coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RPF-WP-0064-T06: pin the live production OpenBao image digest in the restore adapter
All checks were successful
CCR intake gate / gate (push) Successful in 1m11s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4384@bnt-lap001
Assistant-Session: 80d1f3da-7a91-4519-9737-9ba128b4da64
This commit is contained in:
codex 2026-10-24 10:17:11 +02:00
parent fb0b50234d
commit 1701a3fa2a
4 changed files with 16 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

7
scripts/openbao-isolated-restore/restore_adapter.py
View file

@ -49,9 +49,10 @@ NAMESPACE = "railiance-openbao-restore-attempt"
ADMISSION_SCHEMA = "railiance-openbao-restore-admission/v1"
RECEIPT_SCHEMA = "railiance-openbao-restore-receipt/v2"
IMAGE_REPOSITORY = "quay.io/openbao/openbao"
# RPF-WP-0064-T06 writes the owner-confirmed production digest here. Until then
# original-material runs refuse; synthetic rehearsals use the admission digest.
PINNED_IMAGE_DIGEST: str | None = None
# RPF-WP-0064-T06: production digest, observed 2026-10-24 as the imageID of the live
# openbao-0 container (spec image quay.io/openbao/openbao:2.5.4); equal to the T04
# rehearsal pull. Original-material runs refuse any other image.
PINNED_IMAGE_DIGEST: str | None = "sha256:436eaf9778cad75507ff70ea26ace30dcbe15606e619ac3823495663d7f7c115"
MAX_DURATION_SECONDS = 2700
REAPER_GRACE_SECONDS = 60
DEFAULT_ANCHOR = Path("/etc/railiance-openbao-restore/allowed_signers")