Repository navigation
Invalidate pending signatures by per-key policy generation - #205
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Key revocation now advances a per-fingerprint policy generation shared by both socket listeners. Pending requests capture it and revalidate before returning a signature, so changing key type/capabilities away and back cannot revive an old request. Rename revocation also works after the old public-index entry disappears. Untrusted control requests cannot advance generations; daemon restarts discard prior generations with all pending requests.
Validation: all 938 tests passed before the final two focused additions; all 13 generation tests then passed, including actual authenticated policy ABA changes during prompts, fresh retry, both listeners, concurrent invalidation, restart, renamed keys, and cross-key token rejection. 302 changed lines. Targets ui/refactor; installed app unchanged.