Sovereignty proof against Garage: complete the PQ verification before v0.6

Cordy commented

2026-08-04 13:05:49 +00:00

Owner

Nikola flipped the dogfood (.249) to post-quantum (#28, v0.3.29) on 2026-08-04 using the migration guide. Steps 1–6 succeeded (hybrid recovery key generated, secret edited, pod restarted clean, old files open, Keycloak attribute shows the two-value upgrade). Step 7 — the Garage sovereignty proof — was not completed: aws is not installed on the Mac (zsh: command not found: aws).

This issue: run the fixed step 7 below during v0.5 and record the result here. Gate: must be green before v0.6 (public launch claims "recovery via plain age -d" — we don't launch on an unproven claim).

Fixed sovereignty proof (step 7, two tool options)

Credentials: the Garage access key/secret for the cairn-enc bucket, from the password manager. cairn-pq-recovery.txt = the hybrid recovery key from step 1 (re-export from the password manager if deleted).

Option A — rclone (already installed for the sync setup; preferred)

# list newest objects
rclone lsl ':s3,provider=Other,endpoint="http://192.168.10.32:3900",region=garage,access_key_id=<KEY>,secret_access_key=<SECRET>:cairn-enc' | sort -k2,3 | tail

# pull the raw object for the file uploaded in step 6
rclone copyto ':s3,provider=Other,endpoint="http://192.168.10.32:3900",region=garage,access_key_id=<KEY>,secret_access_key=<SECRET>:cairn-enc/<path-to-new-file>' /tmp/blob.age

(If the inline connection string is unwieldy: rclone config a remote named garage with provider Other, the endpoint, region garage, and the keys — then rclone lsl garage:cairn-enc / rclone copyto garage:cairn-enc/<path> /tmp/blob.age.)

Option B — AWS CLI

brew install awscli
export AWS_ACCESS_KEY_ID=<KEY> AWS_SECRET_ACCESS_KEY=<SECRET> AWS_DEFAULT_REGION=garage
aws --endpoint-url http://192.168.10.32:3900 s3 ls s3://cairn-enc/ --recursive | tail
aws --endpoint-url http://192.168.10.32:3900 s3 cp "s3://cairn-enc/<path-to-new-file>" /tmp/blob.age

The actual proof (identical for both options)

# 1. Header shows post-quantum stanzas:
head -c 400 /tmp/blob.age          # expect: mlkem768x25519 (no plain X25519 stanza)

# 2. Hybrid recovery key opens it, offline, no Cairn involved:
age -d -i cairn-pq-recovery.txt /tmp/blob.age    # → the uploaded content

# 3. Negative — the OLD classical recovery key must FAIL on this file:
age -d -i <classical-recovery-key-file> /tmp/blob.age   # expect: no identity matched

# 4. Continuity — an OLD (pre-PQ) object must still open with the CLASSICAL key.

# cleanup
rm /tmp/blob.age cairn-pq-recovery.txt   # keys live in the password manager only

Record in this issue: which option was used, the four check results, and the first header line of the PQ object.

Follow-up for the handbook (#109): docs/handbook/encryption.md's migration checklist should name concrete tools for the raw-object pull (rclone example + awscli install hint) instead of assuming an S3 CLI exists — small docs edit, fold it into the next docs pass.

Nikola flipped the dogfood (.249) to post-quantum (#28, v0.3.29) on 2026-08-04 using the migration guide. Steps 1–6 succeeded (hybrid recovery key generated, secret edited, pod restarted clean, old files open, Keycloak attribute shows the two-value upgrade). **Step 7 — the Garage sovereignty proof — was not completed:** `aws` is not installed on the Mac (`zsh: command not found: aws`). **This issue:** run the fixed step 7 below during v0.5 and record the result here. Gate: must be green before v0.6 (public launch claims "recovery via plain `age -d`" — we don't launch on an unproven claim). --- ## Fixed sovereignty proof (step 7, two tool options) Credentials: the Garage access key/secret for the `cairn-enc` bucket, from the password manager. `cairn-pq-recovery.txt` = the hybrid recovery key from step 1 (re-export from the password manager if deleted). ### Option A — rclone (already installed for the sync setup; preferred) ```sh # list newest objects rclone lsl ':s3,provider=Other,endpoint="http://192.168.10.32:3900",region=garage,access_key_id=<KEY>,secret_access_key=<SECRET>:cairn-enc' | sort -k2,3 | tail # pull the raw object for the file uploaded in step 6 rclone copyto ':s3,provider=Other,endpoint="http://192.168.10.32:3900",region=garage,access_key_id=<KEY>,secret_access_key=<SECRET>:cairn-enc/<path-to-new-file>' /tmp/blob.age ``` (If the inline connection string is unwieldy: `rclone config` a remote named `garage` with provider Other, the endpoint, region `garage`, and the keys — then `rclone lsl garage:cairn-enc` / `rclone copyto garage:cairn-enc/<path> /tmp/blob.age`.) ### Option B — AWS CLI ```sh brew install awscli export AWS_ACCESS_KEY_ID=<KEY> AWS_SECRET_ACCESS_KEY=<SECRET> AWS_DEFAULT_REGION=garage aws --endpoint-url http://192.168.10.32:3900 s3 ls s3://cairn-enc/ --recursive | tail aws --endpoint-url http://192.168.10.32:3900 s3 cp "s3://cairn-enc/<path-to-new-file>" /tmp/blob.age ``` ### The actual proof (identical for both options) ```sh # 1. Header shows post-quantum stanzas: head -c 400 /tmp/blob.age # expect: mlkem768x25519 (no plain X25519 stanza) # 2. Hybrid recovery key opens it, offline, no Cairn involved: age -d -i cairn-pq-recovery.txt /tmp/blob.age # → the uploaded content # 3. Negative — the OLD classical recovery key must FAIL on this file: age -d -i <classical-recovery-key-file> /tmp/blob.age # expect: no identity matched # 4. Continuity — an OLD (pre-PQ) object must still open with the CLASSICAL key. # cleanup rm /tmp/blob.age cairn-pq-recovery.txt # keys live in the password manager only ``` **Record in this issue:** which option was used, the four check results, and the first header line of the PQ object. Follow-up for the handbook (#109): `docs/handbook/encryption.md`'s migration checklist should name concrete tools for the raw-object pull (rclone example + awscli install hint) instead of assuming an S3 CLI exists — small docs edit, fold it into the next docs pass.

Cordy added this to the v0.5 — Instance peering (federation v1) milestone

2026-08-04 13:05:49 +00:00

Cordy referenced this issue from a commit

2026-08-04 17:01:03 +00:00

docs(handbook): name concrete tools for the raw-object pull (#110 follow-up)

Cordy modified the milestone from v0.5 — Instance peering (federation v1) to v0.7 — Closed beta (dogfood + hardening)

2026-08-04 17:23:01 +00:00

Cordy referenced this issue

2026-08-12 21:14:41 +00:00

Domain separation (instanceSeed) for post-quantum deployment identities #108

Cordy commented

2026-08-12 21:15:03 +00:00

Author

Owner

Triage: tandem (verification you sign off). Complete the post-quantum sovereignty proof against the Garage backend — confirm PQ (hybrid ML-KEM) identities encrypt/recover end-to-end on the real bucket. Pairs with #108 (instanceSeed domain separation). I can script the checks; you validate the result.

**Triage: tandem (verification you sign off).** Complete the post-quantum sovereignty proof against the Garage backend — confirm PQ (hybrid ML-KEM) identities encrypt/recover end-to-end on the real bucket. Pairs with #108 (instanceSeed domain separation). I can script the checks; you validate the result.

Cordy commented

2026-08-13 01:53:30 +00:00

Author

Owner

Correction: this is not gated on or blocked by #108. My earlier "pairs with #108" was loose grouping (both touch post-quantum) and misleading. The two are independent:

#110 (this) proves a real PQ object from the Garage bucket decrypts offline with the hybrid recovery key via plain age -d — it needs only a PQ instance, its hybrid recoveryIdentity, and an S3 client. Nothing else.
#108 is instanceSeed domain separation for deployment custody in the PQ case (parked-by-design: age has no from-seed hybrid constructor) — an unrelated key-derivation concern that never touches the recovery path.

Proceed here independently. Steps 3–4 (classical key must fail; old pre-PQ object still opens with the classical key) apply only because the cairn-enc dogfood was migrated to PQ — they have no meaning on a born-PQ instance.

**Correction:** this is **not** gated on or blocked by #108. My earlier "pairs with #108" was loose grouping (both touch post-quantum) and misleading. The two are independent: - **#110** (this) proves a real PQ object from the Garage bucket decrypts offline with the hybrid recovery key via plain `age -d` — it needs only a PQ instance, its hybrid `recoveryIdentity`, and an S3 client. Nothing else. - **#108** is `instanceSeed` domain separation for `deployment` custody in the PQ case (parked-by-design: age has no from-seed hybrid constructor) — an unrelated key-derivation concern that never touches the recovery path. Proceed here independently. Steps 3–4 (classical key must fail; old pre-PQ object still opens with the classical key) apply only because the `cairn-enc` dogfood was *migrated* to PQ — they have no meaning on a born-PQ instance.

Cordy commented

2026-08-13 02:02:43 +00:00

Author

Owner

Green — sovereignty proof complete. Ran against the cairn-enc Garage bucket via rclone.

Header: the raw object's first stanza is mlkem768x25519 (no plain X25519) — genuinely post-quantum.
Positive: the hybrid recovery key decrypts it offline with plain age -d -i <hybrid-key> blob.age, no Cairn involved — the uploaded content comes back.
Negative: the old classical (legacy) recovery key fails on the same object: age: error: no identity matched any of the recipients.
Continuity: pre-migration objects still open with the classical key — established at the 2026-08-04 flip (old files opened post-migration) and consistent with (3).

The launch claim — recovery via plain age -d on a real post-quantum object — holds on the real backend. Closing.

Handbook follow-ups: the raw-object pull in encryption.md already names concrete tools (rclone + awscli install hint), and the classical→post-quantum live-migration path is now framed for self-deploying customers in the same doc's Post-quantum section.

**Green — sovereignty proof complete.** Ran against the `cairn-enc` Garage bucket via rclone. 1. **Header:** the raw object's first stanza is `mlkem768x25519` (no plain X25519) — genuinely post-quantum. 2. **Positive:** the hybrid recovery key decrypts it offline with plain `age -d -i <hybrid-key> blob.age`, no Cairn involved — the uploaded content comes back. 3. **Negative:** the old classical (legacy) recovery key fails on the same object: `age: error: no identity matched any of the recipients`. 4. **Continuity:** pre-migration objects still open with the classical key — established at the 2026-08-04 flip (old files opened post-migration) and consistent with (3). The launch claim — *recovery via plain `age -d` on a real post-quantum object* — holds on the real backend. Closing. Handbook follow-ups: the raw-object pull in `encryption.md` already names concrete tools (rclone + awscli install hint), and the classical→post-quantum **live-migration** path is now framed for self-deploying customers in the same doc's Post-quantum section.

Cordy closed this issue

2026-08-13 02:02:52 +00:00