fix(drivers): preserve installed beta trust identity - #1110
Conversation
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_3cc2319e-e3de-4e1f-89da-a838f6ed2928) |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f9cb680b62
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| return nil, errors.New("control opt-in requires a configured Device Support trust root") | ||
| } | ||
| return nil, nil | ||
| return nil, errors.New("active managed driver has no trusted repository source") |
There was a problem hiding this comment.
When an active control-capable managed driver’s repository is removed from configuration, this new error propagates through drivers.Registry.add before the driver is constructed, while the startup loop in go/cmd/ftw/main.go only logs the failure. Consequently, driver_default_mode is never invoked and hardware may remain in the forced mode issued before the restart; reject unrestricted operation only after arranging a default-mode transition or safe fallback.
AGENTS.md reference: AGENTS.md:L36-L36
Useful? React with 👍 / 👎.
1 participant
Changing configured repository IDs could leave an installed official beta driver without its signed runtime policy, or bind it to a different repository that reused the name. The runtime now selects the official trust root from the installation's saved signature provenance and verifies the on-disk manifest again. A missing trust source stops the managed driver instead of granting legacy permissions.
The historical repository ID only locates the cache file. A different repository's in-memory cache cannot replace the saved signature check. No state schema, signing key, driver artifact, or network path changes.
Validation: six regressions fail against the published v3.0.3-beta.1 implementation and pass with this change. They cover added, removed and repeated name collisions, conflicting cached policy, missing manifests, another signer, and changed payloads. The complete driverrepo suite passes with the race detector, and
make verifypasses. The test fixture records synthetic official provenance through the state API and uses its own Ed25519 key; it does not possess the production private key.This addresses the repository-trust finding in #1108. A lost or replaced cached manifest leaves the driver stopped with a verification error until a trusted artifact is restored.
Note
High Risk
Changes driver runtime trust and fail-closed behavior for active managed official installs; incorrect logic could block drivers or briefly weaken signature enforcement.
Overview
Fixes a trust bug where changing configured repository IDs could drop signed runtime policy for an installed official beta driver, or bind it to a different repo reusing the same alias and looser in-memory manifest data.
Runtime policy resolution now uses installation provenance (
FTWSigned+ officialRepoURL): it pins the official beta trust root (keys/URL) while keeping the historicalRepoIDonly to find the on-disk manifest cache. For those drivers,directManifestRuntimePolicyre-reads and re-verifies the cached envelope against the pinned key instead of trustingmanifestFor()’s memory cache.If an active managed driver has no resolvable trusted source, the manager errors and stops policy rather than returning nil and allowing legacy/unrestricted behavior.
manager_testis updated so an unknown/mismatched beta repo ID must not yield a policy.Adds
beta_runtime_policy_test.goregressions for alias add/remove/collision, poisoned in-memory manifests, and missing/wrong-signer/tampered cache payloads.Reviewed by Cursor Bugbot for commit f9cb680. Bugbot is set up for automated code reviews on this repo. Configure here.