Ship age, so a machine can open the secrets it holds
Every secret in _private is age-encrypted, sops for the .env-shaped
files and whole-file .age for the opaque blobs, minisign's own signing
key among them. No image ever carried the binary. gopass is built with
age support, which opens a gopass store and not an arbitrary .age file,
so the gap read as covered and was not.
The failure is the quiet class this fleet keeps meeting: nothing errors,
no unit fails, and a fully bootstrapped machine sits there holding
ciphertext until somebody needs a key. fw12 measured 15 green rows and
could not decrypt a single file.
Base rather than client, beside minisign, for the same reason: opening a
signing key is a build-host act. bin:age joins all three host require
lists so a mint that loses it fails a preflight rather than an install.
The identity itself is unchanged by this: never in the image, never
synced, copied to a machine by hand.
- Co-Authored-By
- Claude Opus 5 (1M context) <noreply@anthropic.com>
- Claude-Session
- https://claude.ai/code/session_01WFBzMprSmNCfvdj2cGZyka
4 files changed,
+32 insertions,
-0 deletions
| 1543 |
1543 |
|
# signing is a build-host act and has nothing to do with a desktop
|
| 1544 |
1544 |
|
# session.
|
| 1545 |
1545 |
|
minisign \
|
|
1546 |
+ |
# age, because every secret this tree keeps is age-encrypted: sops
|
|
1547 |
+ |
# for the .env-shaped files in _private and whole-file .age for the
|
|
1548 |
+ |
# opaque blobs, minisign's own signing key among them. A machine
|
|
1549 |
+ |
# without it holds ciphertext it cannot open, and the failure is
|
|
1550 |
+ |
# quiet, since nothing errors until somebody needs a key. The identity
|
|
1551 |
+ |
# is never shipped in the image and never synced; it is copied to a
|
|
1552 |
+ |
# machine by hand, which is the half that has to stay manual. The
|
|
1553 |
+ |
# binary is not, and 9.1 MiB is not a reason to make a bootstrap
|
|
1554 |
+ |
# step out of it. Base rather than client for the same reason as
|
|
1555 |
+ |
# minisign: decrypting a signing key is a build-host act.
|
|
1556 |
+ |
age \
|
| 1546 |
1557 |
|
# efibootmgr, for usr/bin/alloy-boot-entry, which names the firmware boot
|
| 1547 |
1558 |
|
# entry after `bootc install` has made one. It arrives anyway as something
|
| 1548 |
1559 |
|
# else's dependency; named here because the install step that needs it
|
| 45 |
45 |
|
# --- release signing. Same as fw13: dist/sign-artifacts.sh hard-fails without
|
| 46 |
46 |
|
# minisign, and an arm64 release is signed on the host that built it.
|
| 47 |
47 |
|
bin:minisign
|
|
48 |
+ |
|
|
49 |
+ |
# --- secrets. _private keeps its .env-shaped files under sops and its opaque
|
|
50 |
+ |
# blobs, minisign's own signing key included, as whole-file .age. Without the
|
|
51 |
+ |
# binary a machine holds ciphertext it cannot open, and nothing says so until
|
|
52 |
+ |
# somebody needs a key. The identity itself is copied by hand and stays out of
|
|
53 |
+ |
# the image.
|
|
54 |
+ |
bin:age
|
| 67 |
67 |
|
# the key material is a $HOME restore rather than image content, so the binary
|
| 68 |
68 |
|
# is the part an image can be asked for.
|
| 69 |
69 |
|
bin:minisign
|
|
70 |
+ |
|
|
71 |
+ |
# --- secrets. _private keeps its .env-shaped files under sops and its opaque
|
|
72 |
+ |
# blobs, minisign's own signing key included, as whole-file .age. Without the
|
|
73 |
+ |
# binary a machine holds ciphertext it cannot open, and nothing says so until
|
|
74 |
+ |
# somebody needs a key. The identity itself is copied by hand and stays out of
|
|
75 |
+ |
# the image.
|
|
76 |
+ |
bin:age
|
| 57 |
57 |
|
# hard-fails without minisign, and the key material is a $HOME restore rather
|
| 58 |
58 |
|
# than image content — so the binary is the part an image can be asked for.
|
| 59 |
59 |
|
bin:minisign
|
|
60 |
+ |
|
|
61 |
+ |
# --- secrets. _private keeps its .env-shaped files under sops and its opaque
|
|
62 |
+ |
# blobs, minisign's own signing key included, as whole-file .age. Without the
|
|
63 |
+ |
# binary a machine holds ciphertext it cannot open, and nothing says so until
|
|
64 |
+ |
# somebody needs a key. The identity itself is copied by hand and stays out of
|
|
65 |
+ |
# the image.
|
|
66 |
+ |
bin:age
|