Ensure a root cannot be clobbered #13

Merged
erik merged 2 commits from chore/ensure-root-cannot-be-clobbered into main 2026-06-04 07:42:30 +00:00
Member

Refs: #3


Summary

  • Add a root-prefix preflight that refuses bootstrap when bucket state exists without devices/registry.json.
  • Wire the preflight into dropbear register before local root config is written.
  • Update restore/clean fixtures so joinable remote roots include the registry sentinel.

Validation

  • just validate passed with Go 1.26.4 via GOTOOLCHAIN=go1.26.4 and writable external caches.
Refs: #3 --- ### Summary - Add a root-prefix preflight that refuses bootstrap when bucket state exists without `devices/registry.json`. - Wire the preflight into `dropbear register` before local root config is written. - Update restore/clean fixtures so joinable remote roots include the registry sentinel. ### Validation - `just validate` passed with Go 1.26.4 via `GOTOOLCHAIN=go1.26.4` and writable external caches.
refuse unsafe root bootstrap
Some checks failed
Validate / validate (push) Failing after 44s
Validate / validate (pull_request) Failing after 42s
73361e9cb3
bump go to 1.25.11 to address vulns
All checks were successful
Validate / validate (pull_request) Successful in 2m24s
22625034a9
erik merged commit 91837ca672 into main 2026-06-04 07:42:30 +00:00
erik deleted branch chore/ensure-root-cannot-be-clobbered 2026-06-04 07:42:30 +00:00
Sign in to join this conversation.
No description provided.