From 7ee2fa5a1be913ab7664ea3c54ca212dbd3ae8f7 Mon Sep 17 00:00:00 2001 From: codex Date: Sat, 10 Oct 2026 12:40:12 +0200 Subject: [PATCH] RPF-WP-0054: key-cape confirms the client secret format; T01 and T03 done Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 469992@bnt-lap001 Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9 --- scripts/keycape_client_secret_generate.py | 4 ++-- ...WP-0054-keycape-client-secret-generate-lane.md | 15 +++++++++++++-- 2 files changed, 15 insertions(+), 4 deletions(-) diff --git a/scripts/keycape_client_secret_generate.py b/scripts/keycape_client_secret_generate.py index 29a71b9..25bacdb 100644 --- a/scripts/keycape_client_secret_generate.py +++ b/scripts/keycape_client_secret_generate.py @@ -61,8 +61,8 @@ CASE_TYPE = 'oidc-browser-relying-party@1.0' # oidc-browser-relying-party@1.0 parameter client_id. CLIENT_ID_RE = re.compile(r'^[a-z0-9][a-z0-9-]{1,62}$') CASE_REF_RE = re.compile(r'^[a-z0-9][a-z0-9-]*@sha256:[0-9a-f]{64}$') -# Proposed 48 random bytes -> 64 URL-safe characters; key-cape confirmation -# pending (RPF-WP-0054-T01). +# 48 random bytes -> 64 URL-safe characters, confirmed by key-cape 2026-10-10 +# (message 4e0213b3; opaque constant-time comparison, no alphabet limit). SECRET_BYTES = 48 TOKEN_TTL = '5m' SCHEMA = 'platform.keycape-client-secret-generate.v1' diff --git a/workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md b/workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md index 437fd39..fa7f52d 100644 --- a/workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md +++ b/workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md @@ -45,7 +45,7 @@ case's `client-secret-path` artifacts and are unchanged here. ```task id: RPF-WP-0054-T01 -status: progress +status: done priority: high state_hub_task_id: "38f92db0-317e-5b2b-8bbd-b4af3272cc21" ``` @@ -73,6 +73,13 @@ the case type, `^[a-z0-9][a-z0-9-]{1,62}$` (authoritative; it replaces the proposal above). Still open: key-cape confirmation of length and alphabet, asked 2026-10-09. +2026-10-10 key-cape (`4e0213b3`): format confirmed as proposed, 48 random bytes +as URL-safe base64 without padding (64 characters) in the single field +`CLIENT_SECRET`, read only through ESO Secret `sso/keycape-{client_id}-client`. +KeyCape compares secrets as opaque strings in constant time and imposes no +length or alphabet limit. It requires only a non-empty clientId; the pattern +belongs to the case type. T01 is closed. + ## T02 — Decide the grant shape ```task @@ -115,7 +122,7 @@ built. ```task id: RPF-WP-0054-T03 -status: progress +status: done priority: high depends_on: [RPF-WP-0054-T01, RPF-WP-0054-T02] state_hub_task_id: "3e159e92-f5ee-5a92-b887-e06daf7dfbdb" @@ -154,6 +161,10 @@ token, and makes every KV call with that token only. It proves absence, writes once with CAS 0, verifies by metadata (version 1), revokes the token, and prints nothing. There are 8 offline tests. Remaining before done: key-cape's format confirmation (`SECRET_BYTES` is the proposed 48 bytes, 64 URL-safe characters). +2026-10-10: key-cape confirmed the format; `SECRET_BYTES` stays as is. T03 is done. +The live probe passed under T05. The first real run (Forgejo) needs the case +`net-kingdom/security-cases/forgejo-netkingdom-oidc.yaml` to reach `materialized` +(today `accepted`; ops-mason's step). ## T04 — Grant, policy and token role source plus CCR