Join Forgejo callback identity to the issuer-owned current access grant
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a14bfc-9643-7872-aa12-98326dcf25e7
This commit is contained in:
parent
308e83fcfb
commit
a927ec8cc8
4 changed files with 1245 additions and 42 deletions
|
|
@ -1,6 +1,6 @@
|
|||
# Forgejo release preparation (build only)
|
||||
|
||||
The Apps Makefile targets package the digest-bound 40-path Forgejo 11.0.3
|
||||
The Apps Makefile targets package the digest-bound 49-path Forgejo 11.0.3
|
||||
source candidate in `forgejo-security-extension.patch`. It combines the original
|
||||
three-group any-of gate, private secret-file input, private source-operation DB
|
||||
primitives and the producer-owned Access Engine client in the OIDC callback.
|
||||
|
|
@ -134,3 +134,34 @@ mechanics checks; owner admission, current authenticated operation/inverse
|
|||
sessions, runtime/backup custody, retention, every release writer and native
|
||||
deployed-database acceptance remain separate obligations. The previous frozen
|
||||
release is historical and does not contain this context correction.
|
||||
|
||||
|
||||
## Current-token callback source continuation
|
||||
|
||||
The 49-path candidate additionally vendors the unchanged, producer-generated
|
||||
KeyCape current-token adapter from `08c083ba`; no consumer token registry or
|
||||
handwritten copy is introduced. `current_token` (explicit HTTPS issuer, resource
|
||||
audience, owning client, CA/JWKS/private-client-file references and maximum token
|
||||
age) and `application_tenant` are mandatory in the independently admitted
|
||||
`FORGEJO_ACCESS_ENGINE_ADMISSION_FILE` for this guarded callback profile. A signed
|
||||
caller cannot select the application's tenant. No operational configuration or
|
||||
credential is supplied by the build.
|
||||
|
||||
The callback requires the online KeyCape human ID token's exact RS256 `at_hash`
|
||||
access-grant binding before private caller use. Access-only `jti`/`scope` cannot
|
||||
substitute for an ID token. It joins independently verified subject/tenant/type,
|
||||
issuance, assurance/authentication time and tenant provenance to a fresh issuer
|
||||
observation before the PDP, then checks current status again after the decision.
|
||||
Source tests refuse mixed, revoked, suspended, stale, malformed and unavailable
|
||||
inputs; actual HTTPS issuer PKCE/discovery/UserInfo/status/revocation and real
|
||||
Forgejo provider/callback run in five isolated consumer processes. MFA session
|
||||
seeds and PDP admissions are synthetic. Complete release build/asset/OCI evidence
|
||||
for the preceding patch remains historical; this revision requires its own build
|
||||
and independent owner/package/type/custody admission before operational use.
|
||||
|
||||
The user selected current KeyCape checks on every ongoing API/Git/SSH operation
|
||||
for NetKingdom-linked accounts, while retaining the separate local break-glass
|
||||
path. That is an implementation requirement under RAPPS16-T09/NK48-T43, not a
|
||||
claim that the callback implements those routes or a native deployment grant.
|
||||
Ongoing resource/action/current-group decisions, protected operation/inverse and
|
||||
all release writers/journal custody remain acceptance work.
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load diff
|
|
@ -3,13 +3,13 @@
|
|||
"forgejo_version": "11.0.3",
|
||||
"source_archive_sha256": "1ddd8c926ca07d40436897971458ace7dcf1d3496a0813ab9e0d869edef2365c",
|
||||
"source_commit": "b81aa4d0807cc1e2d6a2fbafd0b75c46cc0ae237",
|
||||
"patch_sha256": "feb1079399a43989742ae0a946c1ada50113d1821e6541f97f0b5592ee1fc20c",
|
||||
"patch_sha256": "9fe3d7baa648c9347964a177befab5070e00151d1ec5ddff16c41890db84e62a",
|
||||
"go_archive_sha256": "3333f6ea53afa971e9078895eaa4ac7204a8c6b5c68c10e6bc9a33e8e391bdd8",
|
||||
"go_version": "1.24.3",
|
||||
"node_archive_sha256": "dafe2e8f82cb97de1bd10db9e2ec4c07bbf53389b0799b1e095a918951e78fd4",
|
||||
"node_version": "22.15.0",
|
||||
"source_date_epoch": 1752105237,
|
||||
"release_version": "11.0.3+cust80.feb10793",
|
||||
"release_version": "11.0.3+cust80.9fe3d7ba",
|
||||
"tags": "bindata timetzdata sqlite sqlite_unlock_notify",
|
||||
"runtime_base": "code.forgejo.org/forgejo/forgejo@sha256:41649dff5311664097d29b4d80620403f0b27e7c0eee0b8af79b132a37f3807b",
|
||||
"runtime_index_digest": "sha256:691657c7e64af7730a2e885e6d022cf16ae60724931c5392bd61838afadcaeba",
|
||||
|
|
@ -33,7 +33,7 @@
|
|||
},
|
||||
{
|
||||
"path": "go.mod",
|
||||
"sha256": "130138c4c3ecc29fa0d7f1e2eef0589ddf3b06071f3cc0448aa7b2326847653a"
|
||||
"sha256": "11fe525ccb3f099aa281738b86097bbd587a99b4640ddae8dd04dd7d046c49f0"
|
||||
},
|
||||
{
|
||||
"path": "models/auth/source_operation.go",
|
||||
|
|
@ -93,7 +93,7 @@
|
|||
},
|
||||
{
|
||||
"path": "services/auth/source/oauth2/access_engine.go",
|
||||
"sha256": "d5f07f9491ac2212410e1fa8c0248d68ba3a723e7ca99e363627c5292d187aa8"
|
||||
"sha256": "d16330043825d0284253e65d28bda2de4edbc633e4887d8c3618a106ee251daa"
|
||||
},
|
||||
{
|
||||
"path": "services/auth/source/oauth2/access_engine_assurance.go",
|
||||
|
|
@ -109,11 +109,27 @@
|
|||
},
|
||||
{
|
||||
"path": "services/auth/source/oauth2/access_engine_callback_test.go",
|
||||
"sha256": "5cea36b630c895a9473dc876b7128526ddef65d9395b2fddc56343e162452472"
|
||||
"sha256": "1cbe378cc20149be7b354484ab3297916733564f03a2441cd276f9039d043580"
|
||||
},
|
||||
{
|
||||
"path": "services/auth/source/oauth2/access_engine_current_token.go",
|
||||
"sha256": "4a2e484ece7cf74686173d5e85c127643287570c2298af135ddfdc7c450b18d8"
|
||||
},
|
||||
{
|
||||
"path": "services/auth/source/oauth2/access_engine_current_token_test.go",
|
||||
"sha256": "58f799c08a7b4638780abc511bd1a7359bd5e691c7805ff54582d02d2f42cae1"
|
||||
},
|
||||
{
|
||||
"path": "services/auth/source/oauth2/access_engine_purpose_test.go",
|
||||
"sha256": "533dc3153fcf9bfcf7bfc08712c057092c7b3892882f217fb8f839fdbdd99939"
|
||||
},
|
||||
{
|
||||
"path": "services/auth/source/oauth2/access_engine_test.go",
|
||||
"sha256": "99edd6cfe3e834d73e0447a7915f52cc4ab7b82644669c5ae61963f850b447e8"
|
||||
"sha256": "9112a142983c0a58c5d40344b58a20fa2c1bdbc7a79b5c586796362839a43b48"
|
||||
},
|
||||
{
|
||||
"path": "services/auth/source/oauth2/current_issuer_fixture_test.go",
|
||||
"sha256": "24fb430e72848326c5d9ef42eab5028cf915dd601f43fb06010b32b568908781"
|
||||
},
|
||||
{
|
||||
"path": "services/auth/source/oauth2/providers_openid.go",
|
||||
|
|
@ -174,10 +190,30 @@
|
|||
{
|
||||
"path": "third_party/access-engine-pep/testsupport/signfixture/sign.go",
|
||||
"sha256": "fe4aa86f444dc20145aefbaca35b24f046264b2c5c8b4e3b057a4496b77a4d29"
|
||||
},
|
||||
{
|
||||
"path": "third_party/keycape-tokenstatus/LICENSE",
|
||||
"sha256": "ff413f361a3b3bf44cf50f110fbcc4837064d57eefbcef89df2b43997c6262b6"
|
||||
},
|
||||
{
|
||||
"path": "third_party/keycape-tokenstatus/go.mod",
|
||||
"sha256": "e8b028e1002e63a76dba78a4abbd67882307ad198e4783bad631652061aa0f54"
|
||||
},
|
||||
{
|
||||
"path": "third_party/keycape-tokenstatus/internal/jose/jose.go",
|
||||
"sha256": "a6de154cd81e34a521b8aac5dce6b45a3cfb015681ed16e2beb8f2a24c72c00d"
|
||||
},
|
||||
{
|
||||
"path": "third_party/keycape-tokenstatus/pkg/tokenstatus/client.go",
|
||||
"sha256": "f34626a85d67590b9c61474f19ce1021f8afd17093f8f522b3f98e9cef34e575"
|
||||
},
|
||||
{
|
||||
"path": "third_party/keycape-tokenstatus/producer-source.json",
|
||||
"sha256": "3bd9b25b912e7c17b331997ca5fee9da8a7c314f336e09e3c116885954799b73"
|
||||
}
|
||||
],
|
||||
"lockfiles": {
|
||||
"go.mod": "130138c4c3ecc29fa0d7f1e2eef0589ddf3b06071f3cc0448aa7b2326847653a",
|
||||
"go.mod": "11fe525ccb3f099aa281738b86097bbd587a99b4640ddae8dd04dd7d046c49f0",
|
||||
"go.sum": "19c305c7e68de9d3f1bc0dda2de09c5d38597f1ee7fa411c7b36b92467ae1eaf",
|
||||
"package.json": "ab5c54ec7077501b50acf3ab5f1fff4f63a51abe99e720b8ecdc6cc6c78f39fc",
|
||||
"package-lock.json": "fdd5c2f891311be7c01b1907b418c243ca1f0f951fd4b4ee5b5e931c43493657"
|
||||
|
|
@ -193,7 +229,7 @@
|
|||
},
|
||||
"runtime_base_config_sha256": "bc5a3df111729582faadebd01d126ba769e2b65d0c62f306f6bc79f4e562452b",
|
||||
"patch_file": "forgejo-security-extension.patch",
|
||||
"candidate_review_status": "coordinator tested; independent owner review pending",
|
||||
"candidate_review_status": "current-token callback source tested; complete release rebuild and independent owner review pending",
|
||||
"producer_source_commit": "ca0cb75729a63c9288b7333382d0fa3eb1e8c9a3",
|
||||
"optional_source_tests": {
|
||||
"source_operation_postgres": {
|
||||
|
|
@ -202,5 +238,7 @@
|
|||
"source_only": true,
|
||||
"production_connection_or_credentials": false
|
||||
}
|
||||
}
|
||||
},
|
||||
"identity_client_source_revision": "git:08c083bae9ff35fbaf028c36d72a95b57d2541b7",
|
||||
"identity_issuer_source_revision": "git:e2c5a947829568baf837543a6708fd0c3f6a863b"
|
||||
}
|
||||
|
|
|
|||
|
|
@ -308,3 +308,26 @@ PostgreSQL/native proof and actual issuer/factor/custody acceptance remain open.
|
|||
No trust, deployed image, Helm values, source DB, user/link state or local sign-in
|
||||
is changed by this build-source update. The preserved legacy patch is historical;
|
||||
the input lock now explicitly selects forgejo-security-extension.patch.
|
||||
|
||||
|
||||
2026-10-18 current-token callback continuation: the new 49-path source candidate
|
||||
uses the exact generated KeyCape online client, without a consumer token registry.
|
||||
Mandatory owner application-tenant/current-token admission, ID-token purpose,
|
||||
exact signed RS256 at_hash, current status before/after the PDP, and signed
|
||||
identity/assurance/authentication-time/tenant-provenance joins refuse substitution
|
||||
and stale authority. The latest focused callback/identity suite passes 91 results
|
||||
without skips; the selected four composed packages passed 114 results with one
|
||||
optional PostgreSQL test skipped before the additional owner-tenant regression.
|
||||
The actual HTTP PKCE/discovery/UserInfo/status/revocation and Forgejo provider /
|
||||
callback pass five fresh consumer processes: two current grants accepted, mixed
|
||||
pair/revoked original/suspended human refused. The original verifier and issuer
|
||||
fail their new controls. MFA session seeds and PDP admission are synthetic.
|
||||
|
||||
The user explicitly selected current KeyCape checks on every API/Git/SSH
|
||||
operation for linked accounts, keeping the separate local break-glass path.
|
||||
That full ongoing route/resource/action/group profile is still implementation
|
||||
work here; callback proof does not close it. Input lock now selects patch
|
||||
9fe3d7ba; complete release/asset/OCI checks, independent owner assent,
|
||||
software/type/package/custody admission, real factors/current sessions and native
|
||||
acceptance remain open. T07/T08 and every existing task UUID/status are preserved.
|
||||
Exact source/evidence: Custodian forgejo-current-token-r1.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue