Complete custody commands and add unsigned public ceremony replay - #22
Merged
Conversation
mellowcroc
changed the title
…nal-workflow # Conflicts: # cmd/mpc-ceremony/main.go # cmd/mpc-ceremony/ops_guided.go # cmd/mpc-ceremony/parse.go # cmd/mpc-ceremony/usage.go
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Complete supported ceremony custody/public-proof commands and allow anyone to independently replay a public ceremony without a signing identity. Add current-time handoff and receipt preparation, reviewed owner signing for the supported operational records, and
finalize rehearsal-evidencefor the exact tiny-circuit public golden input.Add
mpc-ceremony replaywith the ceremony trust and complete replay evidence inputs. It compiles the signed circuit, replays both phases, and checks final native keys, Cardano export and public proof evidence using the same helper as signed audits. It accepts no private key and writes no signed audit. All running-software and signed-policy checks remain in force. Release and decision verification results expose the exact release manifest digest so archive verifiers can require production GO approval for that same release.Receiver preparation authenticates the sender and hashes retained files. Operational signing retains canonical-byte, trusted-definition, owner-key and reviewed-digest checks. Public replay cannot prove secret deletion, host integrity or independence, and does not authorize new software for already frozen ceremonies.
Validation: command tests and the full signed lifecycle/tampering suite passed from a full Git checkout with repository dependencies vendored; Go vet passed. New checks exercise unsigned replay on real signed fixture data, reject a changed candidate signature, and reject signing/output flags on the public command. Relay's archive tests cover missing evidence, NO-GO and mismatched-release approval. Its extended full container rehearsal was attempted but stopped at the existing host-swap requirement before contributions; that combined lane remains to be run on a suitable host.
Release through the protected proof-tool workflow before updating Relay Anastasia-Labs#33's exact binary pins. Tessera #3 gates complete verification-package downloads on compatible reviewed releases. No test build or synthetic release metadata is provisioned into the live catalogue.