code wiki / _hdl_build / nx_pw_rotate.nx

nx_pw_rotate.nx

buildroot/runtime/_hdl_build/nx_pw_rotate.nx

8381 B172 linesdepth 2pulls 3 transitivereach 0 importersview sourcekind tool

docs dependencies structs consts functions

about

nx_pw_rotate.nx -- vault SECRET ROTATION (the true closure of the plaintext-pw debt: the vault migration protects the value going forward, but a value that ever sat in plaintext or in a transcript must be CHANGED). Rotates the stored secret VALUE; the vault passphrase stays machine-bound (nx_machine_key, unattended). Rollback-safe and self-verifying: rotate <name> [len] (len default 24; the secret lives at ~/.nishi/secrets/<name>.nv) 1. machine-key derive -> /tmp/nxpass 2. OPEN current vault (PROVES we can read it before we touch it; abort if not) 3. BACKUP <name>.nv -> <name>.nv.rotatebak (byte copy) 4. CSPRNG new password (nx_entropy, 64-char uniform alphabet) -> /tmp/nxsecret.in 5. SEAL (v3 random-iv) -> overwrites <name>.nv with the new value 6. VERIFY: open the new vault, compare byte-exact to the generated value MISMATCH -> RESTORE the backup, fail closed (the old secret is never lost) 7. success -> new value to /tmp/nxnewpw (0600) for the operator to push to the service; audit-log the rotation (value never logged); shred /tmp/nxpass + /tmp/nxsecret.in This tool ROTATES THE STORE. Pushing the new value to the live service (e.g. the NAS account) is the operator's deploy step -- a tool must never silently change a credential a human also uses to log in. license_tier: ORIGINAL

dependencies 2 imports · 0 importers

imports: nx_syscalls.nxnx_entropy.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

structs

none

consts

20	const AT_MAGIC_65536: i64 = 65536
22	const AT_FDCWD: i64 = 0 - 100
23	const PWR_MAXLEN: i64 = 256

functions

25	func _p(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } called by 1: main calls 1: sys_write
26	func _pn(v: i64) -> i64 { let bb: u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=48+(m%10);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 } called by 1: main calls 2: sys_mmap sys_write
27	func pwr_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } called by 1: pwr_audit
28	func pwr_cat(dst: u8, off: i64, s: u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { dst[off+i] = s[i]; i = i + 1 } return off + i } called by 1: main
29	func pwr_unlink(path: *u8) -> i64 { __syscall(263, AT_FDCWD, path, 0, 0, 0, 0) return 0 } called by 1: main
31	func pwr_read(path: u8, buf: u8, cap: i64) -> i64 called by 2: pwr_copy main calls 3: sys_openat_rd sys_read sys_close
46	func pwr_write(path: u8, buf: u8, n: i64, mode: i64) -> i64 called by 2: pwr_copy main calls 3: sys_openat_wr sys_write sys_close
55	func pwr_copy(src: u8, dst: u8) -> i64 called by 1: main calls 3: sys_mmap pwr_read pwr_write
63	func pwr_run(path: u8, a1: u8, a2: *u8) -> i64 called by 1: main calls 7: sys_fork sys_openat_wr sys_dup3 sys_mmap sys_execve sys_exit+1
86	func pwr_eq(a: u8, b: u8, n: i64) -> i64 called by 1: main
93	func pwr_audit(name: u8, outcome: u8) -> i64 called by 1: main calls 4: sys_openat_append sys_write pwr_slen sys_close
105	func main(argc: i64, argv: *i64) -> i64 calls 13: _p sys_exit sys_mmap pwr_cat pwr_run pwr_unlink+7