coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RPF-WP-0064-T04: native synthetic rehearsal; T02-T04 done

Browse source 
12 native tests against the pinned-tag OpenBao image with --network none and
generated material only: restored end to end plus wrong identity, ciphertext,
plaintext, share, missing objects (refused), source drift, timeout, operator
abort, parent loss and reaper deadline. Only the network-interface abort is
mocked (inspect wrapper). Make targets for offline tests, image pull,
rehearsal and receipt verification. T05/T06 blocking text names the exact
admission fields and the PINNED_IMAGE_DIGEST step.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4384@bnt-lap001
Assistant-Session: 80d1f3da-7a91-4519-9737-9ba128b4da64
This commit is contained in:
codex 2026-10-23 20:49:40 +02:00
parent 7f67c9c244
commit a61a07cf15
4 changed files with 326 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

17
Makefile
View file

@ -305,6 +305,23 @@ openbao-validate-emergency-evidence: ## Validate non-secret OpenBao emergency se
OPENBAO_EMERGENCY_EVIDENCE='$(OPENBAO_EMERGENCY_EVIDENCE)' \
scripts/openbao-validate-emergency-drill-evidence.sh
OPENBAO_REHEARSAL_IMAGE ?= quay.io/openbao/openbao:2.5.4
openbao-isolated-restore-test: ## RPF-WP-0064 offline tests: admission, v2 receipt verifier, launcher (no Docker)
PYTHONDONTWRITEBYTECODE=1 python3 -m unittest tests.test_openbao_isolated_restore
openbao-isolated-restore-image: ## Pull the public OpenBao image used by the synthetic rehearsal (no custody)
docker pull -q $(OPENBAO_REHEARSAL_IMAGE)
openbao-isolated-restore-rehearsal: ## RPF-WP-0064-T04 native rehearsal: --network none containers, generated material only
PYTHONDONTWRITEBYTECODE=1 python3 -m unittest -v tests.test_openbao_isolated_restore_native
openbao-verify-restore-receipt: ## Verify a v2 isolated-restore receipt (RECEIPT=/abs/path SOURCE_ROOT=clean checkout [NOT_AFTER=])
python3 scripts/openbao-isolated-restore/verify-restore-receipt.py --receipt '$(RECEIPT)' \
--source-root '$(or $(SOURCE_ROOT),$(CURDIR))' $(if $(NOT_AFTER),--not-after '$(NOT_AFTER)')
.PHONY: openbao-isolated-restore-test openbao-isolated-restore-image openbao-isolated-restore-rehearsal openbao-verify-restore-receipt
##@ Credential broker
credential-grants-validate: ## Validate non-secret credential grant catalog