coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0048: oidc-browser-relying-party 1.1; re-pin the Forgejo case
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Adds verification consumer-enforces-groups and makes hand-over require the
consumer to enforce access_groups (key-cape review R2). Founder go to move to
1.1 before any apply, so no 1.0 run overlaps.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 736651@bnt-lap001
Assistant-Session: f6189624-fd64-4109-b53e-f8a59ca8a2d8
This commit is contained in:
tegwick 2026-10-10 13:25:54 +02:00
parent 61ab6bcc33
commit e2174cebaf
7 changed files with 47 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

6
security-cases/forgejo-netkingdom-oidc.yaml
View file

@ -1,15 +1,17 @@
# First KnownSecurityCase of oidc-browser-relying-party 1.0 (NK-WP-0048-T06).
# First KnownSecurityCase of oidc-browser-relying-party 1.1 (NK-WP-0048-T06).
# Parameters are the request the founder accepted on 2026-10-08
# (key-cape docs/forgejo-oidc-client-request.yaml, KEY-WP-0038-T01); that
# acceptance carries over as this case's acceptance. One difference: custody is
# derived by the type (platform/workloads/keycape/forgejo), not the request's
# proposed platform/workloads/forgejo/netkingdom-oidc-client. The founder
# acknowledged that derivation with the type (memo r4, 2026-10-09).
# Re-pinned from 1.0 to 1.1 on 2026-10-10 on the founder's go, before any
# apply, so no 1.0 run overlaps (minor change: consumer-enforces-groups).
apiVersion: netkingdom.io/security-case/v0.1
kind: SecurityCase
spec:
id: forgejo-netkingdom-oidc
type: oidc-browser-relying-party@1.0
type: oidc-browser-relying-party@1.1
status: accepted
acceptance:
at: "2026-10-08"