tegwick
78f5a718e9
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
40 lines
2.5 KiB
Markdown
40 lines
2.5 KiB
Markdown
# Provider credential renewal release — 2026-09-13
|
|
|
|
Platform journey P05 consumer implementation, KEY-WP-0035-T04.
|
|
Source `632b1f1376cfcbde6340aed6137213ab79aa8708`.
|
|
Image `forgejo.coulomb.social/coulomb/key-cape@sha256:c9eb584d60efecfe00e1745a7e8cd3ebb4ae0f94faa715ef9594cd58a5dcebb6`.
|
|
|
|
Exclusive `adminTokenFile` supports per-request credential renewal for factor
|
|
lookup and OTP validation. Atomic file/symlink replacement is tested. Invalid or
|
|
missing input fails without stale/inline fallback or secret-bearing error text.
|
|
Regular absolute file input is bounded to 16 KiB. The default HTTP client refuses
|
|
redirects and bounds requests to ten seconds. OTP validation now requires both
|
|
provider success and a true validation result; false/missing success flags deny.
|
|
|
|
`go test ./...` passed, including five new test functions covering renewal,
|
|
invalid-source subcases, rejection/recovery, malformed provider outcomes and
|
|
redirect refusal. Authentication acceptance CI run 50 and image run 51 passed
|
|
for the exact source revision. The CI suite now executes on authentication source
|
|
changes. Synthetic test credentials only; no live factors or identities mutated.
|
|
|
|
Image-only live rollout used tests of cluster UID, deployment UID/resourceVersion
|
|
and predecessor image. KeyCape Ready 1/1. Four public provider checks passed:
|
|
health, readiness, OIDC discovery and the discovery-advertised JWKS endpoint.
|
|
Twelve isolated live Chromium recovery/sign-out checks passed. Pending issuer
|
|
login/code state is process-local and resets during Recreate replacement.
|
|
|
|
The source release includes previously tested optional-policy support, but no
|
|
client policy, credential value, mount or issuer signing-key configuration was
|
|
changed. Mounted-file renewal has NOT been activated live. The existing provider
|
|
credential failure is not claimed fixed. The owner must deliver and verify the
|
|
scoped credential, expiry/renewal and custody contract before enabling the file.
|
|
|
|
Canonical pin: net-kingdom/sso-mfa/k8s/keycape/deployment.yaml.
|
|
Rollback predecessor: `sha256:5f58563aa903ffa0c060e5ae9eb436aa963322d26bdde393efd2dd506dc6c4ed`.
|
|
Rollback was not required; it would restore the previous validation behavior.
|
|
|
|
Residual provider recovery/policy acceptance remains KEY-WP-0035-T02/T03 and
|
|
USER-WP-0030-T03. Owner contract
|
|
railiance-platform/docs/net-kingdom-credential-custody-contract.md remains draft
|
|
with required path/field placeholders; the registered route remains non-resolvable.
|
|
No live Secret read, issuance, renewal or policy mutation was performed.
|