From 02442d988690d2b3258b7b08a7282e52d8bf4200 Mon Sep 17 00:00:00 2001 From: Santiago Date: Sun, 9 Aug 2026 19:07:00 -0300 Subject: [PATCH] feat(stelae): name the official registry's published read-only pair The constants #1184 shipped empty now carry the pair the deployed registry at oci.stelae.store issues: a fresh `dolos init` seeds `[stelae.registry] user = "stelae"` and the binary answers for the password, so a generated config pulls steles out of the box while the pair itself stays rotatable in one place. The password is the published read-only credential -- public by design, pull-only by enforcement -- and gates nothing but out-of-band tooling. Co-Authored-By: Claude Fable 5 --- src/bin/dolos/init.rs | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/src/bin/dolos/init.rs b/src/bin/dolos/init.rs index 297a1fcd..02c3e16f 100644 --- a/src/bin/dolos/init.rs +++ b/src/bin/dolos/init.rs @@ -196,8 +196,8 @@ impl From<&KnownNetwork> for MithrilConfig { /// generated `dolos.toml` gets everything it points at. Written into the file, /// so a config says which identity it reads the registry as. /// -/// Empty until the registry that issues it exists. -const OFFICIAL_REGISTRY_USER: &str = ""; +/// Issued by the official registry at `oci.stelae.store`. +const OFFICIAL_REGISTRY_USER: &str = "stelae"; /// The password that goes with [`OFFICIAL_REGISTRY_USER`], compiled in rather /// than written to `dolos.toml`. @@ -218,16 +218,18 @@ const OFFICIAL_REGISTRY_USER: &str = ""; /// `doctor` reaches into it for [`KnownNetwork`] rather than keeping a second /// account of what the defaults are. /// -/// Empty until the registry exists. Filling both constants is a two-line change -/// here and nowhere else. -pub const OFFICIAL_REGISTRY_PASSWORD: &str = ""; +/// Rotating the pair is a change here and nowhere else — paired with a release +/// and comms, because generated configs and released binaries carry the old one +/// until their nodes update. +pub const OFFICIAL_REGISTRY_PASSWORD: &str = "7214892e36157f4051677b51526382cc96693d45eda4e4cd"; /// `[stelae]` as a generated config carries it: the official registry's user, /// and no password. /// -/// Empty while [`OFFICIAL_REGISTRY_USER`] is, which is why it is a function -/// rather than a `Default` impl on the config type — it asks for the official -/// registry specifically, and gives the honest answer while there is not one. +/// Empty only while [`OFFICIAL_REGISTRY_USER`] is, which is why it is a +/// function rather than a `Default` impl on the config type — it asks for the +/// official registry specifically, and would give the honest answer if there +/// were not one. fn official_stelae() -> StelaeConfig { StelaeConfig { registry: (!OFFICIAL_REGISTRY_USER.is_empty()).then(|| StelaeRegistryConfig {