EchoLot/echolot
1
0
Fork 0
Code Pull Requests Actions Packages Projects Releases 31 Wiki Activity

server: refuse unsigned releases and polluted reserved addresses

Browse Source 
Self-update now verifies SHA256SUMS.sig (ed25519, relsign package) against
a public key baked into the binary; the private key exists only in the CI
secret store, so a compromised release host can withhold updates but not
inject one. CI signs on every server-v* tag and hard-fails without the
secret. Operators with their own pipeline override the key via
ECHOLOT_SELF_UPDATE_PUBKEY (mint a pair with release-sign -gen).

Startup also now proves 80/443 are actually free on the reserved
measurement addresses by asking the OS (throwaway bind), not the config -
CheckReserved could never see a stray process, and the adb-beacon receiver
on 0.0.0.0:443 was exactly that.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
mrambossek
2026-08-02 12:32:02 +02:00
co-authored by Claude Opus 5
parent 20cfecf566
commit a49bef5821
12 changed files with 472 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/cmd/echolot-server/main.go
+24 -1
View File
@@ -113,7 +113,7 @@ func run() error {
case actions.MintEnrollToken != "":
return mintEnrollToken(cfg, actions.MintEnrollToken)
case actions.SelfUpdate:
return selfupdate.Run(cfg.SelfUpdateAPI, Version)
return selfupdate.Run(cfg.SelfUpdateAPI, cfg.SelfUpdatePubKey, Version)
}
return serve(cfg)
}
@@ -166,6 +166,29 @@ func serve(cfg *config.Config) error {
map[bool]string{true: "container", false: "native"}[cfg.Docker],
"state_dir", cfg.StateDir)
// The reserved addresses' proof is only as good as 80/443 actually being free there.
// CheckReserved already keeps OUR listeners away, but a process outside this config pollutes
// them just as silently — the adb-beacon receiver on 0.0.0.0:443 did exactly that. So ask
// the OS, not the config. A hard stop for the same reason CheckReserved is one: the failure
// is invisible, and its first symptom is a measurement calling an intercepted network clean.
if reserved := cfg.ReservedIPs(); len(reserved) > 0 {
occupied, unverifiable := selftest.ReservedWebPortsFree(reserved)
if len(occupied) > 0 {
return fmt.Errorf(
"refusing to start: something outside this server is listening on reserved "+
"measurement address(es) %s\n"+
"The interception proof those addresses exist for is void while anything "+
"answers there.\nFind it with `ss -tlnp | grep -E ':(80|443) '`, stop it, "+
"or remove the address from ECHOLOT_RESERVED_ADDRS if it is no longer reserved",
strings.Join(occupied, ", "))
}
for _, u := range unverifiable {
// Not fatal: an address with a typo, or one this host no longer carries, is a
// config problem — refusing to serve over it would take the whole instrument down.
slog.Warn("could not verify a reserved web port is free", "addr", u)
}
}
st, err := store.Open(cfg.StateDir)
if err != nil {
return fmt.Errorf("state store: %w", err)