tegwick
c1e83c16bf
Approve CCR-2026-0050 for Access scope (sent to railiance-platform).
Add the exact consumer pin derived at candidate 84c78e0 and an offline
projection from the Platform custody receipt to the secrets-engine
pdp-trust.v1 bytes plus a public receipt. No key, rollout or admission.
T07 waits on founder decision 4fab263d.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 809600@bnt-lap001
Assistant-Session: 40ba228f-c8a0-4ec9-bb29-3129951afdc4
46 lines
2.1 KiB
Python
46 lines
2.1 KiB
Python
"""Offline regression for the signer public receipt projection (synthetic values only)."""
|
|
import base64
|
|
import hashlib
|
|
import importlib.util
|
|
import json
|
|
from pathlib import Path
|
|
import unittest
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
spec = importlib.util.spec_from_file_location('public_receipt', ROOT / 'tools/prepare_signer_public_receipt.py')
|
|
MODULE = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(MODULE)
|
|
PIN = (ROOT / 'docs/native-signer-public-pin.json').read_bytes()
|
|
KEY = base64.urlsafe_b64encode(bytes(range(32))).decode().rstrip('=') # synthetic, not a real key
|
|
|
|
|
|
def custody(**changes):
|
|
value = {'schema': MODULE.CUSTODY_SCHEMA, 'path': MODULE.CUSTODY_PATH, 'kv_version': 1,
|
|
'status': 'custody-verified-pending-independent-public-admission',
|
|
'kid': 'flex-auth-lifecycle-20261016-r1', 'public_key': KEY,
|
|
'public_fingerprint': 'sha256:' + hashlib.sha256(KEY.encode()).hexdigest()}
|
|
value.update(changes)
|
|
return json.dumps(value).encode()
|
|
|
|
|
|
class PublicReceiptTests(unittest.TestCase):
|
|
def test_trust_matches_secrets_schema(self):
|
|
trust_bytes, receipt = MODULE.build(custody(), PIN, b'ccr', b'plan')
|
|
trust = json.loads(trust_bytes)
|
|
self.assertEqual(set(trust), {'schema', 'evaluator', 'mode', 'policy_package', 'policy_version',
|
|
'policy_package_digest', 'keys'})
|
|
self.assertEqual(trust['keys'], {'flex-auth-lifecycle-20261016-r1': KEY})
|
|
self.assertEqual(receipt['trust_file_sha256'], 'sha256:' + hashlib.sha256(trust_bytes).hexdigest())
|
|
self.assertNotIn(b'PRIVATE', json.dumps(receipt).encode())
|
|
|
|
def test_refusals(self):
|
|
for bad in (custody(kv_version=None), custody(status='write-intent-unknown'),
|
|
custody(kid='other'), custody(public_fingerprint='sha256:00'),
|
|
custody(public_key=KEY + '='), custody(ED25519_PRIVATE_KEY='x'),
|
|
custody(source_ccr_sha256='sha256:other')):
|
|
with self.assertRaises(ValueError):
|
|
MODULE.build(bad, PIN, b'ccr', b'plan')
|
|
|
|
|
|
if __name__ == '__main__':
|
|
unittest.main()
|