From 185cdaabdb3c97338e6a58e7ccb0f155c8a89939 Mon Sep 17 00:00:00 2001 From: George Lambert Date: Tue, 15 Sep 2026 23:29:25 -0400 Subject: [PATCH] S26: deploy generates nats.env PSK, FORBID_PLAIN, rebuilt pfc-repl PDF bundle rsync so relative PDF links resolve on docs.pfc. --- Historical-Information.MD | 6 ++++++ TODO.md | 1 + cicd/deploy-ns1.sh | 42 ++++++++++++++++++++++++++++++++++++++- cicd/run-review.sh | 2 +- 4 files changed, 49 insertions(+), 2 deletions(-) diff --git a/Historical-Information.MD b/Historical-Information.MD index b293a4b..61647aa 100644 --- a/Historical-Information.MD +++ b/Historical-Information.MD @@ -109,6 +109,12 @@ After a context reset: read this file, then `Remaining-Work.MD`. - `sync.pfc.georgelambert.org` Caddy (DNS already pointed at 138). - Deep links: console footer, hub `links.html`, `https://georgelambert.org/pfc/` (one page; 70 website repos not rewritten). +## S26 (certification-ready controls, still not a certificate) + +- NATS remains **untrusted**. Bodies: `pfc-lab-xor` with host PSK (`PFC_NATS_KEY` + `PFC_FORBID_PLAIN=1`). Python and Go envelopes round-trip the same vector. Production E2E remains NPE/HPKE (`PFC_REQUIRE_NPE` still unset). +- PDFs link to **sibling PDFs** (`nats-service-endpoints.pdf`, `secure-messaging.pdf`, `peergos-for-compliance.pdf`) — no `.md` hrefs. +- Controls / custody / variables chapters in the system PDF. + Go `pfc-repl` now serves loopback `GET 127.0.0.1:18784/health`; admin `PFC_REPL_URL` points there. Ingest replicas a/b do not bind HTTP. ## Do not diff --git a/TODO.md b/TODO.md index 645bf29..8b5a744 100644 --- a/TODO.md +++ b/TODO.md @@ -30,3 +30,4 @@ Insert **new** dependencies **above** the blocked item. - [x] S23 HTML + LaTeX PDFs (system 32p, catalog 17p, SM 11p) - [x] S24 CI run-review expanded; deploy + live revalidate - [x] S25 UserReview: HSM custody docs+rotate, npe CLI probe (REQUIRE_NPE unset), sync.pfc Caddy, website deep-links +- [x] S26 NATS payloads lab-xor (Python+Go match); FORBID_PLAIN on ns1; PDF relative sibling links; controls chapter diff --git a/cicd/deploy-ns1.sh b/cicd/deploy-ns1.sh index ab01715..b704366 100755 --- a/cicd/deploy-ns1.sh +++ b/cicd/deploy-ns1.sh @@ -12,10 +12,13 @@ bash "$ROOT/system-git-sync/cicd/run-review.sh" echo "=== linux sm-leaf ===" mkdir -p "$ROOT/secure-messaging/go/bin" ( cd "$ROOT/secure-messaging/go" && GOOS=linux GOARCH=amd64 go build -o bin/sm-leaf-linux ./cmd/sm-leaf ) +echo "=== linux pfc-repl ===" +( cd "$ROOT/peergos-compliance-go" && GOOS=linux GOARCH=amd64 go build -o /tmp/pfc-repl-linux ./cmd/pfc-repl ) echo "=== rsync ===" ssh "$HOST" 'sudo mkdir -p /opt/pfc/bin /opt/pfc/python/secure_messaging /opt/pfc/python/admin /opt/pfc/python/lib /opt/pfc/etc /opt/pfc/data/admin/admin-history /opt/pfc/docs/html/sync /opt/pfc/docs/html/nats-service-endpoints' rsync -az "$ROOT/secure-messaging/go/bin/sm-leaf-linux" "$HOST:/tmp/sm-leaf-linux" +rsync -az /tmp/pfc-repl-linux "$HOST:/tmp/pfc-repl-linux" rsync -az --exclude '__pycache__' "$ROOT/secure-messaging/python/secure_messaging/" "$HOST:/tmp/secure_messaging/" rsync -az "$ROOT/secure-messaging/deploy/pfc-sm-leaf.service" "$HOST:/tmp/pfc-sm-leaf.service" rsync -az "$ROOT/system-git-sync/" --exclude '.git' --exclude '.forgejo' "$HOST:/tmp/system-git-sync/" @@ -33,6 +36,9 @@ fi if [[ -f "$ROOT/peergos-compliance-docs/build/latex/peergos-for-compliance.pdf" ]]; then rsync -az "$ROOT/peergos-compliance-docs/build/latex/peergos-for-compliance.pdf" "$HOST:/tmp/pfc-docs.pdf" fi +if [[ -d "$ROOT/peergos-compliance-docs/build/pdf-bundle" ]]; then + rsync -az "$ROOT/peergos-compliance-docs/build/pdf-bundle/" "$HOST:/tmp/pdf-bundle/" +fi if [[ -d "$ROOT/secure-messaging/build/html" ]]; then rsync -az "$ROOT/secure-messaging/build/html/" "$HOST:/tmp/sm-html/" fi @@ -46,9 +52,36 @@ rsync -az "$ROOT/system-git-sync/docs/" --exclude pfc-site "$HOST:/tmp/sync-docs echo "=== install on host ===" ssh "$HOST" 'bash -s' << "EOF" set -e -sudo systemctl stop pfc-sm-leaf || true +sudo systemctl stop pfc-sm-leaf pfc-repl pfc-repl-a pfc-repl-b || true sudo cp /tmp/sm-leaf-linux /opt/pfc/bin/sm-leaf sudo chmod +x /opt/pfc/bin/sm-leaf +if [ -f /tmp/pfc-repl-linux ]; then + sudo cp /tmp/pfc-repl-linux /opt/pfc/bin/pfc-repl + sudo chmod +x /opt/pfc/bin/pfc-repl +fi +# bus PSK: never plaintext PHI on NATS (broker remains untrusted) +if [ ! -f /opt/pfc/etc/nats.env ]; then + k=$(python3 -c 'import secrets; print(secrets.token_hex(32))') + printf 'PFC_NATS_KEY=%s\nPFC_FORBID_PLAIN=1\n' "$k" | sudo tee /opt/pfc/etc/nats.env >/dev/null + sudo chmod 600 /opt/pfc/etc/nats.env +fi +sudo mkdir -p /etc/systemd/system/pfc-py-admin.service.d /etc/systemd/system/pfc-repl.service.d /etc/systemd/system/pfc-repl-a.service.d /etc/systemd/system/pfc-repl-b.service.d +sudo tee /etc/systemd/system/pfc-py-admin.service.d/nats-psk.conf >/dev/null << 'UNIT' +[Service] +EnvironmentFile=-/opt/pfc/etc/nats.env +UNIT +sudo tee /etc/systemd/system/pfc-repl.service.d/nats-psk.conf >/dev/null << 'UNIT' +[Service] +EnvironmentFile=-/opt/pfc/etc/nats.env +UNIT +sudo tee /etc/systemd/system/pfc-repl-a.service.d/nats-psk.conf >/dev/null << 'UNIT' +[Service] +EnvironmentFile=-/opt/pfc/etc/nats.env +UNIT +sudo tee /etc/systemd/system/pfc-repl-b.service.d/nats-psk.conf >/dev/null << 'UNIT' +[Service] +EnvironmentFile=-/opt/pfc/etc/nats.env +UNIT sudo mkdir -p /opt/pfc/python/secure_messaging /opt/pfc/python/admin/pfc_admin /opt/pfc/python/lib sudo rsync -a /tmp/secure_messaging/ /opt/pfc/python/secure_messaging/ sudo rsync -a /tmp/pfc_admin/ /opt/pfc/python/admin/pfc_admin/ @@ -144,6 +177,12 @@ fi if [ -f /tmp/pfc-docs.pdf ]; then sudo cp /tmp/pfc-docs.pdf /opt/pfc/docs/html/peergos-for-compliance.pdf fi +if [ -d /tmp/pdf-bundle ]; then + sudo cp /tmp/pdf-bundle/*.pdf /opt/pfc/docs/html/ + sudo cp /tmp/pdf-bundle/*.pdf /opt/pfc/docs/html/nats-service-endpoints/ 2>/dev/null || true + sudo mkdir -p /opt/pfc/docs/html/secure-messaging + sudo cp /tmp/pdf-bundle/*.pdf /opt/pfc/docs/html/secure-messaging/ 2>/dev/null || true +fi if [ -d /tmp/sm-html ]; then sudo mkdir -p /opt/pfc/docs/html/secure-messaging sudo rsync -a /tmp/sm-html/ /opt/pfc/docs/html/secure-messaging/ @@ -165,6 +204,7 @@ if [ -f /tmp/system-git-sync/../peergos-compliance-go/deploy/pfc.georgelambert.o fi sudo systemctl daemon-reload sudo systemctl enable --now pfc-sm-leaf +sudo systemctl start pfc-repl pfc-repl-a pfc-repl-b sudo systemctl restart pfc-py-admin sleep 2 systemctl is-active pfc-sm-leaf pfc-py-admin pfc-connector pfc-peergos-bridge diff --git a/cicd/run-review.sh b/cicd/run-review.sh index d974c56..f8b9c12 100755 --- a/cicd/run-review.sh +++ b/cicd/run-review.sh @@ -20,7 +20,7 @@ if [[ -d "$ROOT/secure-messaging/go" ]]; then ( cd "$ROOT/secure-messaging/go" && run go test ./... ) fi if [[ -d "$ROOT/peergos-compliance-go" ]]; then - ( cd "$ROOT/peergos-compliance-go" && run go test ./cmd/pfc-repl ./internal/leaf ) + ( cd "$ROOT/peergos-compliance-go" && run go test ./cmd/pfc-repl ./internal/leaf ./internal/envelope ) fi if [[ -f "$ROOT/peergos-for-compliance-ipfs/pfc_ipfs/server.py" ]]; then run python3 -m py_compile "$ROOT/peergos-for-compliance-ipfs/pfc_ipfs/server.py"