Capsule trust: the signing certificate is never checked against the root, and an unsigned capsule only warns #139

New Issue

2026-11-07T20:15:24Z

rajames commented

2026-11-07 20:15:24 +00:00

Found

The kernel trusts whichever signing certificate is in its image (x509_ed25519.h: "never re-verified against the offline root CA at boot"); capsules/ACL.4th's ACL-CA-KEY-LO/HI are still 0. A signature proves a capsule matches the certificate in the same image, not that the image is ours.
CAPSULE_SIG_MISSING stays a warning permanently (ruled 2026-08-26: CI had no key). Since 2026-11-07 CI signs every build with the StarshipOS key (FABRIC-3 XLVI), so a release image has no reason to carry an unsigned capsule.

To rule

Anchor the StarshipOS Root CA's public key in the image and verify the signing certificate against it at boot (reverses FABRIC-2's "no boot-time verification")?
Refuse MISSING on release builds (or on real hardware), keeping the warning for developer builds?

Done when

Ruled; built; verified on all three architectures with a good, a missing and a wrong signature

🤖 Filed with Claude Code -- the review after v4.0.0-alpha.3 (Captain Bob, 2026-11-07: "a list of problems, deficiencies, smells and so on placed in issues by rank priority").

### Found - The kernel trusts whichever signing certificate is in its image (`x509_ed25519.h`: "never re-verified against the offline root CA at boot"); `capsules/ACL.4th`'s `ACL-CA-KEY-LO/HI` are still `0`. A signature proves a capsule matches the certificate in the same image, not that the image is ours. - `CAPSULE_SIG_MISSING` stays a warning permanently (ruled 2026-08-26: CI had no key). Since 2026-11-07 CI signs every build with the StarshipOS key (FABRIC-3 XLVI), so a release image has no reason to carry an unsigned capsule. ### To rule 1. Anchor the StarshipOS Root CA's public key in the image and verify the signing certificate against it at boot (reverses FABRIC-2's "no boot-time verification")? 2. Refuse MISSING on release builds (or on real hardware), keeping the warning for developer builds? ### Done when - [ ] Ruled; built; verified on all three architectures with a good, a missing and a wrong signature 🤖 Filed with [Claude Code](https://claude.com/claude-code) -- the review after v4.0.0-alpha.3 (Captain Bob, 2026-11-07: "a list of problems, deficiencies, smells and so on placed in issues by rank priority").

rajames added this to the v4.0.0-alpha.4 milestone 2026-11-07 20:15:24 +00:00

rajames added the

labels 2026-11-07 20:15:24 +00:00

rajames referenced this issue

2026-11-07 20:16:17 +00:00

alpha.4: the list #147