nx_cap_keygen.nx
buildroot/runtime/nx_cap_keygen.nx
about
nx_cap_keygen.nx -- provision the capability-token SIGNING SECRET on the machine that will verify it (the NAS).
GAP 2 of the MCP grant: nx_tools_api prefers a real keyfile (TA_CAP_KEYFILE = tools_cap_secret.key, CWD-relative)
but FALLS BACK to a forgeable baked placeholder when it is absent -- so until a real key is provisioned, any
token is forgeable by anyone who can read the source/binary. This organ draws 32 bytes from the kernel CSPRNG,
hex-encodes them (64 ASCII chars, NO trailing newline / NO NUL -- so the file bytes are EXACTLY the secret
nx_tools_api reads raw and nx_cap_mint signs with), and writes them 0600.
SINGLE RESPONSIBILITY (rule 9): this only PROVISIONS the secret; nx_cap_mint ISSUES tokens from it; nx_tools_api
VERIFIES them. Kept a STANDALONE organ (not a supervisor sub) so it is gate-provable off-LAN and deployable via
the /api chain. FAIL-SAFE: refuses to overwrite an existing keyfile unless argv[2]=="--force" (a silent rotate
would invalidate every outstanding capability). The secret is generated WHERE it is used and NEVER transits a
network, and is NEVER printed. license_tier: ORIGINAL expect_exit: 0
dependencies 1 imports · 2 importers
imports: nx_csprng.nx
imported by: nx_cap_grant_e2e_gate.nxnx_cap_keygen_gate.nx
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| 15 | const CK_DEFAULT: *u8 = "tools_cap_secret.key" as *u8 // must match nx_tools_api TA_CAP_KEYFILE |
| 16 | const CK_BYTES: i64 = 32 // 256-bit secret |
| 19 | const CK_OK: i64 = 1 |
| 20 | const CK_EXISTS: i64 = 0 - 2 // keyfile present + non-empty, force not given -> refused (fail-safe) |
| 21 | const CK_RNG: i64 = 0 - 3 // CSPRNG draw failed |
| 22 | const CK_WRITE: i64 = 0 - 4 // open/write of the keyfile failed |
functions
| 24 | func ck_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } called by 1: main |
| 25 | func ck_streq(a: *u8, b: *u8) -> i64 { var i: i64 = 0; while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 } if b[i] != (0 as u8) { return 0 } return 1 } called by 1: main |
| 26 | func ck_hexd(v: i64) -> i64 { if v < 10 { return 48 + v } return 87 + v } // 0-9 then a-f called by 1: ck_provision |
| 31 | func ck_provision(path: *u8, force: i64, out_key: *u8, out_klen: *i64) -> i64 |
| 59 | func main(argc: i64, argv: *i64) -> i64 |