TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2025-08-14 15:07:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

tka: reject removal of the last signing key

Browse Source 
Fixes tailscale/corp#19447

Signed-off-by: Anton Tolchanov <anton@tailscale.com>
This commit is contained in:
Anton Tolchanov
2025-06-13 14:45:28 +01:00
committed by Anton Tolchanov
parent 59fab8bda7
commit 42da161b19
3 changed files with 25 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
cmd/tailscale/cli/network-lock.go
View File

@@ -326,6 +326,9 @@ func runNetworkLockRemove(ctx context.Context, args []string) error {
if !st.Enabled {
return errors.New("tailnet lock is not enabled")
}
if len(st.TrustedKeys) == 1 {
return errors.New("cannot remove the last trusted signing key; use 'tailscale lock disable' to disable tailnet lock instead, or add another signing key before removing one")
}
if nlRemoveArgs.resign {
// Validate we are not removing trust in ourselves while resigning. This is because