wallpaper 1.2: signed-resident scaffold (caps re-mint pending)#158
Merged
Conversation
…trust/capsules/wallpaper.nonos_id_cert.bin [1.2]
…/capsules/wallpaper.manifest.bin [1.2]
…per_publisher_ed25519.pub [1.2]
…per_publisher_mldsa65.pub [1.2]
…erspace/capsule_wallpaper/embed.rs [1.2]
…rspace/capsule_wallpaper/state.rs [1.2]
… spawn path — src/userspace/capsule_wallpaper/spawn.rs [1.2]
…str> mismatch) — src/userspace/init/entry.rs [1.2]
Contributor
There was a problem hiding this comment.
Pull request overview
Converts the wallpaper kernel mirror toward the signed capsule spawn flow used by other resident capsules, with lifecycle state and signed trust artifacts.
Changes:
- Adds wallpaper lifecycle state and exports
shared_state. - Embeds wallpaper cert/manifest bytes and switches spawn to
CapsuleSpecVerified+spawn_verified. - Updates init boot wiring from display identity to wallpaper identity.
Reviewed changes
Copilot reviewed 5 out of 9 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
src/userspace/init/entry.rs |
Boots wallpaper under the wallpaper identity and lifecycle state. |
src/userspace/capsule_wallpaper/state.rs |
Adds shared lifecycle state for the wallpaper capsule. |
src/userspace/capsule_wallpaper/spawn.rs |
Replaces unsigned spawn with signed verified spawn. |
src/userspace/capsule_wallpaper/mod.rs |
Exports the new lifecycle state accessor. |
src/userspace/capsule_wallpaper/embed.rs |
Embeds wallpaper cert and manifest alongside the ELF. |
| | Capability::Memory.bit() | ||
| | Capability::Debug.bit() | ||
| | Capability::GraphicsDisplayQuery.bit() | ||
| | Capability::GraphicsSurfaceCreate.bit(), |
Comment on lines
+54
to
+55
| let pid = capsule_spawn::spawn_verified(&spec, &trust_anchor, None)?; | ||
| state::set_alive(pid); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
wallpaper 1.2 — signed-resident scaffold (Plan A Option A, accurately scoped)
Converts the wallpaper kernel mirror from the unsigned
CapsuleSpec+capsule_spawn::spawnanti-pattern to the signedCapsuleSpecVerified+spawn_verified+ baked-trust-anchor pattern used bydesktop_shell/login/clipboard/image_codec.Changes (9 commits, one per file)
src/userspace/capsule_wallpaper/embed.rs— embed signed cert + manifestsrc/userspace/capsule_wallpaper/state.rs(new) —CapsuleState/shared_state, byte-identical todesktop_shellsrc/userspace/capsule_wallpaper/spawn.rs—CapsuleSpecVerified+spawn_verified, reconciled to the signed Capsule.mk contract(
wallpaper/ port 4340); unsigned spawn path droppedsrc/userspace/capsule_wallpaper/mod.rs— exportshared_statesrc/userspace/init/entry.rs— signed-residentboot()wiring; also fixesthe latent
|| Some("display")Option<&str>-vs-CapsuleStatetypemismatch (same class as
about)launch.rs/seed.rs(the cross-subsystem one-shot proof harness) aredeliberately untouched — removing them is a separate owner decision.
Wallpaper is not added to the production
microkernel-desktop-guibundle (see blocker below), so the kernel build stays green.
Verification
Kernel-API surface of
spawn.rsis structurally identical to main'salready-compiled
desktop_shellmirror;state.rsbyte-identical. Userlandcapsule_wallpapercrate unchanged.Known blocker (owner / signing-ceremony — must resolve before going live)
The wallpaper signed manifest ceiling is
0x1919=CoreExec|IPC|Memory|Debug|GraphicsDisplayQuery|GraphicsSurfaceCreate. Itlacks
GraphicsSurfaceMap(0x2000) +GraphicsPresent(0x4000) thatwallpaper's graphics round-trip (
surface_map,surface_present_full)requires. Promoting wallpaper into a live signed profile requires
re-minting the manifest with the broader caps (a signing-ceremony action
intentionally not wired into a shipped profile until the re-mint lands.