fix: remove the vault passphrase — store device keys as 0600 files - #269
Open
LiranCohen wants to merge 3 commits into
Open
fix: remove the vault passphrase — store device keys as 0600 files#269LiranCohen wants to merge 3 commits into
LiranCohen wants to merge 3 commits into
Conversation
Device and session key material is now written as plain JSON
(identity.json, delegate.identity.json, session.json), 0600 inside 0700
profile dirs. The trust boundary is the local OS account; the
authoritative identity is the network owner, who can revoke and
re-approve any device from the admin dashboard. No migration shims:
meshd is pre-release.
- delete internal/vault, internal/vaultkey (+ go-keyring dependency),
internal/did/vault.go, all 'meshd vault *' subcommands, MESHD_VAULT_*
env handling, the runtime password cache files, the sudo one-shot
password handoff, and the in-process password globals
- state.StoreWalletSession/LoadWalletSession lose their password params
- root-written key/session files are chowned back to the profile owner
via the same AlignOwnerToDir pattern SaveNetworkState uses
- leftover *.vault.json files fail loudly with 'encrypted vaults were
removed; delete <path> and re-join the network' instead of minting a
fresh identity next to an orphaned network.json
- doctor replaces the vault checks with a key-file permission hygiene
check (warns on group/world-readable files, suggests chmod 600)
- status/peer list/doctor now run with zero unlock; profile authType
strings ('local-vault') are unchanged
Refs #265
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The install.sh /dev/tty reattach rationale is now sudo-only; README loses the 'meshd vault *' command docs, keychain opt-in section, and the encrypted-vault storage description; the smoke test no longer expects a vault password prompt on first identity creation. Refs #265 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Review follow-ups for the vault removal: - add TestKeyFileHygieneChecks covering the doctor's key-file permission rows: all-private and no-files cases collapse to the single OK row, group/world-readable identity/delegate/session files each produce a warn with the offending mode and chmod 600 advice - DESIGN.md identity table: describe key storage as the actual plaintext 0600 key files (identity.json / delegate.identity.json) instead of the removed local meshd vaults - drop dangling references to restoreSudoUserOwnership (removed earlier) from the ownership comments in internal/state Refs #265 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #265
What changed
The vault passphrase system is gone. Device identity and session keys are stored as plaintext JSON, mode 0600 in 0700 dirs —
identity.json,delegate.identity.json,session.json— for all profiles (peer and anchor). The daemon,status,peer list,doctor, and every other command run with zero interactive unlock, so unattended start / restart / self-heal finally works.Why this is the right trust model: anyone with local OS access can already start/stop the service, and tunnel changes still require root. The vault password routinely sat on the same disk anyway (env var, keyring, runtime cache, sudo handoff). The real authoritative identity is the network owner signing into the admin dashboard through their wallet — they can revoke or expire any peer at any time.
internal/vault/,internal/vaultkey/(+go-keyring/wincreddeps, re-vendored),internal/did/vault.go, allmeshd vault *subcommands,MESHD_VAULT_PASSWORD/_CACHE_TTL/_CACHE_DIR, the runtime password cache, and the sudo one-shot password handoff.state.AlignOwnerToDir) so the non-root CLI keeps access after a sudo daemon writes them.*.vault.jsonfiles fail fast with an actionable error ("encrypted vaults were removed; delete and re-join…") instead of silently minting a fresh identity next to an orphanednetwork.json. No migration shims — pre-release, breaking change intended.doctorswaps the vault checks for key-file hygiene (warns +chmod 600fix for group/world-readable key files).dwn-mesh-site/install.txtmirrors the old/dev/ttyvault comment and needs the same sudo-only wording.Verification
go build ./...— cleango vet ./...— cleango test ./... -count=1 -race— all 27 packages pass, no data races🤖 Generated with Claude Code