Robert Allan JamesandClaude Sonnet 5
2fc55f47e1
First attempt shelled out to `openssl pkeyutl -sign` (fork/execlp, not system() -- avoided shell string interpolation of the key path). Corrected on request: no new external host binary dependency when the repo's own code can do the job -- same standing preference as the earlier anti-file correction. Rewritten to link ed25519_sign() (already verified against OpenSSL in Phase B) directly into mkcapsule. New tools/pkcs8_ed25519.c: a narrow DER walker (same shape as x509_ed25519.c, deliberately not shared -- small enough that duplicating a few TLV-walking lines beat threading a header between the kernel crypto tree and host tooling) extracting the raw seed from the intermediate's PKCS#8 private key, plus a minimal self-written base64 decoder (PEM is openssl genpkey's default output; no decoder existed anywhere in the repo). Verified end-to-end before wiring anything in: the extracted seed's derived pubkey matches the cert's exactly, and a full self-contained sign+verify round-trip (zero openssl) passes. CapsuleDesc had no spare bytes, so signatures live in a new parallel CapsuleSigEntry array, emitted by a new `mkcapsule --sign-key <path>` flag (omitted/missing key -> has_sig=0 everywhere, graceful, not a build failure -- CI has no access to the offline key). New capsule_sig.c/.h: capsule_verify_signature(), a separate function, not folded into the already-tested capsule_validate(). Finds and caches the embedded intermediate cert's pubkey once per boot, then verifies against it. Wired into all three capsule_validate() call sites in capsule_birth.c via log_message(LOG_WARN, ...) -- never refuses yet, per the earlier staged-rollout decision. Verified independently, both directions, live in the real kernel: a full clean build (38 signed capsules) boots clean on all three architectures with zero warnings. Separately, hand-corrupted one byte of Mama's own init.4th capsule's stored signature (not its payload/hash, which capsule_validate() already catches and would have masked the test) and rebuilt just the changed object: produced exactly "capsule sig: init.4th: INVALID -- signature does not verify" on boot, and the kernel still reached ok> -- proving warn-only doesn't refuse anything yet. Reverted before the final, untampered 3-arch acceptance pass. Still open: flipping WARN to hard-refuse (separate, deliberate step) and the BLOCK_MAP.md signature-status column. Documented in FABRIC-3.md. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01U14ET9CWAtbQMbYqomKgXd
tools/
Build-time and integration-test utilities for the StarForth / LithosAnanke toolchain.
Contents
| File | Purpose |
|---|---|
mkcapsule.c |
Assembles .4th capsule files into capsule_generated.c baked into the kernel image. Invoked automatically by Makefile.starkernel. |
mkcapsule |
Compiled host binary (rebuilt on demand). |
ttftest.c |
Host TTF glyph-rendering test — font rasterization unit tests, no QEMU needed. |
pe_reloc_gen.py |
Generates PE32+ relocation tables for the UEFI loader. |
svg_to_png.py |
Renders every tracked .svg in the repo to a same-named .png via headless Chromium; leaves the source .svg untouched, run manually. |
hermes_smoke.sh |
Hermes v1 hosted smoke test — swaps in the Hermes init capsule and prints values for manual inspection. |
hermes_channel_smoke.sh |
Exercises the full Hermes channel-negotiation lifecycle (CH-REQUEST → CH-ACCEPT → CH-CLOSE → reap) per the protocol in .claude/HERMES.md. |
hermes_tripod_smoke.sh |
Full Tripod integration test — exercises all 6 inter-VM message paths using the DEFER VM-EXEC/IS VM-EXEC dispatcher shim from init.4th. |
kconfig/ |
Vendored Linux kernel Kconfig tooling (conf/mconf/qconf), GPL-2.0. See tools/kconfig/README.md. |
mkcapsule
# Invoked automatically by the kernel build:
make -f Makefile.starkernel ARCH=amd64 clean qemu
# Manual invocation (for inspection):
./tools/mkcapsule capsules/ build/amd64/kernel/capsule_generated.c
Scans capsules/ for .4th files, computes XXHash64 per capsule, assigns
type (m) to init.4th and (p) to everything else.
See also
capsules/README.md— capsule file format and block namespaceMakefile.starkernel— kernel build system- Project root