justme/MoShiro
1
1 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 5 Wiki Activity

feat!: genesis-pinned operator set, server identity with an encrypted control link, key-less join codes; release key continuity
ci/woodpecker/tag/gitea-release Pipeline is pending
Details
ci/woodpecker/tag/linux-release Pipeline failed
Details
ci/woodpecker/tag/windows-release Pipeline was canceled
Details

Browse Source 
Join codes need no passkey touch and carry only public values (genesis
fingerprint, owner credentials, installer hashes). Nodes pin the genesis and
owners at enrollment and only follow passkey-signed operator set versions.
The panel's server key is listed in the set; pinned nodes require its
signature and run the control link under AES-256-GCM. Password sessions carry
no capabilities. The updater adopts a next_key from a signed manifest.

Bump version to 0.2.0. [CI SKIP]
This commit is contained in:
justme committed 2026-10-08 03:21:44 +08:00
1 parent 9bb6841dce
commit a2f88a344b
89 files changed
+2145 -1195
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

backend/openapi/v1.json
+44 -143
View File
@@ -3999,78 +3999,6 @@
"x-moshiro-capability": "accounts.manage"
}
},
"/api/admin/join-tokens/signed": {
"post": {
"tags": [
"admin-trust"
],
"summary": "Create a join code from a grant the operator signed with a passkey; the browser derives the code from a seed the panel never sees",
"operationId": "join_tokens_create_signed",
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/CreateSignedJoinTokenRequest"
}
}
},
"required": true
},
"responses": {
"201": {
"description": "Created",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/JoinTokenDto"
}
}
}
},
"400": {
"description": "Bad Request",
"content": {
"application/problem+json": {
"schema": {
"$ref": "#/components/schemas/ProblemDto"
}
}
}
},
"401": {
"description": "Unauthorized",
"content": {
"application/problem+json": {
"schema": {
"$ref": "#/components/schemas/ProblemDto"
}
}
}
},
"403": {
"description": "Forbidden",
"content": {
"application/problem+json": {
"schema": {
"$ref": "#/components/schemas/ProblemDto"
}
}
}
},
"409": {
"description": "Conflict",
"content": {
"application/problem+json": {
"schema": {
"$ref": "#/components/schemas/ProblemDto"
}
}
}
}
},
"x-moshiro-capability": "fleet.enroll"
}
},
"/api/admin/api-tokens": {
"get": {
"tags": [
@@ -5003,30 +4931,11 @@
"tags": [
"ops"
],
"summary": "One-line installer for Linux and macOS nodes (agent or probe, decided by the code)",
"summary": "The static one-line installer for Linux and macOS nodes (same bytes for everyone; its SHA-256 is published with each release)",
"operationId": "install_sh",
"parameters": [
{
"name": "code",
"in": "query",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "OK"
},
"404": {
"description": "Not Found",
"content": {
"application/problem+json": {
"schema": {
"$ref": "#/components/schemas/ProblemDto"
}
}
}
}
}
}
@@ -5102,30 +5011,11 @@
"tags": [
"ops"
],
"summary": "One-line installer for Windows nodes (agent or probe, decided by the code)",
"summary": "The static one-line installer for Windows nodes (same bytes for everyone; its SHA-256 is published with each release)",
"operationId": "install_ps1",
"parameters": [
{
"name": "code",
"in": "query",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "OK"
},
"404": {
"description": "Not Found",
"content": {
"application/problem+json": {
"schema": {
"$ref": "#/components/schemas/ProblemDto"
}
}
}
}
}
}
@@ -6015,28 +5905,8 @@
"null",
"string"
]
}
}
},
"CreateSignedJoinTokenRequest": {
"required": [
"grant",
"note",
"labels",
"auto_approve"
],
"type": "object",
"properties": {
"grant": {
"$ref": "#/components/schemas/SignedStatementDto"
},
"note": {
"type": [
"null",
"string"
]
},
"labels": {
"controllers": {
"type": [
"null",
"array"
@@ -6044,12 +5914,6 @@
"items": {
"type": "string"
}
},
"auto_approve": {
"type": [
"null",
"boolean"
]
}
}
},
@@ -6914,10 +6778,6 @@
"null",
"string"
]
},
"signed": {
"type": "boolean",
"default": false
}
}
},
@@ -7223,6 +7083,12 @@
"null",
"string"
]
},
"auth_method": {
"type": [
"null",
"string"
]
}
}
},
@@ -9404,6 +9270,41 @@
"$ref": "#/components/schemas/TrustProposalDto"
}
]
},
"install_url": {
"type": "string",
"default": ""
},
"operators": {
"type": [
"null",
"array"
],
"items": {
"type": "string"
}
},
"install_sh_sha256": {
"type": "string",
"default": ""
},
"install_ps1_sha256": {
"type": "string",
"default": ""
},
"install_matches_release": {
"type": [
"null",
"boolean"
]
},
"server_key": {
"type": "string",
"default": ""
},
"server_key_listed": {
"type": "boolean",
"default": false
}
}
},