/\A[0-9a-f]{64}\z/
|
|
61
|
+ |
|
|
62
|
+ |
# It commits to the entry's contents, so it is a hash of the record and
|
|
63
|
+ |
# not a token issued beside it.
|
|
64
|
+ |
assert {:ok, other} = WAL.chain_link("", %{entry | "principal" => "user:someone"})
|
|
65
|
+ |
refute other == link
|
|
66
|
+ |
|
|
67
|
+ |
# Every key-like secret in the application changes underneath it and the
|
|
68
|
+ |
# link is unmoved, because none of them is an input.
|
|
69
|
+ |
rotate_every_secret(fn ->
|
|
70
|
+ |
assert {:ok, ^link} = WAL.chain_link("", entry)
|
|
71
|
+ |
end)
|
|
72
|
+ |
end
|
|
73
|
+ |
|
|
74
|
+ |
test "the verifier was compiled against no secret and no vault" do
|
|
75
|
+ |
callees = external_calls(Verification)
|
|
76
|
+ |
|
|
77
|
+ |
for module <- [GitHubVault, MachineVault, RecordingVault, Reputation, OpenAgents.ApiTokens] do
|
|
78
|
+ |
refute module in callees,
|
|
79
|
+ |
"#{inspect(module)} reached OpenAgents.Forge.Verification. A receipt that " <>
|
|
80
|
+ |
"depends on a key stops being verifiable the moment that key rotates, " <>
|
|
81
|
+ |
"which is what rehearsal 4 exists to rule out."
|
|
82
|
+ |
end
|
|
83
|
+ |
end
|
|
84
|
+ |
end
|
|
85
|
+ |
|
|
86
|
+ |
describe "the reputation issuer key" do
|
|
87
|
+ |
setup do
|
|
88
|
+ |
repository = repository_fixture()
|
|
89
|
+ |
issue = issue_fixture(repository)
|
|
90
|
+ |
assert {:ok, policy} = Reputation.admit_policy(operator())
|
|
91
|
+ |
keypair = Claim.generate_keypair()
|
|
92
|
+ |
|
|
93
|
+ |
assert {:ok, key} =
|
|
94
|
+ |
Reputation.admit_key(%{public_key: keypair.public_key, issuer: "verifier"})
|
|
95
|
+ |
|
|
96
|
+ |
%{
|
|
97
|
+ |
repository: repository,
|
|
98
|
+ |
issue: issue,
|
|
99
|
+ |
policy: policy,
|
|
100
|
+ |
key: key,
|
|
101
|
+ |
signer: %{key_id: key.key_id, private_key: keypair.private_key}
|
|
102
|
+ |
}
|
|
103
|
+ |
end
|
|
104
|
+ |
|
|
105
|
+ |
test "retiring forward keeps an attestation verified, and the successor issues", context do
|
|
106
|
+ |
assert {:ok, attestation} = issue(context)
|
|
107
|
+ |
assert {:ok, _retired} = Reputation.retire_key(context.key, DateTime.utc_now())
|
|
108
|
+ |
|
|
109
|
+ |
report = Reputation.verify(attestation)
|
|
110
|
+ |
assert report["signature"]["valid"]
|
|
111
|
+ |
assert report["signature"]["key_status"] == "retired"
|
|
112
|
+ |
assert report["verified"]
|
|
113
|
+ |
|
|
114
|
+ |
assert {:error, :signing_key_retired} = issue(context)
|
|
115
|
+ |
end
|
|
116
|
+ |
|
|
117
|
+ |
test "retiring backward silently unverifies what the key already signed (#191)", context do
|
|
118
|
+ |
assert {:ok, attestation} = issue(context)
|
|
119
|
+ |
assert Reputation.verify(attestation)["verified"]
|
|
120
|
+ |
|
|
121
|
+ |
backdated = DateTime.add(attestation.attested_at, -1, :second)
|
|
122
|
+ |
assert {:ok, _retired} = Reputation.retire_key(context.key, backdated)
|
|
123
|
+ |
|
|
124
|
+ |
report = Reputation.verify(attestation)
|
|
125
|
+ |
|
|
126
|
+ |
# The signature is still valid over an unaltered claim. Only the window
|
|
127
|
+ |
# moved, and it moved because one UPDATE against a row the operator
|
|
128
|
+ |
# controls said so. Nothing refused it and nothing recorded it.
|
|
129
|
+ |
assert report["digest_match"]
|
|
130
|
+ |
assert report["signature"]["valid"]
|
|
131
|
+ |
refute report["signature"]["key_active_at_attestation"]
|
|
132
|
+ |
refute report["verified"]
|
|
133
|
+ |
end
|
|
134
|
+ |
|
|
135
|
+ |
test "the forward edge is the one that is guarded", context do
|
|
136
|
+ |
# Issuance under a key that is not active is refused, so the asymmetry
|
|
137
|
+ |
# in #191 is specifically the retirement edge rather than a missing
|
|
138
|
+ |
# window check.
|
|
139
|
+ |
future = DateTime.add(DateTime.utc_now(), 3600, :second)
|
|
140
|
+ |
keypair = Claim.generate_keypair()
|
|
141
|
+ |
|
|
142
|
+ |
assert {:ok, key} =
|
|
143
|
+ |
Reputation.admit_key(%{
|
|
144
|
+ |
public_key: keypair.public_key,
|
|
145
|
+ |
issuer: "verifier",
|
|
146
|
+ |
activated_at: future
|
|
147
|
+ |
})
|
|
148
|
+ |
|
|
149
|
+ |
assert {:error, :signing_key_retired} =
|
|
150
|
+ |
issue(%{context | signer: %{key_id: key.key_id, private_key: keypair.private_key}})
|
|
151
|
+ |
end
|
|
152
|
+ |
end
|
|
153
|
+ |
|
|
154
|
+ |
describe "the three hand-rolled vaults" do
|
|
155
|
+ |
test "the GitHub vault opens envelopes sealed under a retired key" do
|
|
156
|
+ |
first = Base.encode64(:crypto.strong_rand_bytes(32))
|
|
157
|
+ |
second = Base.encode64(:crypto.strong_rand_bytes(32))
|
|
158
|
+ |
|
|
159
|
+ |
sealed =
|
|
160
|
+ |
with_env(
|
|
161
|
+ |
[github_token_encryption_key: first, github_token_encryption_key_id: "first"],
|
|
162
|
+ |
fn ->
|
|
163
|
+ |
assert {:ok, sealed, "first"} = GitHubVault.seal_with_metadata("gho_original")
|
|
164
|
+ |
sealed
|
|
165
|
+ |
end
|
|
166
|
+ |
)
|
|
167
|
+ |
|
|
168
|
+ |
# The documented order: the retiring key enters the keyring before the
|
|
169
|
+ |
# successor becomes active.
|
|
170
|
+ |
with_env(
|
|
171
|
+ |
[
|
|
172
|
+ |
github_token_encryption_key: second,
|
|
173
|
+ |
github_token_encryption_key_id: "second",
|
|
174
|
+ |
github_token_decryption_keys: %{"first" => first}
|
|
175
|
+ |
],
|
|
176
|
+ |
fn ->
|
|
177
|
+ |
assert {:ok, "gho_original"} = GitHubVault.open(sealed)
|
|
178
|
+ |
assert {:ok, "first"} = GitHubVault.key_id(sealed)
|
|
179
|
+ |
end
|
|
180
|
+ |
)
|
|
181
|
+ |
end
|
|
182
|
+ |
|
|
183
|
+ |
test "the GitHub vault refuses to open an envelope whose key left the keyring" do
|
|
184
|
+ |
first = Base.encode64(:crypto.strong_rand_bytes(32))
|
|
185
|
+ |
second = Base.encode64(:crypto.strong_rand_bytes(32))
|
|
186
|
+ |
|
|
187
|
+ |
sealed =
|
|
188
|
+ |
with_env(
|
|
189
|
+ |
[github_token_encryption_key: first, github_token_encryption_key_id: "first"],
|
|
190
|
+ |
fn ->
|
|
191
|
+ |
assert {:ok, sealed, "first"} = GitHubVault.seal_with_metadata("gho_original")
|
|
192
|
+ |
sealed
|
|
193
|
+ |
end
|
|
194
|
+ |
)
|
|
195
|
+ |
|
|
196
|
+ |
# The wrong order: the successor is activated and the predecessor was
|
|
197
|
+ |
# never added to the keyring. This is the one family where the wrong
|
|
198
|
+ |
# order fails closed rather than losing data quietly, and the rewrap
|
|
199
|
+ |
# that would follow rolls back rather than writing an unopenable row.
|
|
200
|
+ |
with_env(
|
|
201
|
+ |
[
|
|
202
|
+ |
github_token_encryption_key: second,
|
|
203
|
+ |
github_token_encryption_key_id: "second",
|
|
204
|
+ |
github_token_decryption_keys: %{}
|
|
205
|
+ |
],
|
|
206
|
+ |
fn ->
|
|
207
|
+ |
assert {:error, reason} = GitHubVault.open(sealed)
|
|
208
|
+ |
assert reason in [:token_unsealable, :token_vault_not_configured]
|
|
209
|
+ |
end
|
|
210
|
+ |
)
|
|
211
|
+ |
end
|
|
212
|
+ |
|
|
213
|
+ |
test "the machine pairing vault reads the GitHub vault's active key (#192)" do
|
|
214
|
+ |
first = Base.encode64(:crypto.strong_rand_bytes(32))
|
|
215
|
+ |
second = Base.encode64(:crypto.strong_rand_bytes(32))
|
|
216
|
+ |
|
|
217
|
+ |
sealed =
|
|
218
|
+ |
with_env([github_token_encryption_key: first], fn ->
|
|
219
|
+ |
assert {:ok, sealed} = MachineVault.seal("smct_pairing")
|
|
220
|
+ |
assert {:ok, "smct_pairing"} = MachineVault.open(sealed)
|
|
221
|
+ |
sealed
|
|
222
|
+ |
end)
|
|
223
|
+ |
|
|
224
|
+ |
# Rotating the GitHub key — the documented procedure, performed in the
|
|
225
|
+ |
# documented order — orphans this envelope, because the machine vault
|
|
226
|
+ |
# carries no key id and consults no keyring. The blast radius is the ten
|
|
227
|
+ |
# minutes of unclaimed pairings the lifetime allows, which is why this
|
|
228
|
+ |
# is filed rather than treated as an incident.
|
|
229
|
+ |
with_env(
|
|
230
|
+ |
[
|
|
231
|
+ |
github_token_encryption_key: second,
|
|
232
|
+ |
github_token_encryption_key_id: "second",
|
|
233
|
+ |
github_token_decryption_keys: %{"first" => first}
|
|
234
|
+ |
],
|
|
235
|
+ |
fn ->
|
|
236
|
+ |
assert {:error, :token_unsealable} = MachineVault.open(sealed)
|
|
237
|
+ |
end
|
|
238
|
+ |
)
|
|
239
|
+ |
end
|
|
240
|
+ |
|
|
241
|
+ |
test "the voice recording vault has no keyring either, so its key cannot rotate" do
|
|
242
|
+ |
first = Base.encode64(:crypto.strong_rand_bytes(32))
|
|
243
|
+ |
second = Base.encode64(:crypto.strong_rand_bytes(32))
|
|
244
|
+ |
recording = Ecto.UUID.generate()
|
|
245
|
+ |
|
|
246
|
+ |
sealed =
|
|
247
|
+ |
with_env([voice_recording_encryption_key: first], fn ->
|
|
248
|
+ |
assert {:ok, sealed} = RecordingVault.seal("audio", recording, 1)
|
|
249
|
+ |
sealed
|
|
250
|
+ |
end)
|
|
251
|
+ |
|
|
252
|
+ |
with_env([voice_recording_encryption_key: second], fn ->
|
|
253
|
+ |
assert {:error, :chunk_unsealable} = RecordingVault.open(sealed, recording, 1)
|
|
254
|
+ |
end)
|
|
255
|
+ |
end
|
|
256
|
+ |
end
|
|
257
|
+ |
|
|
258
|
+ |
describe "the forge operator token" do
|
|
259
|
+ |
test "rotating it changes no principal a past push already recorded" do
|
|
260
|
+ |
# `operator:forge-token` is a literal `OpenAgents.Forge.GitHTTP` writes
|
|
261
|
+ |
# at push time, not a derivation from the secret, so a rotation cannot
|
|
262
|
+ |
# make a past push attributable to a person and cannot make it
|
|
263
|
+ |
# unattributable either. There is no ordering to get wrong, and no
|
|
264
|
+ |
# overlap window: the cutover is hard, and a pusher holding the old
|
|
265
|
+ |
# value is refused rather than accepted under a stale principal.
|
|
266
|
+ |
previous = Application.get_env(:openagents, :forge_operator_token)
|
|
267
|
+ |
on_exit(fn -> restore(:forge_operator_token, previous) end)
|
|
268
|
+ |
|
|
269
|
+ |
entry = %{
|
|
270
|
+ |
"seq" => 7,
|
|
271
|
+ |
"object" => "entries/00000007-0123456789ab",
|
|
272
|
+ |
"format" => "receive_pack",
|
|
273
|
+ |
"principal" => "operator:forge-token",
|
|
274
|
+ |
"pushed_at" => "2026-08-24T00:00:00.000000Z",
|
|
275
|
+ |
"refs" => %{"refs/heads/main" => String.duplicate("b", 40)}
|
|
276
|
+ |
}
|
|
277
|
+ |
|
|
278
|
+ |
Application.put_env(:openagents, :forge_operator_token, "before-rotation")
|
|
279
|
+ |
assert {:ok, link} = WAL.chain_link("", entry)
|
|
280
|
+ |
|
|
281
|
+ |
Application.put_env(:openagents, :forge_operator_token, "after-rotation")
|
|
282
|
+ |
assert {:ok, ^link} = WAL.chain_link("", entry)
|
|
283
|
+ |
assert entry["principal"] == "operator:forge-token"
|
|
284
|
+ |
end
|
|
285
|
+ |
end
|
|
286
|
+ |
|
|
287
|
+ |
defp issue(context) do
|
|
288
|
+ |
decision = outcome_decision_fixture()
|
|
289
|
+ |
|
|
290
|
+ |
Reputation.issue(context.policy, context.signer, %{
|
|
291
|
+ |
event_type: "completion",
|
|
292
|
+ |
subject_id: "actor:builder",
|
|
293
|
+ |
outcome: %{kind: "compensation_outcome_decision", ref: decision.decision_receipt_ref},
|
|
294
|
+ |
repository: context.repository,
|
|
295
|
+ |
issue_number: context.issue.number,
|
|
296
|
+ |
revision: String.duplicate("a", 40),
|
|
297
|
+ |
artifact_digest: OpenAgents.Provenance.Canonical.digest!(%{"nonce" => Claim.nonce()}),
|
|
298
|
+ |
confidence_ppm: 900_000,
|
|
299
|
+ |
transparency_tier: "public",
|
|
300
|
+ |
evidence: [
|
|
301
|
+ |
%{
|
|
302
|
+ |
kind: "outcome",
|
|
303
|
+ |
ref: decision.decision_receipt_ref,
|
|
304
|
+ |
digest: decision.outcome_digest,
|
|
305
|
+ |
observed_at: DateTime.to_iso8601(DateTime.utc_now())
|
|
306
|
+ |
}
|
|
307
|
+ |
]
|
|
308
|
+ |
})
|
|
309
|
+ |
end
|
|
310
|
+ |
|
|
311
|
+ |
defp operator do
|
|
312
|
+ |
%{
|
|
313
|
+ |
authenticated: true,
|
|
314
|
+ |
actor_id: "operator:test",
|
|
315
|
+ |
auth_method: "test_session",
|
|
316
|
+ |
approval_receipt_ref: "rotation:#{System.unique_integer([:positive])}"
|
|
317
|
+ |
}
|
|
318
|
+ |
end
|
|
319
|
+ |
|
|
320
|
+ |
defp rotate_every_secret(assertion) do
|
|
321
|
+ |
keys = [
|
|
322
|
+ |
:forge_operator_token,
|
|
323
|
+ |
:github_token_encryption_key,
|
|
324
|
+ |
:github_token_encryption_key_id,
|
|
325
|
+ |
:voice_recording_encryption_key
|
|
326
|
+ |
]
|
|
327
|
+ |
|
|
328
|
+ |
previous = Enum.map(keys, &{&1, Application.get_env(:openagents, &1)})
|
|
329
|
+ |
on_exit(fn -> Enum.each(previous, fn {key, value} -> restore(key, value) end) end)
|
|
330
|
+ |
|
|
331
|
+ |
for key <- keys do
|
|
332
|
+ |
Application.put_env(:openagents, key, Base.encode64(:crypto.strong_rand_bytes(32)))
|
|
333
|
+ |
end
|
|
334
|
+ |
|
|
335
|
+ |
assertion.()
|
|
336
|
+ |
end
|
|
337
|
+ |
|
|
338
|
+ |
defp with_env(settings, function) do
|
|
339
|
+ |
previous =
|
|
340
|
+ |
Enum.map(settings, fn {key, _value} -> {key, Application.get_env(:openagents, key)} end)
|
|
341
|
+ |
|
|
342
|
+ |
Enum.each(settings, fn {key, value} -> Application.put_env(:openagents, key, value) end)
|
|
343
|
+ |
|
|
344
|
+ |
try do
|
|
345
|
+ |
function.()
|
|
346
|
+ |
after
|
|
347
|
+ |
Enum.each(previous, fn {key, value} -> restore(key, value) end)
|
|
348
|
+ |
end
|
|
349
|
+ |
end
|
|
350
|
+ |
|
|
351
|
+ |
defp restore(key, nil), do: Application.delete_env(:openagents, key)
|
|
352
|
+ |
defp restore(key, value), do: Application.put_env(:openagents, key, value)
|
|
353
|
+ |
|
|
354
|
+ |
defp external_calls(module) do
|
|
355
|
+ |
{:ok, {^module, [imports: imports]}} = :beam_lib.chunks(:code.which(module), [:imports])
|
|
356
|
+ |
Enum.map(imports, &elem(&1, 0))
|
|
357
|
+ |
end
|
|
358
|
+ |
end
|