Repository navigation
Hybrid: installs require the v2 relay signature (merge after #309 is deployed) - #317
Merged
Merged
Conversation
Relayed events have carried v2 (which also signs the source and event headers) since the hosted side's hardening. Installs now refuse an event without it, so the routing headers can never be changed in transit. Merge only after that hosted change has been live for a release cycle: an older hosted side sends v1 alone.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Merge only after #309 has been deployed and live for a release cycle. Since #309, the hosted relay signs each forwarded event with
v2, which also covers the source and event headers. Installs still acceptv1alone so they keep working with an older hosted side. This PR removes that allowance: an install refuses any relayed event without a matchingv2.Changes
common/src/hybrid/sign.rs:verify_relayrequiresv2(missing:signature_malformed; wrong:signature_mismatch), and the tests sign withsign_relay_routed.gateway/src/routes/hybrid_install.rs: the intake's OpenAPI description says a request withoutv2is refused.docs/api/openapi.jsonis regenerated.docs/self-host/hybrid.md: says so too.Verification
the_route_of_a_relayed_event_is_signednow asserts that av1-only header is refused.cargo fmt --check,cargo clippy --all-targets -- -D warnings,cargo test(workspace, including the OpenAPI document check).v2, installs answer 401 (signature_malformed) to every relayed event. The relay retries a 401 for about 24 hours and then gives up, so events would be lost if the hosted side isn't updated within that time.