coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RPF-WP-0015-T03: snapshot lane accepts the escrow key in age identity-file format

Browse source 
First attended snapshot run failed closed at verify: the stored AGE_PRIVATE_KEY
carries the standard '# created'/'# public key' comment lines. Nothing uploaded.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 680842@bnt-lap001
Assistant-Session: 54eb9e8e-7d6b-4f0c-b7a6-a6db62075883
This commit is contained in:
codex 2026-10-14 20:04:25 +02:00
parent a55cfbe116
commit 048362e3ef
3 changed files with 33 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

16
tests/test_openbao_reboot_snapshot.py
View file

@ -195,6 +195,22 @@ class SnapshotLaneTest(unittest.TestCase):
now=datetime.now(UTC), max_age_hours=24)
bad.unlink()
def test_escrow_key_in_age_identity_file_format_is_accepted(self):
recipient = snap.declared_recipient()
identity_file = f"# created: 2026-01-01T00:00:00Z\n# public key: {recipient}\n{self.identity}"
code, receipt = self.run_main(identity=identity_file)
self.assertEqual(code, 0)
self.assertNotIn("AGE-SECRET-KEY", self.receipt.read_text())
def test_escrow_key_with_two_keys_or_junk_is_unusable(self):
for bad in (f"{self.identity}\n{self.identity}", f"junk\n{self.identity}"):
code, record = self.run_main(identity=bad)
self.assertEqual(code, 1)
self.assertIn("AGE_PRIVATE_KEY is unusable", record["error"])
self.assertNotIn("upload", self.lanes[-1].calls)
self.receipt.unlink()
self.assert_clean()
def test_custodian_recipient_requires_escrow_ref(self):
_, recipient = throwaway_key()
argv = ["--scenario-id", SCENARIO, "--receipt-file", str(self.receipt), "--custodian-recipient", recipient]