coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RPF-WP-0015-T03: snapshot lane accepts the escrow key in age identity-file format

Browse source 
First attended snapshot run failed closed at verify: the stored AGE_PRIVATE_KEY
carries the standard '# created'/'# public key' comment lines. Nothing uploaded.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 680842@bnt-lap001
Assistant-Session: 54eb9e8e-7d6b-4f0c-b7a6-a6db62075883
This commit is contained in:
codex 2026-10-14 20:04:25 +02:00
parent a55cfbe116
commit 048362e3ef
3 changed files with 33 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

17
scripts/openbao-reboot-snapshot.py
View file

@ -193,6 +193,21 @@ class Lane:
def snapshot(self, target: Path) -> None:
self.bao(["operator", "raft", "snapshot", "save", str(target)], label="save OpenBao Raft snapshot")
def lane_identity(self) -> str:
"""The escrow key may be stored as a standard age identity file
(``# created``/``# public key`` comments plus one key line); keep only that line."""
raw = self.bao(["kv", "get", "-field=AGE_PRIVATE_KEY", LANE_PATH], label="read offsite lane AGE_PRIVATE_KEY")
keys = []
for line in raw.replace("\r\n", "\n").split("\n"):
line = line.strip()
if not line or line.startswith("#"):
continue
keys.append(line)
del raw
if len(keys) != 1 or not keys[0].startswith("AGE-SECRET-KEY-1"):
fail("offsite lane AGE_PRIVATE_KEY is unusable")
return keys[0]
def lane_field(self, field: str) -> str:
value = self.bao(["kv", "get", f"-field={field}", LANE_PATH], label=f"read offsite lane {field}")
value = value.strip()
@ -306,7 +321,7 @@ def run(
stage.append("verify")
url = lane.lane_field("NC_WEBDAV_URL")
token = lane.lane_field("NC_WEBDAV_TOKEN")
identity = bytearray((lane.lane_field("AGE_PRIVATE_KEY") + "\n").encode())
identity = bytearray((lane.lane_identity() + "\n").encode())
try:
escrow_recipient = lane.recipient_of(bytes(identity))
if not hmac.compare_digest(escrow_recipient, recipient):