Bind dialect names to their first-registering principal #6

New issue

Open

opened 2026-05-11 13:10:03 +00:00 by hugooconnor · 0 comments

hugooconnor commented

2026-05-11 13:10:03 +00:00

(Migrated from codeberg.org)

The dialect store is content-addressed (keyed by digest), which is good. But the secondary name → latest-digest index is latest-write-wins by name alone, without regard to who taught it. A producer with ingress:submit scope can teach a malicious (define cbcl-email …) that wildly diverges from the legitimate one. R1-R5 still pass — the body is structurally well-formed; the harm is in the expansion templates pointing at attacker-controlled addresses. Workers subscribed to cbcl-email or * would then install the malicious version on the next push.

Mitigation

Bind each name to the principal that first registered it. Reject re-teach of an existing name from a different principal with name-already-bound-to-different-principal. Same principal re-teaching new bytes for the same name continues to work as today (versioning a dialect you own is the honest case).

Acceptance

cbcl-dialect-store gen_server state grows a name → principal map (in addition to the existing name → digest).
handle_call (teach …) checks: if name exists and recorded-principal ≠ new-principal, reply {error, name_squatting}.
Bootstrap-time teach (the router's own cbcl-router dialect once we ship it again) uses #"router" as principal; matches subsequent same-author re-teach.
Test: two principals teach the same name; second is rejected, first remains authoritative.
Test: same principal re-teaches the same name with new bytes; second wins, digest rotates.

Out of scope

R4 (Ed25519 signature) enforcement on the define itself — separate concern; this issue is about binding by connection-level principal only.
Authority delegation (@anuna lets @deploy-bot teach on its behalf).
Hierarchical naming / namespaces.

See discussion in hark conversation on the dialect-distribution threat model.

The dialect store is content-addressed (keyed by digest), which is good. But the secondary **name → latest-digest** index is latest-write-wins by name alone, without regard to who taught it. A producer with `ingress:submit` scope can teach a malicious `(define cbcl-email …)` that wildly diverges from the legitimate one. R1-R5 still pass — the body is structurally well-formed; the harm is in the expansion templates pointing at attacker-controlled addresses. Workers subscribed to `cbcl-email` or `*` would then install the malicious version on the next push. ## Mitigation Bind each name to the principal that *first* registered it. Reject re-teach of an existing name from a different principal with `name-already-bound-to-different-principal`. Same principal re-teaching new bytes for the same name continues to work as today (versioning a dialect you own is the honest case). ## Acceptance - [ ] `cbcl-dialect-store` gen_server state grows a `name → principal` map (in addition to the existing `name → digest`). - [ ] `handle_call (teach …)` checks: if name exists and recorded-principal ≠ new-principal, reply `{error, name_squatting}`. - [ ] Bootstrap-time teach (the router's own `cbcl-router` dialect once we ship it again) uses `#"router"` as principal; matches subsequent same-author re-teach. - [ ] Test: two principals teach the same name; second is rejected, first remains authoritative. - [ ] Test: same principal re-teaches the same name with new bytes; second wins, digest rotates. ## Out of scope - R4 (Ed25519 signature) enforcement on the define itself — separate concern; this issue is about binding by *connection-level* principal only. - Authority delegation (`@anuna` lets `@deploy-bot` teach on its behalf). - Hierarchical naming / namespaces. See discussion in hark conversation on the dialect-distribution threat model.

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

anuna-research/cbcl-router#6

No description provided.

Rows
Columns