coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RPF-WP-0064-T06: pin the live production OpenBao image digest in the restore adapter
All checks were successful
CCR intake gate / gate (push) Successful in 1m11s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4384@bnt-lap001
Assistant-Session: 80d1f3da-7a91-4519-9737-9ba128b4da64
This commit is contained in:
codex 2026-10-24 10:17:11 +02:00
parent fb0b50234d
commit 1701a3fa2a
4 changed files with 16 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

2
WORK-RECORDS.md
View file

@ -198,7 +198,7 @@
| task | RPF-WP-0064-T03 | done | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md |
| task | RPF-WP-0064-T04 | done | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md |
| task | RPF-WP-0064-T05 | wait | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md |
| task | RPF-WP-0064-T06 | wait | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md |
| task | RPF-WP-0064-T06 | done | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md |
| task | RPF-WP-0064-T07 | wait | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md |
| task | RPF-WP-0064-T08 | wait | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md |
| intake | RPF-IN-0001 | closed | — | intakes/intakes.md |

7
scripts/openbao-isolated-restore/restore_adapter.py
View file

@ -49,9 +49,10 @@ NAMESPACE = "railiance-openbao-restore-attempt"
ADMISSION_SCHEMA = "railiance-openbao-restore-admission/v1"
RECEIPT_SCHEMA = "railiance-openbao-restore-receipt/v2"
IMAGE_REPOSITORY = "quay.io/openbao/openbao"
# RPF-WP-0064-T06 writes the owner-confirmed production digest here. Until then
# original-material runs refuse; synthetic rehearsals use the admission digest.
PINNED_IMAGE_DIGEST: str | None = None
# RPF-WP-0064-T06: production digest, observed 2026-10-24 as the imageID of the live
# openbao-0 container (spec image quay.io/openbao/openbao:2.5.4); equal to the T04
# rehearsal pull. Original-material runs refuse any other image.
PINNED_IMAGE_DIGEST: str | None = "sha256:436eaf9778cad75507ff70ea26ace30dcbe15606e619ac3823495663d7f7c115"
MAX_DURATION_SECONDS = 2700
REAPER_GRACE_SECONDS = 60
DEFAULT_ANCHOR = Path("/etc/railiance-openbao-restore/allowed_signers")

3
tests/test_openbao_isolated_restore.py
View file

@ -148,7 +148,8 @@ class AdmissionTests(Base):
path, sig, sha, signers = self.signed(self.admission(material="original"))
with self.assertRaises(A.Refused):
A.load_admission(path, sig, sha, signers)
self.assertIsNone(A.PINNED_IMAGE_DIGEST, "T06 fills the pin; update this test then")
self.assertEqual(A.PINNED_IMAGE_DIGEST,
"sha256:436eaf9778cad75507ff70ea26ace30dcbe15606e619ac3823495663d7f7c115")
def test_normalise_and_project(self):
source = {"token_ttl": "5m", "token_policies": ["b", "a"], "_note": "x"}

11
workplans/RPF-WP-0064-isolated-original-openbao-restore.md
View file

@ -351,13 +351,20 @@ so a snapshot older than a later source edit yields `refused`. Signing T05 still
```task
id: RPF-WP-0064-T06
status: wait
status: done
priority: low
depends_on: [RPF-WP-0064-T02]
blocking_reason: "rapp-openbao confirms the chart 0.28.2 / image 2.5.4 pin and digest used by production at the 2026-10-14 snapshot time (rehearsal pulled quay.io/openbao/openbao@sha256:436eaf9778cad75507ff70ea26ace30dcbe15606e619ac3823495663d7f7c115 for tag 2.5.4; not yet owner-confirmed). The confirmed digest is then written to PINNED_IMAGE_DIGEST in scripts/openbao-isolated-restore/restore_adapter.py; original-material runs refuse until it is set. Role/KV/auth definitions stay railiance-platform-owned; no rapp-openbao change requested."
state_hub_task_id: "cb689628-9a5a-5f2b-a3ec-be37bd6cdb37"
```
2026-10-24: done from the live runtime. The founder read `openbao-0` read-only: spec image
`quay.io/openbao/openbao:2.5.4`, container imageID
`docker.io/openbao/openbao@sha256:436eaf9778cad75507ff70ea26ace30dcbe15606e619ac3823495663d7f7c115`,
equal to the T04 rehearsal pull (digests are registry-independent). Written to `PINNED_IMAGE_DIGEST`;
the offline suite (17) passes. This is the current production digest. That the same digest ran at the
2026-10-14 snapshot is not separately proven; the attended run will refuse on any restore incompatibility
rather than repair. rapp-openbao was informed and may object; no rapp-openbao change requested.
## T07 — Attended original restore (phase A)
```task