coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
key-cape/docs/credential-renewal-release-2026-09-13.md
tegwick 78f5a718e9 Record provider credential renewal release and remaining owner handoff 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
2026-09-13 14:27:35 +02:00

2.5 KiB
Raw Blame History

Provider credential renewal release — 2026-09-13

Platform journey P05 consumer implementation, KEY-WP-0035-T04. Source 632b1f1376cfcbde6340aed6137213ab79aa8708. Image forgejo.coulomb.social/coulomb/key-cape@sha256:c9eb584d60efecfe00e1745a7e8cd3ebb4ae0f94faa715ef9594cd58a5dcebb6.

Exclusive adminTokenFile supports per-request credential renewal for factor lookup and OTP validation. Atomic file/symlink replacement is tested. Invalid or missing input fails without stale/inline fallback or secret-bearing error text. Regular absolute file input is bounded to 16 KiB. The default HTTP client refuses redirects and bounds requests to ten seconds. OTP validation now requires both provider success and a true validation result; false/missing success flags deny.

go test ./... passed, including five new test functions covering renewal, invalid-source subcases, rejection/recovery, malformed provider outcomes and redirect refusal. Authentication acceptance CI run 50 and image run 51 passed for the exact source revision. The CI suite now executes on authentication source changes. Synthetic test credentials only; no live factors or identities mutated.

Image-only live rollout used tests of cluster UID, deployment UID/resourceVersion and predecessor image. KeyCape Ready 1/1. Four public provider checks passed: health, readiness, OIDC discovery and the discovery-advertised JWKS endpoint. Twelve isolated live Chromium recovery/sign-out checks passed. Pending issuer login/code state is process-local and resets during Recreate replacement.

The source release includes previously tested optional-policy support, but no client policy, credential value, mount or issuer signing-key configuration was changed. Mounted-file renewal has NOT been activated live. The existing provider credential failure is not claimed fixed. The owner must deliver and verify the scoped credential, expiry/renewal and custody contract before enabling the file.

Canonical pin: net-kingdom/sso-mfa/k8s/keycape/deployment.yaml. Rollback predecessor: sha256:5f58563aa903ffa0c060e5ae9eb436aa963322d26bdde393efd2dd506dc6c4ed. Rollback was not required; it would restore the previous validation behavior.

Residual provider recovery/policy acceptance remains KEY-WP-0035-T02/T03 and USER-WP-0030-T03. Owner contract railiance-platform/docs/net-kingdom-credential-custody-contract.md remains draft with required path/field placeholders; the registered route remains non-resolvable. No live Secret read, issuance, renewal or policy mutation was performed.