Fimeg/souveraine
Watch
1
0
Fork
You've already forked souveraine
 0
Code Releases Activity

federation: document node enrolment trust boundary

Browse source
This commit is contained in:
Fimeg 2026-07-12 15:34:41 -04:00
commit 2c14da0dbe
6 changed files with 150 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

29
packaging/deploy-phone.sh
View file

@ -9,10 +9,12 @@
# for packaged software; this isn't a pacman package). Redeploy = rerun.
#
# Data: mirrors ~/.souveraine (agents, memfs, tokens, db).
# Identity: ~/.souveraine/seed-id is EXCLUDED by default. Machine binding
# is doctrine — the phone is its own federated instance and generates its
# own seed on first start. --clone-identity overrides for a deliberate
# same-instance migration.
# Identity: private keys are EXCLUDED by default. The phone retains or creates
# its own machine key and per-agent keys. This is safe for a new device, but it
# is not yet the planned commissioned-node flow: a separate agent key cannot
# prove it is an authorized fork of an existing agent. --clone-identity is an
# explicit, same-instance migration escape hatch; it copies private keys and
# must never be used as federation enrolment.
set -euo pipefail
SSH=(ssh -F /dev/null -i "$HOME/.ssh/ani" -o BatchMode=yes -o ConnectTimeout=5)
@ -24,7 +26,14 @@ UNIT="$SRC/packaging/souveraine.service"
BIN="$SRC/target/aarch64-unknown-linux-gnu/release/souveraine"
clone_identity=0
[[ "${1:-}" == "--clone-identity" ]] && clone_identity=1
case "${1:-}" in
"") ;;
--clone-identity) clone_identity=1 ;;
*)
echo "usage: $0 [--clone-identity]" >&2
exit 2
;;
esac
# Build locally if the binary is missing or older than the source.
# ponytail: find -newer reruns the cross build only when something changed
@ -52,7 +61,9 @@ sed 's|%h/.local/bin/souveraine|/usr/local/bin/souveraine|' "$UNIT" \
| "${SSH[@]}" "$PHONE" 'install -Dm644 /dev/stdin ~/.config/systemd/user/souveraine.service'
echo "== ~/.souveraine data =="
excludes=(--exclude 'seed-id')
# Excluding only seed-id was insufficient: the agent's private key lives in
# agents/<id>/seed/, which rsync would otherwise copy to the phone.
excludes=(--exclude 'seed-id' --exclude 'agents/*/seed')
[[ $clone_identity -eq 1 ]] && excludes=()
rsync -az -e "ssh -F /dev/null -i $HOME/.ssh/ani -o BatchMode=yes" "${excludes[@]}" \
"$HOME/.souveraine/" "$PHONE:.souveraine/"
@ -68,4 +79,8 @@ echo "== enable + start =="
'
echo "== done =="
[[ $clone_identity -eq 0 ]] && echo "note: seed-id excluded — phone keeps/generates its own federated identity"
if [[ $clone_identity -eq 0 ]]; then
echo "note: no private keys were copied; this is not a commissioned federation node yet"
else
echo "WARNING: copied machine and agent private keys for a deliberate same-instance migration"
fi