fix(agent): route set_identity through agent to preserve meta-tag integrity#242
Merged
Conversation
…egrity set_identity previously called save_meta() directly from the CLI process, modifying the .meta file without updating the HMAC meta-tag in the keychain. This broke all subsequent sign operations because ensure_meta_integrity() detected the file/tag mismatch and rejected it as tampering. Route identity updates through a new SetIdentity agent IPC message (0xF7). The agent modifies the .meta file and atomically re-stamps the meta-tag, maintaining integrity. Also fix error swallowing in the sign path where backend.get() failures were logged without the actual error message, and update AGENTS.md with stronger CI/CD-only binary guidance. Closes #240
On platforms where the meta-integrity store is unavailable (e.g. Linux without Secret Service), perform_migrate_meta fails. Since the identity metadata was already saved successfully, log the re-stamp failure as a warning instead of propagating it as an error.
sshenc identity now routes through the agent IPC, so the agent must be running. Two e2e tests called sshenc identity without starting the agent first: gitenc_config_signs_commit_and_verifies and identity_persists_through_metadata.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
sshenc identitycalledsave_meta()directly from the CLI, modifying.metawithout updating the keychain HMAC meta-tag. This broke all signing after setting an identity.SetIdentityagent IPC message (0xF7). The CLI now sends identity updates through the agent, which modifies.metaand atomically re-stamps the meta-tag.backend.get()failures logged "key lookup failed" without the actual error.Changes
sshenc-agent-proto/src/message.rsSetIdentitymessage type (0xF7), parse, serialize, testssshenc-agent-proto/src/client.rstry_set_identity_via_socket()sshenc-agent/src/server.rsSetIdentityhandler; fix error logging in sign pathsshenc-cli/src/main.rssocket_pathtorun_commandsshenc-cli/src/commands.rsset_identity()to route through agent IPCsshenc-se/src/compat.rswarningfield toKeyMetaliteralAGENTS.mdCompanion PR
_warningfield toKeyMetaandsave_metadoc commentTest plan
cargo test --workspace— 622 tests pass, 0 failurescargo clippy --workspace --all-targets -- -D warnings— cleancargo fmt --all -- --check— cleanCloses #240