v0.19 ensembles #1459
No reviewers
Labels
No labels
UX
active development
backlog
blocker
bootstrap
bounty
bug
dependencies
discussion
documentation
duplicate
enhancement
flaky test
help wanted
invalid
javascript
question
release
tendentious
wontfix
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
mighty-gerbils/gerbil!1459
Loading…
Reference in a new issue
No description provided.
Delete branch "v0.19-ensemble"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
@ -0,0 +4,4 @@(import ./ucan)(export #t)(defstruct ActorShould that be ActorID ?
Or else, what do you call an actual actor?
renamed to Handle
@ -0,0 +16,4 @@(auth : :list) ; UCAN authorization tokens for the message(method : :string) ; the method invoked by the message(body : :u8vector) ; the message body(epxire : :integer) ; expiration of the message in UNIX secondsexpire ?
@ -0,0 +28,4 @@(group : :string) ; destination group(method : :string) ; the method invoked by the message(body : :u8vector) ; the message body(epxire : :integer) ; expiration of the message in UNIX secondsexpire ?
Maybe common class BaseMessage between Message and BroadcastMessage ?
done
@ -0,0 +11,4 @@;; context for security operations(interface (SecurityContext Closer);; the actor to which this security context pertains(actor)owner?
renamed to handle
@ -0,0 +62,4 @@;; actor message handling(interface (ActorHandler Closer);; reveive a messagereceive
fixed
@ -0,0 +37,4 @@(expire token.expire :- :integer))=> VerificationResult(if (fx= next.type DELEGATE)(if (or (equal? next.audience issuer)Can you refactor so the error results are right next to the error case?
invert the tests? ok.
done
@ -0,0 +47,4 @@=> :void(TODO save-capability-context!))(def public-key-cache-ttl 120)Is that an absolute constant? Based on what standard/document? If not, I don't like arbitrary numbers sprinkled around the code without even a distinctive syntactical marker (like the
defconstantof Common Lisp, the*earmuffs*of special variables (more akin to Scheme parameters), the+pluses+around constants).meant it to be 1200.
i dont think we need to earmuff this, it is fine as it is. I hate the pluses.
@ -0,0 +37,4 @@((fx= code DID-KEY-ED25519)(bytes->ed25519-public-key bytes))(else(raise-contract-violation did->public-key "unknwon key type" code))))unknown
You need M-x ispell or something
@ -0,0 +13,4 @@(path :- :string) ; path where the context is stored(key :- :u8vector) ; encryption key for private key material;; data tables(private-keys :- HashTable) ; did string -> PrivKeycomments needed. What keys are those? Those you control, I presume.
What roots? of what? Capability domains you control? You know about?
What are the input and output anchors? A brief description, please.
ok. I think i will do an implementation backed by an sqlite db, this is transient.
added comments for now
@ -0,0 +20,4 @@(root-output-anchors :- HashTable) ; token set(subject-input-anchors :- HashTable) ; did string -> token set(subject-output-anchors :- HashTable) ; did string -> token set(tokens :- HashTable) ; token setexplain that the values are the expiries.
e8d93c072atof94ee596742f3a8d0bedtoedcf514acc8fa7d79c5cto5f8842141fcc03cbe28bto4c1bc51836Remarks after consulting with the clanker:
- [ ] 1. Problem with deterministic IV from something different than what's stored on disk is that if the on-disk representation ever changes for any reason, you have to make sure you also change the IV at the same time.
- [ ] 1. We could as well implement a general purpose way to store arbitrary rows encrypted with random IV that is stored, and some kind of HMAC for AEAD while we're at it. General-purpose, reusable.
- [ ] 6. The clanker says something I don't understand about token-anchored-at?: it never returns !AnchorVerificationError's intended breadth — context.ss / cap.ss. In capability-context's verify, when a subject is supplied you check token-rooted-at? token subject, then roots, then db-get-subject-input-anchors self subject. But db-get-subject-input-anchors with a #f subject (the subject :? := #f default path) will hash-key on #f — and verify's for (anchor ...) loop is only reached when subject is truthy anyway, so a token presented with no subject that's anchored only via a root input anchor is never checked against root input anchors at all. The root-input-anchor set is loaded and cleaned up but I don't see the verify path consulting it. Either that's dead state or a missing check.
- [ ] 8. Add tests for that optimize-call change—and for all bugs you fix.
- [ ] 9. In definline, issue a meaningful syntax error in the cases that don't match well,
instead of falling through with an unhelpful error message.
- [ ] 10. Is on-close-stream guaranteed fired once and only once per stream?
- [ ] 10. timeout helper threads (stream-input-timeout etc.) are spawned via spawn/net too and use let/cc break for the closed path; confirm a thrown (non-caught-by-break) exception in a timeout thread can't wedge a stream in a state where the control thread waits forever on a completion that never posts.
11 - timeout threads: what is the clanker hallucinating? the control thread does not concern itself with timeouts, only the reader/writer touch it and it the state it concerns itself with is just not possible. clanker fail.
10 - yes. on-close-stream is only invoked by the control thread of the connection, and it is guaranteed to be invoked once.
for general purpose key storage, we need a few things, including a table that schema as part of the primitive. backlog material, we are fine for now.
6 seems like complete fabrication to me, i don't see anything wrong there.
i think it fails to understand what let/cc does.
ok, i think the complaint is about using get-subject-input-anchors when subject #f. that makes sense now, i added a check for subject truthiness before checking the anchors.
ok, there was an issue there, just what the clanker said was mostly nonsensical. it did detect that there is an issue however, so net positive.
Some clanker reviews
@ -0,0 +38,4 @@(using (e (new-instance !Error::t) :- !Error)(set! e.message msg)(set! e.irritants irritants)(set! e.trace "?")))Should you return e, asks Sol?
yes.
fixed.
@ -0,0 +85,4 @@(VerificationError-reason result))));; check expiration(when (> token.chain.expire 0)(unless (<= token.expire token.chain.expire)My clanker pal Sol says the convention is that expire is inclusive to when tokens expire, so you should be using (< token.expire ...) here.
no, this is correct, the token can have the same expiration as the chain it doesn't have to be strictly less.