openevec: add-wireless for encrypted WiFi port - #1202
Merged
Conversation
eriknordmark
force-pushed
the
openevec-add-wireless
branch
from
July 2, 2026 22:16
a2121b2 to
fb40086
Compare
eriknordmark
force-pushed
the
openevec-add-wireless
branch
from
July 2, 2026 22:36
fb40086 to
116fee4
Compare
A new 'eden controller edge-node add-wireless' command injects a WiFi device port into the device config with its credentials encrypted (ECDH) against the device certificate, so EVE decrypts them at device-config ingest. This exercises credential decryption independent of the app pipeline and of physical radio presence. The encryption is factored out of the app-userdata path as a reusable EncryptForDevice helper (hard error, no plaintext fallback). Since the QEMU device model has no radio, the command synthesizes a wireless PhysicalIO and a non-management SystemAdapter; verified in a sandbox that nim decrypts the credentials at ingest even with no radio present. Signed-off-by: eriknordmark <erik@zededa.com> Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
eriknordmark
force-pushed
the
openevec-add-wireless
branch
from
July 6, 2026 05:46
116fee4 to
40eef8b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation: testing the kvm-to-k partition-resizing recovery from a lost /persist.
A new
eden controller edge-node add-wirelesscommand injects a WiFi deviceport into the device config with its credentials encrypted (ECDH) against the
device certificate, so EVE decrypts them at device-config ingest. This
exercises credential decryption independent of the app pipeline and of physical
radio presence.
The encryption is factored out of the app-userdata path as a reusable
EncryptForDevicehelper (hard error, no plaintext fallback). Since the QEMUdevice model has no radio, the command synthesizes a wireless PhysicalIO and a
non-management SystemAdapter; verified in a sandbox that nim decrypts the
credentials at ingest even with no radio present.
🤖 Generated with Claude Code