Repository navigation
fix(protocol): hold back the application membership exchange - #696
Merged
Merged
Conversation
Reverts the engine half of #685. Every node sent a __MEMBER__ hello to every neighbour it discovered, and no released build reserves that prefix. A v0.31.0 receiver rejects the frame as plaintext and raises a security warning to its application under the default encryption policy, and shows it to its user as a text message when require_encryption is off. Applications in the field ship such builds, so the next release could not go out with it. ADR 0037 is parked rather than reworked: the recognition key ships in every copy of an application, the exchange fails closed and silently offline, and it costs a signature and a seal per neighbour, for a property no customer has asked for yet. The ADR now says so, and lists what changes first if it is picked up again. Kept from #684 and its review: __MEMBER__ stays reserved and is still consumed on receipt, and the sealed layouts, vectors, the e2e key label and the spec text stay. The spec now requires a sender to know the neighbour reserves the prefix before sending it. A new test fails if discovery puts a membership frame on the air, negative-controlled by injecting one.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
#685 made every node send a
__MEMBER__hello to every neighbour it discovers, every five minutes. No released build reserves that prefix. A v0.31.0 receiver:requireEncryption: true);__MEMBER__…whenrequireEncryptionis off.Apps in the field ship v0.31.0 and earlier, so the next release cannot carry this. Nothing reads visibility yet and no binding exposes it, so reverting loses nothing shippable.
What
ProtocolConfig.app_publisher_key,set_app_membership, the FFI test helper, andhkdf/hmacback to optional behindfile-store.__MEMBER__stays reserved and is consumed on receipt. The sealed layouts, the vectors, theoffline-app-member-e2e-key-v1label and the spec text stay.__MEMBER__, from a key-package capability, before sending it.discovering_a_neighbour_sends_no_membership_framefails if discovery puts a membership frame on the air. Negative-controlled by injecting one.Stack
PRs #687 to #695 are built on the reverted code and are parked with the ADR.
Verified locally
cargo clippy --workspace -- -D warningsand--no-default-featuresonoffline-protocolcargo test --workspace --lib --no-fail-fast: engine 2173, FFI 317 and sealed 102 tests pass. The one failure isno_shipped_file_names_a_relay, which reads stale.claude/worktreeson this machine only.RUSTDOCFLAGS="-D warnings" cargo doc --workspace --no-deps,cargo fmt --all -- --check