code wiki / _hdl_build / nx_vault_migrate.nx

nx_vault_migrate.nx

buildroot/runtime/_hdl_build/nx_vault_migrate.nx

8689 B169 linesdepth 2pulls 2 transitivereach 0 importersview sourcekind tooltopic vault

docs dependencies structs consts functions

about

nx_vault_migrate.nx -- ONE-SHOT KDF MIGRATION v1 -> v2 for every named secret in ~/.nishi/secrets/*.nv (2026-06-10 machine-key upgrade: 500k SHA-256 -> + argon2id memory-hard). Per secret, in rollback-safe order (nx_vault derives salt+IV from the FULL PATH, so the v2 ciphertext MUST be sealed at the final path -- never seal-then-rename): 1. derive v1 passphrase (/tmp/nx_machine_key.elf v1) -> open <name>.nv -> plaintext in memory 2. rename <name>.nv -> <name>.nv.v1bak (history kept; additive-only) 3. derive v2 passphrase (default) -> seal plaintext at <name>.nv 4. re-open <name>.nv under v2 and BYTE-COMPARE against the v1 plaintext 5. mismatch/failure -> rename the .v1bak back over <name>.nv (rollback) + exit nonzero 6. SHRED every ephemeral (overwrite 4096 zeros, then unlink): nxpass nxsecret.in nxsecret.out Idempotent: a secret already sealed under v2 simply fails the v1 open and is SKIPPED with a notice (it opens under v2 -- verified in step-0 probe), so re-running is safe. license_tier: ORIGINAL

dependencies 1 imports · 0 importers

imports: nx_syscalls.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

structs

none

consts

17	const K_MAGIC_4096: i64 = 4096
18	const K_MAGIC_65536: i64 = 65536

functions

20	func _p(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } called by 2: vg_migrate_one main calls 1: sys_write
21	func _pn(v: i64) -> i64 { let bb: u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=48+(m%10);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 } called by 2: vg_migrate_one main calls 2: sys_mmap sys_write
22	func vg_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } called by 1: main
23	func vg_cat(dst: u8, off: i64, s: u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { dst[off+i] = s[i]; i = i + 1 } return off + i } called by 2: vg_migrate_one main
24	func vg_run(path: u8, a1: u8, a2: *u8) -> i64 called by 2: vg_open_to vg_migrate_one calls 7: sys_fork sys_mmap sys_openat_wr sys_dup3 sys_execve sys_exit+1
44	func vg_read(path: u8, out: u8, cap: i64, lb: *i64) -> i64 called by 1: vg_open_to calls 3: sys_openat_rd sys_read sys_close
54	func vg_write(path: u8, s: u8, n: i64) -> i64 { let fd: i64 = sys_openat_wr(path, 0x180); if fd < 0 { return 0 - 1 } sys_write(fd, s, n); sys_close(fd); return 0 } called by 1: vg_migrate_one calls 3: sys_openat_wr sys_write sys_close
56	func vg_shred(path: *u8) -> i64 called by 2: vg_open_to main calls 4: sys_mmap sys_openat_wr sys_write sys_close
63	func vg_open_to(vpath: u8, out: u8, lb: *i64) -> i64 called by 1: vg_migrate_one calls 3: vg_shred vg_run vg_read
70	func vg_bytes_eq(a: u8, an: i64, b: u8, bn: i64) -> i64 { if an != bn { return 0 } var k: i64 = 0; while k < an { if a[k] != b[k] { return 0 } k = k + 1 } return 1 } called by 1: vg_migrate_one
73	func vg_migrate_one(vpath: *u8) -> i64 called by 1: main calls 9: _p sys_mmap vg_run vg_open_to _pn vg_cat+3
104	func main() -> i64 calls 13: _p sys_openat_rd sys_exit sys_mmap sys_getdents64 dirent_reclen+7