coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RPF-WP-0054: key-cape confirms the client secret format; T01 and T03 done
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
This commit is contained in:
codex 2026-10-10 12:40:12 +02:00
parent b96b86753c
commit 7ee2fa5a1b
2 changed files with 15 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

4
scripts/keycape_client_secret_generate.py
View file

@ -61,8 +61,8 @@ CASE_TYPE = 'oidc-browser-relying-party@1.0'
# oidc-browser-relying-party@1.0 parameter client_id.
CLIENT_ID_RE = re.compile(r'^[a-z0-9][a-z0-9-]{1,62}$')
CASE_REF_RE = re.compile(r'^[a-z0-9][a-z0-9-]*@sha256:[0-9a-f]{64}$')
# Proposed 48 random bytes -> 64 URL-safe characters; key-cape confirmation
# pending (RPF-WP-0054-T01).
# 48 random bytes -> 64 URL-safe characters, confirmed by key-cape 2026-10-10
# (message 4e0213b3; opaque constant-time comparison, no alphabet limit).
SECRET_BYTES = 48
TOKEN_TTL = '5m'
SCHEMA = 'platform.keycape-client-secret-generate.v1'

15
workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md
View file

@ -45,7 +45,7 @@ case's `client-secret-path` artifacts and are unchanged here.
```task
id: RPF-WP-0054-T01
status: progress
status: done
priority: high
state_hub_task_id: "38f92db0-317e-5b2b-8bbd-b4af3272cc21"
```
@ -73,6 +73,13 @@ the case type, `^[a-z0-9][a-z0-9-]{1,62}$` (authoritative; it replaces the
proposal above). Still open: key-cape confirmation of length and alphabet,
asked 2026-10-09.
2026-10-10 key-cape (`4e0213b3`): format confirmed as proposed, 48 random bytes
as URL-safe base64 without padding (64 characters) in the single field
`CLIENT_SECRET`, read only through ESO Secret `sso/keycape-{client_id}-client`.
KeyCape compares secrets as opaque strings in constant time and imposes no
length or alphabet limit. It requires only a non-empty clientId; the pattern
belongs to the case type. T01 is closed.
## T02 — Decide the grant shape
```task
@ -115,7 +122,7 @@ built.
```task
id: RPF-WP-0054-T03
status: progress
status: done
priority: high
depends_on: [RPF-WP-0054-T01, RPF-WP-0054-T02]
state_hub_task_id: "3e159e92-f5ee-5a92-b887-e06daf7dfbdb"
@ -154,6 +161,10 @@ token, and makes every KV call with that token only. It proves absence, writes
once with CAS 0, verifies by metadata (version 1), revokes the token, and prints
nothing. There are 8 offline tests. Remaining before done: key-cape's format
confirmation (`SECRET_BYTES` is the proposed 48 bytes, 64 URL-safe characters).
2026-10-10: key-cape confirmed the format; `SECRET_BYTES` stays as is. T03 is done.
The live probe passed under T05. The first real run (Forgejo) needs the case
`net-kingdom/security-cases/forgejo-netkingdom-oidc.yaml` to reach `materialized`
(today `accepted`; ops-mason's step).
## T04 — Grant, policy and token role source plus CCR