From a9bc53312984b7ea826ef94ad536eef74b1eff15 Mon Sep 17 00:00:00 2001 From: CleverWild Date: Mon, 7 Sep 2026 13:50:24 +0200 Subject: [PATCH] test(vault): pin attestation validity across a re-key --- .../arbiter-server/src/actors/vault/mod.rs | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/server/crates/arbiter-server/src/actors/vault/mod.rs b/server/crates/arbiter-server/src/actors/vault/mod.rs index de5c3b5..b4050c7 100644 --- a/server/crates/arbiter-server/src/actors/vault/mod.rs +++ b/server/crates/arbiter-server/src/actors/vault/mod.rs @@ -649,4 +649,23 @@ mod tests { // able to unseal on the next attempt. actor.try_unseal(KeyCell::from([7u8; 32])).await.unwrap(); } + + #[tokio::test] + #[test_log::test] + async fn integrity_envelopes_survive_a_rekey() { + let db = db::create_test_pool().await; + let mut actor = bootstrapped_actor(&db).await; + + let mac_input = b"operator_credentials/1".to_vec(); + let (key_version, mac) = actor.sign_integrity(mac_input.clone()).unwrap(); + + actor.rekey_root_key(KeyCell::from([9u8; 32])).await.unwrap(); + + assert!( + actor + .verify_integrity(mac_input, mac, key_version) + .unwrap(), + "a seal-key re-key must not invalidate existing attestations" + ); + } }