admin
f84f94d987
No release, deploy or publish. Off-site is OFF for Tester4 and the owner passphrase is needed from the operator (bind blocked after 2 of 5 tries).
3.4 KiB
3.4 KiB
C1 reviewer 3 — keys that gate recovery (fresh, read-only; controller 7ca59e2, hub 5c48731, agent 4e1621c)
| # | Sev guess | harm | mechanism |
|---|---|---|---|
| K1 | P2 (P1 with K2 / a RESET) high | A reinstall through „delete the old host first" (D19/R-1154) cuts the new box off from the household's escrow: the recovery code is never asked, a NEW key is minted, and the old off-site history is set aside by itself on night one; typing the old code answers „wrong code" | hub api/passphrase_scope.go:58 409 forces the delete; store.go:3204-3210 delete demotes escrow under the OLD host_id; handler.go:1261 new host_id; GetEscrowStatusForCustomer store.go:3500-3527 joins on hosts → nil (superseded join on deleted host also gone) → identity_blob_present/superseded_present false; controller offbox.go:542-555 mints new pw, :1788 no recovery offer, :905-906 firstNight → resetOrphanedRepo; handleHostEscrowRetainedGet 404 for a deleted host (handler.go:1691); contrast purge store.go:4185-4190 DOES include host_deletions |
| K2 | P2 high | Abandoning ONE set-aside copy deletes EVERY retained recovery package of the customer — other set-aside copies become ciphertext nobody can open | hub handler.go:626-627 → PurgeSupersededEscrowForCustomer store.go:4185-4190 deletes all rows for the customer (incl. deleted hosts); the comment at :4176-4179 states the invariant it breaks |
| K3 | P3 med-high | A ceremony while off-site is not configured seals a package with NO repo password and supersedes the one that had it | controller escrow_handlers.go:217 re-stage only when configured; agent main.go:2975-2981; hub store.go:3392; escrow_confirm.go:222-258 stale card local only |
| K4 | P3 med | The global „create your recovery code" bar links to the ceremony the backups page hides while a recovery offer is outstanding | backups_remote.html:144-160 vs escrow_banner.go:23-33 + hu.json:1682; no recoveryOffer() refusal in the wizard/start handlers; settle gate main.go:876, offsiteapply.go:84 |
| K5 | P3 med-high | After a reinstall recovered on the reuse path, the NEW PBS key K is never escrowed and nothing compares fingerprints | felhom-pbs-apply:99 autogen; escrow_confirm.go:182-205 auto-confirm on hash; no compare of host_escrow.key_fingerprint vs live key (agent internal/backup/runner.go:407-429 only) |
| K6 | P3/P4 design | Whole-guest off-site (PBS) copies run before any escrow exists; host lost before the ceremony → unreadable archives | controller gates Tier 3 (offbox.go:781); agent internal/backup, internal/pbsdr have no escrow gate |
| K7 | P4 low | escrow PUT split in two statements; a failure leaves a row whose hash claims a key its blob lacks | hub handler.go:1388, 1412-1420; store.go:3402-3408 |
| K8 | P4 | operator off-site re-issue resets the provider password before saving it | hub offsite.go:217-245 |
Checked SAFE (reviewer): mint guard while the hub holds a package (offbox.go:542-555, 659-720); orphaned repo moved aside, never re-inited/deleted (offbox.go:886-943, 332-397); supersession retains both blobs (store.go:3343-3416); host delete demotes not destroys (store.go:3164-3229); ceremony two-word confirm; escrow.Create self-verifies; recovery refuses to replace a different local key; ClearOffboxTarget; PBS wrapper has no delete verb; hub abandon delete limited to one path after a delay (offsitekeys/service.go:464-496).