Repository navigation
sealed NPU kernel sets: sign a manifest of their ciphertext (#574) - #615
Merged
Merged
Conversation
Sealing is confidentiality only. A set re-sealed under another key, or a different set that also decrypts, is indistinguishable from ours by the 1BPKCRYP check alone, and #548 was closed as not planned for replacing sealing instead of adding to it. Authenticity goes on top: every set now carries manifest.json - each file it ships, with the sha256 of its ciphertext, plus the set's own name - and manifest.sig, Ed25519 over the manifest's exact bytes by the release signing key. tools/seal_manifest.py the public half: keygen / write <set> --key / check (digests, no key) / verify (with the release public key) / --self-test. Python 3 stdlib only, its own RFC 8032 Ed25519, because os/mini/release-check.sh has to make the same judgement on a busybox stick with no crypto module and no openssl. tests/seal_manifest_test.sh + ctest seal_manifest throwaway key and set in a temp dir: pass on intact, fail on a missing manifest, an unlisted file, a flipped ciphertext byte, and a manifest signed by another key (plus a set moved onto another set's name). scripts/package-linux.sh a sealed set without manifest.json and manifest.sig is not packed at all; the staged copy is checked (verified when ONEBIT_SEAL_PUB names the release public key). scripts/weekly.sh package_checks allows the two new files per set and requires them, checking the tarball's own copy so a manifest that does not list exactly the packed files fails the package. os/mini/release-check.sh the sealed row now also requires every file under /data/npu/kernels to be listed in its set's manifest (seal_manifest_problems, driven by the script's own --self-test), and a new sealed-sig row verifies manifest.sig with the release public key, saying so when the image has no key instead of passing unchecked. scripts/lemond-onebit.sh keeps ONEBIT_KCRYPT_REQUIRE_SEALED=1 and names, without setting, ONEBIT_KCRYPT_REQUIRE_MANIFEST=1: the loader-side switch the private NPU runtime must read, which lands with its pin bump. docs/npu.md, docs/releases.md what a set ships and who checks it. The loader half, the release key and any real re-seal stay private; no switch is exported that nothing reads yet (#548).
bong-water-water-bong
enabled auto-merge (squash)
October 27, 2026 08:46
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #574.
A sealed NPU kernel set now ships a signed manifest of the ciphertext it contains, so tampering is detectable without unsealing anything. Follows #548, which was closed as not-planned because a sealing proposal would have replaced sealing; this signs what is already sealed.
Evidence
31 manifest entries verify; Ed25519 signatures cross-check against
openssl pkeyutl. Packaging, the weekly job and release-check all refuse a missing manifest, an extra file, a flipped ciphertext byte, and a foreign key.sealed-sigSKIPs with a stated reason when no key is configured, so unsigned trees still build. Log:/home/bcloud/1bit-monster/qa-574.log.Not in this PR
No key material, no kernel content, and no sealing internals are added to the public tree.