Repository navigation
feat(cloud): release builds know FTW Cloud by its key - #1609
Conversation
cloudlink.ServiceKeys now carries cloud.ftw.energy's public service key, so a release build can turn FTW Cloud on when an owner asks. The endpoint was already wss://cloud.ftw.energy/v1/box. Nothing dials until an owner grants, and the box checks every hello_ok and downlink message against this key alone. A test shows that a release build refuses a service that signs with any other key: the box says hello, hears hello_ok, and sends nothing more. docs/protocol-cloud.md says how the key rotates. The uplink changeset no longer says release builds name no service. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 081e0d8803
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| @@ -0,0 +1,5 @@ | |||
| --- | |||
| "ftw": patch | |||
There was a problem hiding this comment.
When the Version Packages workflow consumes this changeset, it will publish the first release in which an owner can enable FTW Cloud as a patch. That is a visible new capability, not a fix, so this entry must use minor and receive the required owner approval; otherwise the release version understates the user-visible change.
AGENTS.md reference: AGENTS.md:L164-L168
Useful? React with 👍 / 👎.
1 participant
Release builds can now turn FTW Cloud on.
cloudlink.ServiceKeyscarries the public service key ofcloud.ftw.energy. The endpoint was alreadywss://cloud.ftw.energy/v1/box. Nothing else changes: FTW Cloud stays off until an owner turns it on, and the box checks everyhello_okand every downlink message against this one key.The key
BG6EvBxFzSHPVsQOES6PYaKFo5vHQmte9lJ6D5OBIT9JgcBrJAOxAucdqKXxS76pToQ7orI1Ivsno0OtxbMuliQftw-cloud/service-key. deploy: run ftwcloudd at cloud.ftw.energy in Stockholm ftw-cloud#2 recorded it when the host was set up. docs: add device identity reference #3 checked it when the key moved to Secrets Manager, and Docs: testing guide + test status snapshot #6 checked it again after a reboot.hello_okverifies with it.Rotation
docs/protocol-cloud.mdnow has "Rotating the service keys". A release carries the new public half next to the old one; once boxes have updated, the service switches; a later release drops the old half. If the key leaks, a release with only the new key goes out at once. To stand in for the service, an attacker would also need the TLS certificate forcloud.ftw.energy.Tests
TestAReleaseBuildTrustsOnlyTheServicesKey. It checks the release endpoint and that the release keys parse to exactly one P-256 key. A box with the release keys then talks to a service that has its own key: the box says hello, hearshello_ok, sends nothing more, and does not report itself connected.go test -race ./cmd/ftw ./internal/cloudlink ./internal/apipasses.Live run (13 Oct, 10:38–10:42, a laptop, not the home box)
Two builds of this branch, with the same state directory, so they share one box key:
-X …cloudlink.ServiceKeys=<a fresh key>). FTW Cloud on over loopback at 10:40:33. The box reachedcloud.ftw.energy, sent its hello, and refused each answer:cloudlink: the service broke the protocol: hello_ok did not check out, six times in 20 s with backoff.GET /api/cloudsaidconnected: false.go build ./cmd/ftw, no-X). It started at 10:41:09 and loggedFTW Cloud uplink connected home=m733cwqi7bdyhwuf2iyn3dj6uiat 10:41:34.754.GET /api/cloudsaidconnected: true.DELETE /api/cloud/grantat 10:41:51. The service deleted the test home and sent its receipt at 10:41:51.539 (purgedAtMs). The box deleted itscloud.key. Then I stopped Core.🤖 Generated with Claude Code