From 1701a3fa2a391fa78fb77dc3bfa1cc13293f5956 Mon Sep 17 00:00:00 2001 From: codex Date: Sat, 24 Oct 2026 10:17:11 +0200 Subject: [PATCH] RPF-WP-0064-T06: pin the live production OpenBao image digest in the restore adapter Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 4384@bnt-lap001 Assistant-Session: 80d1f3da-7a91-4519-9737-9ba128b4da64 --- WORK-RECORDS.md | 2 +- scripts/openbao-isolated-restore/restore_adapter.py | 7 ++++--- tests/test_openbao_isolated_restore.py | 3 ++- .../RPF-WP-0064-isolated-original-openbao-restore.md | 11 +++++++++-- 4 files changed, 16 insertions(+), 7 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 352947d..c83eb72 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -198,7 +198,7 @@ | task | RPF-WP-0064-T03 | done | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md | | task | RPF-WP-0064-T04 | done | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md | | task | RPF-WP-0064-T05 | wait | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md | -| task | RPF-WP-0064-T06 | wait | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md | +| task | RPF-WP-0064-T06 | done | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md | | task | RPF-WP-0064-T07 | wait | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md | | task | RPF-WP-0064-T08 | wait | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md | | intake | RPF-IN-0001 | closed | — | intakes/intakes.md | diff --git a/scripts/openbao-isolated-restore/restore_adapter.py b/scripts/openbao-isolated-restore/restore_adapter.py index 625d930..ad67ae7 100644 --- a/scripts/openbao-isolated-restore/restore_adapter.py +++ b/scripts/openbao-isolated-restore/restore_adapter.py @@ -49,9 +49,10 @@ NAMESPACE = "railiance-openbao-restore-attempt" ADMISSION_SCHEMA = "railiance-openbao-restore-admission/v1" RECEIPT_SCHEMA = "railiance-openbao-restore-receipt/v2" IMAGE_REPOSITORY = "quay.io/openbao/openbao" -# RPF-WP-0064-T06 writes the owner-confirmed production digest here. Until then -# original-material runs refuse; synthetic rehearsals use the admission digest. -PINNED_IMAGE_DIGEST: str | None = None +# RPF-WP-0064-T06: production digest, observed 2026-10-24 as the imageID of the live +# openbao-0 container (spec image quay.io/openbao/openbao:2.5.4); equal to the T04 +# rehearsal pull. Original-material runs refuse any other image. +PINNED_IMAGE_DIGEST: str | None = "sha256:436eaf9778cad75507ff70ea26ace30dcbe15606e619ac3823495663d7f7c115" MAX_DURATION_SECONDS = 2700 REAPER_GRACE_SECONDS = 60 DEFAULT_ANCHOR = Path("/etc/railiance-openbao-restore/allowed_signers") diff --git a/tests/test_openbao_isolated_restore.py b/tests/test_openbao_isolated_restore.py index 0efe817..d286146 100644 --- a/tests/test_openbao_isolated_restore.py +++ b/tests/test_openbao_isolated_restore.py @@ -148,7 +148,8 @@ class AdmissionTests(Base): path, sig, sha, signers = self.signed(self.admission(material="original")) with self.assertRaises(A.Refused): A.load_admission(path, sig, sha, signers) - self.assertIsNone(A.PINNED_IMAGE_DIGEST, "T06 fills the pin; update this test then") + self.assertEqual(A.PINNED_IMAGE_DIGEST, + "sha256:436eaf9778cad75507ff70ea26ace30dcbe15606e619ac3823495663d7f7c115") def test_normalise_and_project(self): source = {"token_ttl": "5m", "token_policies": ["b", "a"], "_note": "x"} diff --git a/workplans/RPF-WP-0064-isolated-original-openbao-restore.md b/workplans/RPF-WP-0064-isolated-original-openbao-restore.md index c223a47..dce0b76 100644 --- a/workplans/RPF-WP-0064-isolated-original-openbao-restore.md +++ b/workplans/RPF-WP-0064-isolated-original-openbao-restore.md @@ -351,13 +351,20 @@ so a snapshot older than a later source edit yields `refused`. Signing T05 still ```task id: RPF-WP-0064-T06 -status: wait +status: done priority: low depends_on: [RPF-WP-0064-T02] -blocking_reason: "rapp-openbao confirms the chart 0.28.2 / image 2.5.4 pin and digest used by production at the 2026-10-14 snapshot time (rehearsal pulled quay.io/openbao/openbao@sha256:436eaf9778cad75507ff70ea26ace30dcbe15606e619ac3823495663d7f7c115 for tag 2.5.4; not yet owner-confirmed). The confirmed digest is then written to PINNED_IMAGE_DIGEST in scripts/openbao-isolated-restore/restore_adapter.py; original-material runs refuse until it is set. Role/KV/auth definitions stay railiance-platform-owned; no rapp-openbao change requested." state_hub_task_id: "cb689628-9a5a-5f2b-a3ec-be37bd6cdb37" ``` +2026-10-24: done from the live runtime. The founder read `openbao-0` read-only: spec image +`quay.io/openbao/openbao:2.5.4`, container imageID +`docker.io/openbao/openbao@sha256:436eaf9778cad75507ff70ea26ace30dcbe15606e619ac3823495663d7f7c115`, +equal to the T04 rehearsal pull (digests are registry-independent). Written to `PINNED_IMAGE_DIGEST`; +the offline suite (17) passes. This is the current production digest. That the same digest ran at the +2026-10-14 snapshot is not separately proven; the attended run will refuse on any restore incompatibility +rather than repair. rapp-openbao was informed and may object; no rapp-openbao change requested. + ## T07 — Attended original restore (phase A) ```task