From 8ee0f8bf04104e5bed60dad89fe3c39cccdbca44 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 23 Sep 2026 22:12:14 +0200 Subject: [PATCH] Pin KeyCape main-11ce29a (fresh-login fix) as deployed Operator-run rollout 2026-09-23 of key-cape@11ce29a (KEY-WP-0033-T02): prompt=login now reaches Authelia as max_age=10 and KeyCape enforces freshness itself. Post-rollout: verify-openbao-client PASS; Vergabe callback+PKCE 302, wrong callback 400, missing PKCE 400. Rollback digest: sha256:db2c5a13a47839049349e881c8d19bc39f720ee69d8518f9f2eba2b1f98af9d5 Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 299762@bnt-lap001 Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e --- sso-mfa/k8s/keycape/deployment.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sso-mfa/k8s/keycape/deployment.yaml b/sso-mfa/k8s/keycape/deployment.yaml index f955a86..b0acf9a 100644 --- a/sso-mfa/k8s/keycape/deployment.yaml +++ b/sso-mfa/k8s/keycape/deployment.yaml @@ -52,7 +52,7 @@ spec: - name: keycape # Image published to the self-hosted Forgejo OCI registry (KEY-WP-0002). # KEY-WP-0012: canonical OIDC subject resolution for /userinfo. - image: forgejo.coulomb.social/coulomb/key-cape@sha256:db2c5a13a47839049349e881c8d19bc39f720ee69d8518f9f2eba2b1f98af9d5 + image: forgejo.coulomb.social/coulomb/key-cape@sha256:8dc35801d1d2b0905a43530c40b1fed0107fc179141fe5b2b614c52c01714fc9 imagePullPolicy: IfNotPresent ports: