rajames/LithosAnanke
1
1
Fork 0
Code Issues 76 Pull Requests 1 Actions Packages Projects 1 Releases 6 Activity

wip(kernel): the proxy Zuse -- a stick's first boot mints its own Zuse (#92, Task 1) [skip ci]

Browse Source 
Work in progress on StarForth-v4.0.0; not yet accepted (plan
2026-10-29-stick-5, Task 1).

- zuse_genesis_marker.h: the marker's version 2 -- the proxy's key and the
  real Zuse's -- beside version 1.
- capsule_zuse_boot.c: capsule_zuse_boot_check_key() (the identity-record
  half of the check) and capsule_zuse_boot_genesis_mint() (the mint half of
  v3's genesis) split out; v3's two callers unchanged in behaviour.
- sk_v4_marker.c: the v4 boot reads version 1 as a proxy with no real Zuse,
  and writes version 2.
- sk_v4_identity.c: no marker and a blank identity partition -> genesis:
  mint, read back, then the marker; the proxy logs in. A marker with a real
  key: no session for the proxy (the fixed screen is Task 5).
- qemu_session.py: boot()/shutdown(), so a mode can boot twice; modes
  genesis and stick_genesis; stick_boot now expects genesis and the prompt.

Logs: genesis on amd64 before the change (both boots: "no genesis on this
disk", FAIL) and after (minted, then recognised: PASS). The DoE CSV of
032532 is from a run whose QEMU never started (no display; its empty log
directory was removed).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2
This commit is contained in:
Claude
2026-11-08 03:43:33 +00:00
parent 8f1ba02b3c
commit bfe3506aec
17 changed files with 996 additions and 96 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kernel/src/capsule/capsule_zuse_boot.c
+42 -24
View File
@@ -113,6 +113,36 @@ static void install_and_activate(VM *mama_vm, struct blkio_dev *dev,
* "ACL-ZUSE-BOOT") above already sets. Nothing to call here anymore. */
}
/* The identity-record half of the check (split out 2026-10-29 so the v4 boot
* can check against either of the version 2 marker's keys: plan
* 2026-10-29-stick-5, Task 1). */
zuse_drive_t capsule_zuse_boot_check_key(struct blkio_dev *dev,
homeblocks_sig_result_t sig_rc,
const homeblocks_sig_t *sig,
const uint8_t want[32],
uint8_t seed[32], uint8_t pubkey[32]) {
if (!dev || !want) return ZUSE_DRIVE_NOT_HERS;
if (sig_rc != HOMEBLOCKS_SIG_OK || !sig) return ZUSE_DRIVE_NOT_HERS;
if (sig->identity_src_offset == 0 || sig->identity_src_devblocks < 1) return ZUSE_DRIVE_NOT_HERS;
user_identity_seed_t idrec;
if (read_devblock(dev, sig->identity_src_offset, (uint8_t *)&idrec) != 0) return ZUSE_DRIVE_NOT_HERS;
/* Same magic -> version -> CRC-64 discipline as genesis_marker_read():
* this record carries Zuse's private key (the seed), so a corrupt or
* format-mismatched record must be refused, never loaded -- a bad CRC
* could otherwise install a garbage seed as Zuse's identity. */
if (idrec.magic != USER_IDENTITY_SEED_MAGIC) return ZUSE_DRIVE_NOT_HERS;
if (idrec.version != USER_IDENTITY_SEED_VERSION) return ZUSE_DRIVE_NOT_HERS;
uint64_t want_crc = compute_crc64((const uint8_t *)&idrec,
offsetof(user_identity_seed_t, crc));
if (want_crc != idrec.crc) return ZUSE_DRIVE_NOT_HERS;
if (memcmp(idrec.pubkey, want, 32) != 0) return ZUSE_DRIVE_NOT_HERS; /* not Zuse's drive */
memcpy(seed, idrec.seed, 32);
memcpy(pubkey, idrec.pubkey, 32);
return ZUSE_DRIVE_HERS;
}
/* The check, with no VM (split out 2026-10-26 so the v4 boot makes the same
* one: docs/v4.0.0/plans/2026-10-26-engine-step4-identity-gate.md, D1). */
zuse_drive_t capsule_zuse_boot_check(struct blkio_dev *dev,
@@ -129,25 +159,18 @@ zuse_drive_t capsule_zuse_boot_check(struct blkio_dev *dev,
/* Marker present: genesis already happened, on some thumbdrive.
* Only this drive if it is that drive. */
if (sig_rc != HOMEBLOCKS_SIG_OK || !sig) return ZUSE_DRIVE_NOT_HERS;
if (sig->identity_src_offset == 0 || sig->identity_src_devblocks < 1) return ZUSE_DRIVE_NOT_HERS;
return capsule_zuse_boot_check_key(dev, sig_rc, sig, marker.zuse_pubkey, seed, pubkey);
}
user_identity_seed_t idrec;
if (read_devblock(dev, sig->identity_src_offset, (uint8_t *)&idrec) != 0) return ZUSE_DRIVE_NOT_HERS;
/* Same magic -> version -> CRC-64 discipline as genesis_marker_read():
* this record carries Zuse's private key (the seed), so a corrupt or
* format-mismatched record must be refused, never loaded -- a bad CRC
* could otherwise install a garbage seed as Zuse's identity. */
if (idrec.magic != USER_IDENTITY_SEED_MAGIC) return ZUSE_DRIVE_NOT_HERS;
if (idrec.version != USER_IDENTITY_SEED_VERSION) return ZUSE_DRIVE_NOT_HERS;
uint64_t want_crc = compute_crc64((const uint8_t *)&idrec,
offsetof(user_identity_seed_t, crc));
if (want_crc != idrec.crc) return ZUSE_DRIVE_NOT_HERS;
if (memcmp(idrec.pubkey, marker.zuse_pubkey, 32) != 0) return ZUSE_DRIVE_NOT_HERS; /* not Zuse's drive */
memcpy(seed, idrec.seed, 32);
memcpy(pubkey, idrec.pubkey, 32);
return ZUSE_DRIVE_HERS;
/* The mint half of v3's genesis, with no VM (split out 2026-10-29: plan
* 2026-10-29-stick-5, Task 1). */
int capsule_zuse_boot_genesis_mint(struct blkio_dev *dev, uint8_t seed[32], uint8_t pubkey[32]) {
MintResult r = capsule_mint_identity(dev, (VM *)0, "Zuse", "zuse",
(const char *)0, (const char *)0,
pubkey, seed,
MINT_PERSONALITY_DEFAULT, /* Zuse is the superuser -- never restricted */
1 /* the caller confirmed the drive BLANK */);
return r == MINT_OK ? 0 : -1;
}
int capsule_zuse_boot_root_pubkey(uint8_t pubkey[32]) {
@@ -176,12 +199,7 @@ void capsule_zuse_boot_try_attach(struct blkio_dev *dev,
which = capsule_zuse_boot_check(dev, sig_rc, sig, seed, pubkey);
if (which == ZUSE_DRIVE_GENESIS) {
MintResult r = capsule_mint_identity(dev, (VM *)0, "Zuse", "zuse",
(const char *)0, (const char *)0,
pubkey, seed,
MINT_PERSONALITY_DEFAULT, /* Zuse is the superuser -- never restricted */
1 /* sig_rc already confirmed BLANK above */);
if (r != MINT_OK) {
if (capsule_zuse_boot_genesis_mint(dev, seed, pubkey) != 0) {
console_println("Zuse: genesis mint failed");
return;
}