Fimeg/RedFlag
Watch
1
0
Fork
You've already forked RedFlag
 0
Code Releases Activity

feat: signing key deprecation UI + endpoint, fix agent mgmt for hashed tokens

Browse source 
- GET /admin/signing-keys lists all keys (primary, accepted, deprecated)
- POST /admin/signing-keys/:key_id/deprecate with primary-key guard
- SigningKeyRoster component at Settings > Security > Key Management
- AgentManagement page updated for hashed registration tokens
- README trust model: key rotation presented as operational feature
This commit is contained in:
Fimeg 2026-05-30 14:09:50 -04:00
commit 54bed0711f
10 changed files with 402 additions and 190 deletions
Download patch file Download diff file Expand all files Collapse all files

2
README.md
View file

@ -84,7 +84,7 @@ Agents run at the OS level and query the Docker socket directly — there's no s
Agents register with a one-time token plus a hardware fingerprint. The server stores the fingerprint; future check-ins that don't match the registered machine are rejected. This prevents config copying between hosts.
On first connect, the agent fetches and caches the server's Ed25519 public key (TOFU). Every subsequent command is verified against it. The `signing_keys` table supports multiple concurrent active keys — a new key can be promoted to primary while the old key is deprecated separately. Agents cache the key by `key_id` fingerprint and re-fetch when they see an unknown signer. Rotation currently requires the operator to promote the new key, then explicitly deprecate the old one; there is no automatic TTL on signing keys yet (SEC-006 tracks adding one).
On first connect, the agent fetches and caches the server's Ed25519 public key (TOFU). Every subsequent command is verified against it. The `signing_keys` table supports multiple concurrent active keys for zero-downtime rotation: a new key is promoted to primary while the previous key remains active (still verifies commands) until the operator deprecates it through the dashboard. Agents cache keys by `key_id` fingerprint and re-fetch when they see an unknown signer — no coordinated agent restart required. The signing key roster and deprecation controls live at Settings → Security → Key Management.
Every command includes a signed nonce with a 10-minute validity window. The agent tracks executed nonces and rejects replays, including from an attacker who intercepted a valid command.