coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Require an absolute owner command after attended OpenBao login.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
A relative scripts path can fail to spawn after a successful contained
OIDC session, which Warden then revokes. The wrapper now resolves the
command first; T03 records that this attempt did not write the role.

Assistant: grok
Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a
This commit is contained in:
codex 2026-09-15 02:16:42 +02:00
parent bb1aa85aea
commit 7496d9fab5
5 changed files with 81 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

18
tests/test_openbao_operator_loopback_callback.py
View file

@ -50,6 +50,24 @@ def test_unexpected_live_role_refused(monkeypatch, mutation):
m.read_role()
def test_attended_wrapper_requires_absolute_existing_executable(tmp_path, monkeypatch):
import os
spec = importlib.util.spec_from_file_location(
'attended', Path(__file__).resolve().parents[1] / 'scripts/openbao-attended-exec.py')
wrapper = importlib.util.module_from_spec(spec)
spec.loader.exec_module(wrapper)
missing = tmp_path / 'missing.sh'
with pytest.raises(SystemExit, match='missing'):
wrapper.reviewed_command([str(missing)])
command = tmp_path / 'owner.sh'
command.write_text('#!/bin/sh\n')
with pytest.raises(SystemExit, match='not executable'):
wrapper.reviewed_command([str(command)])
command.chmod(0o755)
monkeypatch.chdir(tmp_path)
assert wrapper.reviewed_command(['owner.sh']) == [str(command.resolve())]
def test_silent_entrypoint_on_command_failure(tmp_path):
import os
import subprocess