coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Establish scoped KeyCape factor custody and verified automatic renewal
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
KeyCape factor custody acceptance / acceptance (push) Successful in 7s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
This commit is contained in:
codex 2026-09-13 16:25:33 +02:00
parent b75729b799
commit 2e2c31d237
22 changed files with 1169 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

16
scripts/keycape_factor_eso_metadata.py Normal file
View file

@ -0,0 +1,16 @@
import json,os,sys
from pathlib import Path
from keycape_factor_metadata import call,normalized,policy_text
NAME="workload-kv-read-keycape-factor-read"
OLD='# Exact-path JWT delivery; no issuer password or sibling paths.\npath "platform/data/workloads/net-kingdom/keycape-factor-read" {\n capabilities = ["read"]\n}\npath "platform/metadata/workloads/net-kingdom/keycape-factor-read" {\n capabilities = ["read"]\n}\n\n# ESO validates its own short-lived workload session.\npath "auth/token/lookup-self" {\n capabilities = ["read"]\n}\n'
NEW=Path(__file__).resolve().parents[1].joinpath("openbao/policies/"+NAME+".hcl").read_text()
fd=os.open(sys.argv[1],os.O_WRONLY|os.O_CREAT|os.O_EXCL,0o600)
result={"success":False}
try:
current=policy_text(call("policy","read","-format=json",NAME))
if normalized(current) not in (normalized(OLD),normalized(NEW)):raise RuntimeError()
call("write","-format=json","sys/policies/acl/"+NAME,"-",payload={"policy":NEW})
if normalized(policy_text(call("policy","read","-format=json",NAME)))!=normalized(NEW):raise RuntimeError()
result={"success":True,"change":"ESO self-session lookup and revocation only","secret_values_read":False}
finally:
os.write(fd,json.dumps(result).encode());os.close(fd)