Repository navigation
Audit verify: report every open gap, accept a known gap, and give old anchors a log ID #158
Description
Follow-up of #40 (PR #157), from its security review.
Why
nodkey audit verify --anchors fails closed when an audit open line does not match the last anchor before it. Some normal events also cause that: a failed write to stderr after the sync, a failed sync, or a power cut that loses journal lines. Then the check stops at that open line, so later starts are not checked unless the person cuts the journal with --since. Two more cases fail a good log: a journal that lost its oldest lines, and old anchor lines (no log ID) of more than one log. The docs now explain each case and the --since way out.
What
checkOpensgoes on after a mismatch and reports every one.- A way to accept one known gap on the person's word, such as
--accept-open SEQ:HASH. - Old anchor lines get the log ID of the first open line with a log ID after them.
- Decide if "other log in the journal" needs its own exit code for scripts that read only the exit code.
Done when
- A test: two mismatched open lines are both reported.
- A test: an accepted gap passes, and only that gap.
- A test: old anchor lines of two logs, then a moved log, verify without
--since. - DESIGN.md section 9, THREAT-MODEL.md T17 and docs/setup.md section 12 match.
Activity
chore: start work on #158
groupsky commentedon Nov 10, 2026
Done in #168 (squash commit 0017857).
internal/audit/journal_test.go"two open lines that do not match are both reported"; CLI:cmd/nodkey/audit_test.go"two gaps are both reported, with how to accept one".--accept-open SEQ:HASH. Tests: "an accepted gap passes, and only that gap", "an accept for an open line that passes is refused", "a first open line after a line of another log cannot be accepted"; CLI "an accepted gap", "an accept with no gap".--since: "old-form anchors of two logs, then a moved log". Old anchors now take the log ID of the first open line with a log ID after them.Decision on the exit code: "other log in the journal" keeps exit code 0. A moved log is normal, so a non-zero code would fail a good check. Scripts can look for the "other log in the journal" line. The reason is in #168.