Fix KeyCape claim interoperability and verify the composed Forgejo release
This commit is contained in:
codex
parent
81f2f59649
commit
1b8dc0a8fd
89 changed files with 19125 additions and 19 deletions
|
|
@ -0,0 +1,182 @@
|
|||
{
|
||||
"objective": "Finish what you found missing and finish CUST-WP-0080",
|
||||
"status": "active",
|
||||
"observed_at": "2026-10-18T00:28:21.910794+00:00",
|
||||
"full_scope_baseline": {
|
||||
"path": "docs/changes/netkingdom-target-2026-10-18/cust80-completion-r1/completion-audit.json",
|
||||
"sha256": "sha256:9bdee9a790db598956fe35d5954137bb4582c9f3810d2392f7ef3236c369b065",
|
||||
"all_requirements_retained": true
|
||||
},
|
||||
"normative_architecture": {
|
||||
"path": "docs/netkingdom-target-security-architecture.md",
|
||||
"sha256": "ec2079be18c7cdb8a1e4fdbd22131c08c83721d7a1bf18b4802bc5e229520f35"
|
||||
},
|
||||
"acceptance_gates": [
|
||||
{
|
||||
"id": "TSA-01",
|
||||
"required_outcome": "Every inventoried privileged PEP authenticates its decision",
|
||||
"required_evidence": "PEP denominator; admitted signer/channel; forged, altered, wrong-key/pin, unsigned/downgrade, expired and rotation refusals. Start SECRETS-WP-0014.",
|
||||
"status": "incomplete",
|
||||
"completion_evidence": []
|
||||
},
|
||||
{
|
||||
"id": "TSA-02",
|
||||
"required_outcome": "Exact approval produces one bounded protected operation",
|
||||
"required_evidence": "SECRETS-WP-0013/RPF-WP-0035-T12 native effect; Approval T01/T05 issuer/tenant provenance; wrong actor/tenant/body, expiry, replay and unavailable refusal.",
|
||||
"status": "incomplete",
|
||||
"completion_evidence": []
|
||||
},
|
||||
{
|
||||
"id": "TSA-03",
|
||||
"required_outcome": "Crashes preserve uncertainty and cleanup",
|
||||
"required_evidence": "Actual ledger restart/concurrency, consumed-before-effect failure, target reconciliation, scoped cleanup and revocation evidence; no blind replay.",
|
||||
"status": "incomplete",
|
||||
"completion_evidence": []
|
||||
},
|
||||
{
|
||||
"id": "TSA-04",
|
||||
"required_outcome": "First reusable browser case is accepted",
|
||||
"required_evidence": "NK-WP-0048 and named Mason/Warden/KeyCape adapters; independent native structure, sign-in/denial, delivery, revocation and rollback.",
|
||||
"status": "incomplete",
|
||||
"completion_evidence": []
|
||||
},
|
||||
{
|
||||
"id": "TSA-05",
|
||||
"required_outcome": "Human and browser consumers can use the delivered identity",
|
||||
"required_evidence": "KEY-WP-0040/U08 real-factor recovery; User Engine journey; NK-WP-0050 and CUST-WP-0080-T05 human/agent Playwright acceptance.",
|
||||
"status": "incomplete",
|
||||
"completion_evidence": []
|
||||
},
|
||||
{
|
||||
"id": "TSA-06",
|
||||
"required_outcome": "Actual agent and runner authority is bounded",
|
||||
"required_evidence": "CUST-WP-0073/GLAS-WP-0012 admitted runtime read-denial/tool-effect proof; Forge/Platform per-job credential and repository-workflow abuse tests.",
|
||||
"status": "incomplete",
|
||||
"completion_evidence": []
|
||||
},
|
||||
{
|
||||
"id": "TSA-07",
|
||||
"required_outcome": "Credential lifecycle is inventoried and simplified",
|
||||
"required_evidence": "Current owner/consumer denominator, unknown/orphan findings, native-identity elimination candidates; sampled replacement/adoption/old-refusal and deletion semantics. G04/G09/G12.",
|
||||
"status": "incomplete",
|
||||
"completion_evidence": []
|
||||
},
|
||||
{
|
||||
"id": "TSA-08",
|
||||
"required_outcome": "Recovery is independent and measured",
|
||||
"required_evidence": "NK-WP-0049 plus platform/root owners; isolated recovery with ordinary issuer unavailable, restore/reconnect/audit continuity and measured RTO/RPO. G08/G11.",
|
||||
"status": "incomplete",
|
||||
"completion_evidence": []
|
||||
},
|
||||
{
|
||||
"id": "TSA-09",
|
||||
"required_outcome": "Security effects have independently reconciled evidence",
|
||||
"required_evidence": "Admitted source/class inventory, atomic outbox, receiver readback, lag/duplicate/boundary accounting and missing-class findings. Approval/Audit/Tenant/Secrets owners.",
|
||||
"status": "incomplete",
|
||||
"completion_evidence": []
|
||||
},
|
||||
{
|
||||
"id": "TSA-10",
|
||||
"required_outcome": "Source and delivery controls cover declared entry paths",
|
||||
"required_evidence": "FORGE-WP-0006/RMGR-WP-0021: denominator, SSH/HTTP/UI/new repo/import/mirror coverage, required checks/provenance, private synthetic finding through resolution.",
|
||||
"status": "incomplete",
|
||||
"completion_evidence": []
|
||||
},
|
||||
{
|
||||
"id": "TSA-11",
|
||||
"required_outcome": "Discovery remains accurate",
|
||||
"required_evidence": "All reviewed IDs exactly once, owner/index parity, usable source links, current limits/version aliases, drift checks and package-family disposition. Reuse/Repo Manager/provider owners.",
|
||||
"status": "incomplete",
|
||||
"completion_evidence": []
|
||||
},
|
||||
{
|
||||
"id": "TSA-12",
|
||||
"required_outcome": "Improvement operates without repeated manual polling",
|
||||
"required_evidence": "CUST-WP-0079/Activity accepted schedule, unassisted firing, checkpoint and changed-state notifications; adopted cadence runtime/receiver receipts; owner change and native remeasurement.",
|
||||
"status": "incomplete",
|
||||
"completion_evidence": []
|
||||
},
|
||||
{
|
||||
"id": "TSA-13",
|
||||
"required_outcome": "Shared adapters reduce per-consumer implementation",
|
||||
"required_evidence": "Producer-format cross-language fixtures, two real consumers, version compatibility, denied-path parity, upgrades and rollback; no second PDP.",
|
||||
"status": "incomplete",
|
||||
"completion_evidence": []
|
||||
},
|
||||
{
|
||||
"id": "TSA-14",
|
||||
"required_outcome": "Minimal profiles are independently reusable",
|
||||
"required_evidence": "Version/provider lock, dependency and optional-provider declaration, provider adapters, second clean installation, complete positive/negative journeys and upgrade/recovery instructions.",
|
||||
"status": "incomplete",
|
||||
"completion_evidence": []
|
||||
},
|
||||
{
|
||||
"id": "TSA-15",
|
||||
"required_outcome": "Optimization improves measured operations",
|
||||
"required_evidence": "Baseline and repeat measurements of onboarding time/touches, p50/p95 decision/effect latency, scanner throughput/failure, resources/headroom and owner effort with unchanged control coverage.",
|
||||
"status": "incomplete",
|
||||
"completion_evidence": []
|
||||
},
|
||||
{
|
||||
"id": "TSA-16",
|
||||
"required_outcome": "Governance and exceptions remain truthful",
|
||||
"required_evidence": "Existing SEC-DSM ledger and close-down controls reconciled to exact evidence; real authority for changes, explicit residual promotions, preserved deferrals and no invented owner assent.",
|
||||
"status": "incomplete",
|
||||
"completion_evidence": []
|
||||
}
|
||||
],
|
||||
"sec_dsm_requirements": {
|
||||
"path": "docs/evidence/2026-10-12-netkingdom-security/sec-dsm-requirement-ledger.json",
|
||||
"sha256": "sha256:ad81f7186ada04aa1cc410932fc8669d69dc2232f3c0be00657b17f3aa3a8184",
|
||||
"count": 116,
|
||||
"status_counts": {
|
||||
"unverified": 84,
|
||||
"incomplete": 12,
|
||||
"reference": 20
|
||||
},
|
||||
"closure_status_unchanged": true
|
||||
},
|
||||
"gap_ids": [
|
||||
"G01",
|
||||
"G02",
|
||||
"G03",
|
||||
"G04",
|
||||
"G05",
|
||||
"G06",
|
||||
"G07",
|
||||
"G08",
|
||||
"G09",
|
||||
"G10",
|
||||
"G11",
|
||||
"G12",
|
||||
"G13"
|
||||
],
|
||||
"separate_required_deliverables": [
|
||||
"G01-G13 current closure evidence or already applicable approved exceptions",
|
||||
"SEC-DSM requirement ledger reconciled with exact evidence",
|
||||
"T05 real human and agent Playwright acceptance and supported discovery",
|
||||
"Second real consumer and clean installation proves reuse",
|
||||
"Residual handoffs before workplan finish; no required work left only in prose"
|
||||
],
|
||||
"source_progress": {
|
||||
"packet": "docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1",
|
||||
"producer_source_commit": "git:ca0cb75729a63c9288b7333382d0fa3eb1e8c9a3",
|
||||
"consumer_owner_commit": "git:3fb031a47ff5379358fd8cc230b40961b3b5d3a8",
|
||||
"consumer_paths": 37,
|
||||
"patch_sha256": "sha256:15cb7f13b1b1d1095cc344176ca337f705333a436a70ae803fcfd3d7f802ccf4",
|
||||
"actual_issuer_provider_callback_passes_including_subtests": 77,
|
||||
"selected_composed_package_passes_including_subtests": 93,
|
||||
"skips_in_these_suites": 0,
|
||||
"complete_frontend_static_build": true,
|
||||
"exact_embedded_assets": 2234,
|
||||
"actual_release_cli_subprocesses": 48,
|
||||
"synthetic_authentication": true,
|
||||
"independent_owner_assent": false,
|
||||
"native_gates_closed": 0,
|
||||
"local_OCI_exports_exact": 2,
|
||||
"local_OCI_manifest": "sha256:fc93a924b6e5f80a1dbf2a371dfd2e09fab10baa1cbca189bf61602009438822"
|
||||
},
|
||||
"current_work": "Publish source evidence and continue existing owner operation/session/exclusion/custody and ongoing protected-path implementation; native acceptance remains required.",
|
||||
"workplan_finished": false,
|
||||
"goal_complete": false
|
||||
}
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
{
|
||||
"passed_including_subtests": 77,
|
||||
"skipped": 0,
|
||||
"failed": 0,
|
||||
"receipt": "consumer-after-attempt3.json",
|
||||
"actual_issuer_serializer": true,
|
||||
"actual_provider_discovery_fetch_userinfo_and_callback": true,
|
||||
"synthetic_completed_authorization_session": true,
|
||||
"native_admission": false
|
||||
}
|
||||
|
|
@ -0,0 +1,36 @@
|
|||
"""Publish explicitly typed public asset digests, retaining byte-exact evidence."""
|
||||
from pathlib import Path
|
||||
import hashlib
|
||||
import json
|
||||
|
||||
HERE = Path(__file__).resolve().parent
|
||||
path = HERE / 'release-evidence/embedded-files.json'
|
||||
raw = path.read_bytes()
|
||||
records = json.loads(raw)
|
||||
work = Path('/tmp/custodian-forgejo-release-r3')
|
||||
verification = json.loads((HERE / 'release-evidence/verification.json').read_text())
|
||||
sha = lambda data: hashlib.sha256(data).hexdigest()
|
||||
assert sha(raw) == verification['embedded_file_manifest_sha256']
|
||||
assert raw == (work / 'embedded-files.json').read_bytes()
|
||||
for name, value in records.items():
|
||||
assert sha((work / 'source' / name).read_bytes()) == value, name
|
||||
assert sha((work / 'embedded-extracted' / name).read_bytes()) == value, name
|
||||
published = (json.dumps({name: 'sha256:' + value for name, value in records.items()},
|
||||
indent=2, sort_keys=True) + '\n').encode()
|
||||
restored = (json.dumps({name: value.removeprefix('sha256:')
|
||||
for name, value in json.loads(published).items()},
|
||||
indent=2, sort_keys=True) + '\n').encode()
|
||||
assert restored == raw
|
||||
path.write_bytes(published)
|
||||
(HERE / 'release-evidence/embedded-manifest-derivation.json').write_text(json.dumps({
|
||||
'scope': 'Public generated/embedded asset SHA-256 identifiers only',
|
||||
'assets_verified_against_both_actual_source_and_extracted_binary': len(records),
|
||||
'runtime_original_manifest_sha256': 'sha256:' + sha(raw),
|
||||
'published_manifest_sha256': 'sha256:' + sha(published),
|
||||
'original_byte_exact_reconstructed': True,
|
||||
'reconstruction': 'Remove the sha256: value prefix and serialize with json.dumps(indent=2, sort_keys=True) plus one newline.',
|
||||
'runtime_verification_receipt_preserved': True,
|
||||
'scanner_rules_or_allowlists_changed': False,
|
||||
'credential_values_transformed': False,
|
||||
}, indent=2) + '\n')
|
||||
print(json.dumps({'public_asset_digests_verified': len(records), 'original_byte_exact_reconstructed': True}))
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,9 @@
|
|||
{
|
||||
"paths_verified": 37,
|
||||
"patch_sha256": "sha256:15cb7f13b1b1d1095cc344176ca337f705333a436a70ae803fcfd3d7f802ccf4",
|
||||
"official_archive_sha256": "sha256:1ddd8c926ca07d40436897971458ace7dcf1d3496a0813ab9e0d869edef2365c",
|
||||
"workspace": "/tmp/custodian-forgejo-replay-r3-kje_jqm_",
|
||||
"fuzz": 0,
|
||||
"all_postimages_exact": true,
|
||||
"native_changes": false
|
||||
}
|
||||
|
|
@ -0,0 +1,217 @@
|
|||
{
|
||||
"schema": "custodian.forgejo-composed-source.v1",
|
||||
"status": "source candidate with actual KeyCape assurance interoperability",
|
||||
"archive_sha256": "1ddd8c926ca07d40436897971458ace7dcf1d3496a0813ab9e0d869edef2365c",
|
||||
"forgejo_version": "11.0.3",
|
||||
"producer_source_commit": "ca0cb75729a63c9288b7333382d0fa3eb1e8c9a3",
|
||||
"patch_sha256": "15cb7f13b1b1d1095cc344176ca337f705333a436a70ae803fcfd3d7f802ccf4",
|
||||
"files": [
|
||||
{
|
||||
"path": "cmd/admin_auth_oauth.go",
|
||||
"before_sha256": "d5faee30ffbb9a560256c92a0e05e652b79e95e016448cbac7dbb6ad0fdad937",
|
||||
"after_sha256": "d718d817c46f6393488a9c5a894b7535640cd0ec1a1ae3f72f8411a2bbec3b38"
|
||||
},
|
||||
{
|
||||
"path": "cmd/admin_auth_oauth_secret_linux.go",
|
||||
"before_sha256": null,
|
||||
"after_sha256": "6741961f1df67c1afbf34c796e549425f0e04a0d0678c6eedb05f66d4754c64b"
|
||||
},
|
||||
{
|
||||
"path": "cmd/admin_auth_oauth_secret_linux_test.go",
|
||||
"before_sha256": null,
|
||||
"after_sha256": "b28c2369dfab9bf2ca48e707e01b4394a36c8be5490cfe5bb658017bb626c4b2"
|
||||
},
|
||||
{
|
||||
"path": "cmd/admin_auth_oauth_secret_other.go",
|
||||
"before_sha256": null,
|
||||
"after_sha256": "54056c989a4757e73db0252130e7c16bf16f5ec8eaaca2468f019ba2ef5c532d"
|
||||
},
|
||||
{
|
||||
"path": "go.mod",
|
||||
"before_sha256": "652162a4a95c6d1c349d2a8c0b514def5abd837f001137b77b7b3f4a0f162d00",
|
||||
"after_sha256": "130138c4c3ecc29fa0d7f1e2eef0589ddf3b06071f3cc0448aa7b2326847653a"
|
||||
},
|
||||
{
|
||||
"path": "models/auth/source_operation.go",
|
||||
"before_sha256": null,
|
||||
"after_sha256": "ef1b07ef6cf454015d00cde8588835f5118d829da91eb0303d37184859345a31"
|
||||
},
|
||||
{
|
||||
"path": "models/auth/source_operation_internal_test.go",
|
||||
"before_sha256": null,
|
||||
"after_sha256": "af0f424d3a1fd2b29793b64baa1fa07284fee7ea0b7721c503db4efac0d871cb"
|
||||
},
|
||||
{
|
||||
"path": "models/auth/source_operation_process_test.go",
|
||||
"before_sha256": null,
|
||||
"after_sha256": "40d33b11a01cb659f0bf6f8b545c4d79910e8c082a789060bcbc9cadeee965bd"
|
||||
},
|
||||
{
|
||||
"path": "models/auth/source_operation_test.go",
|
||||
"before_sha256": null,
|
||||
"after_sha256": "77d311bca42f48faf3fbdc15c53582e3d8a6d9108a72ed7bb6172e5b88951428"
|
||||
},
|
||||
{
|
||||
"path": "models/db/context.go",
|
||||
"before_sha256": "10774e272206c7a8d6ebfb106b37d535de77f7e96ba57657b4dad960639f8519",
|
||||
"after_sha256": "d4c4acfcb8987071aecf5cd957b3821c8d2619a2696398d37c2970f2527686f7"
|
||||
},
|
||||
{
|
||||
"path": "models/db/engine.go",
|
||||
"before_sha256": "774cedc74e1a8d9ae6f9e5f106c6cbb66f12c11b42e99ef07a7affd03269c3d2",
|
||||
"after_sha256": "43683804d0c5bc6ead1dba0344c69dd196825cf3d5eb502af8d932a7b8207b96"
|
||||
},
|
||||
{
|
||||
"path": "models/db/sensitive_sql.go",
|
||||
"before_sha256": null,
|
||||
"after_sha256": "06a298d0d6e628e6920384d4ddeef449e40c090841ebaa3f6d175725a45ae584"
|
||||
},
|
||||
{
|
||||
"path": "models/db/sensitive_sql_logging_test.go",
|
||||
"before_sha256": null,
|
||||
"after_sha256": "d924b35d30686473caf29601cf51cc363ba68158cb4ef0981c9e2fc7b03c04b7"
|
||||
},
|
||||
{
|
||||
"path": "models/db/sensitive_sql_test.go",
|
||||
"before_sha256": null,
|
||||
"after_sha256": "de6353c955047c3311747e4777b9f9b2195e9efb19160b971dd758dfc94cf31b"
|
||||
},
|
||||
{
|
||||
"path": "routers/web/admin/auths.go",
|
||||
"before_sha256": "eeed6999e4655993b55873bb51efb4fcd946532255b9473d16e086e04a1ec911",
|
||||
"after_sha256": "3498229e06fb9ff52396bcb5e68c0cc2d2ad24e6494533d8717d7c833f3e2923"
|
||||
},
|
||||
{
|
||||
"path": "routers/web/auth/oauth.go",
|
||||
"before_sha256": "6f454b3550b150178a8597a9437adb0c626556f34c15a13778c15d675b05659b",
|
||||
"after_sha256": "58bff778e0dc17a521706289bf45c3e0d76a759a0874f76c379b3d1ddb419b17"
|
||||
},
|
||||
{
|
||||
"path": "services/auth/source/oauth2/access_engine.go",
|
||||
"before_sha256": null,
|
||||
"after_sha256": "d5f07f9491ac2212410e1fa8c0248d68ba3a723e7ca99e363627c5292d187aa8"
|
||||
},
|
||||
{
|
||||
"path": "services/auth/source/oauth2/access_engine_assurance.go",
|
||||
"before_sha256": null,
|
||||
"after_sha256": "42de751b1e9a243301d566260954813b770558ecb449639acaeab307fe788642"
|
||||
},
|
||||
{
|
||||
"path": "services/auth/source/oauth2/access_engine_assurance_test.go",
|
||||
"before_sha256": null,
|
||||
"after_sha256": "44e7459f6c1106a264093c19d61d01a8365f6ad22682906552d832ba39d61dd3"
|
||||
},
|
||||
{
|
||||
"path": "services/auth/source/oauth2/access_engine_azp_test.go",
|
||||
"before_sha256": null,
|
||||
"after_sha256": "5f94f43ade9a79b6b7ef529c80115a8c32acfece425dc8ed3f24e6ad839fc0ce"
|
||||
},
|
||||
{
|
||||
"path": "services/auth/source/oauth2/access_engine_callback_test.go",
|
||||
"before_sha256": null,
|
||||
"after_sha256": "5cea36b630c895a9473dc876b7128526ddef65d9395b2fddc56343e162452472"
|
||||
},
|
||||
{
|
||||
"path": "services/auth/source/oauth2/access_engine_test.go",
|
||||
"before_sha256": null,
|
||||
"after_sha256": "99edd6cfe3e834d73e0447a7915f52cc4ab7b82644669c5ae61963f850b447e8"
|
||||
},
|
||||
{
|
||||
"path": "services/auth/source/oauth2/providers_openid.go",
|
||||
"before_sha256": "6ddca7fb4ab8b16e6b096481cfb40ca5abdf3a327f38c895b95b3846cc7c2248",
|
||||
"after_sha256": "5dd9b906cce434c774968d57fcc790cb678147345fea4d2e58477ec6eed70bcf"
|
||||
},
|
||||
{
|
||||
"path": "services/auth/source/oauth2/required_claim_values.go",
|
||||
"before_sha256": null,
|
||||
"after_sha256": "29f16d07464bbe12e3f65616b6c1eb60561d04cd8ff89ecbfb56f93dbeaf1cda"
|
||||
},
|
||||
{
|
||||
"path": "services/auth/source/oauth2/required_claim_values_test.go",
|
||||
"before_sha256": null,
|
||||
"after_sha256": "54a8bd97dc51c524a9adf0c6aefb9a19fa152d234b3bb929bf1a90932662d3d0"
|
||||
},
|
||||
{
|
||||
"path": "services/auth/source/oauth2/source.go",
|
||||
"before_sha256": "a6ee5146c07d8efb1837ef91f1ab5f3139f69a1ff66f814d5e9c6053bf9b0d8b",
|
||||
"after_sha256": "44e99883c2ec479427b3f72c73353fe33936eed2e5c962b2fa40803576aa5642"
|
||||
},
|
||||
{
|
||||
"path": "services/auth/source/oauth2/source_callout.go",
|
||||
"before_sha256": "c30c418182d4cb98b1e448f621c93322accfbbf92d6a59e6df1ae45a7aa8fc7b",
|
||||
"after_sha256": "6abba69df97afc62467f0328eaa5a6383cfb4900202a081dec4b84a21b37349c"
|
||||
},
|
||||
{
|
||||
"path": "third_party/access-engine-pep/LICENSE",
|
||||
"before_sha256": null,
|
||||
"after_sha256": "ff413f361a3b3bf44cf50f110fbcc4837064d57eefbcef89df2b43997c6262b6"
|
||||
},
|
||||
{
|
||||
"path": "third_party/access-engine-pep/go.mod",
|
||||
"before_sha256": null,
|
||||
"after_sha256": "fea700810e47c1ba5638b86a168f8531c083a6e1222ca80bd2a8947b2ea6f2c3"
|
||||
},
|
||||
{
|
||||
"path": "third_party/access-engine-pep/internal/sign/sign.go",
|
||||
"before_sha256": null,
|
||||
"after_sha256": "0df9515922e90775ebbfac798361dcafb20da8a4213796b44e246b8a92046cde"
|
||||
},
|
||||
{
|
||||
"path": "third_party/access-engine-pep/pkg/api/canonical.go",
|
||||
"before_sha256": null,
|
||||
"after_sha256": "a122a2e8cd524333b13c5939c7a3685e41efbe47497a64e0c7297c92b7f10d19"
|
||||
},
|
||||
{
|
||||
"path": "third_party/access-engine-pep/pkg/api/caring.go",
|
||||
"before_sha256": null,
|
||||
"after_sha256": "1907156f0f889e7b9e9c14970cf7a86a20d00478a496efaf92c7231f27fec5e3"
|
||||
},
|
||||
{
|
||||
"path": "third_party/access-engine-pep/pkg/api/resource_manifest.go",
|
||||
"before_sha256": null,
|
||||
"after_sha256": "f0fa4080287d389ed48c2b1d6af96cc62e57ef72c902333f677f964420be133f"
|
||||
},
|
||||
{
|
||||
"path": "third_party/access-engine-pep/pkg/decisionpep/client.go",
|
||||
"before_sha256": null,
|
||||
"after_sha256": "0d57f6ddaca5c3f81ce426c0e8b14ba14ea5962096d3be5909aa456eef19eeba"
|
||||
},
|
||||
{
|
||||
"path": "third_party/access-engine-pep/pkg/decisionpep/client_test.go",
|
||||
"before_sha256": null,
|
||||
"after_sha256": "1a6be3485f580f95a1f1406fb76e525f2c4bf02fe04a424cfe0095bb728e3f62"
|
||||
},
|
||||
{
|
||||
"path": "third_party/access-engine-pep/producer-source.json",
|
||||
"before_sha256": null,
|
||||
"after_sha256": "c1d83e3d79f9860ffaa61ec19a6b3415e914d3058b11b07cdd05a7d1182cdceb"
|
||||
},
|
||||
{
|
||||
"path": "third_party/access-engine-pep/testsupport/signfixture/sign.go",
|
||||
"before_sha256": null,
|
||||
"after_sha256": "fe4aa86f444dc20145aefbaca35b24f046264b2c5c8b4e3b057a4496b77a4d29"
|
||||
}
|
||||
],
|
||||
"original_bad_context_snapshot": "empty; recovered from frozen patch and verified exact pre/postimage hashes",
|
||||
"native_gates_closed": 0,
|
||||
"issuer_source_commit": "git:d803e9282a47b49daf930fb905312fa5104c0ace",
|
||||
"open_gates": [
|
||||
"Complete release rebuild and artifact verification with this exact patch.",
|
||||
"Current authenticated operation/inverse sessions and release-wide writer exclusion.",
|
||||
"Ongoing HTTP/API/Git/SSH authorization; native issuer/factor/custody acceptance.",
|
||||
"Owner source/package/type admission; no operational authority granted by source tests."
|
||||
],
|
||||
"preceding_packet_tests": {
|
||||
"producer_race_passes_including_subtests": 494,
|
||||
"producer_existing_skips": 3,
|
||||
"consumer_passes_including_subtests": 76,
|
||||
"consumer_skips": 0,
|
||||
"actual_cli_subprocesses": 48
|
||||
},
|
||||
"actual_issuer_callback_tests": {
|
||||
"receipt": "consumer-after-attempt2.json",
|
||||
"passed_including_subtests": 71,
|
||||
"skipped": 0,
|
||||
"synthetic_authentication": true
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,149 @@
|
|||
{
|
||||
"returncode": 0,
|
||||
"seconds": 5.79,
|
||||
"workspace": "/tmp/custodian-forgejo-wire-uxs0ekwk",
|
||||
"argv": [
|
||||
"bwrap",
|
||||
"--unshare-pid",
|
||||
"--die-with-parent",
|
||||
"--new-session",
|
||||
"--unshare-net",
|
||||
"--ro-bind",
|
||||
"/usr",
|
||||
"/usr",
|
||||
"--ro-bind",
|
||||
"/lib",
|
||||
"/lib",
|
||||
"--ro-bind",
|
||||
"/lib64",
|
||||
"/lib64",
|
||||
"--symlink",
|
||||
"usr/bin",
|
||||
"/bin",
|
||||
"--proc",
|
||||
"/proc",
|
||||
"--dev",
|
||||
"/dev",
|
||||
"--tmpfs",
|
||||
"/tmp",
|
||||
"--bind",
|
||||
"/tmp/custodian-forgejo-successor-attempt2",
|
||||
"/work",
|
||||
"--ro-bind",
|
||||
"/home/worsch/go/pkg/mod/cache/download",
|
||||
"/cached",
|
||||
"--ro-bind",
|
||||
"/etc/ssl/certs",
|
||||
"/etc/ssl/certs",
|
||||
"--ro-bind",
|
||||
"/etc/resolv.conf",
|
||||
"/etc/resolv.conf",
|
||||
"--chdir",
|
||||
"/work/source",
|
||||
"--clearenv",
|
||||
"--dir",
|
||||
"/run",
|
||||
"--ro-bind",
|
||||
"/tmp/custodian-forgejo-successor-attempt2/descriptor-fixtures",
|
||||
"/run/forgejo-oidc",
|
||||
"--bind",
|
||||
"/tmp/custodian-forgejo-successor-attempt2/descriptor-fixtures",
|
||||
"/run/writable-input",
|
||||
"--setenv",
|
||||
"PATH",
|
||||
"/work/go/bin:/usr/bin:/bin",
|
||||
"--setenv",
|
||||
"HOME",
|
||||
"/work/home",
|
||||
"--setenv",
|
||||
"GOPATH",
|
||||
"/work/gopath",
|
||||
"--setenv",
|
||||
"GOTOOLCHAIN",
|
||||
"local",
|
||||
"--setenv",
|
||||
"GOPROXY",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOSUMDB",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOVCS",
|
||||
"*:off",
|
||||
"--setenv",
|
||||
"GOMODCACHE",
|
||||
"/work/modules",
|
||||
"--setenv",
|
||||
"GOCACHE",
|
||||
"/work/gocache",
|
||||
"--setenv",
|
||||
"GOMAXPROCS",
|
||||
"4",
|
||||
"--setenv",
|
||||
"CGO_ENABLED",
|
||||
"1",
|
||||
"--setenv",
|
||||
"GIT_CONFIG_NOSYSTEM",
|
||||
"1",
|
||||
"--setenv",
|
||||
"GIT_CONFIG_GLOBAL",
|
||||
"/work/home/test.gitconfig",
|
||||
"--setenv",
|
||||
"GIT_TERMINAL_PROMPT",
|
||||
"0",
|
||||
"--ro-bind",
|
||||
"/tmp/custodian-forgejo-wire-uxs0ekwk/oauth2",
|
||||
"/work/source/services/auth/source/oauth2",
|
||||
"--ro-bind",
|
||||
"/tmp/custodian-keycape-wire-jum8uowp/identity.json",
|
||||
"/work/keycape-wire-fixture.json",
|
||||
"--setenv",
|
||||
"CUSTODIAN_SYNTHETIC_IDENTITY_FIXTURE",
|
||||
"/work/keycape-wire-fixture.json",
|
||||
"--",
|
||||
"go",
|
||||
"test",
|
||||
"-p",
|
||||
"1",
|
||||
"-json",
|
||||
"-tags",
|
||||
"sqlite sqlite_unlock_notify",
|
||||
"./services/auth/source/oauth2",
|
||||
"-run",
|
||||
"TestAccessEngine|TestVerifiedApplicationIdentity|TestRequired|TestCurrent",
|
||||
"-count=1"
|
||||
],
|
||||
"actual_issuer_source": "d803e9282a47b49daf930fb905312fa5104c0ace",
|
||||
"fixture_sha256": "a9465766c6edebf8e6ce77e2bcaef9d1bfa081c6472c731f95c0b9caaf684522",
|
||||
"consumer_source_pins": {
|
||||
"access_engine.go": "sha256:d5f07f9491ac2212410e1fa8c0248d68ba3a723e7ca99e363627c5292d187aa8",
|
||||
"access_engine_assurance.go": "sha256:42de751b1e9a243301d566260954813b770558ecb449639acaeab307fe788642",
|
||||
"access_engine_assurance_test.go": "sha256:44e7459f6c1106a264093c19d61d01a8365f6ad22682906552d832ba39d61dd3",
|
||||
"access_engine_azp_test.go": "sha256:5f94f43ade9a79b6b7ef529c80115a8c32acfece425dc8ed3f24e6ad839fc0ce",
|
||||
"access_engine_callback_test.go": "sha256:5cea36b630c895a9473dc876b7128526ddef65d9395b2fddc56343e162452472",
|
||||
"access_engine_test.go": "sha256:99edd6cfe3e834d73e0447a7915f52cc4ab7b82644669c5ae61963f850b447e8",
|
||||
"assert_interface_test.go": "sha256:a0db85e38b7ea61e21b0291e55c8b451c89a877bd3db229e35dbb4418458f54f",
|
||||
"init.go": "sha256:98a8030ed005be67b237d54c3b197a629f8c289e3d74c8edfcf4d740831f87d1",
|
||||
"jwtsigningkey.go": "sha256:0c6e8ac131fd41ad299073ca748dd95e5fd9c044219c4d7f36d50c4ffcd5b266",
|
||||
"jwtsigningkey_test.go": "sha256:3e414a541479741773e48de84be7d5a3b794bcc7289627fbd2e8996832628321",
|
||||
"keycape_wire_test.go": "sha256:e78c9b87ebbbc1da6f9985a394a6ba1bf5d5aa5041fc5a6bf4099d046d026b3e",
|
||||
"providers.go": "sha256:7df0051f19932a68d16a33a5d41898e06e9612f839195e27c86802eeebb2e3e9",
|
||||
"providers_base.go": "sha256:643dbc0561ec7aa7a975978ff2c21d256a5ab619b125e8077d2395281f628542",
|
||||
"providers_custom.go": "sha256:265a526d209d86c24cbcfdde4c2d73957aaeaccfd329438c11ce99c5951ebb39",
|
||||
"providers_openid.go": "sha256:5dd9b906cce434c774968d57fcc790cb678147345fea4d2e58477ec6eed70bcf",
|
||||
"providers_simple.go": "sha256:53927b6bfc621dd1b68a074b6763abe5b27795d5a50ca6f0555f3e7a04fa1613",
|
||||
"required_claim_values.go": "sha256:29f16d07464bbe12e3f65616b6c1eb60561d04cd8ff89ecbfb56f93dbeaf1cda",
|
||||
"required_claim_values_test.go": "sha256:54a8bd97dc51c524a9adf0c6aefb9a19fa152d234b3bb929bf1a90932662d3d0",
|
||||
"source.go": "sha256:44e99883c2ec479427b3f72c73353fe33936eed2e5c962b2fa40803576aa5642",
|
||||
"source_authenticate.go": "sha256:c6551f00ef4349ccd6afdbb2cba847067528485ff621c3e507b9aab588bb96b5",
|
||||
"source_callout.go": "sha256:6abba69df97afc62467f0328eaa5a6383cfb4900202a081dec4b84a21b37349c",
|
||||
"source_name.go": "sha256:712943826e01f718ab4ca717df6c5f2171535cb2229dbf8460f542d757ef8d7f",
|
||||
"source_register.go": "sha256:5ad9ccf213881734dc7fe7619cbe6c47cb6a4afdbbfc3e674ab4493857ebbf91",
|
||||
"store.go": "sha256:35b244081569215384de07f8cdc1e83b5545a2e673ca1ac5a2a6ee686cb917a3",
|
||||
"token.go": "sha256:c0a8868f904bb31842202b4e635a76403902adff9e638d5cb581e7e2d4954933",
|
||||
"urlmapping.go": "sha256:f2132408d4a447e766e67495b1ca7b8cc2b47d4eb56b0c44b50ba01fe41ca83e"
|
||||
},
|
||||
"fixture_values_published": false,
|
||||
"synthetic_authentication": true,
|
||||
"real_credentials": false
|
||||
}
|
||||
|
|
@ -0,0 +1,288 @@
|
|||
{"Time":"2026-10-18T00:14:25.001478827Z","Action":"start","Package":"forgejo.org/services/auth/source/oauth2"}
|
||||
{"Time":"2026-10-18T00:14:25.090083399Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals"}
|
||||
{"Time":"2026-10-18T00:14:25.090150659Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals\n"}
|
||||
{"Time":"2026-10-18T00:14:25.090225701Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/string-at"}
|
||||
{"Time":"2026-10-18T00:14:25.090232013Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/string-at","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/string-at\n"}
|
||||
{"Time":"2026-10-18T00:14:25.093441211Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/string-at","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/string-at (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.09349949Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/string-at","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.093755255Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/integer-mfa"}
|
||||
{"Time":"2026-10-18T00:14:25.093780423Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/integer-mfa","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/integer-mfa\n"}
|
||||
{"Time":"2026-10-18T00:14:25.094191577Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/integer-mfa","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/integer-mfa (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.09424688Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/integer-mfa","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.094257439Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/wrong-source"}
|
||||
{"Time":"2026-10-18T00:14:25.094264112Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/wrong-source","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/wrong-source\n"}
|
||||
{"Time":"2026-10-18T00:14:25.09501313Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/wrong-source","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/wrong-source (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.095076449Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/wrong-source","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.095088784Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/wrong-level"}
|
||||
{"Time":"2026-10-18T00:14:25.095095448Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/wrong-level","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/wrong-level\n"}
|
||||
{"Time":"2026-10-18T00:14:25.095673476Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/wrong-level","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/wrong-level (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.095731511Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/wrong-level","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.09574116Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/mixed-methods"}
|
||||
{"Time":"2026-10-18T00:14:25.095781278Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/mixed-methods","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/mixed-methods\n"}
|
||||
{"Time":"2026-10-18T00:14:25.09661682Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/mixed-methods","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/mixed-methods (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.096709382Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/mixed-methods","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.096721709Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/stale-authentication"}
|
||||
{"Time":"2026-10-18T00:14:25.096726362Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/stale-authentication","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/stale-authentication\n"}
|
||||
{"Time":"2026-10-18T00:14:25.097476214Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/stale-authentication","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/stale-authentication (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.097535999Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/stale-authentication","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.097605936Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/fractional-at"}
|
||||
{"Time":"2026-10-18T00:14:25.097633006Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/fractional-at","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/fractional-at\n"}
|
||||
{"Time":"2026-10-18T00:14:25.099145526Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/fractional-at","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/fractional-at (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.099199007Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/fractional-at","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.099210234Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/inconsistent-mfa"}
|
||||
{"Time":"2026-10-18T00:14:25.099214842Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/inconsistent-mfa","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/inconsistent-mfa\n"}
|
||||
{"Time":"2026-10-18T00:14:25.100019903Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/inconsistent-mfa","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/inconsistent-mfa (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.10006361Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/inconsistent-mfa","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.100073727Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/object-methods"}
|
||||
{"Time":"2026-10-18T00:14:25.100077658Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/object-methods","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/object-methods\n"}
|
||||
{"Time":"2026-10-18T00:14:25.100849733Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/object-methods","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/object-methods (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.100878985Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/object-methods","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.100912692Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/empty-methods"}
|
||||
{"Time":"2026-10-18T00:14:25.100918066Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/empty-methods","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/empty-methods\n"}
|
||||
{"Time":"2026-10-18T00:14:25.10174212Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/empty-methods","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/empty-methods (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.10180763Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/empty-methods","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.101924277Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/duplicate-methods"}
|
||||
{"Time":"2026-10-18T00:14:25.10193747Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/duplicate-methods","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/duplicate-methods\n"}
|
||||
{"Time":"2026-10-18T00:14:25.102648074Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/duplicate-methods","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/duplicate-methods (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.102683764Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/duplicate-methods","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.102695523Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/unknown-object-field"}
|
||||
{"Time":"2026-10-18T00:14:25.102705712Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/unknown-object-field","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/unknown-object-field\n"}
|
||||
{"Time":"2026-10-18T00:14:25.103135191Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/unknown-object-field","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/unknown-object-field (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.103168501Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/unknown-object-field","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.10317842Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/future-authentication"}
|
||||
{"Time":"2026-10-18T00:14:25.103182631Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/future-authentication","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/future-authentication\n"}
|
||||
{"Time":"2026-10-18T00:14:25.103455818Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/future-authentication","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/future-authentication (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.103468829Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/future-authentication","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.103474826Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/missing-at"}
|
||||
{"Time":"2026-10-18T00:14:25.103479371Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/missing-at","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/missing-at\n"}
|
||||
{"Time":"2026-10-18T00:14:25.103770835Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/missing-at","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/missing-at (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.103782657Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/missing-at","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.104434595Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.104448283Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:14:25.10445464Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeIdentityFactsAndFreshnessBounds"}
|
||||
{"Time":"2026-10-18T00:14:25.10445886Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeIdentityFactsAndFreshnessBounds","Output":"=== RUN TestAccessEngineKeyCapeIdentityFactsAndFreshnessBounds\n"}
|
||||
{"Time":"2026-10-18T00:14:25.105028819Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeIdentityFactsAndFreshnessBounds","Output":"--- PASS: TestAccessEngineKeyCapeIdentityFactsAndFreshnessBounds (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.105071353Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeIdentityFactsAndFreshnessBounds","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.105079919Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeLowerAssuranceIsAnIdentityFact"}
|
||||
{"Time":"2026-10-18T00:14:25.105084825Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeLowerAssuranceIsAnIdentityFact","Output":"=== RUN TestAccessEngineKeyCapeLowerAssuranceIsAnIdentityFact\n"}
|
||||
{"Time":"2026-10-18T00:14:25.105348881Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeLowerAssuranceIsAnIdentityFact","Output":"--- PASS: TestAccessEngineKeyCapeLowerAssuranceIsAnIdentityFact (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.1053732Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeLowerAssuranceIsAnIdentityFact","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.10537917Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient"}
|
||||
{"Time":"2026-10-18T00:14:25.105383489Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient","Output":"=== RUN TestAccessEngineAuthorizedPartyRefusesAnotherClient\n"}
|
||||
{"Time":"2026-10-18T00:14:25.105391244Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/other-client"}
|
||||
{"Time":"2026-10-18T00:14:25.105395284Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/other-client","Output":"=== RUN TestAccessEngineAuthorizedPartyRefusesAnotherClient/other-client\n"}
|
||||
{"Time":"2026-10-18T00:14:25.105899627Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/other-client","Output":"--- PASS: TestAccessEngineAuthorizedPartyRefusesAnotherClient/other-client (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.105934326Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/other-client","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.105944163Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/number"}
|
||||
{"Time":"2026-10-18T00:14:25.105962586Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/number","Output":"=== RUN TestAccessEngineAuthorizedPartyRefusesAnotherClient/number\n"}
|
||||
{"Time":"2026-10-18T00:14:25.106270552Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/number","Output":"--- PASS: TestAccessEngineAuthorizedPartyRefusesAnotherClient/number (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.106287603Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/number","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.106511477Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/array"}
|
||||
{"Time":"2026-10-18T00:14:25.106548889Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/array","Output":"=== RUN TestAccessEngineAuthorizedPartyRefusesAnotherClient/array\n"}
|
||||
{"Time":"2026-10-18T00:14:25.106992347Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/array","Output":"--- PASS: TestAccessEngineAuthorizedPartyRefusesAnotherClient/array (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.10705095Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/array","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.107126505Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/empty"}
|
||||
{"Time":"2026-10-18T00:14:25.107134314Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/empty","Output":"=== RUN TestAccessEngineAuthorizedPartyRefusesAnotherClient/empty\n"}
|
||||
{"Time":"2026-10-18T00:14:25.107429458Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/empty","Output":"--- PASS: TestAccessEngineAuthorizedPartyRefusesAnotherClient/empty (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.107448998Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/empty","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.10745706Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient","Output":"--- PASS: TestAccessEngineAuthorizedPartyRefusesAnotherClient (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.107462876Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.107477493Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyAcceptsAdmittedClient"}
|
||||
{"Time":"2026-10-18T00:14:25.107482452Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyAcceptsAdmittedClient","Output":"=== RUN TestAccessEngineAuthorizedPartyAcceptsAdmittedClient\n"}
|
||||
{"Time":"2026-10-18T00:14:25.108268347Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyAcceptsAdmittedClient","Output":"--- PASS: TestAccessEngineAuthorizedPartyAcceptsAdmittedClient (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.108333839Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyAcceptsAdmittedClient","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.108346833Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision"}
|
||||
{"Time":"2026-10-18T00:14:25.10837163Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision","Output":"=== RUN TestAccessEngineActualCallbackAllowsAuthenticatedDecision\n"}
|
||||
{"Time":"2026-10-18T00:14:25.108378195Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-admins"}
|
||||
{"Time":"2026-10-18T00:14:25.108382658Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-admins","Output":"=== RUN TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-admins\n"}
|
||||
{"Time":"2026-10-18T00:14:25.125694113Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-admins","Output":"--- PASS: TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-admins (0.02s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.125761075Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-admins","Elapsed":0.02}
|
||||
{"Time":"2026-10-18T00:14:25.125778541Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-owners"}
|
||||
{"Time":"2026-10-18T00:14:25.125785557Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-owners","Output":"=== RUN TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-owners\n"}
|
||||
{"Time":"2026-10-18T00:14:25.133280734Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-owners","Output":"--- PASS: TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-owners (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.133329869Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-owners","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:14:25.133344649Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-readers"}
|
||||
{"Time":"2026-10-18T00:14:25.13334987Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-readers","Output":"=== RUN TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-readers\n"}
|
||||
{"Time":"2026-10-18T00:14:25.142774698Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-readers","Output":"--- PASS: TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-readers (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.142837386Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-readers","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:14:25.142857756Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision","Output":"--- PASS: TestAccessEngineActualCallbackAllowsAuthenticatedDecision (0.03s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.142868035Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision","Elapsed":0.03}
|
||||
{"Time":"2026-10-18T00:14:25.142878117Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP"}
|
||||
{"Time":"2026-10-18T00:14:25.142881841Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP","Output":"=== RUN TestAccessEngineActualCallbackRefusesUnverifiedPDP\n"}
|
||||
{"Time":"2026-10-18T00:14:25.142898757Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/deny"}
|
||||
{"Time":"2026-10-18T00:14:25.142902625Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/deny","Output":"=== RUN TestAccessEngineActualCallbackRefusesUnverifiedPDP/deny\n"}
|
||||
{"Time":"2026-10-18T00:14:25.149749783Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/deny","Output":"--- PASS: TestAccessEngineActualCallbackRefusesUnverifiedPDP/deny (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.149826168Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/deny","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:14:25.149843959Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/unsigned"}
|
||||
{"Time":"2026-10-18T00:14:25.149849514Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/unsigned","Output":"=== RUN TestAccessEngineActualCallbackRefusesUnverifiedPDP/unsigned\n"}
|
||||
{"Time":"2026-10-18T00:14:25.15804686Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/unsigned","Output":"--- PASS: TestAccessEngineActualCallbackRefusesUnverifiedPDP/unsigned (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.158097339Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/unsigned","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:14:25.158105779Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-key"}
|
||||
{"Time":"2026-10-18T00:14:25.158110639Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-key","Output":"=== RUN TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-key\n"}
|
||||
{"Time":"2026-10-18T00:14:25.166132907Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-key","Output":"--- PASS: TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-key (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.166182943Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-key","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:14:25.166194044Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-pin"}
|
||||
{"Time":"2026-10-18T00:14:25.166199156Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-pin","Output":"=== RUN TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-pin\n"}
|
||||
{"Time":"2026-10-18T00:14:25.175201928Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-pin","Output":"--- PASS: TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-pin (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.175248962Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-pin","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:14:25.17525761Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-binding"}
|
||||
{"Time":"2026-10-18T00:14:25.175262659Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-binding","Output":"=== RUN TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-binding\n"}
|
||||
{"Time":"2026-10-18T00:14:25.183524147Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-binding","Output":"--- PASS: TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-binding (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.183585176Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-binding","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:14:25.183599504Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/expired"}
|
||||
{"Time":"2026-10-18T00:14:25.183606267Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/expired","Output":"=== RUN TestAccessEngineActualCallbackRefusesUnverifiedPDP/expired\n"}
|
||||
{"Time":"2026-10-18T00:14:25.195309772Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/expired","Output":"--- PASS: TestAccessEngineActualCallbackRefusesUnverifiedPDP/expired (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.195374192Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/expired","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:14:25.195389701Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP","Output":"--- PASS: TestAccessEngineActualCallbackRefusesUnverifiedPDP (0.05s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.195397213Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP","Elapsed":0.05}
|
||||
{"Time":"2026-10-18T00:14:25.195411126Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP"}
|
||||
{"Time":"2026-10-18T00:14:25.195422389Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP\n"}
|
||||
{"Time":"2026-10-18T00:14:25.195428503Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-token"}
|
||||
{"Time":"2026-10-18T00:14:25.195434436Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-token","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-token\n"}
|
||||
{"Time":"2026-10-18T00:14:25.198511181Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-token","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-token (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.198581876Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-token","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.198595258Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-user"}
|
||||
{"Time":"2026-10-18T00:14:25.198600001Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-user","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-user\n"}
|
||||
{"Time":"2026-10-18T00:14:25.201479458Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-user","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-user (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.201621849Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-user","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.20165845Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-source"}
|
||||
{"Time":"2026-10-18T00:14:25.201666106Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-source","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-source\n"}
|
||||
{"Time":"2026-10-18T00:14:25.20420718Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-source","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-source (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.204277686Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-source","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.204293791Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/untrusted-identity"}
|
||||
{"Time":"2026-10-18T00:14:25.204300157Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/untrusted-identity","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/untrusted-identity\n"}
|
||||
{"Time":"2026-10-18T00:14:25.20731393Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/untrusted-identity","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/untrusted-identity (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.207374075Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/untrusted-identity","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.207389143Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-subject"}
|
||||
{"Time":"2026-10-18T00:14:25.207395347Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-subject","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-subject\n"}
|
||||
{"Time":"2026-10-18T00:14:25.209940713Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-subject","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-subject (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.210002788Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-subject","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.210013527Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-groups"}
|
||||
{"Time":"2026-10-18T00:14:25.210019893Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-groups","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-groups\n"}
|
||||
{"Time":"2026-10-18T00:14:25.212774907Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-groups","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-groups (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.212853284Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-groups","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.212868857Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-provider"}
|
||||
{"Time":"2026-10-18T00:14:25.212903276Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-provider","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-provider\n"}
|
||||
{"Time":"2026-10-18T00:14:25.218029528Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-provider","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-provider (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.21808199Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-provider","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.218094182Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-audience"}
|
||||
{"Time":"2026-10-18T00:14:25.218101774Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-audience","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-audience\n"}
|
||||
{"Time":"2026-10-18T00:14:25.220432015Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-audience","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-audience (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.22050409Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-audience","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.220519456Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-admission"}
|
||||
{"Time":"2026-10-18T00:14:25.220604407Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-admission","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-admission\n"}
|
||||
{"Time":"2026-10-18T00:14:25.223138132Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-admission","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-admission (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.223206429Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-admission","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.223225248Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/expired-token"}
|
||||
{"Time":"2026-10-18T00:14:25.223232381Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/expired-token","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/expired-token\n"}
|
||||
{"Time":"2026-10-18T00:14:25.231732858Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/expired-token","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/expired-token (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.231803048Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/expired-token","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:14:25.231817043Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP (0.04s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.231828621Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP","Elapsed":0.04}
|
||||
{"Time":"2026-10-18T00:14:25.231963447Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE"}
|
||||
{"Time":"2026-10-18T00:14:25.231986459Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE\n"}
|
||||
{"Time":"2026-10-18T00:14:25.232891505Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/audience"}
|
||||
{"Time":"2026-10-18T00:14:25.232937196Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/audience","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/audience\n"}
|
||||
{"Time":"2026-10-18T00:14:25.233611719Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/audience","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/audience (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.233681711Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/audience","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.233693496Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/expired"}
|
||||
{"Time":"2026-10-18T00:14:25.233706815Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/expired","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/expired\n"}
|
||||
{"Time":"2026-10-18T00:14:25.234347123Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/expired","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/expired (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.234401281Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/expired","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.234415149Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/future-issued"}
|
||||
{"Time":"2026-10-18T00:14:25.234421479Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/future-issued","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/future-issued\n"}
|
||||
{"Time":"2026-10-18T00:14:25.235065678Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/future-issued","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/future-issued (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.235125886Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/future-issued","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.235154696Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-exp"}
|
||||
{"Time":"2026-10-18T00:14:25.235166888Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-exp","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/no-exp\n"}
|
||||
{"Time":"2026-10-18T00:14:25.237377394Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-exp","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/no-exp (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.238624541Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-exp","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.243293199Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-iat"}
|
||||
{"Time":"2026-10-18T00:14:25.24335007Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-iat","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/no-iat\n"}
|
||||
{"Time":"2026-10-18T00:14:25.243950687Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-iat","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/no-iat (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.244009587Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-iat","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.244025936Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-assurance"}
|
||||
{"Time":"2026-10-18T00:14:25.244076405Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-assurance","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/no-assurance\n"}
|
||||
{"Time":"2026-10-18T00:14:25.24469133Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-assurance","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/no-assurance (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.24474454Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-assurance","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.244759247Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/multi-audience-no-azp"}
|
||||
{"Time":"2026-10-18T00:14:25.244766398Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/multi-audience-no-azp","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/multi-audience-no-azp\n"}
|
||||
{"Time":"2026-10-18T00:14:25.245362057Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/multi-audience-no-azp","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/multi-audience-no-azp (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.245421003Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/multi-audience-no-azp","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.245439957Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/empty-subject"}
|
||||
{"Time":"2026-10-18T00:14:25.245447108Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/empty-subject","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/empty-subject\n"}
|
||||
{"Time":"2026-10-18T00:14:25.246139326Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/empty-subject","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/empty-subject (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.246206054Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/empty-subject","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.246218038Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/issuer"}
|
||||
{"Time":"2026-10-18T00:14:25.246233403Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/issuer","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/issuer\n"}
|
||||
{"Time":"2026-10-18T00:14:25.246887145Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/issuer","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/issuer (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.246938489Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/issuer","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.246974098Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/old-issued"}
|
||||
{"Time":"2026-10-18T00:14:25.246987759Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/old-issued","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/old-issued\n"}
|
||||
{"Time":"2026-10-18T00:14:25.247529768Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/old-issued","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/old-issued (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.247573727Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/old-issued","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.247587713Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-tenant"}
|
||||
{"Time":"2026-10-18T00:14:25.247594638Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-tenant","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/no-tenant\n"}
|
||||
{"Time":"2026-10-18T00:14:25.248176165Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-tenant","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/no-tenant (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.248233118Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-tenant","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.248247266Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-principal"}
|
||||
{"Time":"2026-10-18T00:14:25.248255733Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-principal","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/no-principal\n"}
|
||||
{"Time":"2026-10-18T00:14:25.248864826Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-principal","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/no-principal (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.248909777Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-principal","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.248922509Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/wrong-key"}
|
||||
{"Time":"2026-10-18T00:14:25.248936071Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/wrong-key","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/wrong-key\n"}
|
||||
{"Time":"2026-10-18T00:14:25.249707093Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/wrong-key","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/wrong-key (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.249784632Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/wrong-key","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.249803388Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/unknown-key"}
|
||||
{"Time":"2026-10-18T00:14:25.249810521Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/unknown-key","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/unknown-key\n"}
|
||||
{"Time":"2026-10-18T00:14:25.25016838Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/unknown-key","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/unknown-key (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.25024481Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/unknown-key","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.250261627Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/wrong-type"}
|
||||
{"Time":"2026-10-18T00:14:25.250267542Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/wrong-type","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/wrong-type\n"}
|
||||
{"Time":"2026-10-18T00:14:25.250658699Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/wrong-type","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/wrong-type (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.250721333Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/wrong-type","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.250744399Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/algorithm-confusion"}
|
||||
{"Time":"2026-10-18T00:14:25.250752334Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/algorithm-confusion","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/algorithm-confusion\n"}
|
||||
{"Time":"2026-10-18T00:14:25.251065765Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/algorithm-confusion","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/algorithm-confusion (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.251120509Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/algorithm-confusion","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.25115261Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/none"}
|
||||
{"Time":"2026-10-18T00:14:25.25116491Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/none","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/none\n"}
|
||||
{"Time":"2026-10-18T00:14:25.251447855Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/none","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/none (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.251495286Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/none","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.251507216Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE (0.02s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.251514033Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE","Elapsed":0.02}
|
||||
{"Time":"2026-10-18T00:14:25.251536422Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeIssuer"}
|
||||
{"Time":"2026-10-18T00:14:25.251544736Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeIssuer","Output":"=== RUN TestAccessEngineActualKeyCapeIssuer\n"}
|
||||
{"Time":"2026-10-18T00:14:25.25223051Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeIssuer/allow"}
|
||||
{"Time":"2026-10-18T00:14:25.252290827Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeIssuer/allow","Output":"=== RUN TestAccessEngineActualKeyCapeIssuer/allow\n"}
|
||||
{"Time":"2026-10-18T00:14:25.269582031Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeIssuer/allow","Output":"--- PASS: TestAccessEngineActualKeyCapeIssuer/allow (0.02s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.269661283Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeIssuer/allow","Elapsed":0.02}
|
||||
{"Time":"2026-10-18T00:14:25.269672672Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeIssuer/deny"}
|
||||
{"Time":"2026-10-18T00:14:25.269684872Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeIssuer/deny","Output":"=== RUN TestAccessEngineActualKeyCapeIssuer/deny\n"}
|
||||
{"Time":"2026-10-18T00:14:25.280351239Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeIssuer/deny","Output":"--- PASS: TestAccessEngineActualKeyCapeIssuer/deny (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.280431258Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeIssuer/deny","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:14:25.280449482Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeIssuer","Output":"--- PASS: TestAccessEngineActualKeyCapeIssuer (0.03s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.280458355Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeIssuer","Elapsed":0.03}
|
||||
{"Time":"2026-10-18T00:14:25.280692825Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestRequiredClaimExactAnyOfAndNoMutation"}
|
||||
{"Time":"2026-10-18T00:14:25.280741563Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestRequiredClaimExactAnyOfAndNoMutation","Output":"=== RUN TestRequiredClaimExactAnyOfAndNoMutation\n"}
|
||||
{"Time":"2026-10-18T00:14:25.281438902Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestRequiredClaimExactAnyOfAndNoMutation","Output":"--- PASS: TestRequiredClaimExactAnyOfAndNoMutation (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.281501914Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestRequiredClaimExactAnyOfAndNoMutation","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.28159628Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestRequiredClaimConfigurationRefusalsAndLegacyIsolation"}
|
||||
{"Time":"2026-10-18T00:14:25.28163426Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestRequiredClaimConfigurationRefusalsAndLegacyIsolation","Output":"=== RUN TestRequiredClaimConfigurationRefusalsAndLegacyIsolation\n"}
|
||||
{"Time":"2026-10-18T00:14:25.282223103Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestRequiredClaimConfigurationRefusalsAndLegacyIsolation","Output":"--- PASS: TestRequiredClaimConfigurationRefusalsAndLegacyIsolation (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.282279478Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestRequiredClaimConfigurationRefusalsAndLegacyIsolation","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.28230772Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoGuardRejectsMissingMalformedAndUnavailable"}
|
||||
{"Time":"2026-10-18T00:14:25.282316512Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoGuardRejectsMissingMalformedAndUnavailable","Output":"=== RUN TestCurrentUserInfoGuardRejectsMissingMalformedAndUnavailable\n"}
|
||||
{"Time":"2026-10-18T00:14:25.29206661Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoGuardRejectsMissingMalformedAndUnavailable","Output":"--- PASS: TestCurrentUserInfoGuardRejectsMissingMalformedAndUnavailable (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.292834141Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoGuardRejectsMissingMalformedAndUnavailable","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:14:25.292966226Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoEmptyArrayOverwritesAndGroupRemoval"}
|
||||
{"Time":"2026-10-18T00:14:25.292981023Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoEmptyArrayOverwritesAndGroupRemoval","Output":"=== RUN TestCurrentUserInfoEmptyArrayOverwritesAndGroupRemoval\n"}
|
||||
{"Time":"2026-10-18T00:14:25.294295993Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoEmptyArrayOverwritesAndGroupRemoval","Output":"--- PASS: TestCurrentUserInfoEmptyArrayOverwritesAndGroupRemoval (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.294383199Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoEmptyArrayOverwritesAndGroupRemoval","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.29473842Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoGuardIsOptInAndRedirectsRefuse"}
|
||||
{"Time":"2026-10-18T00:14:25.294791035Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoGuardIsOptInAndRedirectsRefuse","Output":"=== RUN TestCurrentUserInfoGuardIsOptInAndRedirectsRefuse\n"}
|
||||
{"Time":"2026-10-18T00:14:25.295614484Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoGuardIsOptInAndRedirectsRefuse","Output":"--- PASS: TestCurrentUserInfoGuardIsOptInAndRedirectsRefuse (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:14:25.296007419Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoGuardIsOptInAndRedirectsRefuse","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:14:25.296061866Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Output":"PASS\n"}
|
||||
{"Time":"2026-10-18T00:14:25.307733872Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Output":"ok \tforgejo.org/services/auth/source/oauth2\t0.306s\n"}
|
||||
{"Time":"2026-10-18T00:14:25.307834567Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Elapsed":0.306}
|
||||
|
|
@ -0,0 +1,149 @@
|
|||
{
|
||||
"returncode": 0,
|
||||
"seconds": 31.56,
|
||||
"workspace": "/tmp/custodian-forgejo-wire-338cr8ht",
|
||||
"argv": [
|
||||
"bwrap",
|
||||
"--unshare-pid",
|
||||
"--die-with-parent",
|
||||
"--new-session",
|
||||
"--unshare-net",
|
||||
"--ro-bind",
|
||||
"/usr",
|
||||
"/usr",
|
||||
"--ro-bind",
|
||||
"/lib",
|
||||
"/lib",
|
||||
"--ro-bind",
|
||||
"/lib64",
|
||||
"/lib64",
|
||||
"--symlink",
|
||||
"usr/bin",
|
||||
"/bin",
|
||||
"--proc",
|
||||
"/proc",
|
||||
"--dev",
|
||||
"/dev",
|
||||
"--tmpfs",
|
||||
"/tmp",
|
||||
"--bind",
|
||||
"/tmp/custodian-forgejo-successor-attempt2",
|
||||
"/work",
|
||||
"--ro-bind",
|
||||
"/home/worsch/go/pkg/mod/cache/download",
|
||||
"/cached",
|
||||
"--ro-bind",
|
||||
"/etc/ssl/certs",
|
||||
"/etc/ssl/certs",
|
||||
"--ro-bind",
|
||||
"/etc/resolv.conf",
|
||||
"/etc/resolv.conf",
|
||||
"--chdir",
|
||||
"/work/source",
|
||||
"--clearenv",
|
||||
"--dir",
|
||||
"/run",
|
||||
"--ro-bind",
|
||||
"/tmp/custodian-forgejo-successor-attempt2/descriptor-fixtures",
|
||||
"/run/forgejo-oidc",
|
||||
"--bind",
|
||||
"/tmp/custodian-forgejo-successor-attempt2/descriptor-fixtures",
|
||||
"/run/writable-input",
|
||||
"--setenv",
|
||||
"PATH",
|
||||
"/work/go/bin:/usr/bin:/bin",
|
||||
"--setenv",
|
||||
"HOME",
|
||||
"/work/home",
|
||||
"--setenv",
|
||||
"GOPATH",
|
||||
"/work/gopath",
|
||||
"--setenv",
|
||||
"GOTOOLCHAIN",
|
||||
"local",
|
||||
"--setenv",
|
||||
"GOPROXY",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOSUMDB",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOVCS",
|
||||
"*:off",
|
||||
"--setenv",
|
||||
"GOMODCACHE",
|
||||
"/work/modules",
|
||||
"--setenv",
|
||||
"GOCACHE",
|
||||
"/work/gocache",
|
||||
"--setenv",
|
||||
"GOMAXPROCS",
|
||||
"4",
|
||||
"--setenv",
|
||||
"CGO_ENABLED",
|
||||
"1",
|
||||
"--setenv",
|
||||
"GIT_CONFIG_NOSYSTEM",
|
||||
"1",
|
||||
"--setenv",
|
||||
"GIT_CONFIG_GLOBAL",
|
||||
"/work/home/test.gitconfig",
|
||||
"--setenv",
|
||||
"GIT_TERMINAL_PROMPT",
|
||||
"0",
|
||||
"--ro-bind",
|
||||
"/tmp/custodian-forgejo-wire-338cr8ht/oauth2",
|
||||
"/work/source/services/auth/source/oauth2",
|
||||
"--ro-bind",
|
||||
"/tmp/custodian-keycape-wire-gvebji6u/identity.json",
|
||||
"/work/keycape-wire-fixture.json",
|
||||
"--setenv",
|
||||
"CUSTODIAN_SYNTHETIC_IDENTITY_FIXTURE",
|
||||
"/work/keycape-wire-fixture.json",
|
||||
"--",
|
||||
"go",
|
||||
"test",
|
||||
"-p",
|
||||
"1",
|
||||
"-json",
|
||||
"-tags",
|
||||
"sqlite sqlite_unlock_notify",
|
||||
"./services/auth/source/oauth2",
|
||||
"-run",
|
||||
"TestAccessEngine|TestVerifiedApplicationIdentity|TestRequired|TestCurrent",
|
||||
"-count=1"
|
||||
],
|
||||
"actual_issuer_source": "d803e9282a47b49daf930fb905312fa5104c0ace",
|
||||
"fixture_sha256": "de14985f3087c72695ff013c7a6f2fd3f73e0709eff5939388d9bd0c21303b9b",
|
||||
"consumer_source_pins": {
|
||||
"access_engine.go": "sha256:d5f07f9491ac2212410e1fa8c0248d68ba3a723e7ca99e363627c5292d187aa8",
|
||||
"access_engine_assurance.go": "sha256:42de751b1e9a243301d566260954813b770558ecb449639acaeab307fe788642",
|
||||
"access_engine_assurance_test.go": "sha256:44e7459f6c1106a264093c19d61d01a8365f6ad22682906552d832ba39d61dd3",
|
||||
"access_engine_azp_test.go": "sha256:5f94f43ade9a79b6b7ef529c80115a8c32acfece425dc8ed3f24e6ad839fc0ce",
|
||||
"access_engine_callback_test.go": "sha256:5cea36b630c895a9473dc876b7128526ddef65d9395b2fddc56343e162452472",
|
||||
"access_engine_test.go": "sha256:99edd6cfe3e834d73e0447a7915f52cc4ab7b82644669c5ae61963f850b447e8",
|
||||
"assert_interface_test.go": "sha256:a0db85e38b7ea61e21b0291e55c8b451c89a877bd3db229e35dbb4418458f54f",
|
||||
"init.go": "sha256:98a8030ed005be67b237d54c3b197a629f8c289e3d74c8edfcf4d740831f87d1",
|
||||
"jwtsigningkey.go": "sha256:0c6e8ac131fd41ad299073ca748dd95e5fd9c044219c4d7f36d50c4ffcd5b266",
|
||||
"jwtsigningkey_test.go": "sha256:3e414a541479741773e48de84be7d5a3b794bcc7289627fbd2e8996832628321",
|
||||
"keycape_wire_test.go": "sha256:ca411819ebbe9f4576fa2dd8722ddcaf09d868dbafb3e9a2c6f114c865903a9a",
|
||||
"providers.go": "sha256:7df0051f19932a68d16a33a5d41898e06e9612f839195e27c86802eeebb2e3e9",
|
||||
"providers_base.go": "sha256:643dbc0561ec7aa7a975978ff2c21d256a5ab619b125e8077d2395281f628542",
|
||||
"providers_custom.go": "sha256:265a526d209d86c24cbcfdde4c2d73957aaeaccfd329438c11ce99c5951ebb39",
|
||||
"providers_openid.go": "sha256:5dd9b906cce434c774968d57fcc790cb678147345fea4d2e58477ec6eed70bcf",
|
||||
"providers_simple.go": "sha256:53927b6bfc621dd1b68a074b6763abe5b27795d5a50ca6f0555f3e7a04fa1613",
|
||||
"required_claim_values.go": "sha256:29f16d07464bbe12e3f65616b6c1eb60561d04cd8ff89ecbfb56f93dbeaf1cda",
|
||||
"required_claim_values_test.go": "sha256:54a8bd97dc51c524a9adf0c6aefb9a19fa152d234b3bb929bf1a90932662d3d0",
|
||||
"source.go": "sha256:44e99883c2ec479427b3f72c73353fe33936eed2e5c962b2fa40803576aa5642",
|
||||
"source_authenticate.go": "sha256:c6551f00ef4349ccd6afdbb2cba847067528485ff621c3e507b9aab588bb96b5",
|
||||
"source_callout.go": "sha256:6abba69df97afc62467f0328eaa5a6383cfb4900202a081dec4b84a21b37349c",
|
||||
"source_name.go": "sha256:712943826e01f718ab4ca717df6c5f2171535cb2229dbf8460f542d757ef8d7f",
|
||||
"source_register.go": "sha256:5ad9ccf213881734dc7fe7619cbe6c47cb6a4afdbbfc3e674ab4493857ebbf91",
|
||||
"store.go": "sha256:35b244081569215384de07f8cdc1e83b5545a2e673ca1ac5a2a6ee686cb917a3",
|
||||
"token.go": "sha256:c0a8868f904bb31842202b4e635a76403902adff9e638d5cb581e7e2d4954933",
|
||||
"urlmapping.go": "sha256:f2132408d4a447e766e67495b1ca7b8cc2b47d4eb56b0c44b50ba01fe41ca83e"
|
||||
},
|
||||
"fixture_values_published": false,
|
||||
"synthetic_authentication": true,
|
||||
"real_credentials": false
|
||||
}
|
||||
|
|
@ -0,0 +1,312 @@
|
|||
{"Time":"2026-10-18T00:24:16.960143605Z","Action":"start","Package":"forgejo.org/services/auth/source/oauth2"}
|
||||
{"Time":"2026-10-18T00:24:17.190347083Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals"}
|
||||
{"Time":"2026-10-18T00:24:17.190462314Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals\n"}
|
||||
{"Time":"2026-10-18T00:24:17.190522225Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/string-at"}
|
||||
{"Time":"2026-10-18T00:24:17.190531233Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/string-at","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/string-at\n"}
|
||||
{"Time":"2026-10-18T00:24:17.197465801Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/string-at","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/string-at (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.197552223Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/string-at","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:24:17.197574829Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/fractional-at"}
|
||||
{"Time":"2026-10-18T00:24:17.197583702Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/fractional-at","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/fractional-at\n"}
|
||||
{"Time":"2026-10-18T00:24:17.198942781Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/fractional-at","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/fractional-at (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.199015045Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/fractional-at","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.199038075Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/integer-mfa"}
|
||||
{"Time":"2026-10-18T00:24:17.199050808Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/integer-mfa","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/integer-mfa\n"}
|
||||
{"Time":"2026-10-18T00:24:17.200027646Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/integer-mfa","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/integer-mfa (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.200098368Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/integer-mfa","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.200123788Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/inconsistent-mfa"}
|
||||
{"Time":"2026-10-18T00:24:17.200141886Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/inconsistent-mfa","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/inconsistent-mfa\n"}
|
||||
{"Time":"2026-10-18T00:24:17.200872725Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/inconsistent-mfa","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/inconsistent-mfa (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.200932275Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/inconsistent-mfa","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.200965611Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/wrong-level"}
|
||||
{"Time":"2026-10-18T00:24:17.201012276Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/wrong-level","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/wrong-level\n"}
|
||||
{"Time":"2026-10-18T00:24:17.201973397Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/wrong-level","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/wrong-level (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.202024831Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/wrong-level","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.202035923Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/object-methods"}
|
||||
{"Time":"2026-10-18T00:24:17.202044137Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/object-methods","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/object-methods\n"}
|
||||
{"Time":"2026-10-18T00:24:17.203113626Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/object-methods","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/object-methods (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.203380834Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/object-methods","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.203872076Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/mixed-methods"}
|
||||
{"Time":"2026-10-18T00:24:17.203997932Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/mixed-methods","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/mixed-methods\n"}
|
||||
{"Time":"2026-10-18T00:24:17.205564559Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/mixed-methods","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/mixed-methods (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.206027959Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/mixed-methods","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.206493384Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/future-authentication"}
|
||||
{"Time":"2026-10-18T00:24:17.206533258Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/future-authentication","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/future-authentication\n"}
|
||||
{"Time":"2026-10-18T00:24:17.208041005Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/future-authentication","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/future-authentication (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.208356492Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/future-authentication","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.208570363Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/missing-at"}
|
||||
{"Time":"2026-10-18T00:24:17.208594295Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/missing-at","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/missing-at\n"}
|
||||
{"Time":"2026-10-18T00:24:17.211646967Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/missing-at","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/missing-at (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.211736698Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/missing-at","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.211752Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/wrong-source"}
|
||||
{"Time":"2026-10-18T00:24:17.211761062Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/wrong-source","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/wrong-source\n"}
|
||||
{"Time":"2026-10-18T00:24:17.211772983Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/wrong-source","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/wrong-source (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.211783524Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/wrong-source","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.211792794Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/empty-methods"}
|
||||
{"Time":"2026-10-18T00:24:17.211800549Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/empty-methods","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/empty-methods\n"}
|
||||
{"Time":"2026-10-18T00:24:17.211810774Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/empty-methods","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/empty-methods (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.21182008Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/empty-methods","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.211828971Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/duplicate-methods"}
|
||||
{"Time":"2026-10-18T00:24:17.211843462Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/duplicate-methods","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/duplicate-methods\n"}
|
||||
{"Time":"2026-10-18T00:24:17.212564986Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/duplicate-methods","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/duplicate-methods (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.212837875Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/duplicate-methods","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.213075462Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/unknown-object-field"}
|
||||
{"Time":"2026-10-18T00:24:17.213106995Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/unknown-object-field","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/unknown-object-field\n"}
|
||||
{"Time":"2026-10-18T00:24:17.214229823Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/unknown-object-field","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/unknown-object-field (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.214435452Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/unknown-object-field","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.214638935Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/stale-authentication"}
|
||||
{"Time":"2026-10-18T00:24:17.214664364Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/stale-authentication","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/stale-authentication\n"}
|
||||
{"Time":"2026-10-18T00:24:17.215677957Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/stale-authentication","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/stale-authentication (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.215916121Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/stale-authentication","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.217396879Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals (0.03s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.217713799Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals","Elapsed":0.03}
|
||||
{"Time":"2026-10-18T00:24:17.217852683Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeIdentityFactsAndFreshnessBounds"}
|
||||
{"Time":"2026-10-18T00:24:17.217874802Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeIdentityFactsAndFreshnessBounds","Output":"=== RUN TestAccessEngineKeyCapeIdentityFactsAndFreshnessBounds\n"}
|
||||
{"Time":"2026-10-18T00:24:17.219232845Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeIdentityFactsAndFreshnessBounds","Output":"--- PASS: TestAccessEngineKeyCapeIdentityFactsAndFreshnessBounds (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.219544707Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeIdentityFactsAndFreshnessBounds","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.219982819Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeLowerAssuranceIsAnIdentityFact"}
|
||||
{"Time":"2026-10-18T00:24:17.220053667Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeLowerAssuranceIsAnIdentityFact","Output":"=== RUN TestAccessEngineKeyCapeLowerAssuranceIsAnIdentityFact\n"}
|
||||
{"Time":"2026-10-18T00:24:17.221091607Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeLowerAssuranceIsAnIdentityFact","Output":"--- PASS: TestAccessEngineKeyCapeLowerAssuranceIsAnIdentityFact (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.221335767Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeLowerAssuranceIsAnIdentityFact","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.223629132Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient"}
|
||||
{"Time":"2026-10-18T00:24:17.223685779Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient","Output":"=== RUN TestAccessEngineAuthorizedPartyRefusesAnotherClient\n"}
|
||||
{"Time":"2026-10-18T00:24:17.223696275Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/other-client"}
|
||||
{"Time":"2026-10-18T00:24:17.223703002Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/other-client","Output":"=== RUN TestAccessEngineAuthorizedPartyRefusesAnotherClient/other-client\n"}
|
||||
{"Time":"2026-10-18T00:24:17.223747312Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/other-client","Output":"--- PASS: TestAccessEngineAuthorizedPartyRefusesAnotherClient/other-client (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.223764761Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/other-client","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.223774256Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/number"}
|
||||
{"Time":"2026-10-18T00:24:17.223798918Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/number","Output":"=== RUN TestAccessEngineAuthorizedPartyRefusesAnotherClient/number\n"}
|
||||
{"Time":"2026-10-18T00:24:17.2238078Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/number","Output":"--- PASS: TestAccessEngineAuthorizedPartyRefusesAnotherClient/number (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.223815077Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/number","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.223828792Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/array"}
|
||||
{"Time":"2026-10-18T00:24:17.223834942Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/array","Output":"=== RUN TestAccessEngineAuthorizedPartyRefusesAnotherClient/array\n"}
|
||||
{"Time":"2026-10-18T00:24:17.223927215Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/array","Output":"--- PASS: TestAccessEngineAuthorizedPartyRefusesAnotherClient/array (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.224058759Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/array","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.224153079Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/empty"}
|
||||
{"Time":"2026-10-18T00:24:17.224165821Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/empty","Output":"=== RUN TestAccessEngineAuthorizedPartyRefusesAnotherClient/empty\n"}
|
||||
{"Time":"2026-10-18T00:24:17.225138611Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/empty","Output":"--- PASS: TestAccessEngineAuthorizedPartyRefusesAnotherClient/empty (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.225386413Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/empty","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.225490409Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient","Output":"--- PASS: TestAccessEngineAuthorizedPartyRefusesAnotherClient (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.225724777Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.225875888Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyAcceptsAdmittedClient"}
|
||||
{"Time":"2026-10-18T00:24:17.225894671Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyAcceptsAdmittedClient","Output":"=== RUN TestAccessEngineAuthorizedPartyAcceptsAdmittedClient\n"}
|
||||
{"Time":"2026-10-18T00:24:17.227711655Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyAcceptsAdmittedClient","Output":"--- PASS: TestAccessEngineAuthorizedPartyAcceptsAdmittedClient (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.227978972Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyAcceptsAdmittedClient","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.228098369Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision"}
|
||||
{"Time":"2026-10-18T00:24:17.22813313Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision","Output":"=== RUN TestAccessEngineActualCallbackAllowsAuthenticatedDecision\n"}
|
||||
{"Time":"2026-10-18T00:24:17.228520106Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-admins"}
|
||||
{"Time":"2026-10-18T00:24:17.228550773Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-admins","Output":"=== RUN TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-admins\n"}
|
||||
{"Time":"2026-10-18T00:24:17.281311607Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-admins","Output":"--- PASS: TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-admins (0.05s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.281528859Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-admins","Elapsed":0.05}
|
||||
{"Time":"2026-10-18T00:24:17.281666544Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-owners"}
|
||||
{"Time":"2026-10-18T00:24:17.281686219Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-owners","Output":"=== RUN TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-owners\n"}
|
||||
{"Time":"2026-10-18T00:24:17.301492156Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-owners","Output":"--- PASS: TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-owners (0.02s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.303700381Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-owners","Elapsed":0.02}
|
||||
{"Time":"2026-10-18T00:24:17.303789823Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-readers"}
|
||||
{"Time":"2026-10-18T00:24:17.303815765Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-readers","Output":"=== RUN TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-readers\n"}
|
||||
{"Time":"2026-10-18T00:24:17.323628247Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-readers","Output":"--- PASS: TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-readers (0.02s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.323712973Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-readers","Elapsed":0.02}
|
||||
{"Time":"2026-10-18T00:24:17.323734714Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision","Output":"--- PASS: TestAccessEngineActualCallbackAllowsAuthenticatedDecision (0.09s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.323748239Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision","Elapsed":0.09}
|
||||
{"Time":"2026-10-18T00:24:17.323761513Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP"}
|
||||
{"Time":"2026-10-18T00:24:17.323772063Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP","Output":"=== RUN TestAccessEngineActualCallbackRefusesUnverifiedPDP\n"}
|
||||
{"Time":"2026-10-18T00:24:17.323812045Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/deny"}
|
||||
{"Time":"2026-10-18T00:24:17.323822433Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/deny","Output":"=== RUN TestAccessEngineActualCallbackRefusesUnverifiedPDP/deny\n"}
|
||||
{"Time":"2026-10-18T00:24:17.336793262Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/deny","Output":"--- PASS: TestAccessEngineActualCallbackRefusesUnverifiedPDP/deny (0.02s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.336862298Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/deny","Elapsed":0.02}
|
||||
{"Time":"2026-10-18T00:24:17.336889494Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/unsigned"}
|
||||
{"Time":"2026-10-18T00:24:17.336901586Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/unsigned","Output":"=== RUN TestAccessEngineActualCallbackRefusesUnverifiedPDP/unsigned\n"}
|
||||
{"Time":"2026-10-18T00:24:17.352265272Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/unsigned","Output":"--- PASS: TestAccessEngineActualCallbackRefusesUnverifiedPDP/unsigned (0.02s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.352335787Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/unsigned","Elapsed":0.02}
|
||||
{"Time":"2026-10-18T00:24:17.352352315Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-key"}
|
||||
{"Time":"2026-10-18T00:24:17.352362631Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-key","Output":"=== RUN TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-key\n"}
|
||||
{"Time":"2026-10-18T00:24:17.370624001Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-key","Output":"--- PASS: TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-key (0.02s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.370810676Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-key","Elapsed":0.02}
|
||||
{"Time":"2026-10-18T00:24:17.370841028Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-pin"}
|
||||
{"Time":"2026-10-18T00:24:17.370915754Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-pin","Output":"=== RUN TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-pin\n"}
|
||||
{"Time":"2026-10-18T00:24:17.387584798Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-pin","Output":"--- PASS: TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-pin (0.02s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.387657865Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-pin","Elapsed":0.02}
|
||||
{"Time":"2026-10-18T00:24:17.387677315Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-binding"}
|
||||
{"Time":"2026-10-18T00:24:17.387688974Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-binding","Output":"=== RUN TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-binding\n"}
|
||||
{"Time":"2026-10-18T00:24:17.402415306Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-binding","Output":"--- PASS: TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-binding (0.02s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.402483666Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-binding","Elapsed":0.02}
|
||||
{"Time":"2026-10-18T00:24:17.402500122Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/expired"}
|
||||
{"Time":"2026-10-18T00:24:17.402510799Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/expired","Output":"=== RUN TestAccessEngineActualCallbackRefusesUnverifiedPDP/expired\n"}
|
||||
{"Time":"2026-10-18T00:24:17.417792972Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/expired","Output":"--- PASS: TestAccessEngineActualCallbackRefusesUnverifiedPDP/expired (0.02s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.417868068Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/expired","Elapsed":0.02}
|
||||
{"Time":"2026-10-18T00:24:17.417891657Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP","Output":"--- PASS: TestAccessEngineActualCallbackRefusesUnverifiedPDP (0.10s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.417905436Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP","Elapsed":0.1}
|
||||
{"Time":"2026-10-18T00:24:17.417916869Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP"}
|
||||
{"Time":"2026-10-18T00:24:17.417927771Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP\n"}
|
||||
{"Time":"2026-10-18T00:24:17.417945535Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-admission"}
|
||||
{"Time":"2026-10-18T00:24:17.418001875Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-admission","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-admission\n"}
|
||||
{"Time":"2026-10-18T00:24:17.420364277Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-admission","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-admission (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.420431104Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-admission","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.420446577Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-token"}
|
||||
{"Time":"2026-10-18T00:24:17.420456938Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-token","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-token\n"}
|
||||
{"Time":"2026-10-18T00:24:17.422812687Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-token","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-token (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.42287698Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-token","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.422938171Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-user"}
|
||||
{"Time":"2026-10-18T00:24:17.422947324Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-user","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-user\n"}
|
||||
{"Time":"2026-10-18T00:24:17.426344201Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-user","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-user (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.426415681Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-user","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.426429125Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-groups"}
|
||||
{"Time":"2026-10-18T00:24:17.426438206Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-groups","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-groups\n"}
|
||||
{"Time":"2026-10-18T00:24:17.42917688Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-groups","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-groups (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.429322301Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-groups","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.429347261Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/expired-token"}
|
||||
{"Time":"2026-10-18T00:24:17.429357612Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/expired-token","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/expired-token\n"}
|
||||
{"Time":"2026-10-18T00:24:17.432561513Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/expired-token","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/expired-token (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.432646879Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/expired-token","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.432672209Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/untrusted-identity"}
|
||||
{"Time":"2026-10-18T00:24:17.432682119Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/untrusted-identity","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/untrusted-identity\n"}
|
||||
{"Time":"2026-10-18T00:24:17.435052031Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/untrusted-identity","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/untrusted-identity (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.435134818Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/untrusted-identity","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.435158939Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-subject"}
|
||||
{"Time":"2026-10-18T00:24:17.435191609Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-subject","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-subject\n"}
|
||||
{"Time":"2026-10-18T00:24:17.439070957Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-subject","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-subject (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.439163771Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-subject","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.439267226Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-source"}
|
||||
{"Time":"2026-10-18T00:24:17.439294377Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-source","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-source\n"}
|
||||
{"Time":"2026-10-18T00:24:17.443065425Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-source","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-source (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.443162956Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-source","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.443192677Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-provider"}
|
||||
{"Time":"2026-10-18T00:24:17.443233895Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-provider","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-provider\n"}
|
||||
{"Time":"2026-10-18T00:24:17.446044019Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-provider","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-provider (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.446129286Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-provider","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.446185896Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-audience"}
|
||||
{"Time":"2026-10-18T00:24:17.44621183Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-audience","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-audience\n"}
|
||||
{"Time":"2026-10-18T00:24:17.449608865Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-audience","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-audience (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.449680263Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-audience","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.449698217Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP (0.03s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.449717225Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP","Elapsed":0.03}
|
||||
{"Time":"2026-10-18T00:24:17.449760859Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE"}
|
||||
{"Time":"2026-10-18T00:24:17.449773475Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE\n"}
|
||||
{"Time":"2026-10-18T00:24:17.451095376Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/issuer"}
|
||||
{"Time":"2026-10-18T00:24:17.451157405Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/issuer","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/issuer\n"}
|
||||
{"Time":"2026-10-18T00:24:17.45210629Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/issuer","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/issuer (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.452195823Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/issuer","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.452234083Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/audience"}
|
||||
{"Time":"2026-10-18T00:24:17.452256328Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/audience","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/audience\n"}
|
||||
{"Time":"2026-10-18T00:24:17.452972749Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/audience","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/audience (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.453016807Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/audience","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.453053994Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/old-issued"}
|
||||
{"Time":"2026-10-18T00:24:17.453069459Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/old-issued","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/old-issued\n"}
|
||||
{"Time":"2026-10-18T00:24:17.453793003Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/old-issued","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/old-issued (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.453857512Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/old-issued","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.45388928Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-tenant"}
|
||||
{"Time":"2026-10-18T00:24:17.453902806Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-tenant","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/no-tenant\n"}
|
||||
{"Time":"2026-10-18T00:24:17.45468434Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-tenant","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/no-tenant (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.454759661Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-tenant","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.454790491Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-principal"}
|
||||
{"Time":"2026-10-18T00:24:17.454802989Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-principal","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/no-principal\n"}
|
||||
{"Time":"2026-10-18T00:24:17.455662585Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-principal","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/no-principal (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.455746499Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-principal","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.455770684Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-assurance"}
|
||||
{"Time":"2026-10-18T00:24:17.455781856Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-assurance","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/no-assurance\n"}
|
||||
{"Time":"2026-10-18T00:24:17.456508628Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-assurance","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/no-assurance (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.45657257Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-assurance","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.456597223Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/multi-audience-no-azp"}
|
||||
{"Time":"2026-10-18T00:24:17.456615636Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/multi-audience-no-azp","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/multi-audience-no-azp\n"}
|
||||
{"Time":"2026-10-18T00:24:17.457276826Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/multi-audience-no-azp","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/multi-audience-no-azp (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.457328855Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/multi-audience-no-azp","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.457356782Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/expired"}
|
||||
{"Time":"2026-10-18T00:24:17.457369225Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/expired","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/expired\n"}
|
||||
{"Time":"2026-10-18T00:24:17.458155331Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/expired","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/expired (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.458195341Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/expired","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.45823159Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/future-issued"}
|
||||
{"Time":"2026-10-18T00:24:17.458245594Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/future-issued","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/future-issued\n"}
|
||||
{"Time":"2026-10-18T00:24:17.458904361Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/future-issued","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/future-issued (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.458957238Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/future-issued","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.459040828Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-exp"}
|
||||
{"Time":"2026-10-18T00:24:17.459058971Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-exp","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/no-exp\n"}
|
||||
{"Time":"2026-10-18T00:24:17.459885002Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-exp","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/no-exp (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.459973903Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-exp","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.460006744Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-iat"}
|
||||
{"Time":"2026-10-18T00:24:17.460035013Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-iat","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/no-iat\n"}
|
||||
{"Time":"2026-10-18T00:24:17.460672244Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-iat","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/no-iat (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.460715941Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-iat","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.46099698Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/empty-subject"}
|
||||
{"Time":"2026-10-18T00:24:17.461045168Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/empty-subject","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/empty-subject\n"}
|
||||
{"Time":"2026-10-18T00:24:17.463612573Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/empty-subject","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/empty-subject (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.463702854Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/empty-subject","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.463725379Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/wrong-key"}
|
||||
{"Time":"2026-10-18T00:24:17.463734576Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/wrong-key","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/wrong-key\n"}
|
||||
{"Time":"2026-10-18T00:24:17.463747832Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/wrong-key","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/wrong-key (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.463757661Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/wrong-key","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.463779942Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/unknown-key"}
|
||||
{"Time":"2026-10-18T00:24:17.463788887Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/unknown-key","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/unknown-key\n"}
|
||||
{"Time":"2026-10-18T00:24:17.463800583Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/unknown-key","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/unknown-key (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.463850619Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/unknown-key","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.463864749Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/wrong-type"}
|
||||
{"Time":"2026-10-18T00:24:17.463873397Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/wrong-type","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/wrong-type\n"}
|
||||
{"Time":"2026-10-18T00:24:17.463886219Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/wrong-type","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/wrong-type (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.463896256Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/wrong-type","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.463904885Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/algorithm-confusion"}
|
||||
{"Time":"2026-10-18T00:24:17.463911783Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/algorithm-confusion","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/algorithm-confusion\n"}
|
||||
{"Time":"2026-10-18T00:24:17.464386161Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/algorithm-confusion","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/algorithm-confusion (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.464439317Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/algorithm-confusion","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.464460093Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/none"}
|
||||
{"Time":"2026-10-18T00:24:17.464471265Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/none","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/none\n"}
|
||||
{"Time":"2026-10-18T00:24:17.464961164Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/none","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/none (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.465010317Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/none","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.465035231Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE (0.02s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.465052616Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE","Elapsed":0.02}
|
||||
{"Time":"2026-10-18T00:24:17.465372945Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeIssuer"}
|
||||
{"Time":"2026-10-18T00:24:17.465415362Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeIssuer","Output":"=== RUN TestAccessEngineActualKeyCapeIssuer\n"}
|
||||
{"Time":"2026-10-18T00:24:17.466437738Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeIssuer/allow"}
|
||||
{"Time":"2026-10-18T00:24:17.466492797Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeIssuer/allow","Output":"=== RUN TestAccessEngineActualKeyCapeIssuer/allow\n"}
|
||||
{"Time":"2026-10-18T00:24:17.481732933Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeIssuer/allow","Output":"--- PASS: TestAccessEngineActualKeyCapeIssuer/allow (0.02s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.481832546Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeIssuer/allow","Elapsed":0.02}
|
||||
{"Time":"2026-10-18T00:24:17.481852267Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeIssuer/deny"}
|
||||
{"Time":"2026-10-18T00:24:17.481862538Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeIssuer/deny","Output":"=== RUN TestAccessEngineActualKeyCapeIssuer/deny\n"}
|
||||
{"Time":"2026-10-18T00:24:17.497929732Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeIssuer/deny","Output":"--- PASS: TestAccessEngineActualKeyCapeIssuer/deny (0.02s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.498011906Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeIssuer/deny","Elapsed":0.02}
|
||||
{"Time":"2026-10-18T00:24:17.498034341Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeIssuer","Output":"--- PASS: TestAccessEngineActualKeyCapeIssuer (0.03s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.498047353Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeIssuer","Elapsed":0.03}
|
||||
{"Time":"2026-10-18T00:24:17.498068787Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeProviderUserInfo"}
|
||||
{"Time":"2026-10-18T00:24:17.498079445Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeProviderUserInfo","Output":"=== RUN TestAccessEngineActualKeyCapeProviderUserInfo\n"}
|
||||
{"Time":"2026-10-18T00:24:17.499710854Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeProviderUserInfo/allow"}
|
||||
{"Time":"2026-10-18T00:24:17.499786671Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeProviderUserInfo/allow","Output":"=== RUN TestAccessEngineActualKeyCapeProviderUserInfo/allow\n"}
|
||||
{"Time":"2026-10-18T00:24:17.527254482Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeProviderUserInfo/allow","Output":"--- PASS: TestAccessEngineActualKeyCapeProviderUserInfo/allow (0.03s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.527320011Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeProviderUserInfo/allow","Elapsed":0.03}
|
||||
{"Time":"2026-10-18T00:24:17.527334186Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeProviderUserInfo/missing-groups"}
|
||||
{"Time":"2026-10-18T00:24:17.527342319Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeProviderUserInfo/missing-groups","Output":"=== RUN TestAccessEngineActualKeyCapeProviderUserInfo/missing-groups\n"}
|
||||
{"Time":"2026-10-18T00:24:17.542686711Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeProviderUserInfo/missing-groups","Output":"--- PASS: TestAccessEngineActualKeyCapeProviderUserInfo/missing-groups (0.02s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.542770571Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeProviderUserInfo/missing-groups","Elapsed":0.02}
|
||||
{"Time":"2026-10-18T00:24:17.542793845Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeProviderUserInfo/missing-subject"}
|
||||
{"Time":"2026-10-18T00:24:17.542803872Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeProviderUserInfo/missing-subject","Output":"=== RUN TestAccessEngineActualKeyCapeProviderUserInfo/missing-subject\n"}
|
||||
{"Time":"2026-10-18T00:24:17.561867325Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeProviderUserInfo/missing-subject","Output":"--- PASS: TestAccessEngineActualKeyCapeProviderUserInfo/missing-subject (0.02s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.561941672Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeProviderUserInfo/missing-subject","Elapsed":0.02}
|
||||
{"Time":"2026-10-18T00:24:17.561960609Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeProviderUserInfo/wrong-subject"}
|
||||
{"Time":"2026-10-18T00:24:17.561971285Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeProviderUserInfo/wrong-subject","Output":"=== RUN TestAccessEngineActualKeyCapeProviderUserInfo/wrong-subject\n"}
|
||||
{"Time":"2026-10-18T00:24:17.583591831Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeProviderUserInfo/wrong-subject","Output":"--- PASS: TestAccessEngineActualKeyCapeProviderUserInfo/wrong-subject (0.02s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.58370112Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeProviderUserInfo/wrong-subject","Elapsed":0.02}
|
||||
{"Time":"2026-10-18T00:24:17.583726648Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeProviderUserInfo/malformed-groups"}
|
||||
{"Time":"2026-10-18T00:24:17.58373544Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeProviderUserInfo/malformed-groups","Output":"=== RUN TestAccessEngineActualKeyCapeProviderUserInfo/malformed-groups\n"}
|
||||
{"Time":"2026-10-18T00:24:17.598088131Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeProviderUserInfo/malformed-groups","Output":"--- PASS: TestAccessEngineActualKeyCapeProviderUserInfo/malformed-groups (0.02s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.598380606Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeProviderUserInfo/malformed-groups","Elapsed":0.02}
|
||||
{"Time":"2026-10-18T00:24:17.598539967Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeProviderUserInfo","Output":"--- PASS: TestAccessEngineActualKeyCapeProviderUserInfo (0.10s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.599647599Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeProviderUserInfo","Elapsed":0.1}
|
||||
{"Time":"2026-10-18T00:24:17.599717375Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestRequiredClaimExactAnyOfAndNoMutation"}
|
||||
{"Time":"2026-10-18T00:24:17.599728186Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestRequiredClaimExactAnyOfAndNoMutation","Output":"=== RUN TestRequiredClaimExactAnyOfAndNoMutation\n"}
|
||||
{"Time":"2026-10-18T00:24:17.599743921Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestRequiredClaimExactAnyOfAndNoMutation","Output":"--- PASS: TestRequiredClaimExactAnyOfAndNoMutation (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.599752884Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestRequiredClaimExactAnyOfAndNoMutation","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.599762253Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestRequiredClaimConfigurationRefusalsAndLegacyIsolation"}
|
||||
{"Time":"2026-10-18T00:24:17.59976935Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestRequiredClaimConfigurationRefusalsAndLegacyIsolation","Output":"=== RUN TestRequiredClaimConfigurationRefusalsAndLegacyIsolation\n"}
|
||||
{"Time":"2026-10-18T00:24:17.599781244Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestRequiredClaimConfigurationRefusalsAndLegacyIsolation","Output":"--- PASS: TestRequiredClaimConfigurationRefusalsAndLegacyIsolation (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.599809846Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestRequiredClaimConfigurationRefusalsAndLegacyIsolation","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.599819423Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoGuardRejectsMissingMalformedAndUnavailable"}
|
||||
{"Time":"2026-10-18T00:24:17.59982688Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoGuardRejectsMissingMalformedAndUnavailable","Output":"=== RUN TestCurrentUserInfoGuardRejectsMissingMalformedAndUnavailable\n"}
|
||||
{"Time":"2026-10-18T00:24:17.624318235Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoGuardRejectsMissingMalformedAndUnavailable","Output":"--- PASS: TestCurrentUserInfoGuardRejectsMissingMalformedAndUnavailable (0.02s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.624416938Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoGuardRejectsMissingMalformedAndUnavailable","Elapsed":0.02}
|
||||
{"Time":"2026-10-18T00:24:17.624473575Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoEmptyArrayOverwritesAndGroupRemoval"}
|
||||
{"Time":"2026-10-18T00:24:17.624487462Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoEmptyArrayOverwritesAndGroupRemoval","Output":"=== RUN TestCurrentUserInfoEmptyArrayOverwritesAndGroupRemoval\n"}
|
||||
{"Time":"2026-10-18T00:24:17.625608648Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoEmptyArrayOverwritesAndGroupRemoval","Output":"--- PASS: TestCurrentUserInfoEmptyArrayOverwritesAndGroupRemoval (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.625668189Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoEmptyArrayOverwritesAndGroupRemoval","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.625679136Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoGuardIsOptInAndRedirectsRefuse"}
|
||||
{"Time":"2026-10-18T00:24:17.625686756Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoGuardIsOptInAndRedirectsRefuse","Output":"=== RUN TestCurrentUserInfoGuardIsOptInAndRedirectsRefuse\n"}
|
||||
{"Time":"2026-10-18T00:24:17.625700561Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoGuardIsOptInAndRedirectsRefuse","Output":"--- PASS: TestCurrentUserInfoGuardIsOptInAndRedirectsRefuse (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:24:17.625709687Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoGuardIsOptInAndRedirectsRefuse","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:24:17.625719416Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Output":"PASS\n"}
|
||||
{"Time":"2026-10-18T00:24:17.643344955Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Output":"ok \tforgejo.org/services/auth/source/oauth2\t0.682s\n"}
|
||||
{"Time":"2026-10-18T00:24:17.643422025Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Elapsed":0.683}
|
||||
|
|
@ -0,0 +1,149 @@
|
|||
{
|
||||
"returncode": 0,
|
||||
"seconds": 12.2,
|
||||
"workspace": "/tmp/custodian-forgejo-wire-mrr1scz2",
|
||||
"argv": [
|
||||
"bwrap",
|
||||
"--unshare-pid",
|
||||
"--die-with-parent",
|
||||
"--new-session",
|
||||
"--unshare-net",
|
||||
"--ro-bind",
|
||||
"/usr",
|
||||
"/usr",
|
||||
"--ro-bind",
|
||||
"/lib",
|
||||
"/lib",
|
||||
"--ro-bind",
|
||||
"/lib64",
|
||||
"/lib64",
|
||||
"--symlink",
|
||||
"usr/bin",
|
||||
"/bin",
|
||||
"--proc",
|
||||
"/proc",
|
||||
"--dev",
|
||||
"/dev",
|
||||
"--tmpfs",
|
||||
"/tmp",
|
||||
"--bind",
|
||||
"/tmp/custodian-forgejo-successor-attempt2",
|
||||
"/work",
|
||||
"--ro-bind",
|
||||
"/home/worsch/go/pkg/mod/cache/download",
|
||||
"/cached",
|
||||
"--ro-bind",
|
||||
"/etc/ssl/certs",
|
||||
"/etc/ssl/certs",
|
||||
"--ro-bind",
|
||||
"/etc/resolv.conf",
|
||||
"/etc/resolv.conf",
|
||||
"--chdir",
|
||||
"/work/source",
|
||||
"--clearenv",
|
||||
"--dir",
|
||||
"/run",
|
||||
"--ro-bind",
|
||||
"/tmp/custodian-forgejo-successor-attempt2/descriptor-fixtures",
|
||||
"/run/forgejo-oidc",
|
||||
"--bind",
|
||||
"/tmp/custodian-forgejo-successor-attempt2/descriptor-fixtures",
|
||||
"/run/writable-input",
|
||||
"--setenv",
|
||||
"PATH",
|
||||
"/work/go/bin:/usr/bin:/bin",
|
||||
"--setenv",
|
||||
"HOME",
|
||||
"/work/home",
|
||||
"--setenv",
|
||||
"GOPATH",
|
||||
"/work/gopath",
|
||||
"--setenv",
|
||||
"GOTOOLCHAIN",
|
||||
"local",
|
||||
"--setenv",
|
||||
"GOPROXY",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOSUMDB",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOVCS",
|
||||
"*:off",
|
||||
"--setenv",
|
||||
"GOMODCACHE",
|
||||
"/work/modules",
|
||||
"--setenv",
|
||||
"GOCACHE",
|
||||
"/work/gocache",
|
||||
"--setenv",
|
||||
"GOMAXPROCS",
|
||||
"4",
|
||||
"--setenv",
|
||||
"CGO_ENABLED",
|
||||
"1",
|
||||
"--setenv",
|
||||
"GIT_CONFIG_NOSYSTEM",
|
||||
"1",
|
||||
"--setenv",
|
||||
"GIT_CONFIG_GLOBAL",
|
||||
"/work/home/test.gitconfig",
|
||||
"--setenv",
|
||||
"GIT_TERMINAL_PROMPT",
|
||||
"0",
|
||||
"--ro-bind",
|
||||
"/tmp/custodian-forgejo-wire-mrr1scz2/oauth2",
|
||||
"/work/source/services/auth/source/oauth2",
|
||||
"--ro-bind",
|
||||
"/tmp/custodian-keycape-wire-6z6gfafi/identity.json",
|
||||
"/work/keycape-wire-fixture.json",
|
||||
"--setenv",
|
||||
"CUSTODIAN_SYNTHETIC_IDENTITY_FIXTURE",
|
||||
"/work/keycape-wire-fixture.json",
|
||||
"--",
|
||||
"go",
|
||||
"test",
|
||||
"-p",
|
||||
"1",
|
||||
"-json",
|
||||
"-tags",
|
||||
"sqlite sqlite_unlock_notify",
|
||||
"./services/auth/source/oauth2",
|
||||
"-run",
|
||||
"TestAccessEngine|TestVerifiedApplicationIdentity|TestRequired|TestCurrent",
|
||||
"-count=1"
|
||||
],
|
||||
"actual_issuer_source": "d803e9282a47b49daf930fb905312fa5104c0ace",
|
||||
"fixture_sha256": "771d365c7c80d731fd2f5cc8999ca7aa5bb6fa0f93269463b84e0f70b3bbd4e2",
|
||||
"consumer_source_pins": {
|
||||
"access_engine.go": "sha256:d5f07f9491ac2212410e1fa8c0248d68ba3a723e7ca99e363627c5292d187aa8",
|
||||
"access_engine_assurance.go": "sha256:42de751b1e9a243301d566260954813b770558ecb449639acaeab307fe788642",
|
||||
"access_engine_assurance_test.go": "sha256:44e7459f6c1106a264093c19d61d01a8365f6ad22682906552d832ba39d61dd3",
|
||||
"access_engine_azp_test.go": "sha256:5f94f43ade9a79b6b7ef529c80115a8c32acfece425dc8ed3f24e6ad839fc0ce",
|
||||
"access_engine_callback_test.go": "sha256:e2fcbfcc2f1077996c947c5c6fd5150aaaa11ba0e77e05f07055a355978398be",
|
||||
"access_engine_test.go": "sha256:99edd6cfe3e834d73e0447a7915f52cc4ab7b82644669c5ae61963f850b447e8",
|
||||
"assert_interface_test.go": "sha256:a0db85e38b7ea61e21b0291e55c8b451c89a877bd3db229e35dbb4418458f54f",
|
||||
"init.go": "sha256:98a8030ed005be67b237d54c3b197a629f8c289e3d74c8edfcf4d740831f87d1",
|
||||
"jwtsigningkey.go": "sha256:0c6e8ac131fd41ad299073ca748dd95e5fd9c044219c4d7f36d50c4ffcd5b266",
|
||||
"jwtsigningkey_test.go": "sha256:3e414a541479741773e48de84be7d5a3b794bcc7289627fbd2e8996832628321",
|
||||
"keycape_wire_test.go": "sha256:d81f6492365e30ea6e3469e14e7e3bfd7d7a8a014e6d898b8d91e1f4a695fd43",
|
||||
"providers.go": "sha256:7df0051f19932a68d16a33a5d41898e06e9612f839195e27c86802eeebb2e3e9",
|
||||
"providers_base.go": "sha256:643dbc0561ec7aa7a975978ff2c21d256a5ab619b125e8077d2395281f628542",
|
||||
"providers_custom.go": "sha256:265a526d209d86c24cbcfdde4c2d73957aaeaccfd329438c11ce99c5951ebb39",
|
||||
"providers_openid.go": "sha256:5dd9b906cce434c774968d57fcc790cb678147345fea4d2e58477ec6eed70bcf",
|
||||
"providers_simple.go": "sha256:53927b6bfc621dd1b68a074b6763abe5b27795d5a50ca6f0555f3e7a04fa1613",
|
||||
"required_claim_values.go": "sha256:29f16d07464bbe12e3f65616b6c1eb60561d04cd8ff89ecbfb56f93dbeaf1cda",
|
||||
"required_claim_values_test.go": "sha256:54a8bd97dc51c524a9adf0c6aefb9a19fa152d234b3bb929bf1a90932662d3d0",
|
||||
"source.go": "sha256:44e99883c2ec479427b3f72c73353fe33936eed2e5c962b2fa40803576aa5642",
|
||||
"source_authenticate.go": "sha256:c6551f00ef4349ccd6afdbb2cba847067528485ff621c3e507b9aab588bb96b5",
|
||||
"source_callout.go": "sha256:6abba69df97afc62467f0328eaa5a6383cfb4900202a081dec4b84a21b37349c",
|
||||
"source_name.go": "sha256:712943826e01f718ab4ca717df6c5f2171535cb2229dbf8460f542d757ef8d7f",
|
||||
"source_register.go": "sha256:5ad9ccf213881734dc7fe7619cbe6c47cb6a4afdbbfc3e674ab4493857ebbf91",
|
||||
"store.go": "sha256:35b244081569215384de07f8cdc1e83b5545a2e673ca1ac5a2a6ee686cb917a3",
|
||||
"token.go": "sha256:c0a8868f904bb31842202b4e635a76403902adff9e638d5cb581e7e2d4954933",
|
||||
"urlmapping.go": "sha256:f2132408d4a447e766e67495b1ca7b8cc2b47d4eb56b0c44b50ba01fe41ca83e"
|
||||
},
|
||||
"fixture_values_published": false,
|
||||
"synthetic_authentication": true,
|
||||
"real_credentials": false
|
||||
}
|
||||
|
|
@ -0,0 +1,280 @@
|
|||
{"Time":"2026-10-18T00:13:47.047791726Z","Action":"start","Package":"forgejo.org/services/auth/source/oauth2"}
|
||||
{"Time":"2026-10-18T00:13:47.129556173Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals"}
|
||||
{"Time":"2026-10-18T00:13:47.12961437Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals\n"}
|
||||
{"Time":"2026-10-18T00:13:47.129684407Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/missing-at"}
|
||||
{"Time":"2026-10-18T00:13:47.129692099Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/missing-at","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/missing-at\n"}
|
||||
{"Time":"2026-10-18T00:13:47.131694794Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/missing-at","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/missing-at (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.131742693Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/missing-at","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.131754028Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/fractional-at"}
|
||||
{"Time":"2026-10-18T00:13:47.131759844Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/fractional-at","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/fractional-at\n"}
|
||||
{"Time":"2026-10-18T00:13:47.13199542Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/fractional-at","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/fractional-at (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.132014563Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/fractional-at","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.132021561Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/integer-mfa"}
|
||||
{"Time":"2026-10-18T00:13:47.132026809Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/integer-mfa","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/integer-mfa\n"}
|
||||
{"Time":"2026-10-18T00:13:47.132293377Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/integer-mfa","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/integer-mfa (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.13230821Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/integer-mfa","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.132315036Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/wrong-source"}
|
||||
{"Time":"2026-10-18T00:13:47.132320717Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/wrong-source","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/wrong-source\n"}
|
||||
{"Time":"2026-10-18T00:13:47.13262247Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/wrong-source","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/wrong-source (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.132637475Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/wrong-source","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.132643985Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/wrong-level"}
|
||||
{"Time":"2026-10-18T00:13:47.132667295Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/wrong-level","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/wrong-level\n"}
|
||||
{"Time":"2026-10-18T00:13:47.132920066Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/wrong-level","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/wrong-level (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.132935396Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/wrong-level","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.132941933Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/duplicate-methods"}
|
||||
{"Time":"2026-10-18T00:13:47.132950274Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/duplicate-methods","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/duplicate-methods\n"}
|
||||
{"Time":"2026-10-18T00:13:47.1331919Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/duplicate-methods","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/duplicate-methods (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.133207149Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/duplicate-methods","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.133213794Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/stale-authentication"}
|
||||
{"Time":"2026-10-18T00:13:47.133218943Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/stale-authentication","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/stale-authentication\n"}
|
||||
{"Time":"2026-10-18T00:13:47.133455853Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/stale-authentication","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/stale-authentication (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.133471083Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/stale-authentication","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.133479992Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/string-at"}
|
||||
{"Time":"2026-10-18T00:13:47.133485412Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/string-at","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/string-at\n"}
|
||||
{"Time":"2026-10-18T00:13:47.133732521Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/string-at","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/string-at (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.133747399Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/string-at","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.133753955Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/inconsistent-mfa"}
|
||||
{"Time":"2026-10-18T00:13:47.133759338Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/inconsistent-mfa","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/inconsistent-mfa\n"}
|
||||
{"Time":"2026-10-18T00:13:47.134027321Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/inconsistent-mfa","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/inconsistent-mfa (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.134042461Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/inconsistent-mfa","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.134061226Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/object-methods"}
|
||||
{"Time":"2026-10-18T00:13:47.134066979Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/object-methods","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/object-methods\n"}
|
||||
{"Time":"2026-10-18T00:13:47.134319219Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/object-methods","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/object-methods (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.13433499Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/object-methods","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.134341573Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/empty-methods"}
|
||||
{"Time":"2026-10-18T00:13:47.134346776Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/empty-methods","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/empty-methods\n"}
|
||||
{"Time":"2026-10-18T00:13:47.134592577Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/empty-methods","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/empty-methods (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.134607617Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/empty-methods","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.134614398Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/mixed-methods"}
|
||||
{"Time":"2026-10-18T00:13:47.134622739Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/mixed-methods","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/mixed-methods\n"}
|
||||
{"Time":"2026-10-18T00:13:47.134897243Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/mixed-methods","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/mixed-methods (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.134924763Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/mixed-methods","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.134934168Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/unknown-object-field"}
|
||||
{"Time":"2026-10-18T00:13:47.134939759Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/unknown-object-field","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/unknown-object-field\n"}
|
||||
{"Time":"2026-10-18T00:13:47.135300386Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/unknown-object-field","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/unknown-object-field (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.135342487Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/unknown-object-field","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.135365211Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/future-authentication"}
|
||||
{"Time":"2026-10-18T00:13:47.135376311Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/future-authentication","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/future-authentication\n"}
|
||||
{"Time":"2026-10-18T00:13:47.135570806Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/future-authentication","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/future-authentication (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.135601285Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/future-authentication","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.136076139Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.136112659Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:13:47.136121505Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeIdentityFactsAndFreshnessBounds"}
|
||||
{"Time":"2026-10-18T00:13:47.13612669Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeIdentityFactsAndFreshnessBounds","Output":"=== RUN TestAccessEngineKeyCapeIdentityFactsAndFreshnessBounds\n"}
|
||||
{"Time":"2026-10-18T00:13:47.136563428Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeIdentityFactsAndFreshnessBounds","Output":"--- PASS: TestAccessEngineKeyCapeIdentityFactsAndFreshnessBounds (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.136588414Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeIdentityFactsAndFreshnessBounds","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.136597432Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeLowerAssuranceIsAnIdentityFact"}
|
||||
{"Time":"2026-10-18T00:13:47.13660332Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeLowerAssuranceIsAnIdentityFact","Output":"=== RUN TestAccessEngineKeyCapeLowerAssuranceIsAnIdentityFact\n"}
|
||||
{"Time":"2026-10-18T00:13:47.136938103Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeLowerAssuranceIsAnIdentityFact","Output":"--- PASS: TestAccessEngineKeyCapeLowerAssuranceIsAnIdentityFact (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.136966517Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeLowerAssuranceIsAnIdentityFact","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.136986571Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient"}
|
||||
{"Time":"2026-10-18T00:13:47.136998221Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient","Output":"=== RUN TestAccessEngineAuthorizedPartyRefusesAnotherClient\n"}
|
||||
{"Time":"2026-10-18T00:13:47.137005823Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/number"}
|
||||
{"Time":"2026-10-18T00:13:47.137011378Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/number","Output":"=== RUN TestAccessEngineAuthorizedPartyRefusesAnotherClient/number\n"}
|
||||
{"Time":"2026-10-18T00:13:47.137307382Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/number","Output":"--- PASS: TestAccessEngineAuthorizedPartyRefusesAnotherClient/number (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.137332422Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/number","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.137340051Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/array"}
|
||||
{"Time":"2026-10-18T00:13:47.137363189Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/array","Output":"=== RUN TestAccessEngineAuthorizedPartyRefusesAnotherClient/array\n"}
|
||||
{"Time":"2026-10-18T00:13:47.137580992Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/array","Output":"--- PASS: TestAccessEngineAuthorizedPartyRefusesAnotherClient/array (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.137595537Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/array","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.137601461Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/empty"}
|
||||
{"Time":"2026-10-18T00:13:47.137605988Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/empty","Output":"=== RUN TestAccessEngineAuthorizedPartyRefusesAnotherClient/empty\n"}
|
||||
{"Time":"2026-10-18T00:13:47.137904891Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/empty","Output":"--- PASS: TestAccessEngineAuthorizedPartyRefusesAnotherClient/empty (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.137930059Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/empty","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.137938877Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/other-client"}
|
||||
{"Time":"2026-10-18T00:13:47.137945126Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/other-client","Output":"=== RUN TestAccessEngineAuthorizedPartyRefusesAnotherClient/other-client\n"}
|
||||
{"Time":"2026-10-18T00:13:47.138201676Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/other-client","Output":"--- PASS: TestAccessEngineAuthorizedPartyRefusesAnotherClient/other-client (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.138219025Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/other-client","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.138226879Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient","Output":"--- PASS: TestAccessEngineAuthorizedPartyRefusesAnotherClient (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.138232723Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.138238061Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyAcceptsAdmittedClient"}
|
||||
{"Time":"2026-10-18T00:13:47.138242678Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyAcceptsAdmittedClient","Output":"=== RUN TestAccessEngineAuthorizedPartyAcceptsAdmittedClient\n"}
|
||||
{"Time":"2026-10-18T00:13:47.138773571Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyAcceptsAdmittedClient","Output":"--- PASS: TestAccessEngineAuthorizedPartyAcceptsAdmittedClient (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.138861813Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyAcceptsAdmittedClient","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.138873337Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision"}
|
||||
{"Time":"2026-10-18T00:13:47.138932455Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision","Output":"=== RUN TestAccessEngineActualCallbackAllowsAuthenticatedDecision\n"}
|
||||
{"Time":"2026-10-18T00:13:47.13895461Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-admins"}
|
||||
{"Time":"2026-10-18T00:13:47.138960399Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-admins","Output":"=== RUN TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-admins\n"}
|
||||
{"Time":"2026-10-18T00:13:47.156351306Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-admins","Output":"--- PASS: TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-admins (0.02s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.156397222Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-admins","Elapsed":0.02}
|
||||
{"Time":"2026-10-18T00:13:47.156405906Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-owners"}
|
||||
{"Time":"2026-10-18T00:13:47.156410306Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-owners","Output":"=== RUN TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-owners\n"}
|
||||
{"Time":"2026-10-18T00:13:47.165626757Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-owners","Output":"--- PASS: TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-owners (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.165674341Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-owners","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:13:47.165685865Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-readers"}
|
||||
{"Time":"2026-10-18T00:13:47.165696929Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-readers","Output":"=== RUN TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-readers\n"}
|
||||
{"Time":"2026-10-18T00:13:47.173632485Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-readers","Output":"--- PASS: TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-readers (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.173682666Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-readers","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:13:47.173693018Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision","Output":"--- PASS: TestAccessEngineActualCallbackAllowsAuthenticatedDecision (0.03s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.173699276Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision","Elapsed":0.03}
|
||||
{"Time":"2026-10-18T00:13:47.173705507Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP"}
|
||||
{"Time":"2026-10-18T00:13:47.173710529Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP","Output":"=== RUN TestAccessEngineActualCallbackRefusesUnverifiedPDP\n"}
|
||||
{"Time":"2026-10-18T00:13:47.173733839Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/deny"}
|
||||
{"Time":"2026-10-18T00:13:47.173739078Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/deny","Output":"=== RUN TestAccessEngineActualCallbackRefusesUnverifiedPDP/deny\n"}
|
||||
{"Time":"2026-10-18T00:13:47.18093918Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/deny","Output":"--- PASS: TestAccessEngineActualCallbackRefusesUnverifiedPDP/deny (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.180988351Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/deny","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:13:47.180997783Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/unsigned"}
|
||||
{"Time":"2026-10-18T00:13:47.181002832Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/unsigned","Output":"=== RUN TestAccessEngineActualCallbackRefusesUnverifiedPDP/unsigned\n"}
|
||||
{"Time":"2026-10-18T00:13:47.187229059Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/unsigned","Output":"--- PASS: TestAccessEngineActualCallbackRefusesUnverifiedPDP/unsigned (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.187299817Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/unsigned","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:13:47.187569905Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-key"}
|
||||
{"Time":"2026-10-18T00:13:47.187590384Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-key","Output":"=== RUN TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-key\n"}
|
||||
{"Time":"2026-10-18T00:13:47.194682985Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-key","Output":"--- PASS: TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-key (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.194730983Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-key","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:13:47.194740352Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-pin"}
|
||||
{"Time":"2026-10-18T00:13:47.19474588Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-pin","Output":"=== RUN TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-pin\n"}
|
||||
{"Time":"2026-10-18T00:13:47.201875476Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-pin","Output":"--- PASS: TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-pin (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.201922825Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-pin","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:13:47.20193187Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-binding"}
|
||||
{"Time":"2026-10-18T00:13:47.201937271Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-binding","Output":"=== RUN TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-binding\n"}
|
||||
{"Time":"2026-10-18T00:13:47.209215594Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-binding","Output":"--- PASS: TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-binding (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.209268472Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-binding","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:13:47.209279464Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/expired"}
|
||||
{"Time":"2026-10-18T00:13:47.209286795Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/expired","Output":"=== RUN TestAccessEngineActualCallbackRefusesUnverifiedPDP/expired\n"}
|
||||
{"Time":"2026-10-18T00:13:47.216216889Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/expired","Output":"--- PASS: TestAccessEngineActualCallbackRefusesUnverifiedPDP/expired (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.216267115Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/expired","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:13:47.216278459Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP","Output":"--- PASS: TestAccessEngineActualCallbackRefusesUnverifiedPDP (0.04s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.216285357Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP","Elapsed":0.04}
|
||||
{"Time":"2026-10-18T00:13:47.21629176Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP"}
|
||||
{"Time":"2026-10-18T00:13:47.216297188Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP\n"}
|
||||
{"Time":"2026-10-18T00:13:47.216306485Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-token"}
|
||||
{"Time":"2026-10-18T00:13:47.216311733Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-token","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-token\n"}
|
||||
{"Time":"2026-10-18T00:13:47.217762617Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-token","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-token (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.217801058Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-token","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.217809399Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-user"}
|
||||
{"Time":"2026-10-18T00:13:47.217813835Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-user","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-user\n"}
|
||||
{"Time":"2026-10-18T00:13:47.219387424Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-user","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-user (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.219434358Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-user","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.219454774Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-subject"}
|
||||
{"Time":"2026-10-18T00:13:47.21946004Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-subject","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-subject\n"}
|
||||
{"Time":"2026-10-18T00:13:47.220640121Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-subject","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-subject (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.220691311Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-subject","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.220701492Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-groups"}
|
||||
{"Time":"2026-10-18T00:13:47.220707561Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-groups","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-groups\n"}
|
||||
{"Time":"2026-10-18T00:13:47.221725482Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-groups","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-groups (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.221758169Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-groups","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.221765428Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-admission"}
|
||||
{"Time":"2026-10-18T00:13:47.221771055Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-admission","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-admission\n"}
|
||||
{"Time":"2026-10-18T00:13:47.222708641Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-admission","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-admission (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.222732618Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-admission","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.222739625Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/expired-token"}
|
||||
{"Time":"2026-10-18T00:13:47.222744557Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/expired-token","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/expired-token\n"}
|
||||
{"Time":"2026-10-18T00:13:47.223901191Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/expired-token","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/expired-token (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.22394478Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/expired-token","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.223954023Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-source"}
|
||||
{"Time":"2026-10-18T00:13:47.223974077Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-source","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-source\n"}
|
||||
{"Time":"2026-10-18T00:13:47.22477728Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-source","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-source (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.224805026Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-source","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.224812393Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-provider"}
|
||||
{"Time":"2026-10-18T00:13:47.224817451Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-provider","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-provider\n"}
|
||||
{"Time":"2026-10-18T00:13:47.225621438Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-provider","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-provider (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.225643891Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-provider","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.225657877Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-audience"}
|
||||
{"Time":"2026-10-18T00:13:47.225677345Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-audience","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-audience\n"}
|
||||
{"Time":"2026-10-18T00:13:47.226654391Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-audience","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-audience (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.226694437Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-audience","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.226702967Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/untrusted-identity"}
|
||||
{"Time":"2026-10-18T00:13:47.22670863Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/untrusted-identity","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/untrusted-identity\n"}
|
||||
{"Time":"2026-10-18T00:13:47.227947597Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/untrusted-identity","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/untrusted-identity (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.22799271Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/untrusted-identity","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.228003711Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.228013486Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:13:47.228036426Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE"}
|
||||
{"Time":"2026-10-18T00:13:47.228046237Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE\n"}
|
||||
{"Time":"2026-10-18T00:13:47.22848189Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-iat"}
|
||||
{"Time":"2026-10-18T00:13:47.228501277Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-iat","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/no-iat\n"}
|
||||
{"Time":"2026-10-18T00:13:47.22872963Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-iat","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/no-iat (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.228743985Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-iat","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.228750478Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-tenant"}
|
||||
{"Time":"2026-10-18T00:13:47.228755212Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-tenant","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/no-tenant\n"}
|
||||
{"Time":"2026-10-18T00:13:47.228999787Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-tenant","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/no-tenant (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.229015432Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-tenant","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.229023809Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-assurance"}
|
||||
{"Time":"2026-10-18T00:13:47.229029066Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-assurance","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/no-assurance\n"}
|
||||
{"Time":"2026-10-18T00:13:47.229326229Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-assurance","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/no-assurance (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.229347059Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-assurance","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.22935604Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/issuer"}
|
||||
{"Time":"2026-10-18T00:13:47.229360837Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/issuer","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/issuer\n"}
|
||||
{"Time":"2026-10-18T00:13:47.229729435Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/issuer","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/issuer (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.229769697Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/issuer","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.229782015Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/audience"}
|
||||
{"Time":"2026-10-18T00:13:47.229787317Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/audience","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/audience\n"}
|
||||
{"Time":"2026-10-18T00:13:47.230110738Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/audience","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/audience (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.230138412Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/audience","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.230149359Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-principal"}
|
||||
{"Time":"2026-10-18T00:13:47.230157448Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-principal","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/no-principal\n"}
|
||||
{"Time":"2026-10-18T00:13:47.230432871Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-principal","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/no-principal (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.230458624Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-principal","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.230465225Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/multi-audience-no-azp"}
|
||||
{"Time":"2026-10-18T00:13:47.230470058Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/multi-audience-no-azp","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/multi-audience-no-azp\n"}
|
||||
{"Time":"2026-10-18T00:13:47.230746392Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/multi-audience-no-azp","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/multi-audience-no-azp (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.230767546Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/multi-audience-no-azp","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.23077742Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/empty-subject"}
|
||||
{"Time":"2026-10-18T00:13:47.230821361Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/empty-subject","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/empty-subject\n"}
|
||||
{"Time":"2026-10-18T00:13:47.231118407Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/empty-subject","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/empty-subject (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.231135892Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/empty-subject","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.231150608Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/expired"}
|
||||
{"Time":"2026-10-18T00:13:47.231155306Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/expired","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/expired\n"}
|
||||
{"Time":"2026-10-18T00:13:47.231549134Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/expired","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/expired (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.231573472Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/expired","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.23159891Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/future-issued"}
|
||||
{"Time":"2026-10-18T00:13:47.231603986Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/future-issued","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/future-issued\n"}
|
||||
{"Time":"2026-10-18T00:13:47.231911429Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/future-issued","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/future-issued (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.231924658Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/future-issued","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.23199685Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/old-issued"}
|
||||
{"Time":"2026-10-18T00:13:47.232007148Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/old-issued","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/old-issued\n"}
|
||||
{"Time":"2026-10-18T00:13:47.232361823Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/old-issued","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/old-issued (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.232374321Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/old-issued","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.232381454Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-exp"}
|
||||
{"Time":"2026-10-18T00:13:47.23238562Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-exp","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/no-exp\n"}
|
||||
{"Time":"2026-10-18T00:13:47.23271428Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-exp","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/no-exp (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.232727256Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-exp","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.232734524Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/wrong-key"}
|
||||
{"Time":"2026-10-18T00:13:47.232738681Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/wrong-key","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/wrong-key\n"}
|
||||
{"Time":"2026-10-18T00:13:47.233078983Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/wrong-key","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/wrong-key (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.233091571Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/wrong-key","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.233098668Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/unknown-key"}
|
||||
{"Time":"2026-10-18T00:13:47.233102824Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/unknown-key","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/unknown-key\n"}
|
||||
{"Time":"2026-10-18T00:13:47.23332895Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/unknown-key","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/unknown-key (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.233356615Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/unknown-key","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.233364884Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/wrong-type"}
|
||||
{"Time":"2026-10-18T00:13:47.233369383Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/wrong-type","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/wrong-type\n"}
|
||||
{"Time":"2026-10-18T00:13:47.233554291Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/wrong-type","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/wrong-type (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.233575473Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/wrong-type","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.233583002Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/algorithm-confusion"}
|
||||
{"Time":"2026-10-18T00:13:47.233597285Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/algorithm-confusion","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/algorithm-confusion\n"}
|
||||
{"Time":"2026-10-18T00:13:47.23383529Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/algorithm-confusion","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/algorithm-confusion (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.233861504Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/algorithm-confusion","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.233869493Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/none"}
|
||||
{"Time":"2026-10-18T00:13:47.233873361Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/none","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/none\n"}
|
||||
{"Time":"2026-10-18T00:13:47.23406881Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/none","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/none (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.234081173Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/none","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.234088161Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.234092264Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:13:47.234207045Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeIssuer"}
|
||||
{"Time":"2026-10-18T00:13:47.234216639Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeIssuer","Output":"=== RUN TestAccessEngineActualKeyCapeIssuer\n"}
|
||||
{"Time":"2026-10-18T00:13:47.234789288Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeIssuer","Output":"--- PASS: TestAccessEngineActualKeyCapeIssuer (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.234823779Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeIssuer","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.234894971Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestRequiredClaimExactAnyOfAndNoMutation"}
|
||||
{"Time":"2026-10-18T00:13:47.234915945Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestRequiredClaimExactAnyOfAndNoMutation","Output":"=== RUN TestRequiredClaimExactAnyOfAndNoMutation\n"}
|
||||
{"Time":"2026-10-18T00:13:47.235061222Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestRequiredClaimExactAnyOfAndNoMutation","Output":"--- PASS: TestRequiredClaimExactAnyOfAndNoMutation (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.235070888Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestRequiredClaimExactAnyOfAndNoMutation","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.235197788Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestRequiredClaimConfigurationRefusalsAndLegacyIsolation"}
|
||||
{"Time":"2026-10-18T00:13:47.235220457Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestRequiredClaimConfigurationRefusalsAndLegacyIsolation","Output":"=== RUN TestRequiredClaimConfigurationRefusalsAndLegacyIsolation\n"}
|
||||
{"Time":"2026-10-18T00:13:47.235232243Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestRequiredClaimConfigurationRefusalsAndLegacyIsolation","Output":"--- PASS: TestRequiredClaimConfigurationRefusalsAndLegacyIsolation (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.235243938Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestRequiredClaimConfigurationRefusalsAndLegacyIsolation","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.235384498Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoGuardRejectsMissingMalformedAndUnavailable"}
|
||||
{"Time":"2026-10-18T00:13:47.235399953Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoGuardRejectsMissingMalformedAndUnavailable","Output":"=== RUN TestCurrentUserInfoGuardRejectsMissingMalformedAndUnavailable\n"}
|
||||
{"Time":"2026-10-18T00:13:47.2416553Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoGuardRejectsMissingMalformedAndUnavailable","Output":"--- PASS: TestCurrentUserInfoGuardRejectsMissingMalformedAndUnavailable (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.241705761Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoGuardRejectsMissingMalformedAndUnavailable","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:13:47.241717591Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoEmptyArrayOverwritesAndGroupRemoval"}
|
||||
{"Time":"2026-10-18T00:13:47.241722605Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoEmptyArrayOverwritesAndGroupRemoval","Output":"=== RUN TestCurrentUserInfoEmptyArrayOverwritesAndGroupRemoval\n"}
|
||||
{"Time":"2026-10-18T00:13:47.241852241Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoEmptyArrayOverwritesAndGroupRemoval","Output":"--- PASS: TestCurrentUserInfoEmptyArrayOverwritesAndGroupRemoval (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.24186904Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoEmptyArrayOverwritesAndGroupRemoval","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.241874937Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoGuardIsOptInAndRedirectsRefuse"}
|
||||
{"Time":"2026-10-18T00:13:47.24187922Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoGuardIsOptInAndRedirectsRefuse","Output":"=== RUN TestCurrentUserInfoGuardIsOptInAndRedirectsRefuse\n"}
|
||||
{"Time":"2026-10-18T00:13:47.241886939Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoGuardIsOptInAndRedirectsRefuse","Output":"--- PASS: TestCurrentUserInfoGuardIsOptInAndRedirectsRefuse (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:13:47.241911241Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoGuardIsOptInAndRedirectsRefuse","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:13:47.24202098Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Output":"PASS\n"}
|
||||
{"Time":"2026-10-18T00:13:47.249310175Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Output":"ok \tforgejo.org/services/auth/source/oauth2\t0.201s\n"}
|
||||
{"Time":"2026-10-18T00:13:47.249379842Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Elapsed":0.202}
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
{"Time":"2026-10-17T23:35:20.479544589Z","Action":"start","Package":"forgejo.org/services/auth/source/oauth2"}
|
||||
{"Time":"2026-10-17T23:35:20.570890583Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeIssuer"}
|
||||
{"Time":"2026-10-17T23:35:20.570934488Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeIssuer","Output":"=== RUN TestAccessEngineActualKeyCapeIssuer\n"}
|
||||
{"Time":"2026-10-17T23:35:20.573011097Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeIssuer","Output":" keycape_wire_test.go:33: actual KeyCape token rejected by consumer current authenticated application access refused\n"}
|
||||
{"Time":"2026-10-17T23:35:20.573074335Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeIssuer","Output":"--- FAIL: TestAccessEngineActualKeyCapeIssuer (0.00s)\n"}
|
||||
{"Time":"2026-10-17T23:35:20.573085633Z","Action":"fail","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualKeyCapeIssuer","Elapsed":0}
|
||||
{"Time":"2026-10-17T23:35:20.573094615Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Output":"FAIL\n"}
|
||||
{"Time":"2026-10-17T23:35:20.578146562Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Output":"FAIL\tforgejo.org/services/auth/source/oauth2\t0.098s\n"}
|
||||
{"Time":"2026-10-17T23:35:20.578206382Z","Action":"fail","Package":"forgejo.org/services/auth/source/oauth2","Elapsed":0.099}
|
||||
|
|
@ -0,0 +1,224 @@
|
|||
// Copyright 2026 The Forgejo Authors. All rights reserved.
|
||||
// SPDX-License-Identifier: MIT
|
||||
|
||||
package oauth2
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto"
|
||||
"crypto/x509"
|
||||
"encoding/json"
|
||||
"encoding/pem"
|
||||
"errors"
|
||||
"io"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/golang-jwt/jwt/v5"
|
||||
"github.com/markbates/goth"
|
||||
"github.com/netkingdom/access-engine/pkg/api"
|
||||
"github.com/netkingdom/access-engine/pkg/decisionpep"
|
||||
)
|
||||
|
||||
var errApplicationDecision = errors.New("current authenticated application access refused")
|
||||
|
||||
// AccessEngineAdmission contains owner-admitted public trust, with only a file
|
||||
// reference to the private PDP caller token. It is not persisted OAuth source
|
||||
// configuration and cannot be replaced by token claims or provider discovery.
|
||||
type AccessEngineAdmission struct {
|
||||
SourceName string `json:"source_name"`
|
||||
Issuer string `json:"issuer"`
|
||||
Audience string `json:"audience"`
|
||||
TokenType string `json:"token_type"`
|
||||
Algorithms []string `json:"algorithms"`
|
||||
IdentityKeys map[string]string `json:"identity_keys"`
|
||||
TenantClaim string `json:"tenant_claim"`
|
||||
PrincipalTypeClaim string `json:"principal_type_claim"`
|
||||
AssuranceClaim string `json:"assurance_claim"`
|
||||
TenantSourceClaim string `json:"tenant_source_claim"`
|
||||
MaxAuthenticationAge string `json:"max_authentication_age"`
|
||||
MaxIdentityAge string `json:"max_identity_age"`
|
||||
Decision decisionpep.Admission `json:"decision"`
|
||||
}
|
||||
|
||||
// VerifiedApplicationIdentity is derived only by VerifyApplicationIdentity from
|
||||
// independently admitted JOSE keys. RawData and UserInfo never supply these
|
||||
// fields. This snapshot is an identity fact, never an authorization verdict.
|
||||
type VerifiedApplicationIdentity struct {
|
||||
Issuer string
|
||||
Subject string
|
||||
Tenant string
|
||||
PrincipalType api.SubjectType
|
||||
Assurance string
|
||||
TenantSource string
|
||||
AssuranceData map[string]any
|
||||
AuthenticatedAt time.Time
|
||||
NotAfter time.Time
|
||||
}
|
||||
|
||||
func loadAccessEngineAdmission(path string) (AccessEngineAdmission, error) {
|
||||
var a AccessEngineAdmission
|
||||
if !filepath.IsAbs(path) {
|
||||
return a, errApplicationDecision
|
||||
}
|
||||
f, e := os.Open(path)
|
||||
if e != nil {
|
||||
return a, errApplicationDecision
|
||||
}
|
||||
defer f.Close()
|
||||
stat, e := f.Stat()
|
||||
if e != nil || !stat.Mode().IsRegular() || stat.Mode().Perm()&0022 != 0 {
|
||||
return a, errApplicationDecision
|
||||
}
|
||||
raw, e := io.ReadAll(io.LimitReader(f, 1<<20+1))
|
||||
if e != nil || len(raw) > 1<<20 {
|
||||
return a, errApplicationDecision
|
||||
}
|
||||
d := json.NewDecoder(strings.NewReader(string(raw)))
|
||||
d.DisallowUnknownFields()
|
||||
if d.Decode(&a) != nil {
|
||||
return a, errApplicationDecision
|
||||
}
|
||||
if _, e = d.Token(); e != io.EOF {
|
||||
return a, errApplicationDecision
|
||||
}
|
||||
return a, nil
|
||||
}
|
||||
|
||||
// VerifyApplicationIdentity validates the ID token independently of Goth's
|
||||
// decode/claim checks and of the UserInfo merge. Keys and accepted algorithm,
|
||||
// issuer, audience and type are admitted separately; none come from the JWT URL.
|
||||
func VerifyApplicationIdentity(raw string, a AccessEngineAdmission, now time.Time) (VerifiedApplicationIdentity, error) {
|
||||
var out VerifiedApplicationIdentity
|
||||
age, e := time.ParseDuration(a.MaxIdentityAge)
|
||||
authAge, authErr := time.ParseDuration(a.MaxAuthenticationAge)
|
||||
if e != nil || authErr != nil || authAge <= 0 || age <= 0 || a.TenantSourceClaim == "" || a.Issuer == "" || a.Audience == "" || a.TokenType == "" || len(a.Algorithms) == 0 || len(a.IdentityKeys) == 0 || a.TenantClaim == "" || a.PrincipalTypeClaim == "" || a.AssuranceClaim == "" {
|
||||
return out, errApplicationDecision
|
||||
}
|
||||
for _, alg := range a.Algorithms {
|
||||
if alg != "RS256" && alg != "RS384" && alg != "RS512" && alg != "ES256" && alg != "ES384" && alg != "ES512" && alg != "EdDSA" {
|
||||
return out, errApplicationDecision
|
||||
}
|
||||
}
|
||||
claims := jwt.MapClaims{}
|
||||
token, e := jwt.ParseWithClaims(raw, claims, func(t *jwt.Token) (any, error) {
|
||||
if typ, ok := t.Header["typ"].(string); !ok || typ != a.TokenType {
|
||||
return nil, errApplicationDecision
|
||||
}
|
||||
kid, ok := t.Header["kid"].(string)
|
||||
if !ok || kid == "" {
|
||||
return nil, errApplicationDecision
|
||||
}
|
||||
text, ok := a.IdentityKeys[kid]
|
||||
if !ok {
|
||||
return nil, errApplicationDecision
|
||||
}
|
||||
block, rest := pem.Decode([]byte(text))
|
||||
if block == nil || block.Type != "PUBLIC KEY" || len(strings.TrimSpace(string(rest))) != 0 {
|
||||
return nil, errApplicationDecision
|
||||
}
|
||||
key, e := x509.ParsePKIXPublicKey(block.Bytes)
|
||||
if e != nil {
|
||||
return nil, errApplicationDecision
|
||||
}
|
||||
var pub crypto.PublicKey = key
|
||||
return pub, nil
|
||||
}, jwt.WithValidMethods(a.Algorithms), jwt.WithIssuer(a.Issuer), jwt.WithAudience(a.Audience), jwt.WithExpirationRequired(), jwt.WithIssuedAt(), jwt.WithJSONNumber(), jwt.WithTimeFunc(func() time.Time { return now }))
|
||||
if e != nil || token == nil || !token.Valid {
|
||||
return out, errApplicationDecision
|
||||
}
|
||||
subject, e := claims.GetSubject()
|
||||
if e != nil || subject == "" {
|
||||
return out, errApplicationDecision
|
||||
}
|
||||
issued, e := claims.GetIssuedAt()
|
||||
if e != nil || issued == nil || issued.Time.After(now) || now.Sub(issued.Time) > age {
|
||||
return out, errApplicationDecision
|
||||
}
|
||||
end, e := claims.GetExpirationTime()
|
||||
if e != nil || end == nil || !now.Before(end.Time) {
|
||||
return out, errApplicationDecision
|
||||
}
|
||||
aud, e := claims.GetAudience()
|
||||
if e != nil {
|
||||
return out, errApplicationDecision
|
||||
}
|
||||
if authorizedParty, present := claims["azp"]; present {
|
||||
if azp, ok := authorizedParty.(string); !ok || azp != a.Audience {
|
||||
return out, errApplicationDecision
|
||||
}
|
||||
} else if len(aud) > 1 {
|
||||
return out, errApplicationDecision
|
||||
}
|
||||
value := func(name string) (string, bool) { v, ok := claims[name].(string); return v, ok && validClaimLiteral(v) }
|
||||
tenant, ok := value(a.TenantClaim)
|
||||
if !ok {
|
||||
return out, errApplicationDecision
|
||||
}
|
||||
principal, ok := value(a.PrincipalTypeClaim)
|
||||
if !ok {
|
||||
return out, errApplicationDecision
|
||||
}
|
||||
tenantSource, ok := value(a.TenantSourceClaim)
|
||||
if !ok || (tenantSource != "directory" && tenantSource != "registration" && tenantSource != "default") {
|
||||
return out, errApplicationDecision
|
||||
}
|
||||
assurance, assuranceData, authenticatedAt, authenticationEnd, err := verifiedKeyCapeAssurance(claims[a.AssuranceClaim], issued.Time, now, authAge)
|
||||
if err != nil {
|
||||
return out, errApplicationDecision
|
||||
}
|
||||
validUntil := end.Time
|
||||
for _, bound := range []time.Time{issued.Time.Add(age), authenticationEnd} {
|
||||
if bound.Before(validUntil) {
|
||||
validUntil = bound
|
||||
}
|
||||
}
|
||||
if !now.Before(validUntil) {
|
||||
return out, errApplicationDecision
|
||||
}
|
||||
return VerifiedApplicationIdentity{Issuer: a.Issuer, Subject: subject, Tenant: tenant, PrincipalType: api.SubjectType(principal), Assurance: assurance, TenantSource: tenantSource, AssuranceData: assuranceData, AuthenticatedAt: authenticatedAt, NotAfter: validUntil}, nil
|
||||
}
|
||||
|
||||
func (source *Source) authorizeAccessEngine(ctx context.Context, user goth.User) error {
|
||||
// The guarded target extension cannot silently fall back to a local group
|
||||
// decision when admission, keys, facts, PDP or caller authentication is absent.
|
||||
if source.Provider != "openidConnect" || ValidateRequiredClaimValues(source.RequiredClaimName, source.RequiredClaimValue, source.RequiredClaimValues) != nil {
|
||||
return errApplicationDecision
|
||||
}
|
||||
a, e := loadAccessEngineAdmission(os.Getenv("FORGEJO_ACCESS_ENGINE_ADMISSION_FILE"))
|
||||
if e != nil || source.authSource == nil || a.SourceName != source.authSource.Name || a.Audience != source.ClientID {
|
||||
return errApplicationDecision
|
||||
}
|
||||
identity, e := VerifyApplicationIdentity(user.IDToken, a, time.Now().UTC())
|
||||
if e != nil {
|
||||
return errApplicationDecision
|
||||
}
|
||||
// RequireCurrentUserInfoClaim has refused missing/malformed current groups
|
||||
// before Goth can merge. The validated ID subject must still match that join.
|
||||
sub, ok := user.RawData["sub"].(string)
|
||||
if !ok || sub != identity.Subject || user.UserID != identity.Subject {
|
||||
return errApplicationDecision
|
||||
}
|
||||
groups, ok := strictClaimValues(user.RawData[source.RequiredClaimName])
|
||||
if !ok {
|
||||
return errApplicationDecision
|
||||
}
|
||||
client, e := decisionpep.New(a.Decision)
|
||||
if e != nil {
|
||||
return errApplicationDecision
|
||||
}
|
||||
request := api.CheckRequest{Tenant: identity.Tenant,
|
||||
Subject: api.SubjectRef{ID: identity.Subject, Type: identity.PrincipalType, Tenant: identity.Tenant,
|
||||
Attributes: map[string]any{"issuer": identity.Issuer, "assurance": identity.Assurance, "current_userinfo_groups": groups}},
|
||||
Action: "application.access", Resource: api.ResourceRef{ID: "application:forgejo", Type: "application", System: "forgejo", Tenant: identity.Tenant},
|
||||
Context: map[string]any{"identity_issuer": identity.Issuer, "identity_subject": identity.Subject, "identity_tenant": identity.Tenant, "identity_principal_type": string(identity.PrincipalType), "identity_assurance": identity.Assurance, "identity_assurance_claim": identity.AssuranceData, "identity_authenticated_at": identity.AuthenticatedAt.UTC().Format(time.RFC3339Nano), "identity_tenant_source": identity.TenantSource, "identity_not_after": identity.NotAfter.UTC().Format(time.RFC3339Nano), "current_userinfo_groups": groups, "required_groups_any_of": source.RequiredClaimValues, "source_name": a.SourceName, "source_id": source.authSource.ID}}
|
||||
if _, e = client.Check(ctx, request); e != nil {
|
||||
return errApplicationDecision
|
||||
}
|
||||
if !time.Now().UTC().Before(identity.NotAfter) {
|
||||
return errApplicationDecision
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
|
@ -0,0 +1,54 @@
|
|||
package oauth2
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"time"
|
||||
)
|
||||
|
||||
// Validate the actual IAM v0.3 object only after issuer JOSE verification. These
|
||||
// are identity facts, not an access verdict: aal1/service facts still reach the
|
||||
// PDP, which owns the application's assurance and principal policy. Preserve the
|
||||
// full object and its integer timestamp in the signed decision request.
|
||||
func verifiedKeyCapeAssurance(raw any, issued, now time.Time, maxAge time.Duration) (string, map[string]any, time.Time, time.Time, error) {
|
||||
refuse := func() (string, map[string]any, time.Time, time.Time, error) {
|
||||
return "", nil, time.Time{}, time.Time{}, errApplicationDecision
|
||||
}
|
||||
claim, ok := raw.(map[string]any)
|
||||
if !ok || len(claim) != 5 {
|
||||
return refuse()
|
||||
}
|
||||
level, ok := claim["level"].(string)
|
||||
if !ok || (level != "aal1" && level != "aal2" && level != "service") {
|
||||
return refuse()
|
||||
}
|
||||
mfa, ok := claim["mfa"].(bool)
|
||||
if !ok || mfa != (level == "aal2") || claim["source"] != "key-cape" {
|
||||
return refuse()
|
||||
}
|
||||
methods, ok := claim["methods"].([]any)
|
||||
if !ok || len(methods) == 0 {
|
||||
return refuse()
|
||||
}
|
||||
seen := map[string]bool{}
|
||||
for _, method := range methods {
|
||||
value, ok := method.(string)
|
||||
if !ok || !validClaimLiteral(value) || seen[value] {
|
||||
return refuse()
|
||||
}
|
||||
seen[value] = true
|
||||
}
|
||||
number, ok := claim["at"].(json.Number)
|
||||
if !ok {
|
||||
return refuse()
|
||||
}
|
||||
seconds, err := number.Int64()
|
||||
if err != nil || seconds <= 0 || seconds > issued.Unix() || seconds > now.Unix() {
|
||||
return refuse()
|
||||
}
|
||||
authenticated := time.Unix(seconds, 0).UTC()
|
||||
end := authenticated.Add(maxAge)
|
||||
if maxAge <= 0 || !now.Before(end) {
|
||||
return refuse()
|
||||
}
|
||||
return level, claim, authenticated, end, nil
|
||||
}
|
||||
|
|
@ -0,0 +1,75 @@
|
|||
package oauth2
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
func TestAccessEngineKeyCapeAssuranceRefusals(t *testing.T) {
|
||||
cases := map[string]func(map[string]any, time.Time){
|
||||
"stale-authentication": func(c map[string]any, now time.Time) { c["at"] = now.Add(-10 * time.Minute).Unix() },
|
||||
"future-authentication": func(c map[string]any, now time.Time) { c["at"] = now.Add(time.Minute).Unix() },
|
||||
"missing-at": func(c map[string]any, _ time.Time) { delete(c, "at") },
|
||||
"string-at": func(c map[string]any, _ time.Time) { c["at"] = "recent" },
|
||||
"fractional-at": func(c map[string]any, now time.Time) { c["at"] = float64(now.Unix()) - 1.5 },
|
||||
"integer-mfa": func(c map[string]any, _ time.Time) { c["mfa"] = 1 },
|
||||
"inconsistent-mfa": func(c map[string]any, _ time.Time) { c["mfa"] = false },
|
||||
"wrong-source": func(c map[string]any, _ time.Time) { c["source"] = "userinfo" },
|
||||
"wrong-level": func(c map[string]any, _ time.Time) { c["level"] = "verified" },
|
||||
"object-methods": func(c map[string]any, _ time.Time) { c["methods"] = map[string]any{"pwd": true} },
|
||||
"empty-methods": func(c map[string]any, _ time.Time) { c["methods"] = []string{} },
|
||||
"mixed-methods": func(c map[string]any, _ time.Time) { c["methods"] = []any{"pwd", 1} },
|
||||
"duplicate-methods": func(c map[string]any, _ time.Time) { c["methods"] = []string{"pwd", "pwd"} },
|
||||
"unknown-object-field": func(c map[string]any, _ time.Time) { c["verified"] = true },
|
||||
}
|
||||
for name, mutate := range cases {
|
||||
t.Run(name, func(t *testing.T) {
|
||||
admission, key, claims, now := identityFixture(t)
|
||||
mutate(claims["assurance"].(map[string]any), now)
|
||||
if _, err := VerifyApplicationIdentity(signedIdentity(t, key, claims, nil), admission, now); err == nil {
|
||||
t.Fatal("malformed or stale issuer assurance accepted")
|
||||
}
|
||||
})
|
||||
}
|
||||
for _, source := range []string{"", "assumed"} {
|
||||
admission, key, claims, now := identityFixture(t)
|
||||
claims["tenant_source"] = source
|
||||
if _, err := VerifyApplicationIdentity(signedIdentity(t, key, claims, nil), admission, now); err == nil {
|
||||
t.Fatal("missing or unknown tenant provenance accepted")
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestAccessEngineKeyCapeIdentityFactsAndFreshnessBounds(t *testing.T) {
|
||||
admission, key, claims, now := identityFixture(t)
|
||||
admission.MaxAuthenticationAge = "5s"
|
||||
claims["assurance"].(map[string]any)["at"] = now.Add(-3 * time.Second).Unix()
|
||||
identity, err := VerifyApplicationIdentity(signedIdentity(t, key, claims, nil), admission, now)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !identity.NotAfter.Equal(now.Add(2*time.Second)) || !identity.AuthenticatedAt.Equal(now.Add(-3*time.Second)) || identity.TenantSource != "directory" {
|
||||
t.Fatal("snapshot overstated authentication freshness or tenant provenance")
|
||||
}
|
||||
if _, ok := identity.AssuranceData["at"].(json.Number); !ok || identity.AssuranceData["mfa"] != true || identity.AssuranceData["source"] != "key-cape" {
|
||||
t.Fatal("source assurance object lost its actual wire types")
|
||||
}
|
||||
admission.MaxIdentityAge = "2s"
|
||||
identity, err = VerifyApplicationIdentity(signedIdentity(t, key, claims, nil), admission, now)
|
||||
if err != nil || !identity.NotAfter.Equal(now.Add(time.Second)) {
|
||||
t.Fatal("snapshot overstated token-age validity", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestAccessEngineKeyCapeLowerAssuranceIsAnIdentityFact(t *testing.T) {
|
||||
admission, key, claims, now := identityFixture(t)
|
||||
claim := claims["assurance"].(map[string]any)
|
||||
claim["level"] = "aal1"
|
||||
claim["mfa"] = false
|
||||
claim["methods"] = []string{"pwd"}
|
||||
identity, err := VerifyApplicationIdentity(signedIdentity(t, key, claims, nil), admission, now)
|
||||
if err != nil || identity.Assurance != "aal1" || identity.AssuranceData["mfa"] != false {
|
||||
t.Fatal("identity parser substituted an application authorization policy", err)
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,194 @@
|
|||
package oauth2
|
||||
|
||||
import (
|
||||
"crypto/ed25519"
|
||||
"crypto/rand"
|
||||
"encoding/base64"
|
||||
"encoding/json"
|
||||
"encoding/pem"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"reflect"
|
||||
"strings"
|
||||
"sync/atomic"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
authmodel "forgejo.org/models/auth"
|
||||
"github.com/golang-jwt/jwt/v5"
|
||||
"github.com/markbates/goth"
|
||||
"github.com/markbates/goth/gothic"
|
||||
"github.com/netkingdom/access-engine/pkg/api"
|
||||
"github.com/netkingdom/access-engine/pkg/decisionpep"
|
||||
"github.com/netkingdom/access-engine/testsupport/signfixture"
|
||||
)
|
||||
|
||||
// This fixture substitutes only Goth's completed authentication result. The
|
||||
// actual Source.Callback, JOSE verifier, HTTPS PEP client and producer signature
|
||||
// implementation execute. Actual issuer login and native admission are separate.
|
||||
func callbackFixture(t *testing.T, group, mode string) (*Source, *goth.User, *atomic.Int64) {
|
||||
return callbackFixtureWithIdentity(t, group, mode, nil, "")
|
||||
}
|
||||
|
||||
func callbackFixtureWithIdentity(t *testing.T, group, mode string, suppliedAdmission *AccessEngineAdmission, suppliedToken string) (*Source, *goth.User, *atomic.Int64) {
|
||||
t.Helper()
|
||||
admission, identityKey, claims, _ := identityFixture(t)
|
||||
identityToken := signedIdentity(t, identityKey, claims, nil)
|
||||
if suppliedAdmission != nil {
|
||||
admission, identityToken = *suppliedAdmission, suppliedToken
|
||||
}
|
||||
verified, err := VerifyApplicationIdentity(identityToken, admission, time.Now().UTC())
|
||||
if err != nil {
|
||||
t.Fatal("callback fixture identity invalid")
|
||||
}
|
||||
pub, key, err := ed25519.GenerateKey(rand.Reader)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
calls := new(atomic.Int64)
|
||||
server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
calls.Add(1)
|
||||
if r.URL.Path != "/v1/check" || r.Method != http.MethodPost || r.Header.Get("Authorization") != "Bearer synthetic-caller" || r.Header.Get("Access-Engine-JSON-Profile") != decisionpep.JSONProfile {
|
||||
t.Error("incorrect authenticated PDP request")
|
||||
w.WriteHeader(403)
|
||||
return
|
||||
}
|
||||
var request api.CheckRequest
|
||||
decoder := json.NewDecoder(r.Body)
|
||||
decoder.UseNumber()
|
||||
if err := decoder.Decode(&request); err != nil {
|
||||
t.Error(err)
|
||||
w.WriteHeader(400)
|
||||
return
|
||||
}
|
||||
c := request.Context
|
||||
if request.Subject.ID != "user:synthetic" || request.Subject.Tenant != "tenant:synthetic" || request.Subject.Type != "human" || request.Action != "application.access" || request.Resource.ID != "application:forgejo" || c["identity_issuer"] != admission.Issuer || c["identity_assurance"] != "aal2" || c["identity_tenant"] != "tenant:synthetic" || c["source_id"] != json.Number("17") || !reflect.DeepEqual(c["identity_assurance_claim"], verified.AssuranceData) || c["identity_authenticated_at"] != verified.AuthenticatedAt.UTC().Format(time.RFC3339Nano) || c["identity_tenant_source"] != verified.TenantSource {
|
||||
t.Error("PDP request did not use authenticated identity and source")
|
||||
w.WriteHeader(400)
|
||||
return
|
||||
}
|
||||
now := time.Now().UTC()
|
||||
envelope := api.DecisionEnvelope{ID: "synthetic-decision", RequestID: request.ID, Effect: api.DecisionEffectAllow, MatchedPolicyVersion: "v1", Subject: request.Subject, Resource: request.Resource, Binding: api.NewDecisionBindingFor(request, request), Provenance: api.DecisionProvenance{Evaluator: "flex-auth/local", Mode: "standalone/" + decisionpep.JSONProfile, PolicyPackage: "forgejo.application-access", PolicyVersion: "v1", PolicyPackageDigest: "sha256:" + strings.Repeat("1", 64), RegistrySnapshotDigest: "sha256:" + strings.Repeat("2", 64), Caller: &api.CallerProvenance{Mode: "enforce", Principal: "system:serviceaccount:synthetic:forgejo", Audience: "access-engine", NotAfter: now.Add(time.Minute).Format(time.RFC3339Nano)}}}
|
||||
api.CompleteDecision(&envelope, request, api.DecisionCompletion{AllowTTL: "10s", Now: now})
|
||||
switch mode {
|
||||
case "deny":
|
||||
envelope.Effect = api.DecisionEffectDeny
|
||||
case "wrong-binding":
|
||||
envelope.Binding.Subject.ID = "other"
|
||||
case "wrong-pin":
|
||||
envelope.Provenance.PolicyPackageDigest = "sha256:" + strings.Repeat("3", 64)
|
||||
case "expired":
|
||||
envelope.Lifetime.ExpiresAt = now.Add(-time.Hour).Format(time.RFC3339Nano)
|
||||
}
|
||||
if mode != "unsigned" {
|
||||
signingKey := key
|
||||
if mode == "wrong-key" {
|
||||
_, signingKey, err = ed25519.GenerateKey(rand.Reader)
|
||||
if err != nil {
|
||||
t.Error(err)
|
||||
return
|
||||
}
|
||||
}
|
||||
if err := signfixture.Sign(&envelope, signingKey, "synthetic-pdp"); err != nil {
|
||||
t.Error(err)
|
||||
return
|
||||
}
|
||||
}
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
if err := json.NewEncoder(w).Encode(envelope); err != nil {
|
||||
t.Error(err)
|
||||
}
|
||||
}))
|
||||
t.Cleanup(server.Close)
|
||||
dir := t.TempDir()
|
||||
ca := filepath.Join(dir, "ca.pem")
|
||||
token := filepath.Join(dir, "caller")
|
||||
config := filepath.Join(dir, "admission.json")
|
||||
if err := os.WriteFile(ca, pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: server.Certificate().Raw}), 0600); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := os.WriteFile(token, []byte("synthetic-caller"), 0600); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
admission.SourceName = "synthetic-source"
|
||||
admission.Decision = decisionpep.Admission{Endpoint: server.URL + "/v1/check", CAFile: ca, TokenFile: token, Keys: map[string]string{"synthetic-pdp": base64.RawURLEncoding.EncodeToString(pub)}, Evaluator: "flex-auth/local", PolicyPackage: "forgejo.application-access", PolicyVersion: "v1", PolicyDigest: "sha256:" + strings.Repeat("1", 64), RegistryDigest: "sha256:" + strings.Repeat("2", 64), CallerPrincipal: "system:serviceaccount:synthetic:forgejo", CallerAudience: "access-engine", MaxTTL: "30s", MaxClockSkew: "2s"}
|
||||
raw, err := json.Marshal(admission)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err = os.WriteFile(config, raw, 0600); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
t.Setenv("FORGEJO_ACCESS_ENGINE_ADMISSION_FILE", config)
|
||||
source := &Source{Provider: "openidConnect", ClientID: admission.Audience, RequiredClaimName: "groups", RequiredClaimValues: []string{"forge-admins", "forge-coulomb-owners", "forge-coulomb-readers"}}
|
||||
source.authSource = &authmodel.Source{ID: 17, Name: admission.SourceName}
|
||||
user := &goth.User{UserID: "user:synthetic", IDToken: identityToken, RawData: map[string]any{"sub": "user:synthetic", "groups": []string{group}}}
|
||||
previous := gothic.CompleteUserAuth
|
||||
gothic.CompleteUserAuth = func(http.ResponseWriter, *http.Request) (goth.User, error) { return *user, nil }
|
||||
t.Cleanup(func() { gothic.CompleteUserAuth = previous })
|
||||
return source, user, calls
|
||||
}
|
||||
|
||||
func TestAccessEngineActualCallbackAllowsAuthenticatedDecision(t *testing.T) {
|
||||
for _, group := range []string{"forge-admins", "forge-coulomb-owners", "forge-coulomb-readers"} {
|
||||
t.Run(group, func(t *testing.T) {
|
||||
source, user, calls := callbackFixture(t, group, "allow")
|
||||
// Mutable UserInfo cannot supply identity assurance, issuer or tenant.
|
||||
user.RawData["acr"] = "aal1"
|
||||
user.RawData["assurance"] = map[string]any{"level": "aal1", "source": "attacker"}
|
||||
user.RawData["tenant_source"] = "attacker"
|
||||
user.RawData["tenant"] = "tenant:attacker"
|
||||
user.RawData["iss"] = "https://attacker.invalid"
|
||||
got, err := source.Callback(httptest.NewRequest(http.MethodGet, "https://forgejo.invalid/callback", nil), httptest.NewRecorder(), "")
|
||||
if err != nil || got.UserID != user.UserID || calls.Load() != 1 {
|
||||
t.Fatalf("callback result: err=%v requests=%d", err, calls.Load())
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestAccessEngineActualCallbackRefusesUnverifiedPDP(t *testing.T) {
|
||||
for _, mode := range []string{"deny", "unsigned", "wrong-key", "wrong-pin", "wrong-binding", "expired"} {
|
||||
t.Run(mode, func(t *testing.T) {
|
||||
source, _, calls := callbackFixture(t, "forge-admins", mode)
|
||||
got, err := source.Callback(httptest.NewRequest(http.MethodGet, "https://forgejo.invalid/callback", nil), httptest.NewRecorder(), "")
|
||||
if err == nil || got.UserID != "" || got.IDToken != "" || calls.Load() != 1 {
|
||||
t.Fatalf("unverified decision escaped callback: requests=%d err=%v", calls.Load(), err)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestAccessEngineActualCallbackChecksIdentityBeforePDP(t *testing.T) {
|
||||
cases := map[string]func(*Source, *goth.User){
|
||||
"missing-token": func(_ *Source, u *goth.User) { u.IDToken = "" },
|
||||
"mismatched-user": func(_ *Source, u *goth.User) { u.UserID = "other" },
|
||||
"mismatched-subject": func(_ *Source, u *goth.User) { u.RawData["sub"] = "other" },
|
||||
"missing-groups": func(_ *Source, u *goth.User) { delete(u.RawData, "groups") },
|
||||
"wrong-source": func(s *Source, _ *goth.User) { s.authSource.Name = "other" },
|
||||
"wrong-provider": func(s *Source, _ *goth.User) { s.Provider = "other" },
|
||||
"wrong-audience": func(s *Source, _ *goth.User) { s.ClientID = "other" },
|
||||
"missing-admission": func(_ *Source, _ *goth.User) { t.Setenv("FORGEJO_ACCESS_ENGINE_ADMISSION_FILE", "") },
|
||||
"expired-token": func(_ *Source, u *goth.User) {
|
||||
_, key, claims, now := identityFixture(t)
|
||||
claims["exp"] = now.Add(-time.Hour).Unix()
|
||||
u.IDToken = signedIdentity(t, key, claims, nil)
|
||||
},
|
||||
"untrusted-identity": func(_ *Source, u *goth.User) {
|
||||
token := jwt.NewWithClaims(jwt.SigningMethodNone, jwt.MapClaims{"sub": "user:synthetic"})
|
||||
u.IDToken, _ = token.SignedString(jwt.UnsafeAllowNoneSignatureType)
|
||||
},
|
||||
}
|
||||
for name, mutate := range cases {
|
||||
t.Run(name, func(t *testing.T) {
|
||||
source, user, calls := callbackFixture(t, "forge-admins", "allow")
|
||||
mutate(source, user)
|
||||
got, err := source.Callback(httptest.NewRequest(http.MethodGet, "https://forgejo.invalid/callback", nil), httptest.NewRecorder(), "")
|
||||
if err == nil || got.UserID != "" || calls.Load() != 0 {
|
||||
t.Fatalf("unverified identity reached PDP: requests=%d err=%v", calls.Load(), err)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,100 @@
|
|||
package oauth2
|
||||
|
||||
import (
|
||||
"crypto/ed25519"
|
||||
"crypto/rand"
|
||||
"crypto/x509"
|
||||
"encoding/pem"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/golang-jwt/jwt/v5"
|
||||
)
|
||||
|
||||
func identityFixture(t *testing.T) (AccessEngineAdmission, ed25519.PrivateKey, jwt.MapClaims, time.Time) {
|
||||
t.Helper()
|
||||
pub, key, e := ed25519.GenerateKey(rand.Reader)
|
||||
if e != nil {
|
||||
t.Fatal(e)
|
||||
}
|
||||
der, e := x509.MarshalPKIXPublicKey(pub)
|
||||
if e != nil {
|
||||
t.Fatal(e)
|
||||
}
|
||||
now := time.Now().UTC().Truncate(time.Second)
|
||||
a := AccessEngineAdmission{Issuer: "https://issuer.invalid", Audience: "forgejo", TokenType: "JWT", Algorithms: []string{"EdDSA"}, IdentityKeys: map[string]string{"synthetic": string(pem.EncodeToMemory(&pem.Block{Type: "PUBLIC KEY", Bytes: der}))}, TenantClaim: "tenant", PrincipalTypeClaim: "principal_type", AssuranceClaim: "assurance", TenantSourceClaim: "tenant_source", MaxAuthenticationAge: "5m", MaxIdentityAge: "5m"}
|
||||
c := jwt.MapClaims{"iss": a.Issuer, "aud": a.Audience, "sub": "user:synthetic", "iat": now.Add(-time.Second).Unix(), "exp": now.Add(time.Minute).Unix(), "tenant": "tenant:synthetic", "principal_type": "human", "tenant_source": "directory", "assurance": map[string]any{"level": "aal2", "mfa": true, "source": "key-cape", "methods": []string{"pwd", "otp"}, "at": now.Add(-time.Second).Unix()}}
|
||||
return a, key, c, now
|
||||
}
|
||||
func signedIdentity(t *testing.T, key ed25519.PrivateKey, c jwt.MapClaims, mutate func(*jwt.Token)) string {
|
||||
t.Helper()
|
||||
token := jwt.NewWithClaims(jwt.SigningMethodEdDSA, c)
|
||||
token.Header["kid"] = "synthetic"
|
||||
token.Header["typ"] = "JWT"
|
||||
if mutate != nil {
|
||||
mutate(token)
|
||||
}
|
||||
raw, e := token.SignedString(key)
|
||||
if e != nil {
|
||||
t.Fatal(e)
|
||||
}
|
||||
return raw
|
||||
}
|
||||
func TestVerifiedApplicationIdentityActualJOSE(t *testing.T) {
|
||||
a, key, c, now := identityFixture(t)
|
||||
raw := signedIdentity(t, key, c, nil)
|
||||
got, e := VerifyApplicationIdentity(raw, a, now)
|
||||
if e != nil {
|
||||
t.Fatal(e)
|
||||
}
|
||||
if got.Subject != "user:synthetic" || got.Tenant != "tenant:synthetic" || got.Assurance != "aal2" || got.Issuer != a.Issuer || string(got.PrincipalType) != "human" {
|
||||
t.Fatal("identity did not come from verified token")
|
||||
}
|
||||
cases := map[string]func(jwt.MapClaims){"issuer": func(c jwt.MapClaims) { c["iss"] = "https://other.invalid" }, "audience": func(c jwt.MapClaims) { c["aud"] = "other" }, "expired": func(c jwt.MapClaims) { c["exp"] = now.Add(-time.Nanosecond).Unix() }, "future-issued": func(c jwt.MapClaims) { c["iat"] = now.Add(time.Minute).Unix() }, "old-issued": func(c jwt.MapClaims) { c["iat"] = now.Add(-10 * time.Minute).Unix() }, "no-exp": func(c jwt.MapClaims) { delete(c, "exp") }, "no-iat": func(c jwt.MapClaims) { delete(c, "iat") }, "no-tenant": func(c jwt.MapClaims) { delete(c, "tenant") }, "no-principal": func(c jwt.MapClaims) { delete(c, "principal_type") }, "no-assurance": func(c jwt.MapClaims) { delete(c, "assurance") }, "multi-audience-no-azp": func(c jwt.MapClaims) { c["aud"] = []string{"forgejo", "other"} }, "empty-subject": func(c jwt.MapClaims) { c["sub"] = "" }}
|
||||
for name, change := range cases {
|
||||
t.Run(name, func(t *testing.T) {
|
||||
copy := jwt.MapClaims{}
|
||||
for k, v := range c {
|
||||
copy[k] = v
|
||||
}
|
||||
change(copy)
|
||||
if _, e := VerifyApplicationIdentity(signedIdentity(t, key, copy, nil), a, now); e == nil {
|
||||
t.Fatal("unverified identity accepted")
|
||||
}
|
||||
})
|
||||
}
|
||||
t.Run("wrong-key", func(t *testing.T) {
|
||||
_, other, _ := ed25519.GenerateKey(rand.Reader)
|
||||
if _, e := VerifyApplicationIdentity(signedIdentity(t, other, c, nil), a, now); e == nil {
|
||||
t.Fatal("wrong key accepted")
|
||||
}
|
||||
})
|
||||
t.Run("unknown-key", func(t *testing.T) {
|
||||
if _, e := VerifyApplicationIdentity(signedIdentity(t, key, c, func(t *jwt.Token) { t.Header["kid"] = "other" }), a, now); e == nil {
|
||||
t.Fatal("unknown key accepted")
|
||||
}
|
||||
})
|
||||
t.Run("wrong-type", func(t *testing.T) {
|
||||
if _, e := VerifyApplicationIdentity(signedIdentity(t, key, c, func(t *jwt.Token) { t.Header["typ"] = "at+jwt" }), a, now); e == nil {
|
||||
t.Fatal("access token accepted as ID token")
|
||||
}
|
||||
})
|
||||
t.Run("algorithm-confusion", func(t *testing.T) {
|
||||
token := jwt.NewWithClaims(jwt.SigningMethodHS256, c)
|
||||
token.Header["kid"] = "synthetic"
|
||||
token.Header["typ"] = "JWT"
|
||||
raw, _ := token.SignedString([]byte(a.IdentityKeys["synthetic"]))
|
||||
if _, e := VerifyApplicationIdentity(raw, a, now); e == nil {
|
||||
t.Fatal("algorithm confusion accepted")
|
||||
}
|
||||
})
|
||||
t.Run("none", func(t *testing.T) {
|
||||
token := jwt.NewWithClaims(jwt.SigningMethodNone, c)
|
||||
token.Header["kid"] = "synthetic"
|
||||
token.Header["typ"] = "JWT"
|
||||
raw, _ := token.SignedString(jwt.UnsafeAllowNoneSignatureType)
|
||||
if _, e := VerifyApplicationIdentity(raw, a, now); e == nil {
|
||||
t.Fatal("unsigned identity accepted")
|
||||
}
|
||||
})
|
||||
}
|
||||
|
|
@ -0,0 +1,163 @@
|
|||
{
|
||||
"returncode": 0,
|
||||
"seconds": 50.98,
|
||||
"argv": [
|
||||
"bwrap",
|
||||
"--unshare-pid",
|
||||
"--die-with-parent",
|
||||
"--new-session",
|
||||
"--unshare-net",
|
||||
"--ro-bind",
|
||||
"/usr",
|
||||
"/usr",
|
||||
"--ro-bind",
|
||||
"/lib",
|
||||
"/lib",
|
||||
"--ro-bind",
|
||||
"/lib64",
|
||||
"/lib64",
|
||||
"--symlink",
|
||||
"usr/bin",
|
||||
"/bin",
|
||||
"--proc",
|
||||
"/proc",
|
||||
"--dev",
|
||||
"/dev",
|
||||
"--tmpfs",
|
||||
"/tmp",
|
||||
"--bind",
|
||||
"/tmp/custodian-forgejo-successor-r3",
|
||||
"/work",
|
||||
"--ro-bind",
|
||||
"/home/worsch/go/pkg/mod/cache/download",
|
||||
"/cached",
|
||||
"--ro-bind",
|
||||
"/etc/ssl/certs",
|
||||
"/etc/ssl/certs",
|
||||
"--ro-bind",
|
||||
"/etc/resolv.conf",
|
||||
"/etc/resolv.conf",
|
||||
"--chdir",
|
||||
"/work/source",
|
||||
"--clearenv",
|
||||
"--ro-bind",
|
||||
"/tmp/custodian-forgejo-successor-attempt2/modules",
|
||||
"/work/modules",
|
||||
"--bind",
|
||||
"/tmp/custodian-forgejo-successor-attempt2/gocache",
|
||||
"/work/gocache",
|
||||
"--dir",
|
||||
"/run",
|
||||
"--ro-bind",
|
||||
"/tmp/custodian-forgejo-successor-r3/descriptor-fixtures",
|
||||
"/run/forgejo-oidc",
|
||||
"--bind",
|
||||
"/tmp/custodian-forgejo-successor-r3/descriptor-fixtures",
|
||||
"/run/writable-input",
|
||||
"--setenv",
|
||||
"PATH",
|
||||
"/work/go/bin:/usr/bin:/bin",
|
||||
"--setenv",
|
||||
"HOME",
|
||||
"/work/home",
|
||||
"--setenv",
|
||||
"GOPATH",
|
||||
"/work/gopath",
|
||||
"--setenv",
|
||||
"GOTOOLCHAIN",
|
||||
"local",
|
||||
"--setenv",
|
||||
"GOPROXY",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOSUMDB",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOVCS",
|
||||
"*:off",
|
||||
"--setenv",
|
||||
"GOMODCACHE",
|
||||
"/work/modules",
|
||||
"--setenv",
|
||||
"GOCACHE",
|
||||
"/work/gocache",
|
||||
"--setenv",
|
||||
"GOMAXPROCS",
|
||||
"4",
|
||||
"--setenv",
|
||||
"CGO_ENABLED",
|
||||
"1",
|
||||
"--setenv",
|
||||
"GIT_CONFIG_NOSYSTEM",
|
||||
"1",
|
||||
"--setenv",
|
||||
"GIT_CONFIG_GLOBAL",
|
||||
"/work/home/test.gitconfig",
|
||||
"--setenv",
|
||||
"GIT_TERMINAL_PROMPT",
|
||||
"0",
|
||||
"--",
|
||||
"go",
|
||||
"test",
|
||||
"-p",
|
||||
"1",
|
||||
"-json",
|
||||
"-tags",
|
||||
"sqlite sqlite_unlock_notify",
|
||||
"./services/auth/source/oauth2",
|
||||
"./cmd",
|
||||
"./models/auth",
|
||||
"./models/db",
|
||||
"-run",
|
||||
"TestAccessEngine|TestVerifiedApplicationIdentity|TestRequired|TestCurrent|TestPrivateSecret|TestSourceOperation|TestSensitiveSQL",
|
||||
"-count=1"
|
||||
],
|
||||
"workspace": "/tmp/custodian-forgejo-successor-r3",
|
||||
"module_hashes": {
|
||||
"go.mod": "sha256:130138c4c3ecc29fa0d7f1e2eef0589ddf3b06071f3cc0448aa7b2326847653a",
|
||||
"go.sum": "sha256:19c305c7e68de9d3f1bc0dda2de09c5d38597f1ee7fa411c7b36b92467ae1eaf"
|
||||
},
|
||||
"composed_source_pins": {
|
||||
"cmd/admin_auth_oauth.go": "sha256:d718d817c46f6393488a9c5a894b7535640cd0ec1a1ae3f72f8411a2bbec3b38",
|
||||
"cmd/admin_auth_oauth_secret_linux.go": "sha256:6741961f1df67c1afbf34c796e549425f0e04a0d0678c6eedb05f66d4754c64b",
|
||||
"cmd/admin_auth_oauth_secret_linux_test.go": "sha256:b28c2369dfab9bf2ca48e707e01b4394a36c8be5490cfe5bb658017bb626c4b2",
|
||||
"cmd/admin_auth_oauth_secret_other.go": "sha256:54056c989a4757e73db0252130e7c16bf16f5ec8eaaca2468f019ba2ef5c532d",
|
||||
"go.mod": "sha256:130138c4c3ecc29fa0d7f1e2eef0589ddf3b06071f3cc0448aa7b2326847653a",
|
||||
"go.sum": "sha256:19c305c7e68de9d3f1bc0dda2de09c5d38597f1ee7fa411c7b36b92467ae1eaf",
|
||||
"models/auth/source_operation.go": "sha256:ef1b07ef6cf454015d00cde8588835f5118d829da91eb0303d37184859345a31",
|
||||
"models/auth/source_operation_internal_test.go": "sha256:af0f424d3a1fd2b29793b64baa1fa07284fee7ea0b7721c503db4efac0d871cb",
|
||||
"models/auth/source_operation_process_test.go": "sha256:40d33b11a01cb659f0bf6f8b545c4d79910e8c082a789060bcbc9cadeee965bd",
|
||||
"models/auth/source_operation_test.go": "sha256:77d311bca42f48faf3fbdc15c53582e3d8a6d9108a72ed7bb6172e5b88951428",
|
||||
"models/db/context.go": "sha256:d4c4acfcb8987071aecf5cd957b3821c8d2619a2696398d37c2970f2527686f7",
|
||||
"models/db/engine.go": "sha256:43683804d0c5bc6ead1dba0344c69dd196825cf3d5eb502af8d932a7b8207b96",
|
||||
"models/db/sensitive_sql.go": "sha256:06a298d0d6e628e6920384d4ddeef449e40c090841ebaa3f6d175725a45ae584",
|
||||
"models/db/sensitive_sql_logging_test.go": "sha256:d924b35d30686473caf29601cf51cc363ba68158cb4ef0981c9e2fc7b03c04b7",
|
||||
"models/db/sensitive_sql_test.go": "sha256:de6353c955047c3311747e4777b9f9b2195e9efb19160b971dd758dfc94cf31b",
|
||||
"routers/web/admin/auths.go": "sha256:3498229e06fb9ff52396bcb5e68c0cc2d2ad24e6494533d8717d7c833f3e2923",
|
||||
"routers/web/auth/oauth.go": "sha256:58bff778e0dc17a521706289bf45c3e0d76a759a0874f76c379b3d1ddb419b17",
|
||||
"services/auth/source/oauth2/access_engine.go": "sha256:d5f07f9491ac2212410e1fa8c0248d68ba3a723e7ca99e363627c5292d187aa8",
|
||||
"services/auth/source/oauth2/access_engine_assurance.go": "sha256:42de751b1e9a243301d566260954813b770558ecb449639acaeab307fe788642",
|
||||
"services/auth/source/oauth2/access_engine_assurance_test.go": "sha256:44e7459f6c1106a264093c19d61d01a8365f6ad22682906552d832ba39d61dd3",
|
||||
"services/auth/source/oauth2/access_engine_azp_test.go": "sha256:5f94f43ade9a79b6b7ef529c80115a8c32acfece425dc8ed3f24e6ad839fc0ce",
|
||||
"services/auth/source/oauth2/access_engine_callback_test.go": "sha256:5cea36b630c895a9473dc876b7128526ddef65d9395b2fddc56343e162452472",
|
||||
"services/auth/source/oauth2/access_engine_test.go": "sha256:99edd6cfe3e834d73e0447a7915f52cc4ab7b82644669c5ae61963f850b447e8",
|
||||
"services/auth/source/oauth2/providers_openid.go": "sha256:5dd9b906cce434c774968d57fcc790cb678147345fea4d2e58477ec6eed70bcf",
|
||||
"services/auth/source/oauth2/required_claim_values.go": "sha256:29f16d07464bbe12e3f65616b6c1eb60561d04cd8ff89ecbfb56f93dbeaf1cda",
|
||||
"services/auth/source/oauth2/required_claim_values_test.go": "sha256:54a8bd97dc51c524a9adf0c6aefb9a19fa152d234b3bb929bf1a90932662d3d0",
|
||||
"services/auth/source/oauth2/source.go": "sha256:44e99883c2ec479427b3f72c73353fe33936eed2e5c962b2fa40803576aa5642",
|
||||
"services/auth/source/oauth2/source_callout.go": "sha256:6abba69df97afc62467f0328eaa5a6383cfb4900202a081dec4b84a21b37349c",
|
||||
"third_party/access-engine-pep/LICENSE": "sha256:ff413f361a3b3bf44cf50f110fbcc4837064d57eefbcef89df2b43997c6262b6",
|
||||
"third_party/access-engine-pep/go.mod": "sha256:fea700810e47c1ba5638b86a168f8531c083a6e1222ca80bd2a8947b2ea6f2c3",
|
||||
"third_party/access-engine-pep/internal/sign/sign.go": "sha256:0df9515922e90775ebbfac798361dcafb20da8a4213796b44e246b8a92046cde",
|
||||
"third_party/access-engine-pep/pkg/api/canonical.go": "sha256:a122a2e8cd524333b13c5939c7a3685e41efbe47497a64e0c7297c92b7f10d19",
|
||||
"third_party/access-engine-pep/pkg/api/caring.go": "sha256:1907156f0f889e7b9e9c14970cf7a86a20d00478a496efaf92c7231f27fec5e3",
|
||||
"third_party/access-engine-pep/pkg/api/resource_manifest.go": "sha256:f0fa4080287d389ed48c2b1d6af96cc62e57ef72c902333f677f964420be133f",
|
||||
"third_party/access-engine-pep/pkg/decisionpep/client.go": "sha256:0d57f6ddaca5c3f81ce426c0e8b14ba14ea5962096d3be5909aa456eef19eeba",
|
||||
"third_party/access-engine-pep/pkg/decisionpep/client_test.go": "sha256:1a6be3485f580f95a1f1406fb76e525f2c4bf02fe04a424cfe0095bb728e3f62",
|
||||
"third_party/access-engine-pep/producer-source.json": "sha256:c1d83e3d79f9860ffaa61ec19a6b3415e914d3058b11b07cdd05a7d1182cdceb",
|
||||
"third_party/access-engine-pep/testsupport/signfixture/sign.go": "sha256:fe4aa86f444dc20145aefbaca35b24f046264b2c5c8b4e3b057a4496b77a4d29"
|
||||
},
|
||||
"network": "disabled",
|
||||
"pid_namespace": "private",
|
||||
"real_credentials": false
|
||||
}
|
||||
|
|
@ -0,0 +1,432 @@
|
|||
{"Time":"2026-10-18T00:15:43.574746912Z","Action":"start","Package":"forgejo.org/services/auth/source/oauth2"}
|
||||
{"Time":"2026-10-18T00:15:43.663502082Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals"}
|
||||
{"Time":"2026-10-18T00:15:43.663558773Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals\n"}
|
||||
{"Time":"2026-10-18T00:15:43.663601479Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/wrong-source"}
|
||||
{"Time":"2026-10-18T00:15:43.663607737Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/wrong-source","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/wrong-source\n"}
|
||||
{"Time":"2026-10-18T00:15:43.665615986Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/wrong-source","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/wrong-source (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.665636338Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/wrong-source","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.665647357Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/wrong-level"}
|
||||
{"Time":"2026-10-18T00:15:43.665653913Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/wrong-level","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/wrong-level\n"}
|
||||
{"Time":"2026-10-18T00:15:43.66589526Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/wrong-level","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/wrong-level (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.665914024Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/wrong-level","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.665921978Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/mixed-methods"}
|
||||
{"Time":"2026-10-18T00:15:43.665933276Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/mixed-methods","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/mixed-methods\n"}
|
||||
{"Time":"2026-10-18T00:15:43.6661897Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/mixed-methods","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/mixed-methods (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.666207121Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/mixed-methods","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.666214894Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/unknown-object-field"}
|
||||
{"Time":"2026-10-18T00:15:43.666221035Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/unknown-object-field","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/unknown-object-field\n"}
|
||||
{"Time":"2026-10-18T00:15:43.666581466Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/unknown-object-field","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/unknown-object-field (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.666614469Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/unknown-object-field","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.666626588Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/future-authentication"}
|
||||
{"Time":"2026-10-18T00:15:43.666652161Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/future-authentication","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/future-authentication\n"}
|
||||
{"Time":"2026-10-18T00:15:43.666819329Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/future-authentication","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/future-authentication (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.666845037Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/future-authentication","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.666855371Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/missing-at"}
|
||||
{"Time":"2026-10-18T00:15:43.666864893Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/missing-at","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/missing-at\n"}
|
||||
{"Time":"2026-10-18T00:15:43.667091091Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/missing-at","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/missing-at (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.667108765Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/missing-at","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.667116448Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/string-at"}
|
||||
{"Time":"2026-10-18T00:15:43.667122426Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/string-at","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/string-at\n"}
|
||||
{"Time":"2026-10-18T00:15:43.667376541Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/string-at","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/string-at (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.667393133Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/string-at","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.667400608Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/integer-mfa"}
|
||||
{"Time":"2026-10-18T00:15:43.667406487Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/integer-mfa","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/integer-mfa\n"}
|
||||
{"Time":"2026-10-18T00:15:43.667644462Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/integer-mfa","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/integer-mfa (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.667661991Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/integer-mfa","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.667669683Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/inconsistent-mfa"}
|
||||
{"Time":"2026-10-18T00:15:43.667675869Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/inconsistent-mfa","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/inconsistent-mfa\n"}
|
||||
{"Time":"2026-10-18T00:15:43.667975954Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/inconsistent-mfa","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/inconsistent-mfa (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.66801012Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/inconsistent-mfa","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.668018732Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/object-methods"}
|
||||
{"Time":"2026-10-18T00:15:43.668024827Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/object-methods","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/object-methods\n"}
|
||||
{"Time":"2026-10-18T00:15:43.668251377Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/object-methods","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/object-methods (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.668266444Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/object-methods","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.668273225Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/empty-methods"}
|
||||
{"Time":"2026-10-18T00:15:43.668278473Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/empty-methods","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/empty-methods\n"}
|
||||
{"Time":"2026-10-18T00:15:43.668519964Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/empty-methods","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/empty-methods (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.668534635Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/empty-methods","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.668543743Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/duplicate-methods"}
|
||||
{"Time":"2026-10-18T00:15:43.668552336Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/duplicate-methods","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/duplicate-methods\n"}
|
||||
{"Time":"2026-10-18T00:15:43.668821086Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/duplicate-methods","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/duplicate-methods (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.668839608Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/duplicate-methods","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.668847417Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/stale-authentication"}
|
||||
{"Time":"2026-10-18T00:15:43.668855217Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/stale-authentication","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/stale-authentication\n"}
|
||||
{"Time":"2026-10-18T00:15:43.669108448Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/stale-authentication","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/stale-authentication (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.669123408Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/stale-authentication","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.669130522Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/fractional-at"}
|
||||
{"Time":"2026-10-18T00:15:43.669135752Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/fractional-at","Output":"=== RUN TestAccessEngineKeyCapeAssuranceRefusals/fractional-at\n"}
|
||||
{"Time":"2026-10-18T00:15:43.669406089Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/fractional-at","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals/fractional-at (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.669421437Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals/fractional-at","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.669878314Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals","Output":"--- PASS: TestAccessEngineKeyCapeAssuranceRefusals (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.669894383Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeAssuranceRefusals","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:15:43.669905086Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeIdentityFactsAndFreshnessBounds"}
|
||||
{"Time":"2026-10-18T00:15:43.669912688Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeIdentityFactsAndFreshnessBounds","Output":"=== RUN TestAccessEngineKeyCapeIdentityFactsAndFreshnessBounds\n"}
|
||||
{"Time":"2026-10-18T00:15:43.67033098Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeIdentityFactsAndFreshnessBounds","Output":"--- PASS: TestAccessEngineKeyCapeIdentityFactsAndFreshnessBounds (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.670438204Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeIdentityFactsAndFreshnessBounds","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.670449268Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeLowerAssuranceIsAnIdentityFact"}
|
||||
{"Time":"2026-10-18T00:15:43.670455066Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeLowerAssuranceIsAnIdentityFact","Output":"=== RUN TestAccessEngineKeyCapeLowerAssuranceIsAnIdentityFact\n"}
|
||||
{"Time":"2026-10-18T00:15:43.670770312Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeLowerAssuranceIsAnIdentityFact","Output":"--- PASS: TestAccessEngineKeyCapeLowerAssuranceIsAnIdentityFact (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.670799014Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineKeyCapeLowerAssuranceIsAnIdentityFact","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.670808518Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient"}
|
||||
{"Time":"2026-10-18T00:15:43.670815398Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient","Output":"=== RUN TestAccessEngineAuthorizedPartyRefusesAnotherClient\n"}
|
||||
{"Time":"2026-10-18T00:15:43.670822909Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/empty"}
|
||||
{"Time":"2026-10-18T00:15:43.670829041Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/empty","Output":"=== RUN TestAccessEngineAuthorizedPartyRefusesAnotherClient/empty\n"}
|
||||
{"Time":"2026-10-18T00:15:43.671050565Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/empty","Output":"--- PASS: TestAccessEngineAuthorizedPartyRefusesAnotherClient/empty (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.671073505Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/empty","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.671081395Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/other-client"}
|
||||
{"Time":"2026-10-18T00:15:43.671104569Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/other-client","Output":"=== RUN TestAccessEngineAuthorizedPartyRefusesAnotherClient/other-client\n"}
|
||||
{"Time":"2026-10-18T00:15:43.671357179Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/other-client","Output":"--- PASS: TestAccessEngineAuthorizedPartyRefusesAnotherClient/other-client (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.671373229Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/other-client","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.671380723Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/number"}
|
||||
{"Time":"2026-10-18T00:15:43.671386692Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/number","Output":"=== RUN TestAccessEngineAuthorizedPartyRefusesAnotherClient/number\n"}
|
||||
{"Time":"2026-10-18T00:15:43.671641204Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/number","Output":"--- PASS: TestAccessEngineAuthorizedPartyRefusesAnotherClient/number (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.671657282Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/number","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.671663846Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/array"}
|
||||
{"Time":"2026-10-18T00:15:43.67166923Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/array","Output":"=== RUN TestAccessEngineAuthorizedPartyRefusesAnotherClient/array\n"}
|
||||
{"Time":"2026-10-18T00:15:43.671937105Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/array","Output":"--- PASS: TestAccessEngineAuthorizedPartyRefusesAnotherClient/array (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.671957836Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient/array","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.672087774Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient","Output":"--- PASS: TestAccessEngineAuthorizedPartyRefusesAnotherClient (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.672099208Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyRefusesAnotherClient","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.672105755Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyAcceptsAdmittedClient"}
|
||||
{"Time":"2026-10-18T00:15:43.672111183Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyAcceptsAdmittedClient","Output":"=== RUN TestAccessEngineAuthorizedPartyAcceptsAdmittedClient\n"}
|
||||
{"Time":"2026-10-18T00:15:43.67242786Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyAcceptsAdmittedClient","Output":"--- PASS: TestAccessEngineAuthorizedPartyAcceptsAdmittedClient (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.672451765Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineAuthorizedPartyAcceptsAdmittedClient","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.672459564Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision"}
|
||||
{"Time":"2026-10-18T00:15:43.672480403Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision","Output":"=== RUN TestAccessEngineActualCallbackAllowsAuthenticatedDecision\n"}
|
||||
{"Time":"2026-10-18T00:15:43.672490575Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-admins"}
|
||||
{"Time":"2026-10-18T00:15:43.672495931Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-admins","Output":"=== RUN TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-admins\n"}
|
||||
{"Time":"2026-10-18T00:15:43.686861682Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-admins","Output":"--- PASS: TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-admins (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.686917634Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-admins","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:15:43.686930231Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-owners"}
|
||||
{"Time":"2026-10-18T00:15:43.686937283Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-owners","Output":"=== RUN TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-owners\n"}
|
||||
{"Time":"2026-10-18T00:15:43.693908491Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-owners","Output":"--- PASS: TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-owners (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.693966165Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-owners","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:15:43.693997022Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-readers"}
|
||||
{"Time":"2026-10-18T00:15:43.694005516Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-readers","Output":"=== RUN TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-readers\n"}
|
||||
{"Time":"2026-10-18T00:15:43.700179137Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-readers","Output":"--- PASS: TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-readers (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.700232889Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision/forge-coulomb-readers","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:15:43.700247362Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision","Output":"--- PASS: TestAccessEngineActualCallbackAllowsAuthenticatedDecision (0.03s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.700256208Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackAllowsAuthenticatedDecision","Elapsed":0.03}
|
||||
{"Time":"2026-10-18T00:15:43.700269274Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP"}
|
||||
{"Time":"2026-10-18T00:15:43.700276776Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP","Output":"=== RUN TestAccessEngineActualCallbackRefusesUnverifiedPDP\n"}
|
||||
{"Time":"2026-10-18T00:15:43.700300338Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/deny"}
|
||||
{"Time":"2026-10-18T00:15:43.700307137Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/deny","Output":"=== RUN TestAccessEngineActualCallbackRefusesUnverifiedPDP/deny\n"}
|
||||
{"Time":"2026-10-18T00:15:43.708082578Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/deny","Output":"--- PASS: TestAccessEngineActualCallbackRefusesUnverifiedPDP/deny (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.708127376Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/deny","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:15:43.708136492Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/unsigned"}
|
||||
{"Time":"2026-10-18T00:15:43.708143111Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/unsigned","Output":"=== RUN TestAccessEngineActualCallbackRefusesUnverifiedPDP/unsigned\n"}
|
||||
{"Time":"2026-10-18T00:15:43.714997518Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/unsigned","Output":"--- PASS: TestAccessEngineActualCallbackRefusesUnverifiedPDP/unsigned (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.715034336Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/unsigned","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:15:43.715042956Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-key"}
|
||||
{"Time":"2026-10-18T00:15:43.715046807Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-key","Output":"=== RUN TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-key\n"}
|
||||
{"Time":"2026-10-18T00:15:43.721829179Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-key","Output":"--- PASS: TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-key (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.721879955Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-key","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:15:43.721889964Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-pin"}
|
||||
{"Time":"2026-10-18T00:15:43.721896114Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-pin","Output":"=== RUN TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-pin\n"}
|
||||
{"Time":"2026-10-18T00:15:43.728950492Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-pin","Output":"--- PASS: TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-pin (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.728998887Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-pin","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:15:43.72900859Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-binding"}
|
||||
{"Time":"2026-10-18T00:15:43.729014343Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-binding","Output":"=== RUN TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-binding\n"}
|
||||
{"Time":"2026-10-18T00:15:43.735938579Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-binding","Output":"--- PASS: TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-binding (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.735983927Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/wrong-binding","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:15:43.735997904Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/expired"}
|
||||
{"Time":"2026-10-18T00:15:43.736004766Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/expired","Output":"=== RUN TestAccessEngineActualCallbackRefusesUnverifiedPDP/expired\n"}
|
||||
{"Time":"2026-10-18T00:15:43.743488993Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/expired","Output":"--- PASS: TestAccessEngineActualCallbackRefusesUnverifiedPDP/expired (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.743535143Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP/expired","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:15:43.74354674Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP","Output":"--- PASS: TestAccessEngineActualCallbackRefusesUnverifiedPDP (0.04s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.743553872Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackRefusesUnverifiedPDP","Elapsed":0.04}
|
||||
{"Time":"2026-10-18T00:15:43.743560356Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP"}
|
||||
{"Time":"2026-10-18T00:15:43.743567272Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP\n"}
|
||||
{"Time":"2026-10-18T00:15:43.74357344Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-token"}
|
||||
{"Time":"2026-10-18T00:15:43.743578913Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-token","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-token\n"}
|
||||
{"Time":"2026-10-18T00:15:43.744633562Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-token","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-token (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.744662696Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-token","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.744670244Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-user"}
|
||||
{"Time":"2026-10-18T00:15:43.744675068Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-user","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-user\n"}
|
||||
{"Time":"2026-10-18T00:15:43.745808366Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-user","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-user (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.745854038Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-user","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.745877871Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-subject"}
|
||||
{"Time":"2026-10-18T00:15:43.745885003Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-subject","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-subject\n"}
|
||||
{"Time":"2026-10-18T00:15:43.747057624Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-subject","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-subject (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.74710373Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/mismatched-subject","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.74711364Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-source"}
|
||||
{"Time":"2026-10-18T00:15:43.747119744Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-source","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-source\n"}
|
||||
{"Time":"2026-10-18T00:15:43.748497365Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-source","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-source (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.748546842Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-source","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.748557176Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-provider"}
|
||||
{"Time":"2026-10-18T00:15:43.748563344Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-provider","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-provider\n"}
|
||||
{"Time":"2026-10-18T00:15:43.749738517Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-provider","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-provider (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.749775055Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-provider","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.749782873Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-audience"}
|
||||
{"Time":"2026-10-18T00:15:43.749787607Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-audience","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-audience\n"}
|
||||
{"Time":"2026-10-18T00:15:43.751188013Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-audience","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-audience (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.751233982Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/wrong-audience","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.751469143Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-admission"}
|
||||
{"Time":"2026-10-18T00:15:43.751491308Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-admission","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-admission\n"}
|
||||
{"Time":"2026-10-18T00:15:43.752751863Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-admission","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-admission (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.752778518Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-admission","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.752785849Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/expired-token"}
|
||||
{"Time":"2026-10-18T00:15:43.752790592Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/expired-token","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/expired-token\n"}
|
||||
{"Time":"2026-10-18T00:15:43.75394837Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/expired-token","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/expired-token (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.753998776Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/expired-token","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.754008371Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-groups"}
|
||||
{"Time":"2026-10-18T00:15:43.754014692Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-groups","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-groups\n"}
|
||||
{"Time":"2026-10-18T00:15:43.75540131Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-groups","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-groups (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.755443763Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/missing-groups","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.755464043Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/untrusted-identity"}
|
||||
{"Time":"2026-10-18T00:15:43.75547894Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/untrusted-identity","Output":"=== RUN TestAccessEngineActualCallbackChecksIdentityBeforePDP/untrusted-identity\n"}
|
||||
{"Time":"2026-10-18T00:15:43.756459556Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/untrusted-identity","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP/untrusted-identity (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.756495111Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP/untrusted-identity","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.756504381Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP","Output":"--- PASS: TestAccessEngineActualCallbackChecksIdentityBeforePDP (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.756516013Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestAccessEngineActualCallbackChecksIdentityBeforePDP","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:15:43.756540874Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE"}
|
||||
{"Time":"2026-10-18T00:15:43.756549855Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE\n"}
|
||||
{"Time":"2026-10-18T00:15:43.756865558Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/issuer"}
|
||||
{"Time":"2026-10-18T00:15:43.756888281Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/issuer","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/issuer\n"}
|
||||
{"Time":"2026-10-18T00:15:43.757166175Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/issuer","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/issuer (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.757183461Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/issuer","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.757190801Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/audience"}
|
||||
{"Time":"2026-10-18T00:15:43.757196473Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/audience","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/audience\n"}
|
||||
{"Time":"2026-10-18T00:15:43.757460714Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/audience","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/audience (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.757476296Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/audience","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.757482563Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/expired"}
|
||||
{"Time":"2026-10-18T00:15:43.757487378Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/expired","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/expired\n"}
|
||||
{"Time":"2026-10-18T00:15:43.757789979Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/expired","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/expired (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.757827301Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/expired","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.757834173Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-iat"}
|
||||
{"Time":"2026-10-18T00:15:43.757839466Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-iat","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/no-iat\n"}
|
||||
{"Time":"2026-10-18T00:15:43.758044536Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-iat","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/no-iat (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.758063382Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-iat","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.758072363Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-tenant"}
|
||||
{"Time":"2026-10-18T00:15:43.758077548Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-tenant","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/no-tenant\n"}
|
||||
{"Time":"2026-10-18T00:15:43.758425109Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-tenant","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/no-tenant (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.758449708Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-tenant","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.758460421Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-principal"}
|
||||
{"Time":"2026-10-18T00:15:43.758467012Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-principal","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/no-principal\n"}
|
||||
{"Time":"2026-10-18T00:15:43.758798694Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-principal","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/no-principal (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.758812409Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-principal","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.758817711Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-assurance"}
|
||||
{"Time":"2026-10-18T00:15:43.75882176Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-assurance","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/no-assurance\n"}
|
||||
{"Time":"2026-10-18T00:15:43.759075532Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-assurance","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/no-assurance (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.75908914Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-assurance","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.759094469Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/multi-audience-no-azp"}
|
||||
{"Time":"2026-10-18T00:15:43.759098445Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/multi-audience-no-azp","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/multi-audience-no-azp\n"}
|
||||
{"Time":"2026-10-18T00:15:43.75936596Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/multi-audience-no-azp","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/multi-audience-no-azp (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.75937926Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/multi-audience-no-azp","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.759385104Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/future-issued"}
|
||||
{"Time":"2026-10-18T00:15:43.75938908Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/future-issued","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/future-issued\n"}
|
||||
{"Time":"2026-10-18T00:15:43.759630138Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/future-issued","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/future-issued (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.759641807Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/future-issued","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.759660842Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/old-issued"}
|
||||
{"Time":"2026-10-18T00:15:43.75966829Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/old-issued","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/old-issued\n"}
|
||||
{"Time":"2026-10-18T00:15:43.7599331Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/old-issued","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/old-issued (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.759945625Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/old-issued","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.759952758Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-exp"}
|
||||
{"Time":"2026-10-18T00:15:43.759956806Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-exp","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/no-exp\n"}
|
||||
{"Time":"2026-10-18T00:15:43.760238316Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-exp","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/no-exp (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.760252843Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/no-exp","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.760260029Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/empty-subject"}
|
||||
{"Time":"2026-10-18T00:15:43.760266386Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/empty-subject","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/empty-subject\n"}
|
||||
{"Time":"2026-10-18T00:15:43.760524911Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/empty-subject","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/empty-subject (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.760554397Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/empty-subject","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.760580448Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/wrong-key"}
|
||||
{"Time":"2026-10-18T00:15:43.760588013Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/wrong-key","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/wrong-key\n"}
|
||||
{"Time":"2026-10-18T00:15:43.76089845Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/wrong-key","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/wrong-key (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.760916025Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/wrong-key","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.760922436Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/unknown-key"}
|
||||
{"Time":"2026-10-18T00:15:43.760927305Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/unknown-key","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/unknown-key\n"}
|
||||
{"Time":"2026-10-18T00:15:43.76110452Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/unknown-key","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/unknown-key (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.761136036Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/unknown-key","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.761143322Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/wrong-type"}
|
||||
{"Time":"2026-10-18T00:15:43.76115004Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/wrong-type","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/wrong-type\n"}
|
||||
{"Time":"2026-10-18T00:15:43.761296808Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/wrong-type","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/wrong-type (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.761319216Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/wrong-type","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.761402884Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/algorithm-confusion"}
|
||||
{"Time":"2026-10-18T00:15:43.761419386Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/algorithm-confusion","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/algorithm-confusion\n"}
|
||||
{"Time":"2026-10-18T00:15:43.76153744Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/algorithm-confusion","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/algorithm-confusion (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.761562355Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/algorithm-confusion","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.761574879Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/none"}
|
||||
{"Time":"2026-10-18T00:15:43.76158478Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/none","Output":"=== RUN TestVerifiedApplicationIdentityActualJOSE/none\n"}
|
||||
{"Time":"2026-10-18T00:15:43.761750267Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/none","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE/none (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.761768166Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE/none","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.761775705Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE","Output":"--- PASS: TestVerifiedApplicationIdentityActualJOSE (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.761782287Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestVerifiedApplicationIdentityActualJOSE","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:15:43.761893856Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestRequiredClaimExactAnyOfAndNoMutation"}
|
||||
{"Time":"2026-10-18T00:15:43.761907553Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestRequiredClaimExactAnyOfAndNoMutation","Output":"=== RUN TestRequiredClaimExactAnyOfAndNoMutation\n"}
|
||||
{"Time":"2026-10-18T00:15:43.762048661Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestRequiredClaimExactAnyOfAndNoMutation","Output":"--- PASS: TestRequiredClaimExactAnyOfAndNoMutation (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.762077453Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestRequiredClaimExactAnyOfAndNoMutation","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.762118698Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestRequiredClaimConfigurationRefusalsAndLegacyIsolation"}
|
||||
{"Time":"2026-10-18T00:15:43.76213272Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestRequiredClaimConfigurationRefusalsAndLegacyIsolation","Output":"=== RUN TestRequiredClaimConfigurationRefusalsAndLegacyIsolation\n"}
|
||||
{"Time":"2026-10-18T00:15:43.762153811Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestRequiredClaimConfigurationRefusalsAndLegacyIsolation","Output":"--- PASS: TestRequiredClaimConfigurationRefusalsAndLegacyIsolation (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.762219637Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestRequiredClaimConfigurationRefusalsAndLegacyIsolation","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.762242974Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoGuardRejectsMissingMalformedAndUnavailable"}
|
||||
{"Time":"2026-10-18T00:15:43.762259358Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoGuardRejectsMissingMalformedAndUnavailable","Output":"=== RUN TestCurrentUserInfoGuardRejectsMissingMalformedAndUnavailable\n"}
|
||||
{"Time":"2026-10-18T00:15:43.766075105Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoGuardRejectsMissingMalformedAndUnavailable","Output":"--- PASS: TestCurrentUserInfoGuardRejectsMissingMalformedAndUnavailable (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.766130967Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoGuardRejectsMissingMalformedAndUnavailable","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.766145665Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoEmptyArrayOverwritesAndGroupRemoval"}
|
||||
{"Time":"2026-10-18T00:15:43.766152735Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoEmptyArrayOverwritesAndGroupRemoval","Output":"=== RUN TestCurrentUserInfoEmptyArrayOverwritesAndGroupRemoval\n"}
|
||||
{"Time":"2026-10-18T00:15:43.766163528Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoEmptyArrayOverwritesAndGroupRemoval","Output":"--- PASS: TestCurrentUserInfoEmptyArrayOverwritesAndGroupRemoval (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.766184304Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoEmptyArrayOverwritesAndGroupRemoval","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.766289166Z","Action":"run","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoGuardIsOptInAndRedirectsRefuse"}
|
||||
{"Time":"2026-10-18T00:15:43.766302682Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoGuardIsOptInAndRedirectsRefuse","Output":"=== RUN TestCurrentUserInfoGuardIsOptInAndRedirectsRefuse\n"}
|
||||
{"Time":"2026-10-18T00:15:43.766313296Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoGuardIsOptInAndRedirectsRefuse","Output":"--- PASS: TestCurrentUserInfoGuardIsOptInAndRedirectsRefuse (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:15:43.766320113Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Test":"TestCurrentUserInfoGuardIsOptInAndRedirectsRefuse","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:15:43.766440845Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Output":"PASS\n"}
|
||||
{"Time":"2026-10-18T00:15:43.772654532Z","Action":"output","Package":"forgejo.org/services/auth/source/oauth2","Output":"ok \tforgejo.org/services/auth/source/oauth2\t0.197s\n"}
|
||||
{"Time":"2026-10-18T00:15:43.772706543Z","Action":"pass","Package":"forgejo.org/services/auth/source/oauth2","Elapsed":0.198}
|
||||
{"Time":"2026-10-18T00:16:03.440342138Z","Action":"start","Package":"forgejo.org/cmd"}
|
||||
{"Time":"2026-10-18T00:16:03.646190141Z","Action":"output","Package":"forgejo.org/cmd","Output":"2026/10/18 00:16:03 ...s/storage/storage.go:157:initAttachments() [I] Initialising Attachment storage with type: local\n"}
|
||||
{"Time":"2026-10-18T00:16:03.646282126Z","Action":"output","Package":"forgejo.org/cmd","Output":"2026/10/18 00:16:03 ...les/storage/local.go:33:NewLocalStorage() [I] Creating new Local Storage at /tmp/appdata3921882286/attachments\n"}
|
||||
{"Time":"2026-10-18T00:16:03.646293091Z","Action":"output","Package":"forgejo.org/cmd","Output":"2026/10/18 00:16:03 ...s/storage/storage.go:147:initAvatars() [I] Initialising Avatar storage with type: local\n"}
|
||||
{"Time":"2026-10-18T00:16:03.646298411Z","Action":"output","Package":"forgejo.org/cmd","Output":"2026/10/18 00:16:03 ...les/storage/local.go:33:NewLocalStorage() [I] Creating new Local Storage at /tmp/appdata3921882286/avatars\n"}
|
||||
{"Time":"2026-10-18T00:16:03.646303208Z","Action":"output","Package":"forgejo.org/cmd","Output":"2026/10/18 00:16:03 ...s/storage/storage.go:173:initRepoAvatars() [I] Initialising Repository Avatar storage with type: local\n"}
|
||||
{"Time":"2026-10-18T00:16:03.646308663Z","Action":"output","Package":"forgejo.org/cmd","Output":"2026/10/18 00:16:03 ...les/storage/local.go:33:NewLocalStorage() [I] Creating new Local Storage at /tmp/appdata3921882286/repo-avatars\n"}
|
||||
{"Time":"2026-10-18T00:16:03.646315444Z","Action":"output","Package":"forgejo.org/cmd","Output":"2026/10/18 00:16:03 ...s/storage/storage.go:179:initRepoArchives() [I] Initialising Repository Archive storage with type: local\n"}
|
||||
{"Time":"2026-10-18T00:16:03.646321847Z","Action":"output","Package":"forgejo.org/cmd","Output":"2026/10/18 00:16:03 ...les/storage/local.go:33:NewLocalStorage() [I] Creating new Local Storage at /tmp/appdata3921882286/repo-archive\n"}
|
||||
{"Time":"2026-10-18T00:16:03.646337915Z","Action":"output","Package":"forgejo.org/cmd","Output":"2026/10/18 00:16:03 ...s/storage/storage.go:189:initPackages() [I] Initialising Packages storage with type: local\n"}
|
||||
{"Time":"2026-10-18T00:16:03.646345535Z","Action":"output","Package":"forgejo.org/cmd","Output":"2026/10/18 00:16:03 ...les/storage/local.go:33:NewLocalStorage() [I] Creating new Local Storage at /tmp/appdata3921882286/packages\n"}
|
||||
{"Time":"2026-10-18T00:16:03.646351982Z","Action":"output","Package":"forgejo.org/cmd","Output":"2026/10/18 00:16:03 ...s/storage/storage.go:200:initActions() [I] Initialising Actions storage with type: local\n"}
|
||||
{"Time":"2026-10-18T00:16:03.646358998Z","Action":"output","Package":"forgejo.org/cmd","Output":"2026/10/18 00:16:03 ...les/storage/local.go:33:NewLocalStorage() [I] Creating new Local Storage at /tmp/appdata3921882286/actions_log\n"}
|
||||
{"Time":"2026-10-18T00:16:03.646378421Z","Action":"output","Package":"forgejo.org/cmd","Output":"2026/10/18 00:16:03 ...s/storage/storage.go:204:initActions() [I] Initialising ActionsArtifacts storage with type: local\n"}
|
||||
{"Time":"2026-10-18T00:16:03.646394345Z","Action":"output","Package":"forgejo.org/cmd","Output":"2026/10/18 00:16:03 ...les/storage/local.go:33:NewLocalStorage() [I] Creating new Local Storage at /tmp/go-build2892200762/b1034/data/actions_artifacts\n"}
|
||||
{"Time":"2026-10-18T00:16:03.788117665Z","Action":"run","Package":"forgejo.org/cmd","Test":"TestPrivateSecretMetadata"}
|
||||
{"Time":"2026-10-18T00:16:03.788180443Z","Action":"output","Package":"forgejo.org/cmd","Test":"TestPrivateSecretMetadata","Output":"=== RUN TestPrivateSecretMetadata\n"}
|
||||
{"Time":"2026-10-18T00:16:03.788200623Z","Action":"output","Package":"forgejo.org/cmd","Test":"TestPrivateSecretMetadata","Output":"--- PASS: TestPrivateSecretMetadata (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:16:03.788213275Z","Action":"pass","Package":"forgejo.org/cmd","Test":"TestPrivateSecretMetadata","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:16:03.788225718Z","Action":"run","Package":"forgejo.org/cmd","Test":"TestPrivateSecretOpenedFileReplacement"}
|
||||
{"Time":"2026-10-18T00:16:03.788231625Z","Action":"output","Package":"forgejo.org/cmd","Test":"TestPrivateSecretOpenedFileReplacement","Output":"=== RUN TestPrivateSecretOpenedFileReplacement\n"}
|
||||
{"Time":"2026-10-18T00:16:03.788270254Z","Action":"output","Package":"forgejo.org/cmd","Test":"TestPrivateSecretOpenedFileReplacement","Output":"--- PASS: TestPrivateSecretOpenedFileReplacement (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:16:03.788298803Z","Action":"pass","Package":"forgejo.org/cmd","Test":"TestPrivateSecretOpenedFileReplacement","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:16:03.788747818Z","Action":"output","Package":"forgejo.org/cmd","Output":"PASS\n"}
|
||||
{"Time":"2026-10-18T00:16:03.81110796Z","Action":"output","Package":"forgejo.org/cmd","Output":"ok \tforgejo.org/cmd\t0.371s\n"}
|
||||
{"Time":"2026-10-18T00:16:03.811162677Z","Action":"pass","Package":"forgejo.org/cmd","Elapsed":0.371}
|
||||
{"Time":"2026-10-18T00:16:07.646758443Z","Action":"start","Package":"forgejo.org/models/auth"}
|
||||
{"Time":"2026-10-18T00:16:07.791793795Z","Action":"output","Package":"forgejo.org/models/auth","Output":"2026/10/18 00:16:07 ...s/storage/storage.go:157:initAttachments() [I] Initialising Attachment storage with type: local\n"}
|
||||
{"Time":"2026-10-18T00:16:07.791886032Z","Action":"output","Package":"forgejo.org/models/auth","Output":"2026/10/18 00:16:07 ...les/storage/local.go:33:NewLocalStorage() [I] Creating new Local Storage at /tmp/appdata2283251498/attachments\n"}
|
||||
{"Time":"2026-10-18T00:16:07.791901939Z","Action":"output","Package":"forgejo.org/models/auth","Output":"2026/10/18 00:16:07 ...s/storage/storage.go:147:initAvatars() [I] Initialising Avatar storage with type: local\n"}
|
||||
{"Time":"2026-10-18T00:16:07.791913445Z","Action":"output","Package":"forgejo.org/models/auth","Output":"2026/10/18 00:16:07 ...les/storage/local.go:33:NewLocalStorage() [I] Creating new Local Storage at /tmp/appdata2283251498/avatars\n"}
|
||||
{"Time":"2026-10-18T00:16:07.791924067Z","Action":"output","Package":"forgejo.org/models/auth","Output":"2026/10/18 00:16:07 ...s/storage/storage.go:173:initRepoAvatars() [I] Initialising Repository Avatar storage with type: local\n"}
|
||||
{"Time":"2026-10-18T00:16:07.791936538Z","Action":"output","Package":"forgejo.org/models/auth","Output":"2026/10/18 00:16:07 ...les/storage/local.go:33:NewLocalStorage() [I] Creating new Local Storage at /tmp/appdata2283251498/repo-avatars\n"}
|
||||
{"Time":"2026-10-18T00:16:07.791946881Z","Action":"output","Package":"forgejo.org/models/auth","Output":"2026/10/18 00:16:07 ...s/storage/storage.go:179:initRepoArchives() [I] Initialising Repository Archive storage with type: local\n"}
|
||||
{"Time":"2026-10-18T00:16:07.79195652Z","Action":"output","Package":"forgejo.org/models/auth","Output":"2026/10/18 00:16:07 ...les/storage/local.go:33:NewLocalStorage() [I] Creating new Local Storage at /tmp/appdata2283251498/repo-archive\n"}
|
||||
{"Time":"2026-10-18T00:16:07.791965645Z","Action":"output","Package":"forgejo.org/models/auth","Output":"2026/10/18 00:16:07 ...s/storage/storage.go:189:initPackages() [I] Initialising Packages storage with type: local\n"}
|
||||
{"Time":"2026-10-18T00:16:07.791978856Z","Action":"output","Package":"forgejo.org/models/auth","Output":"2026/10/18 00:16:07 ...les/storage/local.go:33:NewLocalStorage() [I] Creating new Local Storage at /tmp/appdata2283251498/packages\n"}
|
||||
{"Time":"2026-10-18T00:16:07.791989036Z","Action":"output","Package":"forgejo.org/models/auth","Output":"2026/10/18 00:16:07 ...s/storage/storage.go:200:initActions() [I] Initialising Actions storage with type: local\n"}
|
||||
{"Time":"2026-10-18T00:16:07.791998982Z","Action":"output","Package":"forgejo.org/models/auth","Output":"2026/10/18 00:16:07 ...les/storage/local.go:33:NewLocalStorage() [I] Creating new Local Storage at /tmp/appdata2283251498/actions_log\n"}
|
||||
{"Time":"2026-10-18T00:16:07.79200845Z","Action":"output","Package":"forgejo.org/models/auth","Output":"2026/10/18 00:16:07 ...s/storage/storage.go:204:initActions() [I] Initialising ActionsArtifacts storage with type: local\n"}
|
||||
{"Time":"2026-10-18T00:16:07.792021841Z","Action":"output","Package":"forgejo.org/models/auth","Output":"2026/10/18 00:16:07 ...les/storage/local.go:33:NewLocalStorage() [I] Creating new Local Storage at /tmp/go-build2892200762/b1314/data/actions_artifacts\n"}
|
||||
{"Time":"2026-10-18T00:16:07.887790393Z","Action":"run","Package":"forgejo.org/models/auth","Test":"TestSourceOperationDatabaseWriterExclusion"}
|
||||
{"Time":"2026-10-18T00:16:07.887848591Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationDatabaseWriterExclusion","Output":"=== RUN TestSourceOperationDatabaseWriterExclusion\n"}
|
||||
{"Time":"2026-10-18T00:16:07.988905121Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationDatabaseWriterExclusion","Output":"--- PASS: TestSourceOperationDatabaseWriterExclusion (0.10s)\n"}
|
||||
{"Time":"2026-10-18T00:16:07.988948143Z","Action":"pass","Package":"forgejo.org/models/auth","Test":"TestSourceOperationDatabaseWriterExclusion","Elapsed":0.1}
|
||||
{"Time":"2026-10-18T00:16:07.988958449Z","Action":"run","Package":"forgejo.org/models/auth","Test":"TestSourceOperationRefusesActualXORMArgumentLogging"}
|
||||
{"Time":"2026-10-18T00:16:07.988962733Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationRefusesActualXORMArgumentLogging","Output":"=== RUN TestSourceOperationRefusesActualXORMArgumentLogging\n"}
|
||||
{"Time":"2026-10-18T00:16:07.98915366Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationRefusesActualXORMArgumentLogging","Output":"[xorm] [info] 2026/10/18 00:16:07.989063 [SQL] BEGIN TRANSACTION [] - 47.034µs\n"}
|
||||
{"Time":"2026-10-18T00:16:07.989170143Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationRefusesActualXORMArgumentLogging","Output":"[xorm] [info] 2026/10/18 00:16:07.989116 [SQL] ROLLBACK [] - 13.445µs\n"}
|
||||
{"Time":"2026-10-18T00:16:07.989177727Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationRefusesActualXORMArgumentLogging","Output":"--- PASS: TestSourceOperationRefusesActualXORMArgumentLogging (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:16:07.989182641Z","Action":"pass","Package":"forgejo.org/models/auth","Test":"TestSourceOperationRefusesActualXORMArgumentLogging","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:16:07.990168605Z","Action":"run","Package":"forgejo.org/models/auth","Test":"TestSourceOperationProcessRecovery"}
|
||||
{"Time":"2026-10-18T00:16:07.990181311Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationProcessRecovery","Output":"=== RUN TestSourceOperationProcessRecovery\n"}
|
||||
{"Time":"2026-10-18T00:16:09.750143033Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationProcessRecovery","Output":"--- PASS: TestSourceOperationProcessRecovery (1.76s)\n"}
|
||||
{"Time":"2026-10-18T00:16:09.750188822Z","Action":"pass","Package":"forgejo.org/models/auth","Test":"TestSourceOperationProcessRecovery","Elapsed":1.76}
|
||||
{"Time":"2026-10-18T00:16:09.750201663Z","Action":"run","Package":"forgejo.org/models/auth","Test":"TestSourceOperationCreateAndInverse"}
|
||||
{"Time":"2026-10-18T00:16:09.750207587Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationCreateAndInverse","Output":"=== RUN TestSourceOperationCreateAndInverse\n"}
|
||||
{"Time":"2026-10-18T00:16:09.773066493Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationCreateAndInverse","Output":"--- PASS: TestSourceOperationCreateAndInverse (0.02s)\n"}
|
||||
{"Time":"2026-10-18T00:16:09.773118297Z","Action":"pass","Package":"forgejo.org/models/auth","Test":"TestSourceOperationCreateAndInverse","Elapsed":0.02}
|
||||
{"Time":"2026-10-18T00:16:09.773127711Z","Action":"run","Package":"forgejo.org/models/auth","Test":"TestSourceOperationRestoresExactRawPreexisting"}
|
||||
{"Time":"2026-10-18T00:16:09.773132193Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationRestoresExactRawPreexisting","Output":"=== RUN TestSourceOperationRestoresExactRawPreexisting\n"}
|
||||
{"Time":"2026-10-18T00:16:09.792689764Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationRestoresExactRawPreexisting","Output":"--- PASS: TestSourceOperationRestoresExactRawPreexisting (0.02s)\n"}
|
||||
{"Time":"2026-10-18T00:16:09.792745508Z","Action":"pass","Package":"forgejo.org/models/auth","Test":"TestSourceOperationRestoresExactRawPreexisting","Elapsed":0.02}
|
||||
{"Time":"2026-10-18T00:16:09.792780901Z","Action":"run","Package":"forgejo.org/models/auth","Test":"TestSourceOperationUnchangedNeverDeletesPreexisting"}
|
||||
{"Time":"2026-10-18T00:16:09.792789179Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationUnchangedNeverDeletesPreexisting","Output":"=== RUN TestSourceOperationUnchangedNeverDeletesPreexisting\n"}
|
||||
{"Time":"2026-10-18T00:16:09.812408416Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationUnchangedNeverDeletesPreexisting","Output":"--- PASS: TestSourceOperationUnchangedNeverDeletesPreexisting (0.02s)\n"}
|
||||
{"Time":"2026-10-18T00:16:09.812453421Z","Action":"pass","Package":"forgejo.org/models/auth","Test":"TestSourceOperationUnchangedNeverDeletesPreexisting","Elapsed":0.02}
|
||||
{"Time":"2026-10-18T00:16:09.812461916Z","Action":"run","Package":"forgejo.org/models/auth","Test":"TestSourceOperationPrivateDriftRefuses"}
|
||||
{"Time":"2026-10-18T00:16:09.812466749Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationPrivateDriftRefuses","Output":"=== RUN TestSourceOperationPrivateDriftRefuses\n"}
|
||||
{"Time":"2026-10-18T00:16:09.812666349Z","Action":"run","Package":"forgejo.org/models/auth","Test":"TestSourceOperationPrivateDriftRefuses/before-apply"}
|
||||
{"Time":"2026-10-18T00:16:09.81270065Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationPrivateDriftRefuses/before-apply","Output":"=== RUN TestSourceOperationPrivateDriftRefuses/before-apply\n"}
|
||||
{"Time":"2026-10-18T00:16:09.828603572Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationPrivateDriftRefuses/before-apply","Output":"--- PASS: TestSourceOperationPrivateDriftRefuses/before-apply (0.02s)\n"}
|
||||
{"Time":"2026-10-18T00:16:09.828651309Z","Action":"pass","Package":"forgejo.org/models/auth","Test":"TestSourceOperationPrivateDriftRefuses/before-apply","Elapsed":0.02}
|
||||
{"Time":"2026-10-18T00:16:09.82865956Z","Action":"run","Package":"forgejo.org/models/auth","Test":"TestSourceOperationPrivateDriftRefuses/before-inverse"}
|
||||
{"Time":"2026-10-18T00:16:09.828664204Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationPrivateDriftRefuses/before-inverse","Output":"=== RUN TestSourceOperationPrivateDriftRefuses/before-inverse\n"}
|
||||
{"Time":"2026-10-18T00:16:09.848138125Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationPrivateDriftRefuses/before-inverse","Output":"--- PASS: TestSourceOperationPrivateDriftRefuses/before-inverse (0.02s)\n"}
|
||||
{"Time":"2026-10-18T00:16:09.848202977Z","Action":"pass","Package":"forgejo.org/models/auth","Test":"TestSourceOperationPrivateDriftRefuses/before-inverse","Elapsed":0.02}
|
||||
{"Time":"2026-10-18T00:16:09.848212274Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationPrivateDriftRefuses","Output":"--- PASS: TestSourceOperationPrivateDriftRefuses (0.04s)\n"}
|
||||
{"Time":"2026-10-18T00:16:09.848217612Z","Action":"pass","Package":"forgejo.org/models/auth","Test":"TestSourceOperationPrivateDriftRefuses","Elapsed":0.04}
|
||||
{"Time":"2026-10-18T00:16:09.848226052Z","Action":"run","Package":"forgejo.org/models/auth","Test":"TestSourceOperationStockCRUDDriftRefuses"}
|
||||
{"Time":"2026-10-18T00:16:09.848231003Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationStockCRUDDriftRefuses","Output":"=== RUN TestSourceOperationStockCRUDDriftRefuses\n"}
|
||||
{"Time":"2026-10-18T00:16:09.868145825Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationStockCRUDDriftRefuses","Output":"--- PASS: TestSourceOperationStockCRUDDriftRefuses (0.02s)\n"}
|
||||
{"Time":"2026-10-18T00:16:09.868200605Z","Action":"pass","Package":"forgejo.org/models/auth","Test":"TestSourceOperationStockCRUDDriftRefuses","Elapsed":0.02}
|
||||
{"Time":"2026-10-18T00:16:09.868212499Z","Action":"run","Package":"forgejo.org/models/auth","Test":"TestSourceOperationLinkedSourceRefusesDeletion"}
|
||||
{"Time":"2026-10-18T00:16:09.868219Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationLinkedSourceRefusesDeletion","Output":"=== RUN TestSourceOperationLinkedSourceRefusesDeletion\n"}
|
||||
{"Time":"2026-10-18T00:16:09.868238883Z","Action":"run","Package":"forgejo.org/models/auth","Test":"TestSourceOperationLinkedSourceRefusesDeletion/user"}
|
||||
{"Time":"2026-10-18T00:16:09.868242553Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationLinkedSourceRefusesDeletion/user","Output":"=== RUN TestSourceOperationLinkedSourceRefusesDeletion/user\n"}
|
||||
{"Time":"2026-10-18T00:16:09.885068632Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationLinkedSourceRefusesDeletion/user","Output":"--- PASS: TestSourceOperationLinkedSourceRefusesDeletion/user (0.02s)\n"}
|
||||
{"Time":"2026-10-18T00:16:09.885109741Z","Action":"pass","Package":"forgejo.org/models/auth","Test":"TestSourceOperationLinkedSourceRefusesDeletion/user","Elapsed":0.02}
|
||||
{"Time":"2026-10-18T00:16:09.88512003Z","Action":"run","Package":"forgejo.org/models/auth","Test":"TestSourceOperationLinkedSourceRefusesDeletion/external"}
|
||||
{"Time":"2026-10-18T00:16:09.885125287Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationLinkedSourceRefusesDeletion/external","Output":"=== RUN TestSourceOperationLinkedSourceRefusesDeletion/external\n"}
|
||||
{"Time":"2026-10-18T00:16:09.901962868Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationLinkedSourceRefusesDeletion/external","Output":"--- PASS: TestSourceOperationLinkedSourceRefusesDeletion/external (0.02s)\n"}
|
||||
{"Time":"2026-10-18T00:16:09.902024303Z","Action":"pass","Package":"forgejo.org/models/auth","Test":"TestSourceOperationLinkedSourceRefusesDeletion/external","Elapsed":0.02}
|
||||
{"Time":"2026-10-18T00:16:09.902037658Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationLinkedSourceRefusesDeletion","Output":"--- PASS: TestSourceOperationLinkedSourceRefusesDeletion (0.03s)\n"}
|
||||
{"Time":"2026-10-18T00:16:09.902045457Z","Action":"pass","Package":"forgejo.org/models/auth","Test":"TestSourceOperationLinkedSourceRefusesDeletion","Elapsed":0.03}
|
||||
{"Time":"2026-10-18T00:16:09.90206002Z","Action":"run","Package":"forgejo.org/models/auth","Test":"TestSourceOperationPreparedCancellationAndIDReuse"}
|
||||
{"Time":"2026-10-18T00:16:09.902072681Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationPreparedCancellationAndIDReuse","Output":"=== RUN TestSourceOperationPreparedCancellationAndIDReuse\n"}
|
||||
{"Time":"2026-10-18T00:16:09.920990725Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationPreparedCancellationAndIDReuse","Output":"--- PASS: TestSourceOperationPreparedCancellationAndIDReuse (0.02s)\n"}
|
||||
{"Time":"2026-10-18T00:16:09.921036425Z","Action":"pass","Package":"forgejo.org/models/auth","Test":"TestSourceOperationPreparedCancellationAndIDReuse","Elapsed":0.02}
|
||||
{"Time":"2026-10-18T00:16:09.921048093Z","Action":"run","Package":"forgejo.org/models/auth","Test":"TestSourceOperationRejectsUnsafeRuntime"}
|
||||
{"Time":"2026-10-18T00:16:09.921056885Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationRejectsUnsafeRuntime","Output":"=== RUN TestSourceOperationRejectsUnsafeRuntime\n"}
|
||||
{"Time":"2026-10-18T00:16:09.937535281Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationRejectsUnsafeRuntime","Output":"--- PASS: TestSourceOperationRejectsUnsafeRuntime (0.02s)\n"}
|
||||
{"Time":"2026-10-18T00:16:09.937580061Z","Action":"pass","Package":"forgejo.org/models/auth","Test":"TestSourceOperationRejectsUnsafeRuntime","Elapsed":0.02}
|
||||
{"Time":"2026-10-18T00:16:09.937597401Z","Action":"run","Package":"forgejo.org/models/auth","Test":"TestSourceOperationRefusesSharedManagedSource"}
|
||||
{"Time":"2026-10-18T00:16:09.937602216Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationRefusesSharedManagedSource","Output":"=== RUN TestSourceOperationRefusesSharedManagedSource\n"}
|
||||
{"Time":"2026-10-18T00:16:09.953721111Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationRefusesSharedManagedSource","Output":"--- PASS: TestSourceOperationRefusesSharedManagedSource (0.02s)\n"}
|
||||
{"Time":"2026-10-18T00:16:09.953803285Z","Action":"pass","Package":"forgejo.org/models/auth","Test":"TestSourceOperationRefusesSharedManagedSource","Elapsed":0.02}
|
||||
{"Time":"2026-10-18T00:16:09.953813501Z","Action":"run","Package":"forgejo.org/models/auth","Test":"TestSourceOperationBoundsPrivateJournalCustody"}
|
||||
{"Time":"2026-10-18T00:16:09.953818957Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationBoundsPrivateJournalCustody","Output":"=== RUN TestSourceOperationBoundsPrivateJournalCustody\n"}
|
||||
{"Time":"2026-10-18T00:16:09.969487139Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationBoundsPrivateJournalCustody","Output":"--- PASS: TestSourceOperationBoundsPrivateJournalCustody (0.02s)\n"}
|
||||
{"Time":"2026-10-18T00:16:09.969533605Z","Action":"pass","Package":"forgejo.org/models/auth","Test":"TestSourceOperationBoundsPrivateJournalCustody","Elapsed":0.02}
|
||||
{"Time":"2026-10-18T00:16:09.969542712Z","Action":"run","Package":"forgejo.org/models/auth","Test":"TestSourceOperationRequiresExactPostState"}
|
||||
{"Time":"2026-10-18T00:16:09.969548186Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationRequiresExactPostState","Output":"=== RUN TestSourceOperationRequiresExactPostState\n"}
|
||||
{"Time":"2026-10-18T00:16:09.988705955Z","Action":"output","Package":"forgejo.org/models/auth","Test":"TestSourceOperationRequiresExactPostState","Output":"--- PASS: TestSourceOperationRequiresExactPostState (0.02s)\n"}
|
||||
{"Time":"2026-10-18T00:16:09.988752348Z","Action":"pass","Package":"forgejo.org/models/auth","Test":"TestSourceOperationRequiresExactPostState","Elapsed":0.02}
|
||||
{"Time":"2026-10-18T00:16:09.989169316Z","Action":"output","Package":"forgejo.org/models/auth","Output":"PASS\n"}
|
||||
{"Time":"2026-10-18T00:16:10.01551221Z","Action":"output","Package":"forgejo.org/models/auth","Output":"ok \tforgejo.org/models/auth\t2.369s\n"}
|
||||
{"Time":"2026-10-18T00:16:10.015557332Z","Action":"pass","Package":"forgejo.org/models/auth","Elapsed":2.3689999999999998}
|
||||
{"Time":"2026-10-18T00:16:31.880928791Z","Action":"start","Package":"forgejo.org/models/db"}
|
||||
{"Time":"2026-10-18T00:16:32.249398731Z","Action":"output","Package":"forgejo.org/models/db","Output":"2026/10/18 00:16:32 ...s/storage/storage.go:157:initAttachments() [I] Initialising Attachment storage with type: local\n"}
|
||||
{"Time":"2026-10-18T00:16:32.249570041Z","Action":"output","Package":"forgejo.org/models/db","Output":"2026/10/18 00:16:32 ...les/storage/local.go:33:NewLocalStorage() [I] Creating new Local Storage at /tmp/appdata2863400786/attachments\n"}
|
||||
{"Time":"2026-10-18T00:16:32.249587498Z","Action":"output","Package":"forgejo.org/models/db","Output":"2026/10/18 00:16:32 ...s/storage/storage.go:147:initAvatars() [I] Initialising Avatar storage with type: local\n"}
|
||||
{"Time":"2026-10-18T00:16:32.249601809Z","Action":"output","Package":"forgejo.org/models/db","Output":"2026/10/18 00:16:32 ...les/storage/local.go:33:NewLocalStorage() [I] Creating new Local Storage at /tmp/appdata2863400786/avatars\n"}
|
||||
{"Time":"2026-10-18T00:16:32.249611069Z","Action":"output","Package":"forgejo.org/models/db","Output":"2026/10/18 00:16:32 ...s/storage/storage.go:173:initRepoAvatars() [I] Initialising Repository Avatar storage with type: local\n"}
|
||||
{"Time":"2026-10-18T00:16:32.249619753Z","Action":"output","Package":"forgejo.org/models/db","Output":"2026/10/18 00:16:32 ...les/storage/local.go:33:NewLocalStorage() [I] Creating new Local Storage at /tmp/appdata2863400786/repo-avatars\n"}
|
||||
{"Time":"2026-10-18T00:16:32.249628951Z","Action":"output","Package":"forgejo.org/models/db","Output":"2026/10/18 00:16:32 ...s/storage/storage.go:179:initRepoArchives() [I] Initialising Repository Archive storage with type: local\n"}
|
||||
{"Time":"2026-10-18T00:16:32.249637265Z","Action":"output","Package":"forgejo.org/models/db","Output":"2026/10/18 00:16:32 ...les/storage/local.go:33:NewLocalStorage() [I] Creating new Local Storage at /tmp/appdata2863400786/repo-archive\n"}
|
||||
{"Time":"2026-10-18T00:16:32.249661295Z","Action":"output","Package":"forgejo.org/models/db","Output":"2026/10/18 00:16:32 ...s/storage/storage.go:189:initPackages() [I] Initialising Packages storage with type: local\n"}
|
||||
{"Time":"2026-10-18T00:16:32.249668347Z","Action":"output","Package":"forgejo.org/models/db","Output":"2026/10/18 00:16:32 ...les/storage/local.go:33:NewLocalStorage() [I] Creating new Local Storage at /tmp/appdata2863400786/packages\n"}
|
||||
{"Time":"2026-10-18T00:16:32.249741747Z","Action":"output","Package":"forgejo.org/models/db","Output":"2026/10/18 00:16:32 ...s/storage/storage.go:200:initActions() [I] Initialising Actions storage with type: local\n"}
|
||||
{"Time":"2026-10-18T00:16:32.24975833Z","Action":"output","Package":"forgejo.org/models/db","Output":"2026/10/18 00:16:32 ...les/storage/local.go:33:NewLocalStorage() [I] Creating new Local Storage at /tmp/appdata2863400786/actions_log\n"}
|
||||
{"Time":"2026-10-18T00:16:32.249765183Z","Action":"output","Package":"forgejo.org/models/db","Output":"2026/10/18 00:16:32 ...s/storage/storage.go:204:initActions() [I] Initialising ActionsArtifacts storage with type: local\n"}
|
||||
{"Time":"2026-10-18T00:16:32.249774228Z","Action":"output","Package":"forgejo.org/models/db","Output":"2026/10/18 00:16:32 ...les/storage/local.go:33:NewLocalStorage() [I] Creating new Local Storage at /tmp/go-build2892200762/b1335/data/actions_artifacts\n"}
|
||||
{"Time":"2026-10-18T00:16:32.434709746Z","Action":"run","Package":"forgejo.org/models/db","Test":"TestSensitiveSQLLoggingChecksUnderlyingEngine"}
|
||||
{"Time":"2026-10-18T00:16:32.434778421Z","Action":"output","Package":"forgejo.org/models/db","Test":"TestSensitiveSQLLoggingChecksUnderlyingEngine","Output":"=== RUN TestSensitiveSQLLoggingChecksUnderlyingEngine\n"}
|
||||
{"Time":"2026-10-18T00:16:32.434817601Z","Action":"run","Package":"forgejo.org/models/db","Test":"TestSensitiveSQLLoggingChecksUnderlyingEngine/engine"}
|
||||
{"Time":"2026-10-18T00:16:32.434825581Z","Action":"output","Package":"forgejo.org/models/db","Test":"TestSensitiveSQLLoggingChecksUnderlyingEngine/engine","Output":"=== RUN TestSensitiveSQLLoggingChecksUnderlyingEngine/engine\n"}
|
||||
{"Time":"2026-10-18T00:16:32.434913175Z","Action":"output","Package":"forgejo.org/models/db","Test":"TestSensitiveSQLLoggingChecksUnderlyingEngine/engine","Output":"--- PASS: TestSensitiveSQLLoggingChecksUnderlyingEngine/engine (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:16:32.43494029Z","Action":"pass","Package":"forgejo.org/models/db","Test":"TestSensitiveSQLLoggingChecksUnderlyingEngine/engine","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:16:32.434960471Z","Action":"run","Package":"forgejo.org/models/db","Test":"TestSensitiveSQLLoggingChecksUnderlyingEngine/session"}
|
||||
{"Time":"2026-10-18T00:16:32.43497048Z","Action":"output","Package":"forgejo.org/models/db","Test":"TestSensitiveSQLLoggingChecksUnderlyingEngine/session","Output":"=== RUN TestSensitiveSQLLoggingChecksUnderlyingEngine/session\n"}
|
||||
{"Time":"2026-10-18T00:16:32.435015187Z","Action":"output","Package":"forgejo.org/models/db","Test":"TestSensitiveSQLLoggingChecksUnderlyingEngine/session","Output":"--- PASS: TestSensitiveSQLLoggingChecksUnderlyingEngine/session (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:16:32.435030426Z","Action":"pass","Package":"forgejo.org/models/db","Test":"TestSensitiveSQLLoggingChecksUnderlyingEngine/session","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:16:32.435045999Z","Action":"output","Package":"forgejo.org/models/db","Test":"TestSensitiveSQLLoggingChecksUnderlyingEngine","Output":"--- PASS: TestSensitiveSQLLoggingChecksUnderlyingEngine (0.00s)\n"}
|
||||
{"Time":"2026-10-18T00:16:32.435057045Z","Action":"pass","Package":"forgejo.org/models/db","Test":"TestSensitiveSQLLoggingChecksUnderlyingEngine","Elapsed":0}
|
||||
{"Time":"2026-10-18T00:16:32.435356721Z","Action":"run","Package":"forgejo.org/models/db","Test":"TestSensitiveSQLHooks"}
|
||||
{"Time":"2026-10-18T00:16:32.43538637Z","Action":"output","Package":"forgejo.org/models/db","Test":"TestSensitiveSQLHooks","Output":"=== RUN TestSensitiveSQLHooks\n"}
|
||||
{"Time":"2026-10-18T00:16:32.441406542Z","Action":"output","Package":"forgejo.org/models/db","Test":"TestSensitiveSQLHooks","Output":"--- PASS: TestSensitiveSQLHooks (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:16:32.44153327Z","Action":"pass","Package":"forgejo.org/models/db","Test":"TestSensitiveSQLHooks","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:16:32.441551746Z","Action":"run","Package":"forgejo.org/models/db","Test":"TestSensitiveSQLActualContextPropagation"}
|
||||
{"Time":"2026-10-18T00:16:32.441557112Z","Action":"output","Package":"forgejo.org/models/db","Test":"TestSensitiveSQLActualContextPropagation","Output":"=== RUN TestSensitiveSQLActualContextPropagation\n"}
|
||||
{"Time":"2026-10-18T00:16:32.447687295Z","Action":"output","Package":"forgejo.org/models/db","Test":"TestSensitiveSQLActualContextPropagation","Output":"--- PASS: TestSensitiveSQLActualContextPropagation (0.01s)\n"}
|
||||
{"Time":"2026-10-18T00:16:32.447730424Z","Action":"pass","Package":"forgejo.org/models/db","Test":"TestSensitiveSQLActualContextPropagation","Elapsed":0.01}
|
||||
{"Time":"2026-10-18T00:16:32.448526539Z","Action":"output","Package":"forgejo.org/models/db","Output":"PASS\n"}
|
||||
{"Time":"2026-10-18T00:16:32.492991898Z","Action":"output","Package":"forgejo.org/models/db","Output":"ok \tforgejo.org/models/db\t0.611s\n"}
|
||||
{"Time":"2026-10-18T00:16:32.493097562Z","Action":"pass","Package":"forgejo.org/models/db","Elapsed":0.612}
|
||||
|
|
@ -0,0 +1,131 @@
|
|||
package oauth2
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"os"
|
||||
"sync/atomic"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/markbates/goth"
|
||||
"github.com/markbates/goth/gothic"
|
||||
"github.com/markbates/goth/providers/openidConnect"
|
||||
)
|
||||
|
||||
func TestAccessEngineActualKeyCapeIssuer(t *testing.T) {
|
||||
raw, err := os.ReadFile(os.Getenv("CUSTODIAN_SYNTHETIC_IDENTITY_FIXTURE"))
|
||||
if err != nil {
|
||||
t.Fatal("actual issuer fixture unavailable")
|
||||
}
|
||||
var fixture struct {
|
||||
Token string `json:"id_token"`
|
||||
Key string `json:"public_key_pem"`
|
||||
Kid string `json:"kid"`
|
||||
Issuer string `json:"issuer"`
|
||||
Audience string `json:"audience"`
|
||||
}
|
||||
if json.Unmarshal(raw, &fixture) != nil {
|
||||
t.Fatal("actual issuer fixture malformed")
|
||||
}
|
||||
admission, _, _, _ := identityFixture(t)
|
||||
admission.Issuer = fixture.Issuer
|
||||
admission.Audience = fixture.Audience
|
||||
admission.AssuranceClaim = "assurance"
|
||||
admission.Algorithms = []string{"RS256"}
|
||||
admission.IdentityKeys = map[string]string{fixture.Kid: fixture.Key}
|
||||
identity, err := VerifyApplicationIdentity(fixture.Token, admission, time.Now().UTC())
|
||||
if err != nil {
|
||||
t.Fatal("actual KeyCape token rejected by consumer", err)
|
||||
}
|
||||
if identity.Subject != "user:synthetic" || identity.Tenant != "tenant:synthetic" || identity.Assurance != "aal2" {
|
||||
t.Fatal("actual issuer identity snapshot mismatch")
|
||||
}
|
||||
if identity.TenantSource != "directory" || identity.AssuranceData["source"] != "key-cape" || identity.AssuranceData["mfa"] != true || identity.AuthenticatedAt.IsZero() {
|
||||
t.Fatal("actual issuer assurance or tenant provenance lost")
|
||||
}
|
||||
for _, mode := range []string{"allow", "deny"} {
|
||||
t.Run(mode, func(t *testing.T) {
|
||||
source, user, calls := callbackFixtureWithIdentity(t, "forge-admins", mode, &admission, fixture.Token)
|
||||
user.RawData["assurance"] = map[string]any{"level": "aal1", "source": "attacker"}
|
||||
user.RawData["tenant_source"] = "attacker"
|
||||
got, err := source.Callback(httptest.NewRequest(http.MethodGet, "https://forgejo.invalid/callback", nil), httptest.NewRecorder(), "")
|
||||
if calls.Load() != 1 || (mode == "allow" && (err != nil || got.UserID != user.UserID)) || (mode == "deny" && (err == nil || got.UserID != "" || got.IDToken != "")) {
|
||||
t.Fatalf("actual issuer callback failed decision enforcement: mode=%s requests=%d err=%v", mode, calls.Load(), err)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// The real provider creation/discovery, response guard and Goth FetchUser run.
|
||||
// Only the browser's completed authorization-code session is synthetic. The ID
|
||||
// token is unchanged output of the actual KeyCape handler fixture.
|
||||
func TestAccessEngineActualKeyCapeProviderUserInfo(t *testing.T) {
|
||||
var fixture struct {
|
||||
Token string `json:"id_token"`
|
||||
Key string `json:"public_key_pem"`
|
||||
Kid string `json:"kid"`
|
||||
Issuer string `json:"issuer"`
|
||||
Audience string `json:"audience"`
|
||||
}
|
||||
raw, err := os.ReadFile(os.Getenv("CUSTODIAN_SYNTHETIC_IDENTITY_FIXTURE"))
|
||||
if err != nil || json.Unmarshal(raw, &fixture) != nil {
|
||||
t.Fatal("actual issuer fixture unavailable")
|
||||
}
|
||||
for _, mode := range []string{"allow", "missing-groups", "missing-subject", "wrong-subject", "malformed-groups"} {
|
||||
t.Run(mode, func(t *testing.T) {
|
||||
admission, _, _, _ := identityFixture(t)
|
||||
admission.Issuer, admission.Audience = fixture.Issuer, fixture.Audience
|
||||
admission.Algorithms = []string{"RS256"}
|
||||
admission.IdentityKeys = map[string]string{fixture.Kid: fixture.Key}
|
||||
source, _, calls := callbackFixtureWithIdentity(t, "forge-admins", "allow", &admission, fixture.Token)
|
||||
var server *httptest.Server
|
||||
lookups := new(atomic.Int64)
|
||||
server = httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
if r.URL.Path == "/discovery" {
|
||||
_ = json.NewEncoder(w).Encode(map[string]any{"issuer": fixture.Issuer,
|
||||
"authorization_endpoint": server.URL + "/authorize", "token_endpoint": server.URL + "/token", "userinfo_endpoint": server.URL + "/userinfo"})
|
||||
return
|
||||
}
|
||||
if r.URL.Path != "/userinfo" || r.Header.Get("Authorization") != "Bearer synthetic-userinfo" {
|
||||
w.WriteHeader(http.StatusForbidden)
|
||||
return
|
||||
}
|
||||
lookups.Add(1)
|
||||
claims := map[string]any{"sub": "user:synthetic", "groups": []string{"forge-admins"},
|
||||
"assurance": map[string]any{"level": "aal1", "source": "attacker"}, "tenant_source": "attacker"}
|
||||
switch mode {
|
||||
case "missing-groups":
|
||||
delete(claims, "groups")
|
||||
case "missing-subject":
|
||||
delete(claims, "sub")
|
||||
case "wrong-subject":
|
||||
claims["sub"] = "other"
|
||||
case "malformed-groups":
|
||||
claims["groups"] = map[string]any{"forge-admins": true}
|
||||
}
|
||||
_ = json.NewEncoder(w).Encode(claims)
|
||||
}))
|
||||
t.Cleanup(server.Close)
|
||||
previous := http.DefaultClient
|
||||
http.DefaultClient = server.Client()
|
||||
t.Cleanup(func() { http.DefaultClient = previous })
|
||||
source.OpenIDConnectAutoDiscoveryURL = server.URL + "/discovery"
|
||||
provider, err := (&OpenIDProvider{}).CreateGothProvider("synthetic-source", "https://forgejo.invalid/callback", source)
|
||||
if err != nil {
|
||||
t.Fatal("real provider creation refused")
|
||||
}
|
||||
// Exercise the actual provider's subject join, current group guard and
|
||||
// UserInfo merge before the real application callback verifies JOSE/PDP.
|
||||
gothic.CompleteUserAuth = func(http.ResponseWriter, *http.Request) (goth.User, error) {
|
||||
return provider.FetchUser(&openidConnect.Session{IDToken: fixture.Token, AccessToken: "synthetic-userinfo", ExpiresAt: time.Now().Add(time.Minute)})
|
||||
}
|
||||
got, err := source.Callback(httptest.NewRequest(http.MethodGet, "https://forgejo.invalid/callback", nil), httptest.NewRecorder(), "")
|
||||
if lookups.Load() != 1 || (mode == "allow" && (err != nil || got.UserID != "user:synthetic" || calls.Load() != 1)) || (mode != "allow" && (err == nil || got.UserID != "" || calls.Load() != 0)) {
|
||||
t.Fatalf("actual provider/callback boundary failed: mode=%s lookups=%d PDP=%d", mode, lookups.Load(), calls.Load())
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,69 @@
|
|||
{
|
||||
"role": "coordinator technical source review",
|
||||
"independent_owner_assent": false,
|
||||
"issuer_source": "git:d803e9282a47b49daf930fb905312fa5104c0ace",
|
||||
"producer_source": "git:ca0cb75729a63c9288b7333382d0fa3eb1e8c9a3",
|
||||
"consumer_patch_sha256": "sha256:15cb7f13b1b1d1095cc344176ca337f705333a436a70ae803fcfd3d7f802ccf4",
|
||||
"owner_source_commit": "git:3fb031a47ff5379358fd8cc230b40961b3b5d3a8",
|
||||
"checks": [
|
||||
{
|
||||
"claim": "Actual issuer format, not a modified token fixture",
|
||||
"evidence": [
|
||||
"issuer_fixture_test.go",
|
||||
"issuer-fixture-result-attempt5.json",
|
||||
"consumer-after-attempt3.json"
|
||||
]
|
||||
},
|
||||
{
|
||||
"claim": "Admitted JOSE keys/issuer/audience/type, authentication freshness and provenance preserved",
|
||||
"evidence": [
|
||||
"consumer-source/access_engine.go",
|
||||
"consumer-source/access_engine_assurance.go",
|
||||
"consumer-source/access_engine_assurance_test.go"
|
||||
]
|
||||
},
|
||||
{
|
||||
"claim": "Original current UserInfo subject join remains enforced by the actual pinned Goth library",
|
||||
"evidence": [
|
||||
"consumer_wire_after_test.go",
|
||||
"consumer-after-attempt3.json",
|
||||
"actual-issuer-test-summary.json"
|
||||
]
|
||||
},
|
||||
{
|
||||
"claim": "Producer canonical/signature/client implementation is unchanged in the consumer slice",
|
||||
"evidence": [
|
||||
"producer-slice-parity.json"
|
||||
]
|
||||
},
|
||||
{
|
||||
"claim": "Complete composition replay and package results, including private SQL/session contexts",
|
||||
"evidence": [
|
||||
"composed-patch-verification.json",
|
||||
"consumer-test-attempt1.json",
|
||||
"selected-package-test-summary.json"
|
||||
]
|
||||
},
|
||||
{
|
||||
"claim": "Release recipe retains network/PID isolation and changes only patch selection and CLI flag verification",
|
||||
"evidence": [
|
||||
"release-source/tools/forgejo-release-build.py",
|
||||
"owner-integration/source-application.json"
|
||||
]
|
||||
}
|
||||
],
|
||||
"historical_failures_preserved": [
|
||||
"consumer-before.json",
|
||||
"consumer-before.jsonl"
|
||||
],
|
||||
"remaining_existing_owner_work": {
|
||||
"RAPPS-WP-0016-T07": "Chart/private mount admission and custody route acceptance",
|
||||
"RAPPS-WP-0016-T08": "Current operation/inverse sessions; release-wide writer exclusion; durable private evidence/retention; PostgreSQL/native proof",
|
||||
"RAPPS-WP-0016-T09": "Ongoing HTTP/API/Git/SSH protected paths and full native admission",
|
||||
"NK-WP-0048-T39": "Exact complete release candidate acceptance",
|
||||
"CUST-WP-0080-T04": "All sixteen native gates and all 116 SEC-DSM requirement entries remain in scope"
|
||||
},
|
||||
"native_admission": false,
|
||||
"native_gates_closed": 0,
|
||||
"authentication_fixture": "synthetic; no real browser, authenticator or credential acceptance"
|
||||
}
|
||||
|
|
@ -0,0 +1,64 @@
|
|||
"""Freeze all consumer paths against official source, then replay the patch."""
|
||||
from pathlib import Path
|
||||
import difflib
|
||||
import hashlib
|
||||
import json
|
||||
import subprocess
|
||||
import tarfile
|
||||
import tempfile
|
||||
|
||||
HERE = Path(__file__).resolve().parent
|
||||
BASE = HERE.parents[1] / 'netkingdom-target-2026-10-17/apps-access-engine-integration-r2'
|
||||
ARCHIVE = Path('/tmp/custodian-forgejo-successor/forgejo-v11.0.3.tar.gz')
|
||||
SOURCE = Path('/tmp/custodian-forgejo-successor-attempt2/source')
|
||||
digest = lambda value: hashlib.sha256(value).hexdigest()
|
||||
prior = json.loads((BASE / 'composed-source-inventory.json').read_text())
|
||||
assert digest(ARCHIVE.read_bytes()) == prior['archive_sha256']
|
||||
before, after = {}, {}
|
||||
with tarfile.open(ARCHIVE) as tar:
|
||||
for row in prior['files']:
|
||||
name = row['path']
|
||||
data = (SOURCE / name).read_bytes()
|
||||
assert digest(data) == row['after_sha256'], name
|
||||
after[name] = data
|
||||
if row['before_sha256']:
|
||||
before[name] = tar.extractfile('forgejo/' + name).read()
|
||||
assert digest(before[name]) == row['before_sha256'], name
|
||||
for path in sorted((HERE / 'consumer-source').glob('*.go')):
|
||||
after['services/auth/source/oauth2/' + path.name] = path.read_bytes()
|
||||
patch = ''.join(''.join(difflib.unified_diff(
|
||||
before.get(name, b'').decode().splitlines(True), data.decode().splitlines(True),
|
||||
fromfile='a/' + name if name in before else '/dev/null', tofile='b/' + name))
|
||||
for name, data in sorted(after.items())).encode()
|
||||
target = HERE / 'composed-forgejo-source.patch'
|
||||
assert not target.exists()
|
||||
target.write_bytes(patch)
|
||||
manifest = dict(prior, status='source candidate with actual KeyCape assurance interoperability',
|
||||
patch_sha256=digest(patch), issuer_source_commit='git:d803e9282a47b49daf930fb905312fa5104c0ace',
|
||||
files=[dict(path=name, before_sha256=digest(before[name]) if name in before else None,
|
||||
after_sha256=digest(data)) for name, data in sorted(after.items())])
|
||||
manifest['open_gates'] = [
|
||||
'Complete release rebuild and artifact verification with this exact patch.',
|
||||
'Current authenticated operation/inverse sessions and release-wide writer exclusion.',
|
||||
'Ongoing HTTP/API/Git/SSH authorization; native issuer/factor/custody acceptance.',
|
||||
'Owner source/package/type admission; no operational authority granted by source tests.']
|
||||
# Keep earlier limitations as historical evidence in the preceding immutable packet.
|
||||
manifest.pop('known_open', None)
|
||||
manifest.pop('known_gaps', None)
|
||||
manifest.pop('known_open_work', None)
|
||||
manifest['preceding_packet_tests'] = manifest.pop('tests')
|
||||
manifest['actual_issuer_callback_tests'] = {'receipt': 'consumer-after-attempt2.json',
|
||||
'passed_including_subtests': 71, 'skipped': 0, 'synthetic_authentication': True}
|
||||
(HERE / 'composed-source-inventory.json').write_text(json.dumps(manifest, indent=2) + '\n')
|
||||
work = Path(tempfile.mkdtemp(prefix='custodian-forgejo-replay-r3-'))
|
||||
with tarfile.open(ARCHIVE) as tar:
|
||||
tar.extractall(work, filter='data')
|
||||
run = subprocess.run(['patch', '--fuzz=0', '-p1'], input=patch, cwd=work / 'forgejo', capture_output=True)
|
||||
assert run.returncode == 0, 'patch replay refused; trial retained'
|
||||
for name, data in after.items():
|
||||
assert (work / 'forgejo' / name).read_bytes() == data, name
|
||||
(HERE / 'composed-patch-verification.json').write_text(json.dumps(dict(
|
||||
paths_verified=len(after), patch_sha256='sha256:' + digest(patch),
|
||||
official_archive_sha256='sha256:' + prior['archive_sha256'], workspace=str(work),
|
||||
fuzz=0, all_postimages_exact=True, native_changes=False), indent=2) + '\n')
|
||||
print(json.dumps(dict(paths_verified=len(after), all_postimages_exact=True)))
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
{"Time":"2026-10-18T00:11:38.889231746Z","Action":"start","Package":"keycape/internal/server/oidc"}
|
||||
{"Time":"2026-10-18T00:11:38.896073928Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCustodianForgejoIssuerFixture"}
|
||||
{"Time":"2026-10-18T00:11:38.896118257Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCustodianForgejoIssuerFixture","Output":"=== RUN TestCustodianForgejoIssuerFixture\n"}
|
||||
{"Time":"2026-10-18T00:11:38.95533258Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCustodianForgejoIssuerFixture","Output":"--- PASS: TestCustodianForgejoIssuerFixture (0.06s)\n"}
|
||||
{"Time":"2026-10-18T00:11:38.955395196Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCustodianForgejoIssuerFixture","Elapsed":0.06}
|
||||
{"Time":"2026-10-18T00:11:38.955408027Z","Action":"output","Package":"keycape/internal/server/oidc","Output":"PASS\n"}
|
||||
{"Time":"2026-10-18T00:11:38.956724003Z","Action":"output","Package":"keycape/internal/server/oidc","Output":"ok \tkeycape/internal/server/oidc\t0.067s\n"}
|
||||
{"Time":"2026-10-18T00:11:38.956783075Z","Action":"pass","Package":"keycape/internal/server/oidc","Elapsed":0.068}
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
{"Time":"2026-10-18T00:13:28.644704987Z","Action":"start","Package":"keycape/internal/server/oidc"}
|
||||
{"Time":"2026-10-18T00:13:28.649307407Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCustodianForgejoIssuerFixture"}
|
||||
{"Time":"2026-10-18T00:13:28.649392251Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCustodianForgejoIssuerFixture","Output":"=== RUN TestCustodianForgejoIssuerFixture\n"}
|
||||
{"Time":"2026-10-18T00:13:28.781915301Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCustodianForgejoIssuerFixture","Output":"--- PASS: TestCustodianForgejoIssuerFixture (0.13s)\n"}
|
||||
{"Time":"2026-10-18T00:13:28.78200156Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCustodianForgejoIssuerFixture","Elapsed":0.13}
|
||||
{"Time":"2026-10-18T00:13:28.782130345Z","Action":"output","Package":"keycape/internal/server/oidc","Output":"PASS\n"}
|
||||
{"Time":"2026-10-18T00:13:28.783700245Z","Action":"output","Package":"keycape/internal/server/oidc","Output":"ok \tkeycape/internal/server/oidc\t0.138s\n"}
|
||||
{"Time":"2026-10-18T00:13:28.783731228Z","Action":"pass","Package":"keycape/internal/server/oidc","Elapsed":0.139}
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
{"Time":"2026-10-18T00:14:16.585308004Z","Action":"start","Package":"keycape/internal/server/oidc"}
|
||||
{"Time":"2026-10-18T00:14:16.591080723Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCustodianForgejoIssuerFixture"}
|
||||
{"Time":"2026-10-18T00:14:16.591155043Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCustodianForgejoIssuerFixture","Output":"=== RUN TestCustodianForgejoIssuerFixture\n"}
|
||||
{"Time":"2026-10-18T00:14:16.6497699Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCustodianForgejoIssuerFixture","Output":"--- PASS: TestCustodianForgejoIssuerFixture (0.06s)\n"}
|
||||
{"Time":"2026-10-18T00:14:16.649827854Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCustodianForgejoIssuerFixture","Elapsed":0.06}
|
||||
{"Time":"2026-10-18T00:14:16.649926755Z","Action":"output","Package":"keycape/internal/server/oidc","Output":"PASS\n"}
|
||||
{"Time":"2026-10-18T00:14:16.651240053Z","Action":"output","Package":"keycape/internal/server/oidc","Output":"ok \tkeycape/internal/server/oidc\t0.065s\n"}
|
||||
{"Time":"2026-10-18T00:14:16.651268015Z","Action":"pass","Package":"keycape/internal/server/oidc","Elapsed":0.066}
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
{"Time":"2026-10-18T00:23:37.657005968Z","Action":"start","Package":"keycape/internal/server/oidc"}
|
||||
{"Time":"2026-10-18T00:23:37.683814198Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCustodianForgejoIssuerFixture"}
|
||||
{"Time":"2026-10-18T00:23:37.683985725Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCustodianForgejoIssuerFixture","Output":"=== RUN TestCustodianForgejoIssuerFixture\n"}
|
||||
{"Time":"2026-10-18T00:23:38.374234818Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCustodianForgejoIssuerFixture","Output":"--- PASS: TestCustodianForgejoIssuerFixture (0.69s)\n"}
|
||||
{"Time":"2026-10-18T00:23:38.374318597Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCustodianForgejoIssuerFixture","Elapsed":0.69}
|
||||
{"Time":"2026-10-18T00:23:38.374448463Z","Action":"output","Package":"keycape/internal/server/oidc","Output":"PASS\n"}
|
||||
{"Time":"2026-10-18T00:23:38.377334073Z","Action":"output","Package":"keycape/internal/server/oidc","Output":"ok \tkeycape/internal/server/oidc\t0.719s\n"}
|
||||
{"Time":"2026-10-18T00:23:38.377405598Z","Action":"pass","Package":"keycape/internal/server/oidc","Elapsed":0.72}
|
||||
|
|
@ -0,0 +1,91 @@
|
|||
{
|
||||
"returncode": 0,
|
||||
"seconds": 1.42,
|
||||
"source_commit": "d803e9282a47b49daf930fb905312fa5104c0ace",
|
||||
"source_token_go_sha256": "sha256:8422cc9dbd39c88dfe835b43f6262cb120bc0d2e5b08898a151167b7555368d3",
|
||||
"workspace": "/tmp/custodian-keycape-wire-rw523gzp",
|
||||
"argv": [
|
||||
"bwrap",
|
||||
"--unshare-net",
|
||||
"--unshare-pid",
|
||||
"--die-with-parent",
|
||||
"--new-session",
|
||||
"--ro-bind",
|
||||
"/usr",
|
||||
"/usr",
|
||||
"--ro-bind",
|
||||
"/lib",
|
||||
"/lib",
|
||||
"--ro-bind",
|
||||
"/lib64",
|
||||
"/lib64",
|
||||
"--symlink",
|
||||
"usr/bin",
|
||||
"/bin",
|
||||
"--proc",
|
||||
"/proc",
|
||||
"--dev",
|
||||
"/dev",
|
||||
"--tmpfs",
|
||||
"/tmp",
|
||||
"--bind",
|
||||
"/tmp/custodian-keycape-wire-rw523gzp",
|
||||
"/work",
|
||||
"--ro-bind",
|
||||
"/home/worsch/go/pkg/mod",
|
||||
"/modules",
|
||||
"--ro-bind",
|
||||
"/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
|
||||
"/toolchain",
|
||||
"--chdir",
|
||||
"/work/src",
|
||||
"--clearenv",
|
||||
"--bind",
|
||||
"/tmp/custodian-keycape-wire-rsi4f6hj/gocache",
|
||||
"/work/gocache",
|
||||
"--setenv",
|
||||
"PATH",
|
||||
"/toolchain/bin:/usr/bin:/bin",
|
||||
"--setenv",
|
||||
"HOME",
|
||||
"/work/home",
|
||||
"--setenv",
|
||||
"GOTOOLCHAIN",
|
||||
"local",
|
||||
"--setenv",
|
||||
"GOPROXY",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOSUMDB",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOMODCACHE",
|
||||
"/modules",
|
||||
"--setenv",
|
||||
"GOCACHE",
|
||||
"/work/gocache",
|
||||
"--setenv",
|
||||
"GOMAXPROCS",
|
||||
"4",
|
||||
"--setenv",
|
||||
"CGO_ENABLED",
|
||||
"0",
|
||||
"--setenv",
|
||||
"CUSTODIAN_SYNTHETIC_IDENTITY_FIXTURE",
|
||||
"/work/identity.json",
|
||||
"--",
|
||||
"go",
|
||||
"test",
|
||||
"-p",
|
||||
"4",
|
||||
"-json",
|
||||
"./internal/server/oidc",
|
||||
"-run",
|
||||
"^TestCustodianForgejoIssuerFixture$",
|
||||
"-count=1"
|
||||
],
|
||||
"synthetic_authentication": true,
|
||||
"real_credentials": false,
|
||||
"fixture_values_published": false,
|
||||
"fixture_sha256": "18daf5c6856f34efbdf1029688feea380979f1ca4f6c23e8ca3e78fe913f70cf"
|
||||
}
|
||||
|
|
@ -0,0 +1,91 @@
|
|||
{
|
||||
"returncode": 0,
|
||||
"seconds": 0.67,
|
||||
"source_commit": "d803e9282a47b49daf930fb905312fa5104c0ace",
|
||||
"source_token_go_sha256": "sha256:8422cc9dbd39c88dfe835b43f6262cb120bc0d2e5b08898a151167b7555368d3",
|
||||
"workspace": "/tmp/custodian-keycape-wire-6z6gfafi",
|
||||
"argv": [
|
||||
"bwrap",
|
||||
"--unshare-net",
|
||||
"--unshare-pid",
|
||||
"--die-with-parent",
|
||||
"--new-session",
|
||||
"--ro-bind",
|
||||
"/usr",
|
||||
"/usr",
|
||||
"--ro-bind",
|
||||
"/lib",
|
||||
"/lib",
|
||||
"--ro-bind",
|
||||
"/lib64",
|
||||
"/lib64",
|
||||
"--symlink",
|
||||
"usr/bin",
|
||||
"/bin",
|
||||
"--proc",
|
||||
"/proc",
|
||||
"--dev",
|
||||
"/dev",
|
||||
"--tmpfs",
|
||||
"/tmp",
|
||||
"--bind",
|
||||
"/tmp/custodian-keycape-wire-6z6gfafi",
|
||||
"/work",
|
||||
"--ro-bind",
|
||||
"/home/worsch/go/pkg/mod",
|
||||
"/modules",
|
||||
"--ro-bind",
|
||||
"/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
|
||||
"/toolchain",
|
||||
"--chdir",
|
||||
"/work/src",
|
||||
"--clearenv",
|
||||
"--bind",
|
||||
"/tmp/custodian-keycape-wire-rsi4f6hj/gocache",
|
||||
"/work/gocache",
|
||||
"--setenv",
|
||||
"PATH",
|
||||
"/toolchain/bin:/usr/bin:/bin",
|
||||
"--setenv",
|
||||
"HOME",
|
||||
"/work/home",
|
||||
"--setenv",
|
||||
"GOTOOLCHAIN",
|
||||
"local",
|
||||
"--setenv",
|
||||
"GOPROXY",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOSUMDB",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOMODCACHE",
|
||||
"/modules",
|
||||
"--setenv",
|
||||
"GOCACHE",
|
||||
"/work/gocache",
|
||||
"--setenv",
|
||||
"GOMAXPROCS",
|
||||
"4",
|
||||
"--setenv",
|
||||
"CGO_ENABLED",
|
||||
"0",
|
||||
"--setenv",
|
||||
"CUSTODIAN_SYNTHETIC_IDENTITY_FIXTURE",
|
||||
"/work/identity.json",
|
||||
"--",
|
||||
"go",
|
||||
"test",
|
||||
"-p",
|
||||
"4",
|
||||
"-json",
|
||||
"./internal/server/oidc",
|
||||
"-run",
|
||||
"^TestCustodianForgejoIssuerFixture$",
|
||||
"-count=1"
|
||||
],
|
||||
"synthetic_authentication": true,
|
||||
"real_credentials": false,
|
||||
"fixture_values_published": false,
|
||||
"fixture_sha256": "771d365c7c80d731fd2f5cc8999ca7aa5bb6fa0f93269463b84e0f70b3bbd4e2"
|
||||
}
|
||||
|
|
@ -0,0 +1,91 @@
|
|||
{
|
||||
"returncode": 0,
|
||||
"seconds": 0.62,
|
||||
"source_commit": "d803e9282a47b49daf930fb905312fa5104c0ace",
|
||||
"source_token_go_sha256": "sha256:8422cc9dbd39c88dfe835b43f6262cb120bc0d2e5b08898a151167b7555368d3",
|
||||
"workspace": "/tmp/custodian-keycape-wire-jum8uowp",
|
||||
"argv": [
|
||||
"bwrap",
|
||||
"--unshare-net",
|
||||
"--unshare-pid",
|
||||
"--die-with-parent",
|
||||
"--new-session",
|
||||
"--ro-bind",
|
||||
"/usr",
|
||||
"/usr",
|
||||
"--ro-bind",
|
||||
"/lib",
|
||||
"/lib",
|
||||
"--ro-bind",
|
||||
"/lib64",
|
||||
"/lib64",
|
||||
"--symlink",
|
||||
"usr/bin",
|
||||
"/bin",
|
||||
"--proc",
|
||||
"/proc",
|
||||
"--dev",
|
||||
"/dev",
|
||||
"--tmpfs",
|
||||
"/tmp",
|
||||
"--bind",
|
||||
"/tmp/custodian-keycape-wire-jum8uowp",
|
||||
"/work",
|
||||
"--ro-bind",
|
||||
"/home/worsch/go/pkg/mod",
|
||||
"/modules",
|
||||
"--ro-bind",
|
||||
"/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
|
||||
"/toolchain",
|
||||
"--chdir",
|
||||
"/work/src",
|
||||
"--clearenv",
|
||||
"--bind",
|
||||
"/tmp/custodian-keycape-wire-rsi4f6hj/gocache",
|
||||
"/work/gocache",
|
||||
"--setenv",
|
||||
"PATH",
|
||||
"/toolchain/bin:/usr/bin:/bin",
|
||||
"--setenv",
|
||||
"HOME",
|
||||
"/work/home",
|
||||
"--setenv",
|
||||
"GOTOOLCHAIN",
|
||||
"local",
|
||||
"--setenv",
|
||||
"GOPROXY",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOSUMDB",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOMODCACHE",
|
||||
"/modules",
|
||||
"--setenv",
|
||||
"GOCACHE",
|
||||
"/work/gocache",
|
||||
"--setenv",
|
||||
"GOMAXPROCS",
|
||||
"4",
|
||||
"--setenv",
|
||||
"CGO_ENABLED",
|
||||
"0",
|
||||
"--setenv",
|
||||
"CUSTODIAN_SYNTHETIC_IDENTITY_FIXTURE",
|
||||
"/work/identity.json",
|
||||
"--",
|
||||
"go",
|
||||
"test",
|
||||
"-p",
|
||||
"4",
|
||||
"-json",
|
||||
"./internal/server/oidc",
|
||||
"-run",
|
||||
"^TestCustodianForgejoIssuerFixture$",
|
||||
"-count=1"
|
||||
],
|
||||
"synthetic_authentication": true,
|
||||
"real_credentials": false,
|
||||
"fixture_values_published": false,
|
||||
"fixture_sha256": "a9465766c6edebf8e6ce77e2bcaef9d1bfa081c6472c731f95c0b9caaf684522"
|
||||
}
|
||||
|
|
@ -0,0 +1,91 @@
|
|||
{
|
||||
"returncode": 0,
|
||||
"seconds": 4.55,
|
||||
"source_commit": "d803e9282a47b49daf930fb905312fa5104c0ace",
|
||||
"source_token_go_sha256": "sha256:8422cc9dbd39c88dfe835b43f6262cb120bc0d2e5b08898a151167b7555368d3",
|
||||
"workspace": "/tmp/custodian-keycape-wire-gvebji6u",
|
||||
"argv": [
|
||||
"bwrap",
|
||||
"--unshare-net",
|
||||
"--unshare-pid",
|
||||
"--die-with-parent",
|
||||
"--new-session",
|
||||
"--ro-bind",
|
||||
"/usr",
|
||||
"/usr",
|
||||
"--ro-bind",
|
||||
"/lib",
|
||||
"/lib",
|
||||
"--ro-bind",
|
||||
"/lib64",
|
||||
"/lib64",
|
||||
"--symlink",
|
||||
"usr/bin",
|
||||
"/bin",
|
||||
"--proc",
|
||||
"/proc",
|
||||
"--dev",
|
||||
"/dev",
|
||||
"--tmpfs",
|
||||
"/tmp",
|
||||
"--bind",
|
||||
"/tmp/custodian-keycape-wire-gvebji6u",
|
||||
"/work",
|
||||
"--ro-bind",
|
||||
"/home/worsch/go/pkg/mod",
|
||||
"/modules",
|
||||
"--ro-bind",
|
||||
"/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
|
||||
"/toolchain",
|
||||
"--chdir",
|
||||
"/work/src",
|
||||
"--clearenv",
|
||||
"--bind",
|
||||
"/tmp/custodian-keycape-wire-rsi4f6hj/gocache",
|
||||
"/work/gocache",
|
||||
"--setenv",
|
||||
"PATH",
|
||||
"/toolchain/bin:/usr/bin:/bin",
|
||||
"--setenv",
|
||||
"HOME",
|
||||
"/work/home",
|
||||
"--setenv",
|
||||
"GOTOOLCHAIN",
|
||||
"local",
|
||||
"--setenv",
|
||||
"GOPROXY",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOSUMDB",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOMODCACHE",
|
||||
"/modules",
|
||||
"--setenv",
|
||||
"GOCACHE",
|
||||
"/work/gocache",
|
||||
"--setenv",
|
||||
"GOMAXPROCS",
|
||||
"4",
|
||||
"--setenv",
|
||||
"CGO_ENABLED",
|
||||
"0",
|
||||
"--setenv",
|
||||
"CUSTODIAN_SYNTHETIC_IDENTITY_FIXTURE",
|
||||
"/work/identity.json",
|
||||
"--",
|
||||
"go",
|
||||
"test",
|
||||
"-p",
|
||||
"4",
|
||||
"-json",
|
||||
"./internal/server/oidc",
|
||||
"-run",
|
||||
"^TestCustodianForgejoIssuerFixture$",
|
||||
"-count=1"
|
||||
],
|
||||
"synthetic_authentication": true,
|
||||
"real_credentials": false,
|
||||
"fixture_values_published": false,
|
||||
"fixture_sha256": "de14985f3087c72695ff013c7a6f2fd3f73e0709eff5939388d9bd0c21303b9b"
|
||||
}
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
{"Time":"2026-10-17T23:32:27.288197295Z","Action":"start","Package":"keycape/internal/server/oidc"}
|
||||
{"Time":"2026-10-17T23:32:27.291985303Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCustodianForgejoIssuerFixture"}
|
||||
{"Time":"2026-10-17T23:32:27.292031832Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCustodianForgejoIssuerFixture","Output":"=== RUN TestCustodianForgejoIssuerFixture\n"}
|
||||
{"Time":"2026-10-17T23:32:27.325188741Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCustodianForgejoIssuerFixture","Output":"--- PASS: TestCustodianForgejoIssuerFixture (0.03s)\n"}
|
||||
{"Time":"2026-10-17T23:32:27.325257687Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCustodianForgejoIssuerFixture","Elapsed":0.03}
|
||||
{"Time":"2026-10-17T23:32:27.325273161Z","Action":"output","Package":"keycape/internal/server/oidc","Output":"PASS\n"}
|
||||
{"Time":"2026-10-17T23:32:27.326859189Z","Action":"output","Package":"keycape/internal/server/oidc","Output":"ok \tkeycape/internal/server/oidc\t0.038s\n"}
|
||||
{"Time":"2026-10-17T23:32:27.326892625Z","Action":"pass","Package":"keycape/internal/server/oidc","Elapsed":0.039}
|
||||
|
|
@ -0,0 +1,49 @@
|
|||
"""Apply the tested build candidate, preserving every unrelated owner file."""
|
||||
from pathlib import Path
|
||||
import hashlib
|
||||
import json
|
||||
import re
|
||||
import subprocess
|
||||
|
||||
HERE = Path(__file__).resolve().parent
|
||||
ROOT = Path('/home/worsch/railiance-apps')
|
||||
cfg = json.loads((HERE / 'source-manifest.json').read_text())
|
||||
sha = lambda data: hashlib.sha256(data).hexdigest()
|
||||
def git(*args):
|
||||
return subprocess.check_output(['git', '-C', str(ROOT), *args], text=True).strip()
|
||||
assert git('rev-parse', 'HEAD') == cfg['base_revision']
|
||||
assert git('ls-remote', 'origin', 'refs/heads/main').split()[0] == cfg['base_revision']
|
||||
assert set(git('diff', '--name-only', 'HEAD').splitlines()) <= {'.custodian-brief.md', 'WORK-RECORDS.md'}
|
||||
tracked = git('ls-files').splitlines()
|
||||
protected = {name: sha((ROOT / name).read_bytes()) for name in tracked
|
||||
if (ROOT / name).is_file() and name not in {row['path'] for row in cfg['files']}}
|
||||
index = git('ls-files', '--stage', '--', '.custodian-brief.md', 'WORK-RECORDS.md')
|
||||
plan = 'workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md'
|
||||
before = re.findall(r'```task\n.*?```', (ROOT / plan).read_text(), re.S)
|
||||
assert len(before) == 9
|
||||
for row in cfg['files']:
|
||||
current = ROOT / row['path']
|
||||
if row['before_sha256'] is None:
|
||||
assert not current.exists(), row['path']
|
||||
else:
|
||||
assert sha(current.read_bytes()) == row['before_sha256'], row['path']
|
||||
assert sha(Path(row['source']).read_bytes()) == row['sha256'], row['path']
|
||||
for row in cfg['files']:
|
||||
target = ROOT / row['path']
|
||||
target.parent.mkdir(parents=True, exist_ok=True)
|
||||
target.write_bytes(Path(row['source']).read_bytes())
|
||||
after = re.findall(r'```task\n.*?```', (ROOT / plan).read_text(), re.S)
|
||||
assert before[:8] == after[:8]
|
||||
assert before[8].replace('status: todo', 'status: progress') == after[8]
|
||||
assert all(sha((ROOT / name).read_bytes()) == value for name, value in protected.items())
|
||||
assert git('ls-files', '--stage', '--', '.custodian-brief.md', 'WORK-RECORDS.md') == index
|
||||
receipt = dict(owner=cfg['owner'], base_revision='git:' + cfg['base_revision'],
|
||||
files=cfg['files'], preserved_other_tracked_files=len(protected),
|
||||
original_task_uuids_preserved=9, status_change='T09 todo -> progress',
|
||||
native_actions=False, independent_owner_review=False, operational_admission=False)
|
||||
(HERE / 'source-application.json').write_text(json.dumps(receipt, indent=2) + '\n')
|
||||
publication = dict(owner=cfg['owner'], base_revision=cfg['base_revision'],
|
||||
message='Compose Forgejo private-input and authenticated decision build candidate',
|
||||
files=[dict(path=row['path'], sha256=row['sha256']) for row in cfg['files']])
|
||||
(HERE / 'publication-inputs.json').write_text(json.dumps(publication, indent=2) + '\n')
|
||||
print(json.dumps(dict(status='source_applied', files=len(cfg['files']), native_actions=False)))
|
||||
|
|
@ -0,0 +1,404 @@
|
|||
{
|
||||
"repo_slug": "railiance-apps",
|
||||
"repo_path": "/home/worsch/railiance-apps",
|
||||
"source_revision": "3fb031a47ff5379358fd8cc230b40961b3b5d3a8",
|
||||
"source_revision_reason": null,
|
||||
"issues": [
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-35",
|
||||
"message": "Repo Manager warning: .repo-classification.yaml: category is project but slug is not prj-*; not every category:project is a prj- repo",
|
||||
"file_path": ".repo-classification.yaml",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-35",
|
||||
"message": "Repo Manager missing: README.md: README.md is required for flavor project",
|
||||
"file_path": "README.md",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-35",
|
||||
"message": "Repo Manager warning: workplans/: repository uses more than one workplan prefix: ['RAILIANCE-WP', 'RAPPS-WP']",
|
||||
"file_path": "workplans/",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-35",
|
||||
"message": "Repo Manager contradictory: workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-1: task id 'RAILIANCE-WP-0004-I01' is not accepted by the canon kind registry",
|
||||
"file_path": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-1",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-35",
|
||||
"message": "Repo Manager contradictory: workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-2: task id 'RAILIANCE-WP-0004-I02' is not accepted by the canon kind registry",
|
||||
"file_path": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-2",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-35",
|
||||
"message": "Repo Manager contradictory: workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-3: task id 'RAILIANCE-WP-0004-I03' is not accepted by the canon kind registry",
|
||||
"file_path": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-3",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-35",
|
||||
"message": "Repo Manager contradictory: workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-4: task id 'RAILIANCE-WP-0004-I04' is not accepted by the canon kind registry",
|
||||
"file_path": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-4",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-35",
|
||||
"message": "Repo Manager contradictory: workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-5: task id 'RAILIANCE-WP-0004-I05' is not accepted by the canon kind registry",
|
||||
"file_path": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-5",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-35",
|
||||
"message": "Repo Manager contradictory: workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-6: task id 'RAILIANCE-WP-0004-I06' is not accepted by the canon kind registry",
|
||||
"file_path": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-6",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-35",
|
||||
"message": "Repo Manager contradictory: workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-7: task id 'RAILIANCE-WP-0004-I07' is not accepted by the canon kind registry",
|
||||
"file_path": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-7",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-31",
|
||||
"message": "[workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md] id 'RAILIANCE-WP-0004-I01' matches no kind in the canon work-record type registry \u2014 unregistered species become sidetracks needing manual reintegration (work-record-types_v0.1)",
|
||||
"file_path": "",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-31",
|
||||
"message": "[workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md] id 'RAILIANCE-WP-0004-I02' matches no kind in the canon work-record type registry \u2014 unregistered species become sidetracks needing manual reintegration (work-record-types_v0.1)",
|
||||
"file_path": "",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-31",
|
||||
"message": "[workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md] id 'RAILIANCE-WP-0004-I03' matches no kind in the canon work-record type registry \u2014 unregistered species become sidetracks needing manual reintegration (work-record-types_v0.1)",
|
||||
"file_path": "",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-31",
|
||||
"message": "[workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md] id 'RAILIANCE-WP-0004-I04' matches no kind in the canon work-record type registry \u2014 unregistered species become sidetracks needing manual reintegration (work-record-types_v0.1)",
|
||||
"file_path": "",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-31",
|
||||
"message": "[workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md] id 'RAILIANCE-WP-0004-I05' matches no kind in the canon work-record type registry \u2014 unregistered species become sidetracks needing manual reintegration (work-record-types_v0.1)",
|
||||
"file_path": "",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-31",
|
||||
"message": "[workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md] id 'RAILIANCE-WP-0004-I06' matches no kind in the canon work-record type registry \u2014 unregistered species become sidetracks needing manual reintegration (work-record-types_v0.1)",
|
||||
"file_path": "",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-31",
|
||||
"message": "[workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md] id 'RAILIANCE-WP-0004-I07' matches no kind in the canon work-record type registry \u2014 unregistered species become sidetracks needing manual reintegration (work-record-types_v0.1)",
|
||||
"file_path": "",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-33",
|
||||
"message": "WORK-RECORDS.md is missing or stale \u2014 regenerate via fix-consistency (CUST-WP-0061-T04 generated work-record index)",
|
||||
"file_path": "WORK-RECORDS.md",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-39",
|
||||
"message": "Wait task 'RAPPS-WP-0015-T04' in workplan 'RAPPS-WP-0015' has neither depends_on, needs_human: true, blocked_on: message-from:\u2026 nor wait_until \u2014 unqualified wait",
|
||||
"file_path": "workplans/RAPPS-WP-0015-coulomb-personal-content-release.md#RAPPS-WP-0015-T04",
|
||||
"db_id": "",
|
||||
"file_value": "wait",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Workplan dependency target 'KEY-WP-0038' is not linked to State Hub",
|
||||
"file_path": "workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md",
|
||||
"db_id": "",
|
||||
"file_value": "KEY-WP-0038",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-39",
|
||||
"message": "Human wait task 'RAPPS-WP-0016-T04' in workplan 'RAPPS-WP-0016' has needs_human: true without decision_id \u2014 unrouted human gate",
|
||||
"file_path": "workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md#RAPPS-WP-0016-T04",
|
||||
"db_id": "",
|
||||
"file_value": "needs_human: true",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-10",
|
||||
"message": "Task status drift 'RAPPS-WP-0016-T09': file='progress' db='todo' (file wins)",
|
||||
"file_path": "workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md#RAPPS-WP-0016-T09",
|
||||
"db_id": "d3804638-c73d-5b9f-a456-4262f62f9e6b",
|
||||
"file_value": "progress",
|
||||
"db_value": "todo",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-22",
|
||||
"message": "Task description drift 'RAPPS-WP-0016-T09': file content differs from DB (file wins)",
|
||||
"file_path": "workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md#RAPPS-WP-0016-T09",
|
||||
"db_id": "d3804638-c73d-5b9f-a456-4262f62f9e6b",
|
||||
"file_value": "Use the producer-owned decision format/canonical bytes and independently admitted\nsigner/policy/request pins. Forgejo mu",
|
||||
"db_value": "Use the producer-owned decision format/canonical bytes and independently admitted\nsigner/policy/request pins. Forgejo mu",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Workplan dependency target 'RPF-WP-0058' is not linked to State Hub",
|
||||
"file_path": "workplans/RAPPS-WP-0017-reuse-private-reader-release.md",
|
||||
"db_id": "",
|
||||
"file_value": "RPF-WP-0058",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Workplan dependency target 'REUSE-WP-0025' is not linked to State Hub",
|
||||
"file_path": "workplans/RAPPS-WP-0017-reuse-private-reader-release.md",
|
||||
"db_id": "",
|
||||
"file_value": "REUSE-WP-0025",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'railiance-wp-0006@retired-20260826' (id=1960b22b\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "1960b22b-82ae-4b67-9fff-397bd38bdd65",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'railiance-wp-0005@retired-20260826' (id=685f1c18\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "685f1c18-33c0-400d-a2b1-e1dae0f27c3e",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'railiance-wp-0009@retired-20260826' (id=21c3fcdc\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "21c3fcdc-f014-4858-8028-0ac3038212b7",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'railiance-wp-0011@retired-20260826' (id=98cf42ae\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "98cf42ae-9b64-4736-97e1-bae325ded1f9",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'railiance-wp-0008@retired-20260826' (id=41b9deea\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "41b9deea-a935-4372-8916-b3981336f597",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'railiance-wp-0018@retired-20260826' (id=1b9af4e8\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "1b9af4e8-7579-5141-837b-c736b85204a0",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'railiance-wp-0007@retired-20260826' (id=7da18dd8\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "7da18dd8-76b9-4a70-b9d7-de541afc65c0",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'railiance-wp-0010@retired-20260826' (id=a4f301bb\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "a4f301bb-3f49-450a-8dbd-5cf6a16b8e0f",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-28",
|
||||
"message": "2 unread inbox message(s) older than 3 day(s): the-custodian:23172cb2, the-custodian:51e9eace",
|
||||
"file_path": "",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-28",
|
||||
"message": "2 unread message(s) lack thread_id for supersession tracking: the-custodian:23172cb2, the-custodian:51e9eace",
|
||||
"file_path": "",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-26",
|
||||
"message": "Workplan id 'RAIL-AP-WP-0001' uses prefix 'RAIL-AP-WP' but repo canonical prefix is 'RAPPS-WP' \u2014 new plans must conform",
|
||||
"file_path": "workplans/archived/260605-RAIL-AP-WP-0001-gitea-container-registry.md",
|
||||
"db_id": "",
|
||||
"file_value": "RAIL-AP-WP-0001",
|
||||
"db_value": "RAPPS-WP",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-26",
|
||||
"message": "Workplan id 'RAILIANCE-WP-0002' uses prefix 'RAILIANCE-WP' but repo canonical prefix is 'RAPPS-WP' \u2014 new plans must conform",
|
||||
"file_path": "workplans/archived/260702-railiance-apps-WP-0002-vergabe-teilnahme-on-railiance01.md",
|
||||
"db_id": "",
|
||||
"file_value": "RAILIANCE-WP-0002",
|
||||
"db_value": "RAPPS-WP",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-26",
|
||||
"message": "Workplan id 'RAILIANCE-WP-0004' uses prefix 'RAILIANCE-WP' but repo canonical prefix is 'RAPPS-WP' \u2014 new plans must conform",
|
||||
"file_path": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md",
|
||||
"db_id": "",
|
||||
"file_value": "RAILIANCE-WP-0004",
|
||||
"db_value": "RAPPS-WP",
|
||||
"fixable": false
|
||||
}
|
||||
],
|
||||
"fixes_applied": [
|
||||
"bindings: synced 20/20",
|
||||
"C-17 cleared: pushed 1 backlogged commit(s)",
|
||||
"C-33 fixed: regenerated WORK-RECORDS.md",
|
||||
"C-10 fixed: task d3804638\u2026 status \u2192 'progress'",
|
||||
"C-22 fixed: task d3804638\u2026 description updated",
|
||||
"brief: .custodian-brief.md updated",
|
||||
"push: pushed"
|
||||
],
|
||||
"summary": {
|
||||
"fail": 0,
|
||||
"automation_error": 0,
|
||||
"warn": 30,
|
||||
"info": 8
|
||||
},
|
||||
"result": "warn"
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
WARN: git commit failed for writeback: Generated-only commits rejected: staged
|
||||
|
|
@ -0,0 +1,172 @@
|
|||
{
|
||||
"ok": true,
|
||||
"status": "applied",
|
||||
"repo_slug": "railiance-apps",
|
||||
"commit": "3fb031a47ff5379358fd8cc230b40961b3b5d3a8",
|
||||
"requests": 2,
|
||||
"elapsed_ms": 6389.6,
|
||||
"git": {
|
||||
"upstream": "origin/main",
|
||||
"behind": 0,
|
||||
"ahead": 0
|
||||
},
|
||||
"identifiers": {
|
||||
"schema": "repo-manager.identifier-assignment.v1",
|
||||
"ok": true,
|
||||
"executed": true,
|
||||
"repo": "railiance-apps",
|
||||
"namespace": "helixforge",
|
||||
"assignments": [],
|
||||
"historical_invalid_identifiers": [
|
||||
{
|
||||
"kind": "task",
|
||||
"id": "RAILIANCE-WP-0004-I01",
|
||||
"source": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-1"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"id": "RAILIANCE-WP-0004-I02",
|
||||
"source": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-2"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"id": "RAILIANCE-WP-0004-I03",
|
||||
"source": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-3"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"id": "RAILIANCE-WP-0004-I04",
|
||||
"source": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-4"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"id": "RAILIANCE-WP-0004-I05",
|
||||
"source": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-5"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"id": "RAILIANCE-WP-0004-I06",
|
||||
"source": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-6"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"id": "RAILIANCE-WP-0004-I07",
|
||||
"source": "workplans/archived/260702-railiance-apps-WP-0004-app-deployment-improvements.md#task-block-7"
|
||||
}
|
||||
],
|
||||
"historical_identity_collisions": [],
|
||||
"files_changed": []
|
||||
},
|
||||
"receipt": {
|
||||
"schema": "state-hub.repository-projection-reconcile.v1",
|
||||
"instance_role": "primary",
|
||||
"instance_label": "railiance01",
|
||||
"expected_commit": "3fb031a47ff5379358fd8cc230b40961b3b5d3a8",
|
||||
"derived_commit": "3fb031a47ff5379358fd8cc230b40961b3b5d3a8",
|
||||
"outcome": {
|
||||
"schema": "state-hub.projection-reset.v1",
|
||||
"repo_slug": "railiance-apps",
|
||||
"commit": "3fb031a47ff5379358fd8cc230b40961b3b5d3a8",
|
||||
"status": "applied",
|
||||
"counts": {
|
||||
"created": 0,
|
||||
"updated": 20,
|
||||
"retired": 0,
|
||||
"refused": 0,
|
||||
"released": 0,
|
||||
"created_tasks": 0,
|
||||
"updated_tasks": 0,
|
||||
"cancelled_tasks": 0,
|
||||
"created_edges": 0,
|
||||
"removed_edges": 0,
|
||||
"unresolved_edges": 0,
|
||||
"external_edges": 5
|
||||
},
|
||||
"created": [],
|
||||
"updated": [
|
||||
"RAIL-AP-WP-0001",
|
||||
"RAILIANCE-WP-0002",
|
||||
"RAILIANCE-WP-0004",
|
||||
"RAPPS-WP-0001",
|
||||
"RAPPS-WP-0002",
|
||||
"RAPPS-WP-0003",
|
||||
"RAPPS-WP-0004",
|
||||
"RAPPS-WP-0005",
|
||||
"RAPPS-WP-0006",
|
||||
"RAPPS-WP-0007",
|
||||
"RAPPS-WP-0008",
|
||||
"RAPPS-WP-0009",
|
||||
"RAPPS-WP-0010",
|
||||
"RAPPS-WP-0011",
|
||||
"RAPPS-WP-0012",
|
||||
"RAPPS-WP-0013",
|
||||
"RAPPS-WP-0014",
|
||||
"RAPPS-WP-0015",
|
||||
"RAPPS-WP-0016",
|
||||
"RAPPS-WP-0017"
|
||||
],
|
||||
"retired": [],
|
||||
"released": [],
|
||||
"created_tasks": [],
|
||||
"updated_tasks": [],
|
||||
"cancelled_tasks": [],
|
||||
"created_edges": [],
|
||||
"removed_edges": [],
|
||||
"unresolved_edges": [],
|
||||
"external_edges": [
|
||||
{
|
||||
"workplan": "RAPPS-WP-0016",
|
||||
"from": "RAPPS-WP-0016-T02",
|
||||
"target": "RAPPS-WP-0016-T01",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "f6b1d6f6-0abb-5774-87b9-bf3cfb640a3b",
|
||||
"from_task_id": "13cd3aec-c87d-5d3f-a421-39d8ff131edd",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "98004ed0-83e6-5f6e-9b18-15b8b2aec2e7"
|
||||
},
|
||||
{
|
||||
"workplan": "RAPPS-WP-0016",
|
||||
"from": "RAPPS-WP-0016-T02",
|
||||
"target": "KEY-WP-0038-T02",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "f6b1d6f6-0abb-5774-87b9-bf3cfb640a3b",
|
||||
"from_task_id": "13cd3aec-c87d-5d3f-a421-39d8ff131edd",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "ddcfb482-8f33-5c81-9ce8-84be8fa5dc30"
|
||||
},
|
||||
{
|
||||
"workplan": "RAPPS-WP-0016",
|
||||
"from": "RAPPS-WP-0016-T04",
|
||||
"target": "RAPPS-WP-0016-T03",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "f6b1d6f6-0abb-5774-87b9-bf3cfb640a3b",
|
||||
"from_task_id": "32c54737-c40f-5fde-9b91-163f8dcb0068",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "81f072aa-c316-511e-a2cd-21dd1b1d0a00"
|
||||
},
|
||||
{
|
||||
"workplan": "RAPPS-WP-0016",
|
||||
"from": "RAPPS-WP-0016-T05",
|
||||
"target": "RAPPS-WP-0016-T02",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "f6b1d6f6-0abb-5774-87b9-bf3cfb640a3b",
|
||||
"from_task_id": "728786c9-f1f9-5983-a6a4-dea21faf67f5",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "13cd3aec-c87d-5d3f-a421-39d8ff131edd"
|
||||
},
|
||||
{
|
||||
"workplan": "RAPPS-WP-0016",
|
||||
"from": "RAPPS-WP-0016-T03",
|
||||
"target": "RAPPS-WP-0016-T02",
|
||||
"relationship_type": "starts_after",
|
||||
"from_workplan_id": "f6b1d6f6-0abb-5774-87b9-bf3cfb640a3b",
|
||||
"from_task_id": "81f072aa-c316-511e-a2cd-21dd1b1d0a00",
|
||||
"to_workplan_id": null,
|
||||
"to_task_id": "13cd3aec-c87d-5d3f-a421-39d8ff131edd"
|
||||
}
|
||||
],
|
||||
"refused": [],
|
||||
"notes": []
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
{
|
||||
"exit_code": 0,
|
||||
"commit": "3fb031a47ff5379358fd8cc230b40961b3b5d3a8",
|
||||
"base": "c29408ae6747158a639dc876e6d7492680675658",
|
||||
"files": [
|
||||
{
|
||||
"path": "tools/forgejo-release-build.py",
|
||||
"sha256": "bd5b15ff2ca1e5694903aed3cd47c4fd1fb8baa43c49dd291029a9c9739cc96c"
|
||||
},
|
||||
{
|
||||
"path": "build/forgejo/inputs.lock.json",
|
||||
"sha256": "acf9859d1b1009d1afe0844f2068f9b95cfadb176591edce0ec42084604e4d65"
|
||||
},
|
||||
{
|
||||
"path": "build/forgejo/README.md",
|
||||
"sha256": "6250821cc41d10b92e6d91dde1f2b59b53a9d47d78ada3a597c9d039549c0da4"
|
||||
},
|
||||
{
|
||||
"path": "build/forgejo/forgejo-security-extension.patch",
|
||||
"sha256": "15cb7f13b1b1d1095cc344176ca337f705333a436a70ae803fcfd3d7f802ccf4"
|
||||
},
|
||||
{
|
||||
"path": "workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md",
|
||||
"sha256": "95b48b308d5154f87355b2c230dc9990241aeeb37c2094e164952150ed2fd258"
|
||||
}
|
||||
],
|
||||
"stdout": "[main 3fb031a] Compose Forgejo private-input and authenticated decision build candidate\n 5 files changed, 4756 insertions(+), 12 deletions(-)\n create mode 100644 build/forgejo/forgejo-security-extension.patch\n",
|
||||
"stderr": ""
|
||||
}
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
{
|
||||
"owner": "railiance-apps",
|
||||
"base_revision": "c29408ae6747158a639dc876e6d7492680675658",
|
||||
"message": "Compose Forgejo private-input and authenticated decision build candidate",
|
||||
"files": [
|
||||
{
|
||||
"path": "tools/forgejo-release-build.py",
|
||||
"sha256": "bd5b15ff2ca1e5694903aed3cd47c4fd1fb8baa43c49dd291029a9c9739cc96c"
|
||||
},
|
||||
{
|
||||
"path": "build/forgejo/inputs.lock.json",
|
||||
"sha256": "acf9859d1b1009d1afe0844f2068f9b95cfadb176591edce0ec42084604e4d65"
|
||||
},
|
||||
{
|
||||
"path": "build/forgejo/README.md",
|
||||
"sha256": "6250821cc41d10b92e6d91dde1f2b59b53a9d47d78ada3a597c9d039549c0da4"
|
||||
},
|
||||
{
|
||||
"path": "build/forgejo/forgejo-security-extension.patch",
|
||||
"sha256": "15cb7f13b1b1d1095cc344176ca337f705333a436a70ae803fcfd3d7f802ccf4"
|
||||
},
|
||||
{
|
||||
"path": "workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md",
|
||||
"sha256": "95b48b308d5154f87355b2c230dc9990241aeeb37c2094e164952150ed2fd258"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,42 @@
|
|||
{
|
||||
"owner": "railiance-apps",
|
||||
"base_revision": "git:c29408ae6747158a639dc876e6d7492680675658",
|
||||
"files": [
|
||||
{
|
||||
"path": "tools/forgejo-release-build.py",
|
||||
"source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/release-source/tools/forgejo-release-build.py",
|
||||
"before_sha256": "7e28d9bd5adefaece96eb1d31a23e128ec8f448958e45d22467bf7acf476a9ba",
|
||||
"sha256": "bd5b15ff2ca1e5694903aed3cd47c4fd1fb8baa43c49dd291029a9c9739cc96c"
|
||||
},
|
||||
{
|
||||
"path": "build/forgejo/inputs.lock.json",
|
||||
"source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/release-source/build/forgejo/inputs.lock.json",
|
||||
"before_sha256": "29f329b204a2a5f72084b50d59e8445486ff4799450097c6f3908c74e87a233a",
|
||||
"sha256": "acf9859d1b1009d1afe0844f2068f9b95cfadb176591edce0ec42084604e4d65"
|
||||
},
|
||||
{
|
||||
"path": "build/forgejo/README.md",
|
||||
"source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/release-source/build/forgejo/README.md",
|
||||
"before_sha256": "c3d37b8e62a99c351b8630a31f875fb8f4afbf54ec2488460066c88148f76fa8",
|
||||
"sha256": "6250821cc41d10b92e6d91dde1f2b59b53a9d47d78ada3a597c9d039549c0da4"
|
||||
},
|
||||
{
|
||||
"path": "build/forgejo/forgejo-security-extension.patch",
|
||||
"source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/release-source/build/forgejo/forgejo-security-extension.patch",
|
||||
"before_sha256": null,
|
||||
"sha256": "15cb7f13b1b1d1095cc344176ca337f705333a436a70ae803fcfd3d7f802ccf4"
|
||||
},
|
||||
{
|
||||
"path": "workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md",
|
||||
"source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/owner-integration/workplan.md",
|
||||
"before_sha256": "0ac8db087247bf980339ef8661a26eeb817af82391e3e85038be773fe3c6fb3a",
|
||||
"sha256": "95b48b308d5154f87355b2c230dc9990241aeeb37c2094e164952150ed2fd258"
|
||||
}
|
||||
],
|
||||
"preserved_other_tracked_files": 223,
|
||||
"original_task_uuids_preserved": 9,
|
||||
"status_change": "T09 todo -> progress",
|
||||
"native_actions": false,
|
||||
"independent_owner_review": false,
|
||||
"operational_admission": false
|
||||
}
|
||||
|
|
@ -0,0 +1,38 @@
|
|||
{
|
||||
"owner": "railiance-apps",
|
||||
"base_revision": "c29408ae6747158a639dc876e6d7492680675658",
|
||||
"files": [
|
||||
{
|
||||
"path": "tools/forgejo-release-build.py",
|
||||
"source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/release-source/tools/forgejo-release-build.py",
|
||||
"before_sha256": "7e28d9bd5adefaece96eb1d31a23e128ec8f448958e45d22467bf7acf476a9ba",
|
||||
"sha256": "bd5b15ff2ca1e5694903aed3cd47c4fd1fb8baa43c49dd291029a9c9739cc96c"
|
||||
},
|
||||
{
|
||||
"path": "build/forgejo/inputs.lock.json",
|
||||
"source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/release-source/build/forgejo/inputs.lock.json",
|
||||
"before_sha256": "29f329b204a2a5f72084b50d59e8445486ff4799450097c6f3908c74e87a233a",
|
||||
"sha256": "acf9859d1b1009d1afe0844f2068f9b95cfadb176591edce0ec42084604e4d65"
|
||||
},
|
||||
{
|
||||
"path": "build/forgejo/README.md",
|
||||
"source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/release-source/build/forgejo/README.md",
|
||||
"before_sha256": "c3d37b8e62a99c351b8630a31f875fb8f4afbf54ec2488460066c88148f76fa8",
|
||||
"sha256": "6250821cc41d10b92e6d91dde1f2b59b53a9d47d78ada3a597c9d039549c0da4"
|
||||
},
|
||||
{
|
||||
"path": "build/forgejo/forgejo-security-extension.patch",
|
||||
"source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/release-source/build/forgejo/forgejo-security-extension.patch",
|
||||
"before_sha256": null,
|
||||
"sha256": "15cb7f13b1b1d1095cc344176ca337f705333a436a70ae803fcfd3d7f802ccf4"
|
||||
},
|
||||
{
|
||||
"path": "workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md",
|
||||
"source": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-18/forgejo-keycape-claims-r1/owner-integration/workplan.md",
|
||||
"before_sha256": "0ac8db087247bf980339ef8661a26eeb817af82391e3e85038be773fe3c6fb3a",
|
||||
"sha256": "95b48b308d5154f87355b2c230dc9990241aeeb37c2094e164952150ed2fd258"
|
||||
}
|
||||
],
|
||||
"native_actions": false,
|
||||
"independent_owner_review": false
|
||||
}
|
||||
|
|
@ -0,0 +1,91 @@
|
|||
[
|
||||
{
|
||||
"repo": "railiance-apps",
|
||||
"workplan_id": "f6b1d6f6-0abb-5774-87b9-bf3cfb640a3b",
|
||||
"tasks": [
|
||||
{
|
||||
"id": "RAPPS-WP-0016-T01",
|
||||
"uuid": "98004ed0-83e6-5f6e-9b18-15b8b2aec2e7",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"id": "RAPPS-WP-0016-T02",
|
||||
"uuid": "13cd3aec-c87d-5d3f-a421-39d8ff131edd",
|
||||
"status": "wait"
|
||||
},
|
||||
{
|
||||
"id": "RAPPS-WP-0016-T03",
|
||||
"uuid": "81f072aa-c316-511e-a2cd-21dd1b1d0a00",
|
||||
"status": "wait"
|
||||
},
|
||||
{
|
||||
"id": "RAPPS-WP-0016-T04",
|
||||
"uuid": "32c54737-c40f-5fde-9b91-163f8dcb0068",
|
||||
"status": "wait"
|
||||
},
|
||||
{
|
||||
"id": "RAPPS-WP-0016-T05",
|
||||
"uuid": "728786c9-f1f9-5983-a6a4-dea21faf67f5",
|
||||
"status": "wait"
|
||||
},
|
||||
{
|
||||
"id": "RAPPS-WP-0016-T06",
|
||||
"uuid": "08ab8921-7801-5309-b84b-bc2a3ceea1e4",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"id": "RAPPS-WP-0016-T07",
|
||||
"uuid": "786d6584-6db1-5a10-9324-d7b94db0df94",
|
||||
"status": "progress"
|
||||
},
|
||||
{
|
||||
"id": "RAPPS-WP-0016-T08",
|
||||
"uuid": "4ab8a5e7-ab32-5ee2-aaf2-6da246d1b0c8",
|
||||
"status": "progress"
|
||||
},
|
||||
{
|
||||
"id": "RAPPS-WP-0016-T09",
|
||||
"uuid": "d3804638-c73d-5b9f-a456-4262f62f9e6b",
|
||||
"status": "progress"
|
||||
}
|
||||
],
|
||||
"all_uuid_status_bindings_exact": true
|
||||
},
|
||||
{
|
||||
"repo": "the-custodian",
|
||||
"workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52",
|
||||
"tasks": [
|
||||
{
|
||||
"id": "CUST-WP-0080-T01",
|
||||
"uuid": "c770f7e1-25eb-53ec-9a37-1f7794077ff8",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"id": "CUST-WP-0080-T02",
|
||||
"uuid": "5973026f-8ca9-5882-99fe-65a54bc250ac",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"id": "CUST-WP-0080-T03",
|
||||
"uuid": "87637402-02f1-57c1-8fbc-4141598af8e3",
|
||||
"status": "progress"
|
||||
},
|
||||
{
|
||||
"id": "CUST-WP-0080-T04",
|
||||
"uuid": "82378b0f-7004-5c2f-9683-b356a1227576",
|
||||
"status": "todo"
|
||||
},
|
||||
{
|
||||
"id": "CUST-WP-0080-T05",
|
||||
"uuid": "ed8b909a-23bf-5e5f-b600-e477fbae136b",
|
||||
"status": "progress"
|
||||
},
|
||||
{
|
||||
"id": "CUST-WP-0080-T06",
|
||||
"uuid": "6aca534c-5c7a-556f-b6b6-406433670c29",
|
||||
"status": "progress"
|
||||
}
|
||||
],
|
||||
"all_uuid_status_bindings_exact": true
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,263 @@
|
|||
---
|
||||
id: RAPPS-WP-0016
|
||||
type: workplan
|
||||
title: "Forgejo sign-in through NetKingdom, before the forge closes"
|
||||
domain: infotech
|
||||
repo: railiance-apps
|
||||
status: active
|
||||
flavor: implementation
|
||||
owner: claude-code
|
||||
topic_slug: railiance
|
||||
created: "2026-10-08"
|
||||
updated: "2026-10-18"
|
||||
depends_on:
|
||||
- KEY-WP-0038
|
||||
related_repos:
|
||||
- prj-forgejo-org-refactor
|
||||
- key-cape
|
||||
- railiance-platform
|
||||
state_hub_workstream_id: "f6b1d6f6-0abb-5774-87b9-bf3cfb640a3b"
|
||||
---
|
||||
|
||||
# RAPPS-WP-0016 - Forgejo sign-in through NetKingdom, before the forge closes
|
||||
|
||||
## Why
|
||||
|
||||
`forgejo.coulomb.social` is closing: private by default, no anonymous access
|
||||
(prj-forgejo-org-refactor ORGREF-WP-0002, decision
|
||||
`decisions/forge-visibility-policy.md`). The founder's condition is that sign-in
|
||||
runs through NetKingdom first. railiance-apps owns the Forgejo Helm release
|
||||
(`docs/forgejo-on-railiance01.md`: S5 Helm release, ingress, operator Makefile),
|
||||
so the Forgejo side lands here. This plan is ORGREF-WP-0002-T05. The NetKingdom
|
||||
side is key-cape `KEY-WP-0038`.
|
||||
|
||||
## Boundaries
|
||||
|
||||
- **Founder guardrail:** tighten gradually; never lock anyone out; never risk
|
||||
assets; never reach a state that is hard to repair. Every step keeps the
|
||||
current sign-in path working until the new one is proven.
|
||||
- **No visibility change** in this plan. Repositories, packages and
|
||||
`REQUIRE_SIGNIN_VIEW` are ORGREF-WP-0002-T08.
|
||||
- **Configuration in git.** The authentication source is declared in
|
||||
`helm/forgejo-values.yaml` (`gitea.oauth`), with its secret drawn from an
|
||||
ExternalSecret over OpenBao. No click-ops, and no secret value in git.
|
||||
- Open registration is already disabled (`service.DISABLE_REGISTRATION: true`).
|
||||
This plan keeps it that way.
|
||||
|
||||
## Tasks
|
||||
|
||||
```task
|
||||
id: RAPPS-WP-0016-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "98004ed0-83e6-5f6e-9b18-15b8b2aec2e7"
|
||||
```
|
||||
|
||||
### T01 — Make the local administrator a sealed break-glass
|
||||
|
||||
Before anything about sign-in changes: confirm the local administrator account
|
||||
works, keep its credential only in OpenBao, and document recovery (who, how,
|
||||
where it is logged) in `docs/forgejo-on-railiance01.md`. Verify one break-glass
|
||||
sign-in and record it without the credential.
|
||||
|
||||
Acceptance: a recorded break-glass sign-in, with the recovery path written down.
|
||||
This is the "never lock ourselves out" floor for every later step.
|
||||
|
||||
Done 2026-10-17: founder sealed `forgejo_admin` into OpenBao
|
||||
`platform/workloads/forgejo/break-glass-admin` (version 1) and verified a local
|
||||
sign-in (HTTP 200, site admin): `docs/evidence/2026-10-17-forgejo-breakglass-signin.json`.
|
||||
Recovery path: `docs/forgejo-on-railiance01.md` § Break-glass administrator.
|
||||
|
||||
```task
|
||||
id: RAPPS-WP-0016-T02
|
||||
status: wait
|
||||
depends_on: [RAPPS-WP-0016-T01, KEY-WP-0038-T02]
|
||||
blocking_reason: "Break-glass done (T01); needs the NetKingdom client registered with its secret in custody (KEY-WP-0038-T02)."
|
||||
priority: high
|
||||
state_hub_task_id: "13cd3aec-c87d-5d3f-a421-39d8ff131edd"
|
||||
```
|
||||
|
||||
### T02 — Add the NetKingdom authentication source
|
||||
|
||||
- an ExternalSecret delivering the `forgejo` client secret from OpenBao to a
|
||||
Secret in the `forgejo` namespace. Custody path is
|
||||
`platform/workloads/keycape/forgejo`, field `CLIENT_SECRET`, read by ESO through
|
||||
Kubernetes-auth role `external-secrets-keycape-forgejo-forgejo`, which carries
|
||||
only policy `workload-kv-read-keycape-forgejo-forgejo` (net-kingdom 074b3a0;
|
||||
replaces the earlier `platform/workloads/forgejo/netkingdom-oidc-client` proposal). The
|
||||
SA/SecretStore/ExternalSecret shape follows the NK-WP-0048
|
||||
`deliver-consumer-secret` receipt contract
|
||||
(`docs/evidence/nk48-t16-owner-review/owner-review-railiance-apps.json`)
|
||||
- `gitea.oauth`: name `netkingdom` (must match the redirect URI registered in
|
||||
key-cape), provider `openidConnect`, auto-discovery from
|
||||
`https://kc.coulomb.social/.well-known/openid-configuration`, scopes
|
||||
`openid profile email groups`, group-claim name `groups`
|
||||
- `oauth2_client` settings: no automatic account creation for unknown subjects;
|
||||
account linking to existing local accounts by username after a successful
|
||||
local sign-in (so the founder and agent accounts keep their history)
|
||||
- Helm upgrade with the previous revision noted for rollback
|
||||
|
||||
Local password sign-in stays enabled.
|
||||
|
||||
Acceptance: the "Sign in with netkingdom" option appears. Local sign-in still
|
||||
works. Rollback is one `helm rollback` to the noted revision.
|
||||
|
||||
```task
|
||||
id: RAPPS-WP-0016-T03
|
||||
status: wait
|
||||
depends_on: [RAPPS-WP-0016-T02]
|
||||
blocking_reason: "Linking and team mapping follow a working authentication source."
|
||||
priority: high
|
||||
state_hub_task_id: "81f072aa-c316-511e-a2cd-21dd1b1d0a00"
|
||||
```
|
||||
|
||||
### T03 — Link accounts and map groups to teams
|
||||
|
||||
- The founder links their account through NetKingdom (MFA), then signs in again
|
||||
through NetKingdom only and sees the same repositories, organisations and
|
||||
admin rights.
|
||||
- Map NetKingdom groups (names agreed in KEY-WP-0038-T01) to organisation teams:
|
||||
owners and readers at least. Create the read-only teams that
|
||||
ORGREF-WP-0002-T06 consumers will use.
|
||||
- Apply KEY-WP-0038-T03's decision on agents and services: NetKingdom sign-in, or
|
||||
scoped tokens bound to service identities.
|
||||
|
||||
Acceptance: founder and one agent work through NetKingdom; group-to-team mapping
|
||||
verified by adding and removing one test membership; break-glass still works.
|
||||
|
||||
```task
|
||||
id: RAPPS-WP-0016-T04
|
||||
status: wait
|
||||
depends_on: [RAPPS-WP-0016-T03]
|
||||
needs_human: true
|
||||
blocking_reason: "Restricting local password sign-in is a founder decision once NetKingdom sign-in is proven."
|
||||
priority: medium
|
||||
state_hub_task_id: "32c54737-c40f-5fde-9b91-163f8dcb0068"
|
||||
```
|
||||
|
||||
### T04 — Decide on local password sign-in
|
||||
|
||||
Once NetKingdom sign-in has been used for a while without problems, the founder
|
||||
decides whether local password sign-in is turned off for everyone except
|
||||
break-glass. This is not required to close the forge; it is the next tightening
|
||||
step, taken separately.
|
||||
|
||||
```task
|
||||
id: RAPPS-WP-0016-T05
|
||||
status: wait
|
||||
depends_on: [RAPPS-WP-0016-T02]
|
||||
blocking_reason: "Waits for net-kingdom's answer to the Apps 1.3 needs-change record (the-custodian docs/changes/netkingdom-target-2026-10-17/nk48-1.3-owner-review/owner-review-railiance-apps.json: RAPPS-1.3-C1..C3) and the re-frozen 1.3 candidate."
|
||||
priority: medium
|
||||
state_hub_task_id: "728786c9-f1f9-5983-a6a4-dea21faf67f5"
|
||||
```
|
||||
|
||||
### T05 — Apps owner seams for NK-WP-0048 consumer steps
|
||||
|
||||
Implement the real Apps capabilities behind the `deliver-consumer-secret` and
|
||||
`hand-over` adapters, as owner-run paths (option C): `owner_apply` /
|
||||
`owner_remove` emitting `netkingdom.consumer-secret-delivery.v1` receipts from the
|
||||
T02 objects; a consumer verifier that observes Forgejo sign-in and the T03
|
||||
positive/negative group probes; and a committed-evidence hand-over receipt store.
|
||||
See the owner-review record for the contract.
|
||||
|
||||
Acceptance: receipts produced from the live T02/T03 run validate against the
|
||||
adapters' checks with no value-bearing keys.
|
||||
|
||||
## Also in scope: stale node credential
|
||||
|
||||
The k3s `registries.yaml` on railiance01 still holds a login for the frozen Gitea
|
||||
host `92.205.130.254` (ORGREF-WP-0002-T02). Coordinate its removal with the node
|
||||
owner when ORGREF-WP-0002-T06 adds the forge registry login, in the same change.
|
||||
|
||||
|
||||
## T06 — Package the reviewed consumer source through the Apps build path
|
||||
|
||||
```task
|
||||
id: RAPPS-WP-0016-T06
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "08ab8921-7801-5309-b84b-bc2a3ceea1e4"
|
||||
```
|
||||
|
||||
Completed 2026-10-18, source build tooling only. The existing Apps Makefile now
|
||||
has explicit prepare, public-dependency acquisition, offline build, artifact
|
||||
verification and local OCI export targets for the pinned official Forgejo11.0.3
|
||||
source plus reviewed multi-value claim patch. Source/toolchains/locks/compiler
|
||||
inputs/base image are fixed. Third-party application source stays in a new /tmp
|
||||
workspace; Apps holds the release input lock, patch and build recipe.
|
||||
|
||||
The original build profile produced identical frontend assets, bindata sources
|
||||
and complete static executable in two workspaces, and identical local OCI
|
||||
archives in two no-cache exports. Independent review then found host process
|
||||
argv visibility through /proc (APPSBUILD-R1-F01). The revised recipe adds a
|
||||
private PID namespace; exact source and synthetic canary regression are separately
|
||||
reviewed. The original full builds are historical r1-profile evidence; no full
|
||||
r2 build is claimed. Original packet/review and failure history remain in
|
||||
Custodian apps-forgejo-release-build-r1 and apps-release-independent-review-r1;
|
||||
the correction is apps-forgejo-release-build-r2. This is coordinator source
|
||||
integration after independent technical review, not formal owner assent or image
|
||||
admission. Helm values, deployed image, local sign-in and visibility are unchanged.
|
||||
NK-WP-0048-T39 remains progress for the full release acceptance scope.
|
||||
|
||||
## T07 — Keep the client secret out of process arguments
|
||||
|
||||
```task
|
||||
id: RAPPS-WP-0016-T07
|
||||
status: progress
|
||||
priority: high
|
||||
state_hub_task_id: "786d6584-6db1-5a10-9324-d7b94db0df94"
|
||||
```
|
||||
|
||||
Implement and independently review a real Forgejo add/update --secret-file path
|
||||
and the actual chart helper/mount adaptation. Preserve the existing CLIENT_SECRET
|
||||
key and custody route; use no agent-value argument or environment fallback. Test
|
||||
bounded stable nofollow file reads, exact existing minted-secret encoding,
|
||||
mutual exclusion/update preservation, fixed errors and actual Helm rendering.
|
||||
Private mount identity/reader set and new package/type revisions need explicit
|
||||
owner/runtime admission. The in-progress isolated candidate is Custodian
|
||||
forgejo-private-input-r1; source completion is distinct from T02 native delivery.
|
||||
|
||||
## T08 — Provide a transactional application-source inverse and durable recovery
|
||||
|
||||
```task
|
||||
id: RAPPS-WP-0016-T08
|
||||
status: progress
|
||||
priority: high
|
||||
state_hub_task_id: "4ab8a5e7-ab32-5ee2-aaf2-6da246d1b0c8"
|
||||
```
|
||||
|
||||
Implement actual owner database primitives that record operation intent/outcome
|
||||
in the same durable database, compare complete raw persisted before/post/current
|
||||
source state privately, and serialize conflicting application writers at the DB
|
||||
boundary. Never emit stored credential/config bytes or delete/detach linked users
|
||||
or a preexisting/shared source. SQLite and PostgreSQL transaction semantics must
|
||||
be tested against the real app packages; unsupported backends refuse.
|
||||
|
||||
T05 and NK-WP-0048-T34 additionally require actual authenticated execution and
|
||||
fresh inverse sessions, admitted evidence/recovery and exclusion of every release
|
||||
writer, including Helm/runtime writers. The candidate DB primitive alone does
|
||||
not establish those facilities. Helm rollback/omission does not remove persisted
|
||||
OAuth sources: verify the exact app-state inverse before any image downgrade.
|
||||
If links prevent removal, retain the extended image and reconcile. The earlier
|
||||
T02 single-Helm-rollback statement is not sufficient recovery for this extension;
|
||||
its historical text is retained and corrected here.
|
||||
|
||||
## T09 — Enforce authenticated Access Engine decisions in the application path
|
||||
|
||||
```task
|
||||
id: RAPPS-WP-0016-T09
|
||||
status: todo
|
||||
priority: high
|
||||
state_hub_task_id: "d3804638-c73d-5b9f-a456-4262f62f9e6b"
|
||||
```
|
||||
|
||||
Use the producer-owned decision format/canonical bytes and independently admitted
|
||||
signer/policy/request pins. Forgejo must verify the caller's issuer/tenant and
|
||||
assurance facts, obtain and authenticate the exact Access Engine resource/action
|
||||
decision, and refuse missing, stale, wrong-pin, unavailable or malformed replies.
|
||||
Keep the original three-group any-of access set as policy input; its local
|
||||
compatibility gate is not a substitute PDP or an architecture exception. An
|
||||
issuer allowed/denied claim cannot manufacture authorization. Source integration
|
||||
needs real provider/callback/session wiring and meaningful producer-consumer
|
||||
positive/adverse tests before re-freezing the case and package. Existing break-
|
||||
glass/local account and linking behavior remain within the declared owner scope.
|
||||
|
|
@ -0,0 +1,283 @@
|
|||
---
|
||||
id: RAPPS-WP-0016
|
||||
type: workplan
|
||||
title: "Forgejo sign-in through NetKingdom, before the forge closes"
|
||||
domain: infotech
|
||||
repo: railiance-apps
|
||||
status: active
|
||||
flavor: implementation
|
||||
owner: claude-code
|
||||
topic_slug: railiance
|
||||
created: "2026-10-08"
|
||||
updated: "2026-10-18"
|
||||
depends_on:
|
||||
- KEY-WP-0038
|
||||
related_repos:
|
||||
- prj-forgejo-org-refactor
|
||||
- key-cape
|
||||
- railiance-platform
|
||||
state_hub_workstream_id: "f6b1d6f6-0abb-5774-87b9-bf3cfb640a3b"
|
||||
---
|
||||
|
||||
# RAPPS-WP-0016 - Forgejo sign-in through NetKingdom, before the forge closes
|
||||
|
||||
## Why
|
||||
|
||||
`forgejo.coulomb.social` is closing: private by default, no anonymous access
|
||||
(prj-forgejo-org-refactor ORGREF-WP-0002, decision
|
||||
`decisions/forge-visibility-policy.md`). The founder's condition is that sign-in
|
||||
runs through NetKingdom first. railiance-apps owns the Forgejo Helm release
|
||||
(`docs/forgejo-on-railiance01.md`: S5 Helm release, ingress, operator Makefile),
|
||||
so the Forgejo side lands here. This plan is ORGREF-WP-0002-T05. The NetKingdom
|
||||
side is key-cape `KEY-WP-0038`.
|
||||
|
||||
## Boundaries
|
||||
|
||||
- **Founder guardrail:** tighten gradually; never lock anyone out; never risk
|
||||
assets; never reach a state that is hard to repair. Every step keeps the
|
||||
current sign-in path working until the new one is proven.
|
||||
- **No visibility change** in this plan. Repositories, packages and
|
||||
`REQUIRE_SIGNIN_VIEW` are ORGREF-WP-0002-T08.
|
||||
- **Configuration in git.** The authentication source is declared in
|
||||
`helm/forgejo-values.yaml` (`gitea.oauth`), with its secret drawn from an
|
||||
ExternalSecret over OpenBao. No click-ops, and no secret value in git.
|
||||
- Open registration is already disabled (`service.DISABLE_REGISTRATION: true`).
|
||||
This plan keeps it that way.
|
||||
|
||||
## Tasks
|
||||
|
||||
```task
|
||||
id: RAPPS-WP-0016-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "98004ed0-83e6-5f6e-9b18-15b8b2aec2e7"
|
||||
```
|
||||
|
||||
### T01 — Make the local administrator a sealed break-glass
|
||||
|
||||
Before anything about sign-in changes: confirm the local administrator account
|
||||
works, keep its credential only in OpenBao, and document recovery (who, how,
|
||||
where it is logged) in `docs/forgejo-on-railiance01.md`. Verify one break-glass
|
||||
sign-in and record it without the credential.
|
||||
|
||||
Acceptance: a recorded break-glass sign-in, with the recovery path written down.
|
||||
This is the "never lock ourselves out" floor for every later step.
|
||||
|
||||
Done 2026-10-17: founder sealed `forgejo_admin` into OpenBao
|
||||
`platform/workloads/forgejo/break-glass-admin` (version 1) and verified a local
|
||||
sign-in (HTTP 200, site admin): `docs/evidence/2026-10-17-forgejo-breakglass-signin.json`.
|
||||
Recovery path: `docs/forgejo-on-railiance01.md` § Break-glass administrator.
|
||||
|
||||
```task
|
||||
id: RAPPS-WP-0016-T02
|
||||
status: wait
|
||||
depends_on: [RAPPS-WP-0016-T01, KEY-WP-0038-T02]
|
||||
blocking_reason: "Break-glass done (T01); needs the NetKingdom client registered with its secret in custody (KEY-WP-0038-T02)."
|
||||
priority: high
|
||||
state_hub_task_id: "13cd3aec-c87d-5d3f-a421-39d8ff131edd"
|
||||
```
|
||||
|
||||
### T02 — Add the NetKingdom authentication source
|
||||
|
||||
- an ExternalSecret delivering the `forgejo` client secret from OpenBao to a
|
||||
Secret in the `forgejo` namespace. Custody path is
|
||||
`platform/workloads/keycape/forgejo`, field `CLIENT_SECRET`, read by ESO through
|
||||
Kubernetes-auth role `external-secrets-keycape-forgejo-forgejo`, which carries
|
||||
only policy `workload-kv-read-keycape-forgejo-forgejo` (net-kingdom 074b3a0;
|
||||
replaces the earlier `platform/workloads/forgejo/netkingdom-oidc-client` proposal). The
|
||||
SA/SecretStore/ExternalSecret shape follows the NK-WP-0048
|
||||
`deliver-consumer-secret` receipt contract
|
||||
(`docs/evidence/nk48-t16-owner-review/owner-review-railiance-apps.json`)
|
||||
- `gitea.oauth`: name `netkingdom` (must match the redirect URI registered in
|
||||
key-cape), provider `openidConnect`, auto-discovery from
|
||||
`https://kc.coulomb.social/.well-known/openid-configuration`, scopes
|
||||
`openid profile email groups`, group-claim name `groups`
|
||||
- `oauth2_client` settings: no automatic account creation for unknown subjects;
|
||||
account linking to existing local accounts by username after a successful
|
||||
local sign-in (so the founder and agent accounts keep their history)
|
||||
- Helm upgrade with the previous revision noted for rollback
|
||||
|
||||
Local password sign-in stays enabled.
|
||||
|
||||
Acceptance: the "Sign in with netkingdom" option appears. Local sign-in still
|
||||
works. Rollback is one `helm rollback` to the noted revision.
|
||||
|
||||
```task
|
||||
id: RAPPS-WP-0016-T03
|
||||
status: wait
|
||||
depends_on: [RAPPS-WP-0016-T02]
|
||||
blocking_reason: "Linking and team mapping follow a working authentication source."
|
||||
priority: high
|
||||
state_hub_task_id: "81f072aa-c316-511e-a2cd-21dd1b1d0a00"
|
||||
```
|
||||
|
||||
### T03 — Link accounts and map groups to teams
|
||||
|
||||
- The founder links their account through NetKingdom (MFA), then signs in again
|
||||
through NetKingdom only and sees the same repositories, organisations and
|
||||
admin rights.
|
||||
- Map NetKingdom groups (names agreed in KEY-WP-0038-T01) to organisation teams:
|
||||
owners and readers at least. Create the read-only teams that
|
||||
ORGREF-WP-0002-T06 consumers will use.
|
||||
- Apply KEY-WP-0038-T03's decision on agents and services: NetKingdom sign-in, or
|
||||
scoped tokens bound to service identities.
|
||||
|
||||
Acceptance: founder and one agent work through NetKingdom; group-to-team mapping
|
||||
verified by adding and removing one test membership; break-glass still works.
|
||||
|
||||
```task
|
||||
id: RAPPS-WP-0016-T04
|
||||
status: wait
|
||||
depends_on: [RAPPS-WP-0016-T03]
|
||||
needs_human: true
|
||||
blocking_reason: "Restricting local password sign-in is a founder decision once NetKingdom sign-in is proven."
|
||||
priority: medium
|
||||
state_hub_task_id: "32c54737-c40f-5fde-9b91-163f8dcb0068"
|
||||
```
|
||||
|
||||
### T04 — Decide on local password sign-in
|
||||
|
||||
Once NetKingdom sign-in has been used for a while without problems, the founder
|
||||
decides whether local password sign-in is turned off for everyone except
|
||||
break-glass. This is not required to close the forge; it is the next tightening
|
||||
step, taken separately.
|
||||
|
||||
```task
|
||||
id: RAPPS-WP-0016-T05
|
||||
status: wait
|
||||
depends_on: [RAPPS-WP-0016-T02]
|
||||
blocking_reason: "Waits for net-kingdom's answer to the Apps 1.3 needs-change record (the-custodian docs/changes/netkingdom-target-2026-10-17/nk48-1.3-owner-review/owner-review-railiance-apps.json: RAPPS-1.3-C1..C3) and the re-frozen 1.3 candidate."
|
||||
priority: medium
|
||||
state_hub_task_id: "728786c9-f1f9-5983-a6a4-dea21faf67f5"
|
||||
```
|
||||
|
||||
### T05 — Apps owner seams for NK-WP-0048 consumer steps
|
||||
|
||||
Implement the real Apps capabilities behind the `deliver-consumer-secret` and
|
||||
`hand-over` adapters, as owner-run paths (option C): `owner_apply` /
|
||||
`owner_remove` emitting `netkingdom.consumer-secret-delivery.v1` receipts from the
|
||||
T02 objects; a consumer verifier that observes Forgejo sign-in and the T03
|
||||
positive/negative group probes; and a committed-evidence hand-over receipt store.
|
||||
See the owner-review record for the contract.
|
||||
|
||||
Acceptance: receipts produced from the live T02/T03 run validate against the
|
||||
adapters' checks with no value-bearing keys.
|
||||
|
||||
## Also in scope: stale node credential
|
||||
|
||||
The k3s `registries.yaml` on railiance01 still holds a login for the frozen Gitea
|
||||
host `92.205.130.254` (ORGREF-WP-0002-T02). Coordinate its removal with the node
|
||||
owner when ORGREF-WP-0002-T06 adds the forge registry login, in the same change.
|
||||
|
||||
|
||||
## T06 — Package the reviewed consumer source through the Apps build path
|
||||
|
||||
```task
|
||||
id: RAPPS-WP-0016-T06
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "08ab8921-7801-5309-b84b-bc2a3ceea1e4"
|
||||
```
|
||||
|
||||
Completed 2026-10-18, source build tooling only. The existing Apps Makefile now
|
||||
has explicit prepare, public-dependency acquisition, offline build, artifact
|
||||
verification and local OCI export targets for the pinned official Forgejo11.0.3
|
||||
source plus reviewed multi-value claim patch. Source/toolchains/locks/compiler
|
||||
inputs/base image are fixed. Third-party application source stays in a new /tmp
|
||||
workspace; Apps holds the release input lock, patch and build recipe.
|
||||
|
||||
The original build profile produced identical frontend assets, bindata sources
|
||||
and complete static executable in two workspaces, and identical local OCI
|
||||
archives in two no-cache exports. Independent review then found host process
|
||||
argv visibility through /proc (APPSBUILD-R1-F01). The revised recipe adds a
|
||||
private PID namespace; exact source and synthetic canary regression are separately
|
||||
reviewed. The original full builds are historical r1-profile evidence; no full
|
||||
r2 build is claimed. Original packet/review and failure history remain in
|
||||
Custodian apps-forgejo-release-build-r1 and apps-release-independent-review-r1;
|
||||
the correction is apps-forgejo-release-build-r2. This is coordinator source
|
||||
integration after independent technical review, not formal owner assent or image
|
||||
admission. Helm values, deployed image, local sign-in and visibility are unchanged.
|
||||
NK-WP-0048-T39 remains progress for the full release acceptance scope.
|
||||
|
||||
## T07 — Keep the client secret out of process arguments
|
||||
|
||||
```task
|
||||
id: RAPPS-WP-0016-T07
|
||||
status: progress
|
||||
priority: high
|
||||
state_hub_task_id: "786d6584-6db1-5a10-9324-d7b94db0df94"
|
||||
```
|
||||
|
||||
Implement and independently review a real Forgejo add/update --secret-file path
|
||||
and the actual chart helper/mount adaptation. Preserve the existing CLIENT_SECRET
|
||||
key and custody route; use no agent-value argument or environment fallback. Test
|
||||
bounded stable nofollow file reads, exact existing minted-secret encoding,
|
||||
mutual exclusion/update preservation, fixed errors and actual Helm rendering.
|
||||
Private mount identity/reader set and new package/type revisions need explicit
|
||||
owner/runtime admission. The in-progress isolated candidate is Custodian
|
||||
forgejo-private-input-r1; source completion is distinct from T02 native delivery.
|
||||
|
||||
## T08 — Provide a transactional application-source inverse and durable recovery
|
||||
|
||||
```task
|
||||
id: RAPPS-WP-0016-T08
|
||||
status: progress
|
||||
priority: high
|
||||
state_hub_task_id: "4ab8a5e7-ab32-5ee2-aaf2-6da246d1b0c8"
|
||||
```
|
||||
|
||||
Implement actual owner database primitives that record operation intent/outcome
|
||||
in the same durable database, compare complete raw persisted before/post/current
|
||||
source state privately, and serialize conflicting application writers at the DB
|
||||
boundary. Never emit stored credential/config bytes or delete/detach linked users
|
||||
or a preexisting/shared source. SQLite and PostgreSQL transaction semantics must
|
||||
be tested against the real app packages; unsupported backends refuse.
|
||||
|
||||
T05 and NK-WP-0048-T34 additionally require actual authenticated execution and
|
||||
fresh inverse sessions, admitted evidence/recovery and exclusion of every release
|
||||
writer, including Helm/runtime writers. The candidate DB primitive alone does
|
||||
not establish those facilities. Helm rollback/omission does not remove persisted
|
||||
OAuth sources: verify the exact app-state inverse before any image downgrade.
|
||||
If links prevent removal, retain the extended image and reconcile. The earlier
|
||||
T02 single-Helm-rollback statement is not sufficient recovery for this extension;
|
||||
its historical text is retained and corrected here.
|
||||
|
||||
## T09 — Enforce authenticated Access Engine decisions in the application path
|
||||
|
||||
```task
|
||||
id: RAPPS-WP-0016-T09
|
||||
status: progress
|
||||
priority: high
|
||||
state_hub_task_id: "d3804638-c73d-5b9f-a456-4262f62f9e6b"
|
||||
```
|
||||
|
||||
Use the producer-owned decision format/canonical bytes and independently admitted
|
||||
signer/policy/request pins. Forgejo must verify the caller's issuer/tenant and
|
||||
assurance facts, obtain and authenticate the exact Access Engine resource/action
|
||||
decision, and refuse missing, stale, wrong-pin, unavailable or malformed replies.
|
||||
Keep the original three-group any-of access set as policy input; its local
|
||||
compatibility gate is not a substitute PDP or an architecture exception. An
|
||||
issuer allowed/denied claim cannot manufacture authorization. Source integration
|
||||
needs real provider/callback/session wiring and meaningful producer-consumer
|
||||
positive/adverse tests before re-freezing the case and package. Existing break-
|
||||
glass/local account and linking behavior remain within the declared owner scope.
|
||||
|
||||
2026-10-18 source continuation for T07/T08/T09: the digest-bound build
|
||||
candidate now composes all 37 paths, including private secret-file input, actual
|
||||
source-state transactions/private SQL hooks, the producer-owned Access Engine
|
||||
Check client from ca0cb757 and guarded OIDC callback enforcement. The parser uses
|
||||
the actual KeyCape typed assurance/authentication-time/provenance contract; its
|
||||
actual issuer fixture/callback suite passes 71 test/subtest results, and selected
|
||||
composed packages pass 93 with no skips. The previous incompatible-string-claim
|
||||
rejection is retained. All patch postimages independently replay from the pinned
|
||||
official archive. Complete release build/verification is tracked in Custodian
|
||||
forgejo-keycape-claims-r1; earlier release outputs do not prove this revision.
|
||||
|
||||
This is coordinator source integration of a tested build candidate; independent
|
||||
owner review and formal operational admission remain open. T07's chart/private
|
||||
mount admission, T08's fresh authenticated operation/inverse and release-wide
|
||||
writer exclusion, T09's ongoing HTTP/API/Git/SSH paths, private evidence/retention,
|
||||
PostgreSQL/native proof and actual issuer/factor/custody acceptance remain open.
|
||||
No trust, deployed image, Helm values, source DB, user/link state or local sign-in
|
||||
is changed by this build-source update. The preserved legacy patch is historical;
|
||||
the input lock now explicitly selects forgejo-security-extension.patch.
|
||||
|
|
@ -0,0 +1,205 @@
|
|||
// Copyright 2026 The Forgejo Authors. All rights reserved.
|
||||
// SPDX-License-Identifier: MIT
|
||||
|
||||
package oauth2
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto"
|
||||
"crypto/x509"
|
||||
"encoding/json"
|
||||
"encoding/pem"
|
||||
"errors"
|
||||
"io"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/golang-jwt/jwt/v5"
|
||||
"github.com/markbates/goth"
|
||||
"github.com/netkingdom/access-engine/pkg/api"
|
||||
"github.com/netkingdom/access-engine/pkg/decisionpep"
|
||||
)
|
||||
|
||||
var errApplicationDecision = errors.New("current authenticated application access refused")
|
||||
|
||||
// AccessEngineAdmission contains owner-admitted public trust, with only a file
|
||||
// reference to the private PDP caller token. It is not persisted OAuth source
|
||||
// configuration and cannot be replaced by token claims or provider discovery.
|
||||
type AccessEngineAdmission struct {
|
||||
SourceName string `json:"source_name"`
|
||||
Issuer string `json:"issuer"`
|
||||
Audience string `json:"audience"`
|
||||
TokenType string `json:"token_type"`
|
||||
Algorithms []string `json:"algorithms"`
|
||||
IdentityKeys map[string]string `json:"identity_keys"`
|
||||
TenantClaim string `json:"tenant_claim"`
|
||||
PrincipalTypeClaim string `json:"principal_type_claim"`
|
||||
AssuranceClaim string `json:"assurance_claim"`
|
||||
MaxIdentityAge string `json:"max_identity_age"`
|
||||
Decision decisionpep.Admission `json:"decision"`
|
||||
}
|
||||
|
||||
// VerifiedApplicationIdentity is derived only by VerifyApplicationIdentity from
|
||||
// independently admitted JOSE keys. RawData and UserInfo never supply these
|
||||
// fields. This snapshot is an identity fact, never an authorization verdict.
|
||||
type VerifiedApplicationIdentity struct {
|
||||
Issuer string
|
||||
Subject string
|
||||
Tenant string
|
||||
PrincipalType api.SubjectType
|
||||
Assurance string
|
||||
NotAfter time.Time
|
||||
}
|
||||
|
||||
func loadAccessEngineAdmission(path string) (AccessEngineAdmission, error) {
|
||||
var a AccessEngineAdmission
|
||||
if !filepath.IsAbs(path) {
|
||||
return a, errApplicationDecision
|
||||
}
|
||||
f, e := os.Open(path)
|
||||
if e != nil {
|
||||
return a, errApplicationDecision
|
||||
}
|
||||
defer f.Close()
|
||||
stat, e := f.Stat()
|
||||
if e != nil || !stat.Mode().IsRegular() || stat.Mode().Perm()&0022 != 0 {
|
||||
return a, errApplicationDecision
|
||||
}
|
||||
raw, e := io.ReadAll(io.LimitReader(f, 1<<20+1))
|
||||
if e != nil || len(raw) > 1<<20 {
|
||||
return a, errApplicationDecision
|
||||
}
|
||||
d := json.NewDecoder(strings.NewReader(string(raw)))
|
||||
d.DisallowUnknownFields()
|
||||
if d.Decode(&a) != nil {
|
||||
return a, errApplicationDecision
|
||||
}
|
||||
if _, e = d.Token(); e != io.EOF {
|
||||
return a, errApplicationDecision
|
||||
}
|
||||
return a, nil
|
||||
}
|
||||
|
||||
// VerifyApplicationIdentity validates the ID token independently of Goth's
|
||||
// decode/claim checks and of the UserInfo merge. Keys and accepted algorithm,
|
||||
// issuer, audience and type are admitted separately; none come from the JWT URL.
|
||||
func VerifyApplicationIdentity(raw string, a AccessEngineAdmission, now time.Time) (VerifiedApplicationIdentity, error) {
|
||||
var out VerifiedApplicationIdentity
|
||||
age, e := time.ParseDuration(a.MaxIdentityAge)
|
||||
if e != nil || age <= 0 || a.Issuer == "" || a.Audience == "" || a.TokenType == "" || len(a.Algorithms) == 0 || len(a.IdentityKeys) == 0 || a.TenantClaim == "" || a.PrincipalTypeClaim == "" || a.AssuranceClaim == "" {
|
||||
return out, errApplicationDecision
|
||||
}
|
||||
for _, alg := range a.Algorithms {
|
||||
if alg != "RS256" && alg != "RS384" && alg != "RS512" && alg != "ES256" && alg != "ES384" && alg != "ES512" && alg != "EdDSA" {
|
||||
return out, errApplicationDecision
|
||||
}
|
||||
}
|
||||
claims := jwt.MapClaims{}
|
||||
token, e := jwt.ParseWithClaims(raw, claims, func(t *jwt.Token) (any, error) {
|
||||
if typ, ok := t.Header["typ"].(string); !ok || typ != a.TokenType {
|
||||
return nil, errApplicationDecision
|
||||
}
|
||||
kid, ok := t.Header["kid"].(string)
|
||||
if !ok || kid == "" {
|
||||
return nil, errApplicationDecision
|
||||
}
|
||||
text, ok := a.IdentityKeys[kid]
|
||||
if !ok {
|
||||
return nil, errApplicationDecision
|
||||
}
|
||||
block, rest := pem.Decode([]byte(text))
|
||||
if block == nil || block.Type != "PUBLIC KEY" || len(strings.TrimSpace(string(rest))) != 0 {
|
||||
return nil, errApplicationDecision
|
||||
}
|
||||
key, e := x509.ParsePKIXPublicKey(block.Bytes)
|
||||
if e != nil {
|
||||
return nil, errApplicationDecision
|
||||
}
|
||||
var pub crypto.PublicKey = key
|
||||
return pub, nil
|
||||
}, jwt.WithValidMethods(a.Algorithms), jwt.WithIssuer(a.Issuer), jwt.WithAudience(a.Audience), jwt.WithExpirationRequired(), jwt.WithIssuedAt(), jwt.WithJSONNumber(), jwt.WithTimeFunc(func() time.Time { return now }))
|
||||
if e != nil || token == nil || !token.Valid {
|
||||
return out, errApplicationDecision
|
||||
}
|
||||
subject, e := claims.GetSubject()
|
||||
if e != nil || subject == "" {
|
||||
return out, errApplicationDecision
|
||||
}
|
||||
issued, e := claims.GetIssuedAt()
|
||||
if e != nil || issued == nil || issued.Time.After(now) || now.Sub(issued.Time) > age {
|
||||
return out, errApplicationDecision
|
||||
}
|
||||
end, e := claims.GetExpirationTime()
|
||||
if e != nil || end == nil || !now.Before(end.Time) {
|
||||
return out, errApplicationDecision
|
||||
}
|
||||
aud, e := claims.GetAudience()
|
||||
if e != nil {
|
||||
return out, errApplicationDecision
|
||||
}
|
||||
if authorizedParty, present := claims["azp"]; present {
|
||||
if azp, ok := authorizedParty.(string); !ok || azp != a.Audience {
|
||||
return out, errApplicationDecision
|
||||
}
|
||||
} else if len(aud) > 1 {
|
||||
return out, errApplicationDecision
|
||||
}
|
||||
value := func(name string) (string, bool) { v, ok := claims[name].(string); return v, ok && validClaimLiteral(v) }
|
||||
tenant, ok := value(a.TenantClaim)
|
||||
if !ok {
|
||||
return out, errApplicationDecision
|
||||
}
|
||||
principal, ok := value(a.PrincipalTypeClaim)
|
||||
if !ok {
|
||||
return out, errApplicationDecision
|
||||
}
|
||||
assurance, ok := value(a.AssuranceClaim)
|
||||
if !ok {
|
||||
return out, errApplicationDecision
|
||||
}
|
||||
return VerifiedApplicationIdentity{Issuer: a.Issuer, Subject: subject, Tenant: tenant, PrincipalType: api.SubjectType(principal), Assurance: assurance, NotAfter: end.Time}, nil
|
||||
}
|
||||
|
||||
func (source *Source) authorizeAccessEngine(ctx context.Context, user goth.User) error {
|
||||
// The guarded target extension cannot silently fall back to a local group
|
||||
// decision when admission, keys, facts, PDP or caller authentication is absent.
|
||||
if source.Provider != "openidConnect" || ValidateRequiredClaimValues(source.RequiredClaimName, source.RequiredClaimValue, source.RequiredClaimValues) != nil {
|
||||
return errApplicationDecision
|
||||
}
|
||||
a, e := loadAccessEngineAdmission(os.Getenv("FORGEJO_ACCESS_ENGINE_ADMISSION_FILE"))
|
||||
if e != nil || source.authSource == nil || a.SourceName != source.authSource.Name || a.Audience != source.ClientID {
|
||||
return errApplicationDecision
|
||||
}
|
||||
identity, e := VerifyApplicationIdentity(user.IDToken, a, time.Now().UTC())
|
||||
if e != nil {
|
||||
return errApplicationDecision
|
||||
}
|
||||
// RequireCurrentUserInfoClaim has refused missing/malformed current groups
|
||||
// before Goth can merge. The validated ID subject must still match that join.
|
||||
sub, ok := user.RawData["sub"].(string)
|
||||
if !ok || sub != identity.Subject || user.UserID != identity.Subject {
|
||||
return errApplicationDecision
|
||||
}
|
||||
groups, ok := strictClaimValues(user.RawData[source.RequiredClaimName])
|
||||
if !ok {
|
||||
return errApplicationDecision
|
||||
}
|
||||
client, e := decisionpep.New(a.Decision)
|
||||
if e != nil {
|
||||
return errApplicationDecision
|
||||
}
|
||||
request := api.CheckRequest{Tenant: identity.Tenant,
|
||||
Subject: api.SubjectRef{ID: identity.Subject, Type: identity.PrincipalType, Tenant: identity.Tenant,
|
||||
Attributes: map[string]any{"issuer": identity.Issuer, "assurance": identity.Assurance, "current_userinfo_groups": groups}},
|
||||
Action: "application.access", Resource: api.ResourceRef{ID: "application:forgejo", Type: "application", System: "forgejo", Tenant: identity.Tenant},
|
||||
Context: map[string]any{"identity_issuer": identity.Issuer, "identity_subject": identity.Subject, "identity_tenant": identity.Tenant, "identity_principal_type": string(identity.PrincipalType), "identity_assurance": identity.Assurance, "identity_not_after": identity.NotAfter.UTC().Format(time.RFC3339Nano), "current_userinfo_groups": groups, "required_groups_any_of": source.RequiredClaimValues, "source_name": a.SourceName, "source_id": source.authSource.ID}}
|
||||
if _, e = client.Check(ctx, request); e != nil {
|
||||
return errApplicationDecision
|
||||
}
|
||||
if !time.Now().UTC().Before(identity.NotAfter) {
|
||||
return errApplicationDecision
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
|
@ -0,0 +1,180 @@
|
|||
package oauth2
|
||||
|
||||
import (
|
||||
"crypto/ed25519"
|
||||
"crypto/rand"
|
||||
"encoding/base64"
|
||||
"encoding/json"
|
||||
"encoding/pem"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"sync/atomic"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
authmodel "forgejo.org/models/auth"
|
||||
"github.com/golang-jwt/jwt/v5"
|
||||
"github.com/markbates/goth"
|
||||
"github.com/markbates/goth/gothic"
|
||||
"github.com/netkingdom/access-engine/pkg/api"
|
||||
"github.com/netkingdom/access-engine/pkg/decisionpep"
|
||||
"github.com/netkingdom/access-engine/testsupport/signfixture"
|
||||
)
|
||||
|
||||
// This fixture substitutes only Goth's completed authentication result. The
|
||||
// actual Source.Callback, JOSE verifier, HTTPS PEP client and producer signature
|
||||
// implementation execute. Actual issuer login and native admission are separate.
|
||||
func callbackFixture(t *testing.T, group, mode string) (*Source, *goth.User, *atomic.Int64) {
|
||||
t.Helper()
|
||||
admission, identityKey, claims, _ := identityFixture(t)
|
||||
identityToken := signedIdentity(t, identityKey, claims, nil)
|
||||
pub, key, err := ed25519.GenerateKey(rand.Reader)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
calls := new(atomic.Int64)
|
||||
server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
calls.Add(1)
|
||||
if r.URL.Path != "/v1/check" || r.Method != http.MethodPost || r.Header.Get("Authorization") != "Bearer synthetic-caller" || r.Header.Get("Access-Engine-JSON-Profile") != decisionpep.JSONProfile {
|
||||
t.Error("incorrect authenticated PDP request")
|
||||
w.WriteHeader(403)
|
||||
return
|
||||
}
|
||||
var request api.CheckRequest
|
||||
decoder := json.NewDecoder(r.Body)
|
||||
decoder.UseNumber()
|
||||
if err := decoder.Decode(&request); err != nil {
|
||||
t.Error(err)
|
||||
w.WriteHeader(400)
|
||||
return
|
||||
}
|
||||
c := request.Context
|
||||
if request.Subject.ID != "user:synthetic" || request.Subject.Tenant != "tenant:synthetic" || request.Subject.Type != "human" || request.Action != "application.access" || request.Resource.ID != "application:forgejo" || c["identity_issuer"] != "https://issuer.invalid" || c["identity_assurance"] != "aal2" || c["identity_tenant"] != "tenant:synthetic" || c["source_id"] != json.Number("17") {
|
||||
t.Error("PDP request did not use authenticated identity and source")
|
||||
w.WriteHeader(400)
|
||||
return
|
||||
}
|
||||
now := time.Now().UTC()
|
||||
envelope := api.DecisionEnvelope{ID: "synthetic-decision", RequestID: request.ID, Effect: api.DecisionEffectAllow, MatchedPolicyVersion: "v1", Subject: request.Subject, Resource: request.Resource, Binding: api.NewDecisionBindingFor(request, request), Provenance: api.DecisionProvenance{Evaluator: "flex-auth/local", Mode: "standalone/" + decisionpep.JSONProfile, PolicyPackage: "forgejo.application-access", PolicyVersion: "v1", PolicyPackageDigest: "sha256:" + strings.Repeat("1", 64), RegistrySnapshotDigest: "sha256:" + strings.Repeat("2", 64), Caller: &api.CallerProvenance{Mode: "enforce", Principal: "system:serviceaccount:synthetic:forgejo", Audience: "access-engine", NotAfter: now.Add(time.Minute).Format(time.RFC3339Nano)}}}
|
||||
api.CompleteDecision(&envelope, request, api.DecisionCompletion{AllowTTL: "10s", Now: now})
|
||||
switch mode {
|
||||
case "deny":
|
||||
envelope.Effect = api.DecisionEffectDeny
|
||||
case "wrong-binding":
|
||||
envelope.Binding.Subject.ID = "other"
|
||||
case "wrong-pin":
|
||||
envelope.Provenance.PolicyPackageDigest = "sha256:" + strings.Repeat("3", 64)
|
||||
case "expired":
|
||||
envelope.Lifetime.ExpiresAt = now.Add(-time.Hour).Format(time.RFC3339Nano)
|
||||
}
|
||||
if mode != "unsigned" {
|
||||
signingKey := key
|
||||
if mode == "wrong-key" {
|
||||
_, signingKey, err = ed25519.GenerateKey(rand.Reader)
|
||||
if err != nil {
|
||||
t.Error(err)
|
||||
return
|
||||
}
|
||||
}
|
||||
if err := signfixture.Sign(&envelope, signingKey, "synthetic-pdp"); err != nil {
|
||||
t.Error(err)
|
||||
return
|
||||
}
|
||||
}
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
if err := json.NewEncoder(w).Encode(envelope); err != nil {
|
||||
t.Error(err)
|
||||
}
|
||||
}))
|
||||
t.Cleanup(server.Close)
|
||||
dir := t.TempDir()
|
||||
ca := filepath.Join(dir, "ca.pem")
|
||||
token := filepath.Join(dir, "caller")
|
||||
config := filepath.Join(dir, "admission.json")
|
||||
if err := os.WriteFile(ca, pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: server.Certificate().Raw}), 0600); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := os.WriteFile(token, []byte("synthetic-caller"), 0600); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
admission.SourceName = "synthetic-source"
|
||||
admission.Decision = decisionpep.Admission{Endpoint: server.URL + "/v1/check", CAFile: ca, TokenFile: token, Keys: map[string]string{"synthetic-pdp": base64.RawURLEncoding.EncodeToString(pub)}, Evaluator: "flex-auth/local", PolicyPackage: "forgejo.application-access", PolicyVersion: "v1", PolicyDigest: "sha256:" + strings.Repeat("1", 64), RegistryDigest: "sha256:" + strings.Repeat("2", 64), CallerPrincipal: "system:serviceaccount:synthetic:forgejo", CallerAudience: "access-engine", MaxTTL: "30s", MaxClockSkew: "2s"}
|
||||
raw, err := json.Marshal(admission)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err = os.WriteFile(config, raw, 0600); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
t.Setenv("FORGEJO_ACCESS_ENGINE_ADMISSION_FILE", config)
|
||||
source := &Source{Provider: "openidConnect", ClientID: admission.Audience, RequiredClaimName: "groups", RequiredClaimValues: []string{"forge-admins", "forge-coulomb-owners", "forge-coulomb-readers"}}
|
||||
source.authSource = &authmodel.Source{ID: 17, Name: admission.SourceName}
|
||||
user := &goth.User{UserID: "user:synthetic", IDToken: identityToken, RawData: map[string]any{"sub": "user:synthetic", "groups": []string{group}}}
|
||||
previous := gothic.CompleteUserAuth
|
||||
gothic.CompleteUserAuth = func(http.ResponseWriter, *http.Request) (goth.User, error) { return *user, nil }
|
||||
t.Cleanup(func() { gothic.CompleteUserAuth = previous })
|
||||
return source, user, calls
|
||||
}
|
||||
|
||||
func TestAccessEngineActualCallbackAllowsAuthenticatedDecision(t *testing.T) {
|
||||
for _, group := range []string{"forge-admins", "forge-coulomb-owners", "forge-coulomb-readers"} {
|
||||
t.Run(group, func(t *testing.T) {
|
||||
source, user, calls := callbackFixture(t, group, "allow")
|
||||
// Mutable UserInfo cannot supply identity assurance, issuer or tenant.
|
||||
user.RawData["acr"] = "aal1"
|
||||
user.RawData["tenant"] = "tenant:attacker"
|
||||
user.RawData["iss"] = "https://attacker.invalid"
|
||||
got, err := source.Callback(httptest.NewRequest(http.MethodGet, "https://forgejo.invalid/callback", nil), httptest.NewRecorder(), "")
|
||||
if err != nil || got.UserID != user.UserID || calls.Load() != 1 {
|
||||
t.Fatalf("callback result: err=%v requests=%d", err, calls.Load())
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestAccessEngineActualCallbackRefusesUnverifiedPDP(t *testing.T) {
|
||||
for _, mode := range []string{"deny", "unsigned", "wrong-key", "wrong-pin", "wrong-binding", "expired"} {
|
||||
t.Run(mode, func(t *testing.T) {
|
||||
source, _, calls := callbackFixture(t, "forge-admins", mode)
|
||||
got, err := source.Callback(httptest.NewRequest(http.MethodGet, "https://forgejo.invalid/callback", nil), httptest.NewRecorder(), "")
|
||||
if err == nil || got.UserID != "" || got.IDToken != "" || calls.Load() != 1 {
|
||||
t.Fatalf("unverified decision escaped callback: requests=%d err=%v", calls.Load(), err)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestAccessEngineActualCallbackChecksIdentityBeforePDP(t *testing.T) {
|
||||
cases := map[string]func(*Source, *goth.User){
|
||||
"missing-token": func(_ *Source, u *goth.User) { u.IDToken = "" },
|
||||
"mismatched-user": func(_ *Source, u *goth.User) { u.UserID = "other" },
|
||||
"mismatched-subject": func(_ *Source, u *goth.User) { u.RawData["sub"] = "other" },
|
||||
"missing-groups": func(_ *Source, u *goth.User) { delete(u.RawData, "groups") },
|
||||
"wrong-source": func(s *Source, _ *goth.User) { s.authSource.Name = "other" },
|
||||
"wrong-provider": func(s *Source, _ *goth.User) { s.Provider = "other" },
|
||||
"wrong-audience": func(s *Source, _ *goth.User) { s.ClientID = "other" },
|
||||
"missing-admission": func(_ *Source, _ *goth.User) { t.Setenv("FORGEJO_ACCESS_ENGINE_ADMISSION_FILE", "") },
|
||||
"expired-token": func(_ *Source, u *goth.User) {
|
||||
_, key, claims, now := identityFixture(t)
|
||||
claims["exp"] = now.Add(-time.Hour).Unix()
|
||||
u.IDToken = signedIdentity(t, key, claims, nil)
|
||||
},
|
||||
"untrusted-identity": func(_ *Source, u *goth.User) {
|
||||
token := jwt.NewWithClaims(jwt.SigningMethodNone, jwt.MapClaims{"sub": "user:synthetic"})
|
||||
u.IDToken, _ = token.SignedString(jwt.UnsafeAllowNoneSignatureType)
|
||||
},
|
||||
}
|
||||
for name, mutate := range cases {
|
||||
t.Run(name, func(t *testing.T) {
|
||||
source, user, calls := callbackFixture(t, "forge-admins", "allow")
|
||||
mutate(source, user)
|
||||
got, err := source.Callback(httptest.NewRequest(http.MethodGet, "https://forgejo.invalid/callback", nil), httptest.NewRecorder(), "")
|
||||
if err == nil || got.UserID != "" || calls.Load() != 0 {
|
||||
t.Fatalf("unverified identity reached PDP: requests=%d err=%v", calls.Load(), err)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,100 @@
|
|||
package oauth2
|
||||
|
||||
import (
|
||||
"crypto/ed25519"
|
||||
"crypto/rand"
|
||||
"crypto/x509"
|
||||
"encoding/pem"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/golang-jwt/jwt/v5"
|
||||
)
|
||||
|
||||
func identityFixture(t *testing.T) (AccessEngineAdmission, ed25519.PrivateKey, jwt.MapClaims, time.Time) {
|
||||
t.Helper()
|
||||
pub, key, e := ed25519.GenerateKey(rand.Reader)
|
||||
if e != nil {
|
||||
t.Fatal(e)
|
||||
}
|
||||
der, e := x509.MarshalPKIXPublicKey(pub)
|
||||
if e != nil {
|
||||
t.Fatal(e)
|
||||
}
|
||||
now := time.Now().UTC().Truncate(time.Second)
|
||||
a := AccessEngineAdmission{Issuer: "https://issuer.invalid", Audience: "forgejo", TokenType: "JWT", Algorithms: []string{"EdDSA"}, IdentityKeys: map[string]string{"synthetic": string(pem.EncodeToMemory(&pem.Block{Type: "PUBLIC KEY", Bytes: der}))}, TenantClaim: "tenant", PrincipalTypeClaim: "principal_type", AssuranceClaim: "acr", MaxIdentityAge: "5m"}
|
||||
c := jwt.MapClaims{"iss": a.Issuer, "aud": a.Audience, "sub": "user:synthetic", "iat": now.Add(-time.Second).Unix(), "exp": now.Add(time.Minute).Unix(), "tenant": "tenant:synthetic", "principal_type": "human", "acr": "aal2"}
|
||||
return a, key, c, now
|
||||
}
|
||||
func signedIdentity(t *testing.T, key ed25519.PrivateKey, c jwt.MapClaims, mutate func(*jwt.Token)) string {
|
||||
t.Helper()
|
||||
token := jwt.NewWithClaims(jwt.SigningMethodEdDSA, c)
|
||||
token.Header["kid"] = "synthetic"
|
||||
token.Header["typ"] = "JWT"
|
||||
if mutate != nil {
|
||||
mutate(token)
|
||||
}
|
||||
raw, e := token.SignedString(key)
|
||||
if e != nil {
|
||||
t.Fatal(e)
|
||||
}
|
||||
return raw
|
||||
}
|
||||
func TestVerifiedApplicationIdentityActualJOSE(t *testing.T) {
|
||||
a, key, c, now := identityFixture(t)
|
||||
raw := signedIdentity(t, key, c, nil)
|
||||
got, e := VerifyApplicationIdentity(raw, a, now)
|
||||
if e != nil {
|
||||
t.Fatal(e)
|
||||
}
|
||||
if got.Subject != "user:synthetic" || got.Tenant != "tenant:synthetic" || got.Assurance != "aal2" || got.Issuer != a.Issuer || string(got.PrincipalType) != "human" {
|
||||
t.Fatal("identity did not come from verified token")
|
||||
}
|
||||
cases := map[string]func(jwt.MapClaims){"issuer": func(c jwt.MapClaims) { c["iss"] = "https://other.invalid" }, "audience": func(c jwt.MapClaims) { c["aud"] = "other" }, "expired": func(c jwt.MapClaims) { c["exp"] = now.Add(-time.Nanosecond).Unix() }, "future-issued": func(c jwt.MapClaims) { c["iat"] = now.Add(time.Minute).Unix() }, "old-issued": func(c jwt.MapClaims) { c["iat"] = now.Add(-10 * time.Minute).Unix() }, "no-exp": func(c jwt.MapClaims) { delete(c, "exp") }, "no-iat": func(c jwt.MapClaims) { delete(c, "iat") }, "no-tenant": func(c jwt.MapClaims) { delete(c, "tenant") }, "no-principal": func(c jwt.MapClaims) { delete(c, "principal_type") }, "no-assurance": func(c jwt.MapClaims) { delete(c, "acr") }, "multi-audience-no-azp": func(c jwt.MapClaims) { c["aud"] = []string{"forgejo", "other"} }, "empty-subject": func(c jwt.MapClaims) { c["sub"] = "" }}
|
||||
for name, change := range cases {
|
||||
t.Run(name, func(t *testing.T) {
|
||||
copy := jwt.MapClaims{}
|
||||
for k, v := range c {
|
||||
copy[k] = v
|
||||
}
|
||||
change(copy)
|
||||
if _, e := VerifyApplicationIdentity(signedIdentity(t, key, copy, nil), a, now); e == nil {
|
||||
t.Fatal("unverified identity accepted")
|
||||
}
|
||||
})
|
||||
}
|
||||
t.Run("wrong-key", func(t *testing.T) {
|
||||
_, other, _ := ed25519.GenerateKey(rand.Reader)
|
||||
if _, e := VerifyApplicationIdentity(signedIdentity(t, other, c, nil), a, now); e == nil {
|
||||
t.Fatal("wrong key accepted")
|
||||
}
|
||||
})
|
||||
t.Run("unknown-key", func(t *testing.T) {
|
||||
if _, e := VerifyApplicationIdentity(signedIdentity(t, key, c, func(t *jwt.Token) { t.Header["kid"] = "other" }), a, now); e == nil {
|
||||
t.Fatal("unknown key accepted")
|
||||
}
|
||||
})
|
||||
t.Run("wrong-type", func(t *testing.T) {
|
||||
if _, e := VerifyApplicationIdentity(signedIdentity(t, key, c, func(t *jwt.Token) { t.Header["typ"] = "at+jwt" }), a, now); e == nil {
|
||||
t.Fatal("access token accepted as ID token")
|
||||
}
|
||||
})
|
||||
t.Run("algorithm-confusion", func(t *testing.T) {
|
||||
token := jwt.NewWithClaims(jwt.SigningMethodHS256, c)
|
||||
token.Header["kid"] = "synthetic"
|
||||
token.Header["typ"] = "JWT"
|
||||
raw, _ := token.SignedString([]byte(a.IdentityKeys["synthetic"]))
|
||||
if _, e := VerifyApplicationIdentity(raw, a, now); e == nil {
|
||||
t.Fatal("algorithm confusion accepted")
|
||||
}
|
||||
})
|
||||
t.Run("none", func(t *testing.T) {
|
||||
token := jwt.NewWithClaims(jwt.SigningMethodNone, c)
|
||||
token.Header["kid"] = "synthetic"
|
||||
token.Header["typ"] = "JWT"
|
||||
raw, _ := token.SignedString(jwt.UnsafeAllowNoneSignatureType)
|
||||
if _, e := VerifyApplicationIdentity(raw, a, now); e == nil {
|
||||
t.Fatal("unsigned identity accepted")
|
||||
}
|
||||
})
|
||||
}
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
"""Reconstruct this frozen consumer directly from verified public archives."""
|
||||
from pathlib import Path
|
||||
import argparse
|
||||
import hashlib
|
||||
import json
|
||||
import subprocess
|
||||
import tarfile
|
||||
|
||||
HERE = Path(__file__).resolve().parent
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument('--inputs', type=Path, required=True)
|
||||
parser.add_argument('--workspace', type=Path, required=True)
|
||||
args = parser.parse_args()
|
||||
work = args.workspace.resolve()
|
||||
assert work.is_relative_to('/tmp') and not work.exists()
|
||||
manifest = json.loads((HERE / 'composed-source-inventory.json').read_text())
|
||||
patch = (HERE / 'composed-forgejo-source.patch').read_bytes()
|
||||
assert hashlib.sha256(patch).hexdigest() == manifest['patch_sha256']
|
||||
archives = [('forgejo-v11.0.3.tar.gz', manifest['archive_sha256']),
|
||||
('go1.24.3.tar.gz', '3333f6ea53afa971e9078895eaa4ac7204a8c6b5c68c10e6bc9a33e8e391bdd8')]
|
||||
for name, digest in archives:
|
||||
assert hashlib.sha256((args.inputs / name).read_bytes()).hexdigest() == digest
|
||||
work.mkdir()
|
||||
for name, _ in archives:
|
||||
with tarfile.open(args.inputs / name) as tar:
|
||||
tar.extractall(work, filter='data')
|
||||
(work / 'forgejo').rename(work / 'source')
|
||||
run = subprocess.run(['patch', '--fuzz=0', '-p1'], input=patch, cwd=work / 'source', capture_output=True)
|
||||
assert run.returncode == 0, 'Pinned composite patch refused; workspace retained'
|
||||
for row in manifest['files']:
|
||||
assert hashlib.sha256((work / 'source' / row['path']).read_bytes()).hexdigest() == row['after_sha256'], row['path']
|
||||
(work / 'home').mkdir()
|
||||
print(json.dumps({'status': 'prepared', 'workspace': str(work), 'paths_verified': len(manifest['files']), 'native_changes': False}))
|
||||
|
|
@ -1,5 +1,6 @@
|
|||
"""Generate a private synthetic identity through the committed actual issuer."""
|
||||
from pathlib import Path
|
||||
import argparse
|
||||
import hashlib
|
||||
import io
|
||||
import json
|
||||
|
|
@ -10,6 +11,11 @@ import tempfile
|
|||
import time
|
||||
|
||||
HERE = Path(__file__).resolve().parent
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument('--attempt', type=int, default=1)
|
||||
parser.add_argument('--cache-from', type=Path)
|
||||
args = parser.parse_args()
|
||||
suffix = '' if args.attempt == 1 else '-attempt' + str(args.attempt)
|
||||
OWNER = Path('/home/worsch/key-cape')
|
||||
WORK = Path(tempfile.mkdtemp(prefix='custodian-keycape-wire-'))
|
||||
revision = subprocess.check_output(['git', '-C', str(OWNER), 'rev-parse', 'HEAD'], text=True).strip()
|
||||
|
|
@ -25,22 +31,27 @@ argv += ['--symlink', 'usr/bin', '/bin', '--proc', '/proc', '--dev', '/dev', '--
|
|||
'--bind', str(WORK), '/work', '--ro-bind', '/home/worsch/go/pkg/mod', '/modules',
|
||||
'--ro-bind', '/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64', '/toolchain',
|
||||
'--chdir', '/work/src', '--clearenv']
|
||||
if args.cache_from:
|
||||
cache = args.cache_from.resolve()
|
||||
assert cache.is_relative_to('/tmp') and cache.is_dir()
|
||||
argv += ['--bind', str(cache), '/work/gocache']
|
||||
for key, value in {'PATH': '/toolchain/bin:/usr/bin:/bin', 'HOME': '/work/home', 'GOTOOLCHAIN': 'local',
|
||||
'GOPROXY': 'off', 'GOSUMDB': 'off', 'GOMODCACHE': '/modules', 'GOCACHE': '/work/gocache',
|
||||
'GOMAXPROCS': '4', 'CGO_ENABLED': '0',
|
||||
'CUSTODIAN_SYNTHETIC_IDENTITY_FIXTURE': '/work/identity.json'}.items():
|
||||
argv += ['--setenv', key, value]
|
||||
argv += ['--', 'go', 'test', '-p', '4', '-json', './internal/server/oidc', '-run', '^TestCustodianForgejoIssuerFixture$', '-count=1']
|
||||
assert not (HERE / 'issuer-fixture-result.json').exists()
|
||||
receipt_path = HERE / ('issuer-fixture-result' + suffix + '.json')
|
||||
assert not receipt_path.exists()
|
||||
started = time.monotonic()
|
||||
with (HERE / 'issuer-fixture.jsonl').open('xb') as log:
|
||||
with (HERE / ('issuer-fixture' + suffix + '.jsonl')).open('xb') as log:
|
||||
result = subprocess.run(argv, stdout=log, stderr=subprocess.STDOUT, timeout=300)
|
||||
receipt = {'returncode': result.returncode, 'seconds': round(time.monotonic() - started, 2),
|
||||
'source_commit': revision, 'source_token_go_sha256': hashlib.sha256((WORK / 'src/internal/server/oidc/token.go').read_bytes()).hexdigest(),
|
||||
'source_commit': revision, 'source_token_go_sha256': 'sha256:' + hashlib.sha256((WORK / 'src/internal/server/oidc/token.go').read_bytes()).hexdigest(),
|
||||
'workspace': str(WORK), 'argv': argv, 'synthetic_authentication': True, 'real_credentials': False,
|
||||
'fixture_values_published': False}
|
||||
if result.returncode == 0:
|
||||
receipt['fixture_sha256'] = hashlib.sha256((WORK / 'identity.json').read_bytes()).hexdigest()
|
||||
(HERE / 'issuer-fixture-result.json').write_text(json.dumps(receipt, indent=2) + '\n')
|
||||
receipt_path.write_text(json.dumps(receipt, indent=2) + '\n')
|
||||
print(json.dumps({'returncode': result.returncode, 'source_commit': revision, 'fixture_values_published': False}))
|
||||
raise SystemExit(result.returncode)
|
||||
|
|
|
|||
|
|
@ -0,0 +1,17 @@
|
|||
{
|
||||
"source_commit": "git:ca0cb75729a63c9288b7333382d0fa3eb1e8c9a3",
|
||||
"paths": [
|
||||
"third_party/access-engine-pep/LICENSE",
|
||||
"third_party/access-engine-pep/go.mod",
|
||||
"third_party/access-engine-pep/internal/sign/sign.go",
|
||||
"third_party/access-engine-pep/pkg/api/canonical.go",
|
||||
"third_party/access-engine-pep/pkg/api/caring.go",
|
||||
"third_party/access-engine-pep/pkg/api/resource_manifest.go",
|
||||
"third_party/access-engine-pep/pkg/decisionpep/client.go",
|
||||
"third_party/access-engine-pep/pkg/decisionpep/client_test.go",
|
||||
"third_party/access-engine-pep/producer-source.json",
|
||||
"third_party/access-engine-pep/testsupport/signfixture/sign.go"
|
||||
],
|
||||
"all_exact": true,
|
||||
"native_admission": false
|
||||
}
|
||||
|
|
@ -0,0 +1,57 @@
|
|||
{
|
||||
"argv": [
|
||||
"bwrap",
|
||||
"--unshare-net",
|
||||
"--unshare-pid",
|
||||
"--proc",
|
||||
"/proc",
|
||||
"--dev",
|
||||
"/dev",
|
||||
"--tmpfs",
|
||||
"/tmp",
|
||||
"--dir",
|
||||
"/app",
|
||||
"--ro-bind",
|
||||
"/tmp/custodian-forgejo-release-r3/source/gitea",
|
||||
"/app/forgejo",
|
||||
"--bind",
|
||||
"/tmp/custodian-forgejo-release-r3/embedded-extracted",
|
||||
"/results",
|
||||
"--chdir",
|
||||
"/tmp",
|
||||
"--clearenv",
|
||||
"--setenv",
|
||||
"PATH",
|
||||
"/nonexistent",
|
||||
"--setenv",
|
||||
"HOME",
|
||||
"/tmp/home",
|
||||
"--setenv",
|
||||
"USER",
|
||||
"builder",
|
||||
"--setenv",
|
||||
"USERNAME",
|
||||
"builder",
|
||||
"--setenv",
|
||||
"GITEA_WORK_DIR",
|
||||
"/tmp/work",
|
||||
"--setenv",
|
||||
"GITEA_CUSTOM",
|
||||
"/tmp/custom",
|
||||
"--setenv",
|
||||
"GITEA_APP_INI",
|
||||
"/tmp/absent-app.ini",
|
||||
"--setenv",
|
||||
"TZ",
|
||||
"UTC",
|
||||
"--setenv",
|
||||
"LC_ALL",
|
||||
"C",
|
||||
"--",
|
||||
"/app/forgejo",
|
||||
"--version"
|
||||
],
|
||||
"phase": "binary-version",
|
||||
"returncode": 0,
|
||||
"seconds": 0.14
|
||||
}
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
{
|
||||
"binary_sha256": "52f1e111ab17b9c8f2841b0815075df5812b066be45326abe50d140d8a231c34",
|
||||
"frontend_built": true,
|
||||
"image_deployment_selected": false,
|
||||
"source_locks_preserved": true,
|
||||
"tags": "bindata timetzdata sqlite sqlite_unlock_notify"
|
||||
}
|
||||
|
|
@ -0,0 +1,708 @@
|
|||
[
|
||||
{
|
||||
"operation": [
|
||||
"migrate"
|
||||
],
|
||||
"returncode": 0,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"add-oauth",
|
||||
"--name",
|
||||
"refused-debug-logging",
|
||||
"--provider",
|
||||
"github",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/CLIENT_SECRET"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"add-oauth",
|
||||
"--name",
|
||||
"synthetic-oauth",
|
||||
"--provider",
|
||||
"github",
|
||||
"--key",
|
||||
"synthetic-public-id",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/CLIENT_SECRET",
|
||||
"--group-claim-name",
|
||||
"groups",
|
||||
"--admin-group",
|
||||
"unchanged-admin",
|
||||
"--scopes",
|
||||
"read:user,user:email"
|
||||
],
|
||||
"returncode": 0,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"update-oauth",
|
||||
"--id",
|
||||
"1",
|
||||
"--icon-url",
|
||||
"https://synthetic.invalid/icon"
|
||||
],
|
||||
"returncode": 0,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"update-oauth",
|
||||
"--id",
|
||||
"1",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/replacement"
|
||||
],
|
||||
"returncode": 0,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"update-oauth",
|
||||
"--id",
|
||||
"1",
|
||||
"--name",
|
||||
"synthetic-guarded"
|
||||
],
|
||||
"returncode": 0,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"update-oauth",
|
||||
"--id",
|
||||
"1",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/good"
|
||||
],
|
||||
"returncode": 0,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"add-oauth",
|
||||
"--name",
|
||||
"refused",
|
||||
"--provider",
|
||||
"github",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/newline"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"update-oauth",
|
||||
"--id",
|
||||
"1",
|
||||
"--name",
|
||||
"refused",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/newline"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"add-oauth",
|
||||
"--name",
|
||||
"refused",
|
||||
"--provider",
|
||||
"github",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/short"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"update-oauth",
|
||||
"--id",
|
||||
"1",
|
||||
"--name",
|
||||
"refused",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/short"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"add-oauth",
|
||||
"--name",
|
||||
"refused",
|
||||
"--provider",
|
||||
"github",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/long"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"update-oauth",
|
||||
"--id",
|
||||
"1",
|
||||
"--name",
|
||||
"refused",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/long"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"add-oauth",
|
||||
"--name",
|
||||
"refused",
|
||||
"--provider",
|
||||
"github",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/badbyte"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"update-oauth",
|
||||
"--id",
|
||||
"1",
|
||||
"--name",
|
||||
"refused",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/badbyte"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"add-oauth",
|
||||
"--name",
|
||||
"refused",
|
||||
"--provider",
|
||||
"github",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/world"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"update-oauth",
|
||||
"--id",
|
||||
"1",
|
||||
"--name",
|
||||
"refused",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/world"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"add-oauth",
|
||||
"--name",
|
||||
"refused",
|
||||
"--provider",
|
||||
"github",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/writable"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"update-oauth",
|
||||
"--id",
|
||||
"1",
|
||||
"--name",
|
||||
"refused",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/writable"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"add-oauth",
|
||||
"--name",
|
||||
"refused",
|
||||
"--provider",
|
||||
"github",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/executable"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"update-oauth",
|
||||
"--id",
|
||||
"1",
|
||||
"--name",
|
||||
"refused",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/executable"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"add-oauth",
|
||||
"--name",
|
||||
"refused",
|
||||
"--provider",
|
||||
"github",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/empty"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"update-oauth",
|
||||
"--id",
|
||||
"1",
|
||||
"--name",
|
||||
"refused",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/empty"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"add-oauth",
|
||||
"--name",
|
||||
"refused",
|
||||
"--provider",
|
||||
"github",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/symlink"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"update-oauth",
|
||||
"--id",
|
||||
"1",
|
||||
"--name",
|
||||
"refused",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/symlink"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"add-oauth",
|
||||
"--name",
|
||||
"refused",
|
||||
"--provider",
|
||||
"github",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/fifo"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"update-oauth",
|
||||
"--id",
|
||||
"1",
|
||||
"--name",
|
||||
"refused",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/fifo"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"add-oauth",
|
||||
"--name",
|
||||
"refused",
|
||||
"--provider",
|
||||
"github",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/directory"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"update-oauth",
|
||||
"--id",
|
||||
"1",
|
||||
"--name",
|
||||
"refused",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/directory"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"add-oauth",
|
||||
"--name",
|
||||
"refused",
|
||||
"--provider",
|
||||
"github",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/missing"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"update-oauth",
|
||||
"--id",
|
||||
"1",
|
||||
"--name",
|
||||
"refused",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/missing"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"add-oauth",
|
||||
"--name",
|
||||
"refused",
|
||||
"--provider",
|
||||
"github",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/badparent/value"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"update-oauth",
|
||||
"--id",
|
||||
"1",
|
||||
"--name",
|
||||
"refused",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/badparent/value"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"add-oauth",
|
||||
"--name",
|
||||
"refused",
|
||||
"--provider",
|
||||
"github",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/parentlink/value"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"update-oauth",
|
||||
"--id",
|
||||
"1",
|
||||
"--name",
|
||||
"refused",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/parentlink/value"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"add-oauth",
|
||||
"--name",
|
||||
"refused",
|
||||
"--provider",
|
||||
"github",
|
||||
"--secret-file",
|
||||
"relative"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"update-oauth",
|
||||
"--id",
|
||||
"1",
|
||||
"--name",
|
||||
"refused",
|
||||
"--secret-file",
|
||||
"relative"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"add-oauth",
|
||||
"--name",
|
||||
"refused",
|
||||
"--provider",
|
||||
"github",
|
||||
"--secret-file",
|
||||
""
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"update-oauth",
|
||||
"--id",
|
||||
"1",
|
||||
"--name",
|
||||
"refused",
|
||||
"--secret-file",
|
||||
""
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"add-oauth",
|
||||
"--name",
|
||||
"refused",
|
||||
"--provider",
|
||||
"github",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/../forgejo-oidc/good"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"update-oauth",
|
||||
"--id",
|
||||
"1",
|
||||
"--name",
|
||||
"refused",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/../forgejo-oidc/good"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"add-oauth",
|
||||
"--name",
|
||||
"refused",
|
||||
"--provider",
|
||||
"github",
|
||||
"--secret-file",
|
||||
"/run/writable-input/good"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"update-oauth",
|
||||
"--id",
|
||||
"1",
|
||||
"--name",
|
||||
"refused",
|
||||
"--secret-file",
|
||||
"/run/writable-input/good"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"add-oauth",
|
||||
"--name",
|
||||
"refused",
|
||||
"--secret",
|
||||
"",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/good"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"update-oauth",
|
||||
"--id",
|
||||
"1",
|
||||
"--secret",
|
||||
"",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/good"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"update-oauth",
|
||||
"--id",
|
||||
"1",
|
||||
"--required-claim-values",
|
||||
""
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"update-oauth",
|
||||
"--id",
|
||||
"1",
|
||||
"--secret-file",
|
||||
"/run/forgejo-oidc/replacement"
|
||||
],
|
||||
"returncode": 1,
|
||||
"stdout_stderr_secret_absent": true
|
||||
},
|
||||
{
|
||||
"operation": [
|
||||
"admin",
|
||||
"auth",
|
||||
"update-oauth",
|
||||
"--id",
|
||||
"1",
|
||||
"--secret",
|
||||
"synthetic-legacy-literal"
|
||||
],
|
||||
"returncode": 0,
|
||||
"stdout_stderr_secret_absent": true
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
{
|
||||
"receipt": "cli-results.json",
|
||||
"subprocesses": 48,
|
||||
"private_file_values_absent_from_argv_environment_stdout_stderr": true,
|
||||
"legacy_public_synthetic_literal_in_argv_intentional": true,
|
||||
"scope": "The original values_never_in_argv_env_output field applies to the two private-file fixture values; legacy explicit --secret compatibility is tested separately.",
|
||||
"real_credentials": false
|
||||
}
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
{
|
||||
"passed": true,
|
||||
"subprocesses": 48,
|
||||
"real_backend_cli_and_sqlite": true,
|
||||
"network": "disabled by bwrap",
|
||||
"secret_inputs": "synthetic only",
|
||||
"values_never_in_argv_env_output": true,
|
||||
"actual_browser_login": false,
|
||||
"actual_readonly_file_bind": true,
|
||||
"replacement_preserves_other_config": true,
|
||||
"unsafe_SQL_logging_refused": true,
|
||||
"actual_error_and_slow_hooks_no_leak": true
|
||||
}
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
{
|
||||
"argv": [
|
||||
"docker",
|
||||
"buildx",
|
||||
"build",
|
||||
"--output",
|
||||
"type=oci,dest=/tmp/custodian-forgejo-release-r3/image.oci.tar,rewrite-timestamp=true",
|
||||
"--no-cache",
|
||||
"--platform",
|
||||
"linux/amd64",
|
||||
"--pull=false",
|
||||
"--network=none",
|
||||
"--provenance=false",
|
||||
"--sbom=false",
|
||||
"--metadata-file",
|
||||
"/tmp/custodian-forgejo-release-r3/image-build-metadata.json",
|
||||
"--build-arg",
|
||||
"SOURCE_DATE_EPOCH=1752120742",
|
||||
"/tmp/custodian-forgejo-release-r3/container-context"
|
||||
],
|
||||
"phase": "container-build",
|
||||
"returncode": 0,
|
||||
"seconds": 38.9
|
||||
}
|
||||
|
|
@ -0,0 +1,40 @@
|
|||
#0 building with "default" instance using docker driver
|
||||
|
||||
#1 [internal] load build definition from Dockerfile
|
||||
#1 transferring dockerfile: 465B done
|
||||
#1 DONE 0.1s
|
||||
|
||||
#2 [internal] load metadata for code.forgejo.org/forgejo/forgejo@sha256:41649dff5311664097d29b4d80620403f0b27e7c0eee0b8af79b132a37f3807b
|
||||
#2 DONE 0.4s
|
||||
|
||||
#3 [internal] load .dockerignore
|
||||
#3 transferring context: 2B done
|
||||
#3 DONE 0.1s
|
||||
|
||||
#4 [internal] load build context
|
||||
#4 ...
|
||||
|
||||
#5 [1/2] FROM code.forgejo.org/forgejo/forgejo@sha256:41649dff5311664097d29b4d80620403f0b27e7c0eee0b8af79b132a37f3807b
|
||||
#5 resolve code.forgejo.org/forgejo/forgejo@sha256:41649dff5311664097d29b4d80620403f0b27e7c0eee0b8af79b132a37f3807b 0.0s done
|
||||
#5 CACHED
|
||||
|
||||
#4 [internal] load build context
|
||||
#4 transferring context: 111.05MB 1.5s done
|
||||
#4 DONE 1.6s
|
||||
|
||||
#6 [2/2] COPY --chown=0:0 --chmod=755 gitea /app/gitea/gitea
|
||||
#6 DONE 1.1s
|
||||
|
||||
#7 exporting to oci image format
|
||||
#7 exporting layers
|
||||
#7 exporting layers 10.6s done
|
||||
#7 rewriting layers with source-date-epoch 1752120742 (2025-07-10 04:12:22 +0000 UTC)
|
||||
#7 rewriting layers with source-date-epoch 1752120742 (2025-07-10 04:12:22 +0000 UTC) 8.2s done
|
||||
#7 exporting manifest sha256:fc93a924b6e5f80a1dbf2a371dfd2e09fab10baa1cbca189bf61602009438822 0.0s done
|
||||
#7 exporting config sha256:f72e76f0ed5c0bd75d0727d1fc28a731a2bcdc90cfe15df534098444d81385c5 0.0s done
|
||||
#7 sending tarball
|
||||
#7 sending tarball 10.0s done
|
||||
#7 DONE 28.9s
|
||||
|
||||
#8 resolving provenance for metadata file
|
||||
#8 DONE 0.0s
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
{
|
||||
"two_fresh_no_cache_OCI_exports_exact": true,
|
||||
"compared_fields": {
|
||||
"image_manifest_digest": "sha256:fc93a924b6e5f80a1dbf2a371dfd2e09fab10baa1cbca189bf61602009438822",
|
||||
"config_digest": "sha256:f72e76f0ed5c0bd75d0727d1fc28a731a2bcdc90cfe15df534098444d81385c5",
|
||||
"oci_index_sha256": "dc86ae233589dec919932834ecf990e1d07a16db4d240c2772ea5fa08a940671",
|
||||
"archive_sha256": "7307e1d9a26aa6284270dac8b751a71ae02338be090511d192e14865c5e485d9"
|
||||
},
|
||||
"same_verified_binary": true,
|
||||
"second_source_build_claimed": false,
|
||||
"registry_publication": false,
|
||||
"native_admission": false
|
||||
}
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
{
|
||||
"all_base_layers_and_rootless_runtime_config_preserved": true,
|
||||
"all_oci_blob_digests_verified": true,
|
||||
"archive_sha256": "7307e1d9a26aa6284270dac8b751a71ae02338be090511d192e14865c5e485d9",
|
||||
"artifact_path": "/tmp/custodian-forgejo-release-r3/image.oci.tar",
|
||||
"config_digest": "sha256:f72e76f0ed5c0bd75d0727d1fc28a731a2bcdc90cfe15df534098444d81385c5",
|
||||
"container_epoch": 1752120742,
|
||||
"deployment_tag": null,
|
||||
"final_layer_binary_exact": true,
|
||||
"host_or_secret_mounts": false,
|
||||
"image_manifest_digest": "sha256:fc93a924b6e5f80a1dbf2a371dfd2e09fab10baa1cbca189bf61602009438822",
|
||||
"local_runtime_image_loaded": false,
|
||||
"oci_index_sha256": "dc86ae233589dec919932834ecf990e1d07a16db4d240c2772ea5fa08a940671",
|
||||
"privileged_containers": false,
|
||||
"registry_publication": false,
|
||||
"source_epoch": 1752105237
|
||||
}
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
{
|
||||
"argv": [
|
||||
"make",
|
||||
"GOFLAGS=-trimpath -buildvcs=false -p=4",
|
||||
"RELEASE_VERSION=11.0.3+cust80.15cb7f13",
|
||||
"FORGEJO_VERSION=11.0.3+cust80.15cb7f13",
|
||||
"FORGEJO_VERSION_API=11.0.3+cust80.15cb7f13",
|
||||
"TAGS=bindata timetzdata sqlite sqlite_unlock_notify",
|
||||
"go-check",
|
||||
"generate-backend",
|
||||
"static-executable"
|
||||
],
|
||||
"phase": "embedded-and-static-backend",
|
||||
"returncode": 0,
|
||||
"seconds": 348.13
|
||||
}
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
Running go generate...
|
||||
generating bindata for migration
|
||||
generating bindata for options
|
||||
generating bindata for public
|
||||
generating bindata for templates
|
||||
CGO_CFLAGS="-O2 -g -DSQLITE_MAX_VARIABLE_NUMBER=32766" /tmp/custodian-forgejo-release-r3/go/bin/go build -trimpath -buildvcs=false -p=4 -tags 'netgo osusergo bindata timetzdata sqlite sqlite_unlock_notify' -ldflags '-linkmode external -extldflags "-static" -s -w -X "main.ReleaseVersion=11.0.3+cust80.15cb7f13" -X "main.MakeVersion=GNU Make 4.3" -X "main.Version=11.0.3+cust80.15cb7f13" -X "main.Tags=bindata timetzdata sqlite sqlite_unlock_notify" -X "main.ForgejoVersion=11.0.3+cust80.15cb7f13"' -o gitea
|
||||
# forgejo.org
|
||||
/usr/bin/ld: /tmp/go-link-3872557335/000012.o: in function `unixDlOpen':
|
||||
/_/github.com/mattn/go-sqlite3@v1.14.28/sqlite3-binding.c:45328:(.text+0x7a2d): warning: Using 'dlopen' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
|
||||
|
|
@ -0,0 +1,62 @@
|
|||
{
|
||||
"argv": [
|
||||
"bwrap",
|
||||
"--unshare-net",
|
||||
"--unshare-pid",
|
||||
"--proc",
|
||||
"/proc",
|
||||
"--dev",
|
||||
"/dev",
|
||||
"--tmpfs",
|
||||
"/tmp",
|
||||
"--dir",
|
||||
"/app",
|
||||
"--ro-bind",
|
||||
"/tmp/custodian-forgejo-release-r3/source/gitea",
|
||||
"/app/forgejo",
|
||||
"--bind",
|
||||
"/tmp/custodian-forgejo-release-r3/embedded-extracted",
|
||||
"/results",
|
||||
"--chdir",
|
||||
"/tmp",
|
||||
"--clearenv",
|
||||
"--setenv",
|
||||
"PATH",
|
||||
"/nonexistent",
|
||||
"--setenv",
|
||||
"HOME",
|
||||
"/tmp/home",
|
||||
"--setenv",
|
||||
"USER",
|
||||
"builder",
|
||||
"--setenv",
|
||||
"USERNAME",
|
||||
"builder",
|
||||
"--setenv",
|
||||
"GITEA_WORK_DIR",
|
||||
"/tmp/work",
|
||||
"--setenv",
|
||||
"GITEA_CUSTOM",
|
||||
"/tmp/custom",
|
||||
"--setenv",
|
||||
"GITEA_APP_INI",
|
||||
"/tmp/absent-app.ini",
|
||||
"--setenv",
|
||||
"TZ",
|
||||
"UTC",
|
||||
"--setenv",
|
||||
"LC_ALL",
|
||||
"C",
|
||||
"--",
|
||||
"/app/forgejo",
|
||||
"embedded",
|
||||
"extract",
|
||||
"--include-vendored",
|
||||
"--destination",
|
||||
"/results",
|
||||
"**"
|
||||
],
|
||||
"phase": "embedded-extract",
|
||||
"returncode": 0,
|
||||
"seconds": 0.81
|
||||
}
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,11 @@
|
|||
{
|
||||
"scope": "Public generated/embedded asset SHA-256 identifiers only",
|
||||
"assets_verified_against_both_actual_source_and_extracted_binary": 2234,
|
||||
"runtime_original_manifest_sha256": "sha256:74a0ec278ab99ac86ee434d7620229dc4a70146efd51876a1e4738d2c9f4ffdb",
|
||||
"published_manifest_sha256": "sha256:ca09d0b2ed436ad6d3473da35d0d1081bdd8c3311825f4684993b33e6b426736",
|
||||
"original_byte_exact_reconstructed": true,
|
||||
"reconstruction": "Remove the sha256: value prefix and serialize with json.dumps(indent=2, sort_keys=True) plus one newline.",
|
||||
"runtime_verification_receipt_preserved": true,
|
||||
"scanner_rules_or_allowlists_changed": false,
|
||||
"credential_values_transformed": false
|
||||
}
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
{
|
||||
"argv": [
|
||||
"make",
|
||||
"GOFLAGS=-trimpath -buildvcs=false -p=4",
|
||||
"RELEASE_VERSION=11.0.3+cust80.15cb7f13",
|
||||
"FORGEJO_VERSION=11.0.3+cust80.15cb7f13",
|
||||
"FORGEJO_VERSION_API=11.0.3+cust80.15cb7f13",
|
||||
"frontend"
|
||||
],
|
||||
"phase": "frontend",
|
||||
"returncode": 0,
|
||||
"seconds": 91.73
|
||||
}
|
||||
|
|
@ -0,0 +1,55 @@
|
|||
{
|
||||
"buildx.build.provenance": {
|
||||
"builder": {
|
||||
"id": ""
|
||||
},
|
||||
"buildType": "https://mobyproject.org/buildkit@v1",
|
||||
"materials": [
|
||||
{
|
||||
"uri": "pkg:docker/code.forgejo.org/forgejo/forgejo?digest=sha256:41649dff5311664097d29b4d80620403f0b27e7c0eee0b8af79b132a37f3807b\u0026platform=linux%2Famd64",
|
||||
"digest": {
|
||||
"sha256": "41649dff5311664097d29b4d80620403f0b27e7c0eee0b8af79b132a37f3807b"
|
||||
}
|
||||
}
|
||||
],
|
||||
"invocation": {
|
||||
"configSource": {
|
||||
"entryPoint": "Dockerfile"
|
||||
},
|
||||
"parameters": {
|
||||
"frontend": "dockerfile.v0",
|
||||
"args": {
|
||||
"build-arg:SOURCE_DATE_EPOCH": "1752120742",
|
||||
"force-network-mode": "none",
|
||||
"no-cache": ""
|
||||
},
|
||||
"locals": [
|
||||
{
|
||||
"name": "context"
|
||||
},
|
||||
{
|
||||
"name": "dockerfile"
|
||||
}
|
||||
]
|
||||
},
|
||||
"environment": {
|
||||
"platform": "linux/amd64"
|
||||
}
|
||||
}
|
||||
},
|
||||
"buildx.build.ref": "default/default/owivw1kzw5uqoc3futrdsrg8z",
|
||||
"containerimage.config.digest": "sha256:f72e76f0ed5c0bd75d0727d1fc28a731a2bcdc90cfe15df534098444d81385c5",
|
||||
"containerimage.descriptor": {
|
||||
"mediaType": "application/vnd.oci.image.manifest.v1+json",
|
||||
"digest": "sha256:fc93a924b6e5f80a1dbf2a371dfd2e09fab10baa1cbca189bf61602009438822",
|
||||
"size": 2841,
|
||||
"annotations": {
|
||||
"org.opencontainers.image.created": "2025-07-10T04:12:22Z"
|
||||
},
|
||||
"platform": {
|
||||
"architecture": "amd64",
|
||||
"os": "linux"
|
||||
}
|
||||
},
|
||||
"containerimage.digest": "sha256:fc93a924b6e5f80a1dbf2a371dfd2e09fab10baa1cbca189bf61602009438822"
|
||||
}
|
||||
|
|
@ -0,0 +1,60 @@
|
|||
{
|
||||
"argv": [
|
||||
"bwrap",
|
||||
"--unshare-net",
|
||||
"--unshare-pid",
|
||||
"--proc",
|
||||
"/proc",
|
||||
"--dev",
|
||||
"/dev",
|
||||
"--tmpfs",
|
||||
"/tmp",
|
||||
"--dir",
|
||||
"/app",
|
||||
"--ro-bind",
|
||||
"/tmp/custodian-forgejo-release-r3/source/gitea",
|
||||
"/app/forgejo",
|
||||
"--bind",
|
||||
"/tmp/custodian-forgejo-release-r3/embedded-extracted",
|
||||
"/results",
|
||||
"--chdir",
|
||||
"/tmp",
|
||||
"--clearenv",
|
||||
"--setenv",
|
||||
"PATH",
|
||||
"/nonexistent",
|
||||
"--setenv",
|
||||
"HOME",
|
||||
"/tmp/home",
|
||||
"--setenv",
|
||||
"USER",
|
||||
"builder",
|
||||
"--setenv",
|
||||
"USERNAME",
|
||||
"builder",
|
||||
"--setenv",
|
||||
"GITEA_WORK_DIR",
|
||||
"/tmp/work",
|
||||
"--setenv",
|
||||
"GITEA_CUSTOM",
|
||||
"/tmp/custom",
|
||||
"--setenv",
|
||||
"GITEA_APP_INI",
|
||||
"/tmp/absent-app.ini",
|
||||
"--setenv",
|
||||
"TZ",
|
||||
"UTC",
|
||||
"--setenv",
|
||||
"LC_ALL",
|
||||
"C",
|
||||
"--",
|
||||
"/app/forgejo",
|
||||
"admin",
|
||||
"auth",
|
||||
"add-oauth",
|
||||
"--help"
|
||||
],
|
||||
"phase": "new-cli-help",
|
||||
"returncode": 0,
|
||||
"seconds": 0.13
|
||||
}
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
{
|
||||
"argv": [
|
||||
"npm",
|
||||
"ci",
|
||||
"--offline",
|
||||
"--ignore-scripts",
|
||||
"--no-audit",
|
||||
"--no-fund"
|
||||
],
|
||||
"phase": "npm-offline-ci",
|
||||
"returncode": 0,
|
||||
"seconds": 51.5
|
||||
}
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
{
|
||||
"argv": [
|
||||
"npm",
|
||||
"ci",
|
||||
"--ignore-scripts",
|
||||
"--no-audit",
|
||||
"--no-fund"
|
||||
],
|
||||
"phase": "npm-public-acquire",
|
||||
"returncode": 0,
|
||||
"seconds": 54.62
|
||||
}
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
{
|
||||
"lock_sha256": "acf9859d1b1009d1afe0844f2068f9b95cfadb176591edce0ec42084604e4d65",
|
||||
"module_cache": "/tmp/custodian-forgejo-successor-attempt2/modules",
|
||||
"public_archives_verified": true
|
||||
}
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
{
|
||||
"source": "https://nodejs.org/dist/v22.15.0/SHASUMS256.txt",
|
||||
"archive_sha256": "sha256:dafe2e8f82cb97de1bd10db9e2ec4c07bbf53389b0799b1e095a918951e78fd4",
|
||||
"official_checksum_exact": true,
|
||||
"archive": "node-v22.15.0-linux-x64.tar.xz"
|
||||
}
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
{
|
||||
"argv": [
|
||||
"docker",
|
||||
"buildx",
|
||||
"build",
|
||||
"--output",
|
||||
"type=oci,dest=/tmp/custodian-forgejo-release-r3-oci-replay/image.oci.tar,rewrite-timestamp=true",
|
||||
"--no-cache",
|
||||
"--platform",
|
||||
"linux/amd64",
|
||||
"--pull=false",
|
||||
"--network=none",
|
||||
"--provenance=false",
|
||||
"--sbom=false",
|
||||
"--metadata-file",
|
||||
"/tmp/custodian-forgejo-release-r3-oci-replay/image-build-metadata.json",
|
||||
"--build-arg",
|
||||
"SOURCE_DATE_EPOCH=1752120742",
|
||||
"/tmp/custodian-forgejo-release-r3-oci-replay/container-context"
|
||||
],
|
||||
"phase": "container-build",
|
||||
"returncode": 0,
|
||||
"seconds": 35.51
|
||||
}
|
||||
|
|
@ -0,0 +1,37 @@
|
|||
#0 building with "default" instance using docker driver
|
||||
|
||||
#1 [internal] load build definition from Dockerfile
|
||||
#1 transferring dockerfile: 465B done
|
||||
#1 DONE 0.1s
|
||||
|
||||
#2 [internal] load metadata for code.forgejo.org/forgejo/forgejo@sha256:41649dff5311664097d29b4d80620403f0b27e7c0eee0b8af79b132a37f3807b
|
||||
#2 DONE 0.0s
|
||||
|
||||
#3 [internal] load .dockerignore
|
||||
#3 transferring context: 2B done
|
||||
#3 DONE 0.1s
|
||||
|
||||
#4 [1/2] FROM code.forgejo.org/forgejo/forgejo@sha256:41649dff5311664097d29b4d80620403f0b27e7c0eee0b8af79b132a37f3807b
|
||||
#4 resolve code.forgejo.org/forgejo/forgejo@sha256:41649dff5311664097d29b4d80620403f0b27e7c0eee0b8af79b132a37f3807b 0.1s done
|
||||
#4 CACHED
|
||||
|
||||
#5 [internal] load build context
|
||||
#5 transferring context: 111.05MB 1.9s done
|
||||
#5 DONE 2.0s
|
||||
|
||||
#6 [2/2] COPY --chown=0:0 --chmod=755 gitea /app/gitea/gitea
|
||||
#6 DONE 1.4s
|
||||
|
||||
#7 exporting to oci image format
|
||||
#7 exporting layers
|
||||
#7 exporting layers 7.1s done
|
||||
#7 rewriting layers with source-date-epoch 1752120742 (2025-07-10 04:12:22 +0000 UTC)
|
||||
#7 rewriting layers with source-date-epoch 1752120742 (2025-07-10 04:12:22 +0000 UTC) 10.2s done
|
||||
#7 exporting manifest sha256:fc93a924b6e5f80a1dbf2a371dfd2e09fab10baa1cbca189bf61602009438822 done
|
||||
#7 exporting config sha256:f72e76f0ed5c0bd75d0727d1fc28a731a2bcdc90cfe15df534098444d81385c5 done
|
||||
#7 sending tarball
|
||||
#7 sending tarball 13.6s done
|
||||
#7 DONE 30.9s
|
||||
|
||||
#8 resolving provenance for metadata file
|
||||
#8 DONE 0.0s
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
{
|
||||
"all_base_layers_and_rootless_runtime_config_preserved": true,
|
||||
"all_oci_blob_digests_verified": true,
|
||||
"archive_sha256": "7307e1d9a26aa6284270dac8b751a71ae02338be090511d192e14865c5e485d9",
|
||||
"artifact_path": "/tmp/custodian-forgejo-release-r3-oci-replay/image.oci.tar",
|
||||
"config_digest": "sha256:f72e76f0ed5c0bd75d0727d1fc28a731a2bcdc90cfe15df534098444d81385c5",
|
||||
"container_epoch": 1752120742,
|
||||
"deployment_tag": null,
|
||||
"final_layer_binary_exact": true,
|
||||
"host_or_secret_mounts": false,
|
||||
"image_manifest_digest": "sha256:fc93a924b6e5f80a1dbf2a371dfd2e09fab10baa1cbca189bf61602009438822",
|
||||
"local_runtime_image_loaded": false,
|
||||
"oci_index_sha256": "dc86ae233589dec919932834ecf990e1d07a16db4d240c2772ea5fa08a940671",
|
||||
"privileged_containers": false,
|
||||
"registry_publication": false,
|
||||
"source_epoch": 1752105237
|
||||
}
|
||||
|
|
@ -0,0 +1,55 @@
|
|||
{
|
||||
"buildx.build.provenance": {
|
||||
"builder": {
|
||||
"id": ""
|
||||
},
|
||||
"buildType": "https://mobyproject.org/buildkit@v1",
|
||||
"materials": [
|
||||
{
|
||||
"uri": "pkg:docker/code.forgejo.org/forgejo/forgejo?digest=sha256:41649dff5311664097d29b4d80620403f0b27e7c0eee0b8af79b132a37f3807b\u0026platform=linux%2Famd64",
|
||||
"digest": {
|
||||
"sha256": "41649dff5311664097d29b4d80620403f0b27e7c0eee0b8af79b132a37f3807b"
|
||||
}
|
||||
}
|
||||
],
|
||||
"invocation": {
|
||||
"configSource": {
|
||||
"entryPoint": "Dockerfile"
|
||||
},
|
||||
"parameters": {
|
||||
"frontend": "dockerfile.v0",
|
||||
"args": {
|
||||
"build-arg:SOURCE_DATE_EPOCH": "1752120742",
|
||||
"force-network-mode": "none",
|
||||
"no-cache": ""
|
||||
},
|
||||
"locals": [
|
||||
{
|
||||
"name": "context"
|
||||
},
|
||||
{
|
||||
"name": "dockerfile"
|
||||
}
|
||||
]
|
||||
},
|
||||
"environment": {
|
||||
"platform": "linux/amd64"
|
||||
}
|
||||
}
|
||||
},
|
||||
"buildx.build.ref": "default/default/t6qvjjr5lscdf1bsfjtmnd2co",
|
||||
"containerimage.config.digest": "sha256:f72e76f0ed5c0bd75d0727d1fc28a731a2bcdc90cfe15df534098444d81385c5",
|
||||
"containerimage.descriptor": {
|
||||
"mediaType": "application/vnd.oci.image.manifest.v1+json",
|
||||
"digest": "sha256:fc93a924b6e5f80a1dbf2a371dfd2e09fab10baa1cbca189bf61602009438822",
|
||||
"size": 2841,
|
||||
"annotations": {
|
||||
"org.opencontainers.image.created": "2025-07-10T04:12:22Z"
|
||||
},
|
||||
"platform": {
|
||||
"architecture": "amd64",
|
||||
"os": "linux"
|
||||
}
|
||||
},
|
||||
"containerimage.digest": "sha256:fc93a924b6e5f80a1dbf2a371dfd2e09fab10baa1cbca189bf61602009438822"
|
||||
}
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
{
|
||||
"all_public_options_templates_exact": true,
|
||||
"architecture_approval": false,
|
||||
"binary_sha256": "52f1e111ab17b9c8f2841b0815075df5812b066be45326abe50d140d8a231c34",
|
||||
"embedded_file_manifest_sha256": "74a0ec278ab99ac86ee434d7620229dc4a70146efd51876a1e4738d2c9f4ffdb",
|
||||
"embedded_files": 2234,
|
||||
"native_admission": false,
|
||||
"network": "bwrap --unshare-net",
|
||||
"new_cli_flag_present": true,
|
||||
"no_dynamic_interpreter": true,
|
||||
"no_source_assets_libraries_or_host_config_mounted": true,
|
||||
"source_locks_preserved": true
|
||||
}
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
{
|
||||
"argv": [
|
||||
"go",
|
||||
"mod",
|
||||
"verify"
|
||||
],
|
||||
"phase": "verify-go-modules",
|
||||
"returncode": 0,
|
||||
"seconds": 11.65
|
||||
}
|
||||
|
|
@ -0,0 +1,113 @@
|
|||
# Forgejo release preparation (build only)
|
||||
|
||||
The Apps Makefile targets package the digest-bound 37-path Forgejo 11.0.3
|
||||
source candidate in `forgejo-security-extension.patch`. It combines the original
|
||||
three-group any-of gate, private secret-file input, private source-operation DB
|
||||
primitives and the producer-owned Access Engine client in the OIDC callback.
|
||||
Coordinator source tests and complete release checks are recorded separately;
|
||||
independent owner review and operational admission of this revision remain open. They never deploy, push, change default values or choose
|
||||
an operational image. Third-party application source is expanded only into a new
|
||||
`/tmp` workspace; this repository retains a release input lock and exact reviewed
|
||||
patch, not a second source-code tree. Upstream source ownership and publication
|
||||
remain separate owner work.
|
||||
|
||||
Supply explicit public input archives/cache paths to `make forgejo-release-prepare`:
|
||||
`FORGEJO_SOURCE_ARCHIVE`, `FORGEJO_GO_ARCHIVE`, `FORGEJO_NODE_ARCHIVE`,
|
||||
`FORGEJO_BUILD_GOMODCACHE`, optionally `FORGEJO_BUILD_GOCACHE_SEED` and
|
||||
`FORGEJO_BUILD_NPM_CACHE_SEED`. Every archive, patch, source output, dependency
|
||||
lock and selected host compiler tool is digest-bound by `inputs.lock.json`.
|
||||
Go's official checksums and Node's official SHASUMS must be independently checked
|
||||
when acquiring those public archives. The source archive is official Forgejo
|
||||
v11.0.3; archive PAX commit b81aa4d0807cc1e2d6a2fbafd0b75c46cc0ae237.
|
||||
|
||||
The workspace must not exist. Existing trials are preserved, never restarted
|
||||
because an observer timed out. The recipe's `process.json` records the exact
|
||||
active child PID, phase and command, then completion; logs and receipts stay in
|
||||
the workspace. Do not run two phases against the same workspace concurrently.
|
||||
|
||||
`make forgejo-release-acquire-npm` explicitly acquires only public registry
|
||||
packages, with fresh HOME/config paths, integrity-bound lockfile and lifecycle
|
||||
scripts disabled. With the cache ready, `make forgejo-release-build` reruns
|
||||
`npm ci --offline --ignore-scripts`, Go module verification, upstream frontend
|
||||
compilation and upstream generation/static backend targets inside a network
|
||||
namespace without connectivity. It uses the exact Go/Node distributions, local
|
||||
compiler inputs, `bindata timetzdata sqlite sqlite_unlock_notify` plus upstream
|
||||
static target's `netgo osusergo`, explicit Make GOFLAGS for trimpath/buildvcs and
|
||||
fixed file/directory timestamps. Build tags retain the upstream rootless build
|
||||
profile. `make forgejo-release-verify` compares every embedded public/options/
|
||||
template file to actual generated source bytes, checks the extension CLI and
|
||||
checks the ELF has no dynamic interpreter. These are local artifact checks,
|
||||
not application login, DB, native rollout or architecture acceptance.
|
||||
|
||||
For a **local container build** only, first acquire the locked public amd64
|
||||
base with an empty Docker client config and the explicit local socket. Then
|
||||
`make forgejo-release-container` uses that exact digest as a build input and a
|
||||
minimal context containing only the verified executable and generated Dockerfile.
|
||||
It directly exports a local OCI archive with `rewrite-timestamp=true`, no-cache,
|
||||
no image load or push. SOURCE_DATE_EPOCH alone does not fix COPY parent-directory
|
||||
timestamps. The image epoch is max(source epoch,ceil immutable base created
|
||||
instant), so the original base layers remain exact while new metadata is stable.
|
||||
The recipe verifies every OCI blob, original base layer prefix, rootless runtime
|
||||
configuration, provenance labels and exact final executable. Two no-cache exports
|
||||
must reproduce the frozen output image and archive digests before claiming
|
||||
reproducibility. The actual local proof receipts are in the accompanying source
|
||||
proposal packet, not an admission of the resulting artifact.
|
||||
|
||||
There is no deployment tag, registry publication, RUN directive, privileged
|
||||
container or Docker host/secret mount. Public base acquisition and a standard
|
||||
local Docker/buildx daemon supporting OCI export/layer timestamp rewriting are
|
||||
explicit prerequisites. An unavailable feature is a retained blocker; do not
|
||||
switch to a privileged builder or claim a successful image from a backend-only
|
||||
binary. Existing contexts/output archives refuse overwrite. Reconcile an actual
|
||||
failed export explicitly, retaining original metadata/logs/artifacts; observation
|
||||
timeouts never justify another build. Older prototype load/save behavior and
|
||||
its config-versus-manifest-ID issue are retained in the source trial history,
|
||||
not shipped as a production continuation.
|
||||
|
||||
The static host toolchain is pinned for this Linux amd64 review estate. Broader
|
||||
cross-host reproducibility or a different architecture/compiler/libc is a new
|
||||
input revision, not an implicit fallback. The glibc static-linker's optional
|
||||
SQLite `dlopen` diagnostic is retained; no SQLite-extension runtime compatibility
|
||||
or production platform admission is inferred from ELF inspection or asset checks.
|
||||
An accepted owner image/source/backend, authenticated access-engine decision,
|
||||
private secret-input boundary, type/case/descriptor re-freeze, current operation/
|
||||
inverse sessions, durable journal and application/Helm writer exclusion are
|
||||
separate gates. Helm omission/rollback does not remove persisted OAuth source.
|
||||
The existing case gate is compatibility code, not a single-PDP exception.
|
||||
|
||||
## KeyCape identity and callback admission
|
||||
|
||||
The callback independently verifies the ID token against owner-admitted public
|
||||
keys, algorithms, issuer, audience and token type. Public trust is loaded from
|
||||
`FORGEJO_ACCESS_ENGINE_ADMISSION_FILE`; only an absolute private file reference
|
||||
is used for the PDP caller token. No admission file or operational keys are
|
||||
supplied by this build. New fields `tenant_source_claim` and
|
||||
`max_authentication_age` are mandatory. The KeyCape v0.3 profile uses
|
||||
`assurance_claim: assurance` and `tenant_source_claim: tenant_source`. Maximum
|
||||
identity age and maximum authentication age are separate positive durations
|
||||
chosen by the owner, not implicit defaults.
|
||||
|
||||
The signed assurance object preserves `level`, `methods`, boolean `mfa`,
|
||||
`source: key-cape` and integer `at`. Its authentication time must not follow
|
||||
issuance or the current time, and must satisfy the admitted authentication-age
|
||||
bound. Identity validity ends at the earliest token expiration, issued-at age
|
||||
bound or authentication-age bound. Directory, registration and default tenant
|
||||
provenance remain distinct in the request. Mutable UserInfo cannot replace
|
||||
these authenticated facts. Current UserInfo subject and the Goth subject must
|
||||
match the independently verified token; the three required group alternatives
|
||||
remain policy input.
|
||||
|
||||
The parser also represents valid lower-assurance facts. Application policy
|
||||
continues to decide authorization. The Check client and unchanged canonical
|
||||
signature bytes are a generated source slice of Access Engine ca0cb757; Forgejo
|
||||
adds no policy evaluator. Exact caller/policy/registry/signer/request/lifetime
|
||||
pins, an authenticated HTTPS connection and a current ALLOW are required.
|
||||
Synthetic callback fixtures test ALLOW, DENY and adverse cases, including an ID
|
||||
token serialized by the actual pinned KeyCape handler. Those fixtures do not
|
||||
prove an actual browser, factor, custody or native rollout.
|
||||
|
||||
The current integration covers this guarded OIDC callback. Ongoing application
|
||||
HTTP/API/Git/SSH paths, current operation/inverse sessions, durable private
|
||||
evidence and retention, PostgreSQL/native proof and exclusion of all release
|
||||
writers remain open in RAPPS-WP-0016-T08/T09 and NK-WP-0048-T43. An old image
|
||||
approval or source test result cannot admit this candidate.
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,186 @@
|
|||
{
|
||||
"schema": "railiance-apps.forgejo-release-inputs.v1",
|
||||
"forgejo_version": "11.0.3",
|
||||
"source_archive_sha256": "1ddd8c926ca07d40436897971458ace7dcf1d3496a0813ab9e0d869edef2365c",
|
||||
"source_commit": "b81aa4d0807cc1e2d6a2fbafd0b75c46cc0ae237",
|
||||
"patch_sha256": "15cb7f13b1b1d1095cc344176ca337f705333a436a70ae803fcfd3d7f802ccf4",
|
||||
"go_archive_sha256": "3333f6ea53afa971e9078895eaa4ac7204a8c6b5c68c10e6bc9a33e8e391bdd8",
|
||||
"go_version": "1.24.3",
|
||||
"node_archive_sha256": "dafe2e8f82cb97de1bd10db9e2ec4c07bbf53389b0799b1e095a918951e78fd4",
|
||||
"node_version": "22.15.0",
|
||||
"source_date_epoch": 1752105237,
|
||||
"release_version": "11.0.3+cust80.15cb7f13",
|
||||
"tags": "bindata timetzdata sqlite sqlite_unlock_notify",
|
||||
"runtime_base": "code.forgejo.org/forgejo/forgejo@sha256:41649dff5311664097d29b4d80620403f0b27e7c0eee0b8af79b132a37f3807b",
|
||||
"runtime_index_digest": "sha256:691657c7e64af7730a2e885e6d022cf16ae60724931c5392bd61838afadcaeba",
|
||||
"platform": "linux/amd64",
|
||||
"reviewed_outputs": [
|
||||
{
|
||||
"path": "cmd/admin_auth_oauth.go",
|
||||
"sha256": "d718d817c46f6393488a9c5a894b7535640cd0ec1a1ae3f72f8411a2bbec3b38"
|
||||
},
|
||||
{
|
||||
"path": "cmd/admin_auth_oauth_secret_linux.go",
|
||||
"sha256": "6741961f1df67c1afbf34c796e549425f0e04a0d0678c6eedb05f66d4754c64b"
|
||||
},
|
||||
{
|
||||
"path": "cmd/admin_auth_oauth_secret_linux_test.go",
|
||||
"sha256": "b28c2369dfab9bf2ca48e707e01b4394a36c8be5490cfe5bb658017bb626c4b2"
|
||||
},
|
||||
{
|
||||
"path": "cmd/admin_auth_oauth_secret_other.go",
|
||||
"sha256": "54056c989a4757e73db0252130e7c16bf16f5ec8eaaca2468f019ba2ef5c532d"
|
||||
},
|
||||
{
|
||||
"path": "go.mod",
|
||||
"sha256": "130138c4c3ecc29fa0d7f1e2eef0589ddf3b06071f3cc0448aa7b2326847653a"
|
||||
},
|
||||
{
|
||||
"path": "models/auth/source_operation.go",
|
||||
"sha256": "ef1b07ef6cf454015d00cde8588835f5118d829da91eb0303d37184859345a31"
|
||||
},
|
||||
{
|
||||
"path": "models/auth/source_operation_internal_test.go",
|
||||
"sha256": "af0f424d3a1fd2b29793b64baa1fa07284fee7ea0b7721c503db4efac0d871cb"
|
||||
},
|
||||
{
|
||||
"path": "models/auth/source_operation_process_test.go",
|
||||
"sha256": "40d33b11a01cb659f0bf6f8b545c4d79910e8c082a789060bcbc9cadeee965bd"
|
||||
},
|
||||
{
|
||||
"path": "models/auth/source_operation_test.go",
|
||||
"sha256": "77d311bca42f48faf3fbdc15c53582e3d8a6d9108a72ed7bb6172e5b88951428"
|
||||
},
|
||||
{
|
||||
"path": "models/db/context.go",
|
||||
"sha256": "d4c4acfcb8987071aecf5cd957b3821c8d2619a2696398d37c2970f2527686f7"
|
||||
},
|
||||
{
|
||||
"path": "models/db/engine.go",
|
||||
"sha256": "43683804d0c5bc6ead1dba0344c69dd196825cf3d5eb502af8d932a7b8207b96"
|
||||
},
|
||||
{
|
||||
"path": "models/db/sensitive_sql.go",
|
||||
"sha256": "06a298d0d6e628e6920384d4ddeef449e40c090841ebaa3f6d175725a45ae584"
|
||||
},
|
||||
{
|
||||
"path": "models/db/sensitive_sql_logging_test.go",
|
||||
"sha256": "d924b35d30686473caf29601cf51cc363ba68158cb4ef0981c9e2fc7b03c04b7"
|
||||
},
|
||||
{
|
||||
"path": "models/db/sensitive_sql_test.go",
|
||||
"sha256": "de6353c955047c3311747e4777b9f9b2195e9efb19160b971dd758dfc94cf31b"
|
||||
},
|
||||
{
|
||||
"path": "routers/web/admin/auths.go",
|
||||
"sha256": "3498229e06fb9ff52396bcb5e68c0cc2d2ad24e6494533d8717d7c833f3e2923"
|
||||
},
|
||||
{
|
||||
"path": "routers/web/auth/oauth.go",
|
||||
"sha256": "58bff778e0dc17a521706289bf45c3e0d76a759a0874f76c379b3d1ddb419b17"
|
||||
},
|
||||
{
|
||||
"path": "services/auth/source/oauth2/access_engine.go",
|
||||
"sha256": "d5f07f9491ac2212410e1fa8c0248d68ba3a723e7ca99e363627c5292d187aa8"
|
||||
},
|
||||
{
|
||||
"path": "services/auth/source/oauth2/access_engine_assurance.go",
|
||||
"sha256": "42de751b1e9a243301d566260954813b770558ecb449639acaeab307fe788642"
|
||||
},
|
||||
{
|
||||
"path": "services/auth/source/oauth2/access_engine_assurance_test.go",
|
||||
"sha256": "44e7459f6c1106a264093c19d61d01a8365f6ad22682906552d832ba39d61dd3"
|
||||
},
|
||||
{
|
||||
"path": "services/auth/source/oauth2/access_engine_azp_test.go",
|
||||
"sha256": "5f94f43ade9a79b6b7ef529c80115a8c32acfece425dc8ed3f24e6ad839fc0ce"
|
||||
},
|
||||
{
|
||||
"path": "services/auth/source/oauth2/access_engine_callback_test.go",
|
||||
"sha256": "5cea36b630c895a9473dc876b7128526ddef65d9395b2fddc56343e162452472"
|
||||
},
|
||||
{
|
||||
"path": "services/auth/source/oauth2/access_engine_test.go",
|
||||
"sha256": "99edd6cfe3e834d73e0447a7915f52cc4ab7b82644669c5ae61963f850b447e8"
|
||||
},
|
||||
{
|
||||
"path": "services/auth/source/oauth2/providers_openid.go",
|
||||
"sha256": "5dd9b906cce434c774968d57fcc790cb678147345fea4d2e58477ec6eed70bcf"
|
||||
},
|
||||
{
|
||||
"path": "services/auth/source/oauth2/required_claim_values.go",
|
||||
"sha256": "29f16d07464bbe12e3f65616b6c1eb60561d04cd8ff89ecbfb56f93dbeaf1cda"
|
||||
},
|
||||
{
|
||||
"path": "services/auth/source/oauth2/required_claim_values_test.go",
|
||||
"sha256": "54a8bd97dc51c524a9adf0c6aefb9a19fa152d234b3bb929bf1a90932662d3d0"
|
||||
},
|
||||
{
|
||||
"path": "services/auth/source/oauth2/source.go",
|
||||
"sha256": "44e99883c2ec479427b3f72c73353fe33936eed2e5c962b2fa40803576aa5642"
|
||||
},
|
||||
{
|
||||
"path": "services/auth/source/oauth2/source_callout.go",
|
||||
"sha256": "6abba69df97afc62467f0328eaa5a6383cfb4900202a081dec4b84a21b37349c"
|
||||
},
|
||||
{
|
||||
"path": "third_party/access-engine-pep/LICENSE",
|
||||
"sha256": "ff413f361a3b3bf44cf50f110fbcc4837064d57eefbcef89df2b43997c6262b6"
|
||||
},
|
||||
{
|
||||
"path": "third_party/access-engine-pep/go.mod",
|
||||
"sha256": "fea700810e47c1ba5638b86a168f8531c083a6e1222ca80bd2a8947b2ea6f2c3"
|
||||
},
|
||||
{
|
||||
"path": "third_party/access-engine-pep/internal/sign/sign.go",
|
||||
"sha256": "0df9515922e90775ebbfac798361dcafb20da8a4213796b44e246b8a92046cde"
|
||||
},
|
||||
{
|
||||
"path": "third_party/access-engine-pep/pkg/api/canonical.go",
|
||||
"sha256": "a122a2e8cd524333b13c5939c7a3685e41efbe47497a64e0c7297c92b7f10d19"
|
||||
},
|
||||
{
|
||||
"path": "third_party/access-engine-pep/pkg/api/caring.go",
|
||||
"sha256": "1907156f0f889e7b9e9c14970cf7a86a20d00478a496efaf92c7231f27fec5e3"
|
||||
},
|
||||
{
|
||||
"path": "third_party/access-engine-pep/pkg/api/resource_manifest.go",
|
||||
"sha256": "f0fa4080287d389ed48c2b1d6af96cc62e57ef72c902333f677f964420be133f"
|
||||
},
|
||||
{
|
||||
"path": "third_party/access-engine-pep/pkg/decisionpep/client.go",
|
||||
"sha256": "0d57f6ddaca5c3f81ce426c0e8b14ba14ea5962096d3be5909aa456eef19eeba"
|
||||
},
|
||||
{
|
||||
"path": "third_party/access-engine-pep/pkg/decisionpep/client_test.go",
|
||||
"sha256": "1a6be3485f580f95a1f1406fb76e525f2c4bf02fe04a424cfe0095bb728e3f62"
|
||||
},
|
||||
{
|
||||
"path": "third_party/access-engine-pep/producer-source.json",
|
||||
"sha256": "c1d83e3d79f9860ffaa61ec19a6b3415e914d3058b11b07cdd05a7d1182cdceb"
|
||||
},
|
||||
{
|
||||
"path": "third_party/access-engine-pep/testsupport/signfixture/sign.go",
|
||||
"sha256": "fe4aa86f444dc20145aefbaca35b24f046264b2c5c8b4e3b057a4496b77a4d29"
|
||||
}
|
||||
],
|
||||
"lockfiles": {
|
||||
"go.mod": "130138c4c3ecc29fa0d7f1e2eef0589ddf3b06071f3cc0448aa7b2326847653a",
|
||||
"go.sum": "19c305c7e68de9d3f1bc0dda2de09c5d38597f1ee7fa411c7b36b92467ae1eaf",
|
||||
"package.json": "ab5c54ec7077501b50acf3ab5f1fff4f63a51abe99e720b8ecdc6cc6c78f39fc",
|
||||
"package-lock.json": "fdd5c2f891311be7c01b1907b418c243ca1f0f951fd4b4ee5b5e931c43493657"
|
||||
},
|
||||
"host_tools": {
|
||||
"/usr/bin/make": "d78b8f1d099fbcfb6f2f49ab87223b9b68fb3956642f92d6ec6de812e8afa965",
|
||||
"/usr/bin/gcc": "1b99826121ae6682a634e5efe09bd3e3df58ce58e0b28f849114ab5b89139c26",
|
||||
"/usr/bin/ld": "e46a122cc3a29feba3b1d0fc2a274b6e46538be016ebe381370c0801bb98b0b8",
|
||||
"/usr/bin/ar": "534681ac11c18868cfc4fdf98770aa0ba8973eedc90c231e94e6ba96e1a04f27",
|
||||
"/usr/bin/bwrap": "e318903862396f96de3df57264e0158682b952fd3fb53ac23d876413e7b30f71",
|
||||
"/usr/lib/x86_64-linux-gnu/libc.a": "a40c7eae7581f977b65eddb81cbc799213a695749e039d966db55bdee4ac9621",
|
||||
"/usr/lib/x86_64-linux-gnu/libm.a": "420cd3c406f6f8c12deb3d1291146e9c091ee015a7c39eaf2237f01e80d6f0ae"
|
||||
},
|
||||
"runtime_base_config_sha256": "bc5a3df111729582faadebd01d126ba769e2b65d0c62f306f6bc79f4e562452b",
|
||||
"patch_file": "forgejo-security-extension.patch",
|
||||
"candidate_review_status": "coordinator tested; independent owner review pending",
|
||||
"producer_source_commit": "ca0cb75729a63c9288b7333382d0fa3eb1e8c9a3"
|
||||
}
|
||||
File diff suppressed because one or more lines are too long
|
|
@ -0,0 +1,240 @@
|
|||
#!/usr/bin/env python3
|
||||
"""Build-only public Forgejo owner recipe; no deployment or publication code."""
|
||||
import argparse
|
||||
import hashlib
|
||||
import json
|
||||
import os
|
||||
from pathlib import Path
|
||||
import shutil
|
||||
import subprocess
|
||||
import tarfile
|
||||
import time
|
||||
import math
|
||||
import datetime
|
||||
|
||||
OWNER=Path(__file__).resolve().parents[1]
|
||||
INPUTS=OWNER/'build/forgejo'
|
||||
LOCK=json.loads((INPUTS/'inputs.lock.json').read_text())
|
||||
|
||||
def digest(path):
|
||||
h=hashlib.sha256()
|
||||
with Path(path).open('rb') as f:
|
||||
for block in iter(lambda:f.read(1024*1024),b''):h.update(block)
|
||||
return h.hexdigest()
|
||||
|
||||
def save(path,data):
|
||||
Path(path).write_text(json.dumps(data,indent=2,sort_keys=True)+'\n')
|
||||
|
||||
def check(path,expected):
|
||||
if digest(path)!=expected:raise ValueError('frozen public input digest differs: '+str(path))
|
||||
|
||||
def base_env(work):
|
||||
return {'PATH':str(work/'node-v22.15.0-linux-x64/bin')+':'+str(work/'go/bin')+':/usr/bin:/bin',
|
||||
'HOME':str(work/'home'),'GOTOOLCHAIN':'local','GOPROXY':'off','GOSUMDB':'off','GOVCS':'*:off',
|
||||
'GOPATH':str(work/'gopath'),'GOMODCACHE':json.loads((work/'prepared.json').read_text())['module_cache'],
|
||||
'GOCACHE':str(work/'gocache'),'CGO_ENABLED':'1','GOMAXPROCS':'4',
|
||||
'GOFLAGS':'-trimpath -buildvcs=false -p=4','SOURCE_DATE_EPOCH':str(LOCK['source_date_epoch']),
|
||||
'TZ':'UTC','LC_ALL':'C','NODE_OPTIONS':'--max-old-space-size=4096',
|
||||
'GIT_CONFIG_NOSYSTEM':'1','GIT_CONFIG_GLOBAL':'/dev/null','GIT_TERMINAL_PROMPT':'0',
|
||||
'NPM_CONFIG_USERCONFIG':str(work/'empty.npmrc'),'NPM_CONFIG_GLOBALCONFIG':str(work/'empty-global.npmrc'),
|
||||
'NPM_CONFIG_CACHE':str(work/'npm-cache'),'NPM_CONFIG_REGISTRY':'https://registry.npmjs.org',
|
||||
'NPM_CONFIG_OFFLINE':'true','NPM_CONFIG_AUDIT':'false','NPM_CONFIG_FUND':'false',
|
||||
'NPM_CONFIG_UPDATE_NOTIFIER':'false','PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD':'1'}
|
||||
|
||||
def sandbox(work,env):
|
||||
cache=Path(env['GOMODCACHE'])
|
||||
return ['bwrap','--unshare-net','--unshare-pid','--ro-bind','/usr','/usr','--ro-bind','/lib','/lib',
|
||||
'--ro-bind','/lib64','/lib64','--symlink','usr/bin','/bin','--proc','/proc','--dev','/dev',
|
||||
'--tmpfs','/tmp','--bind',str(work),str(work),'--ro-bind',str(cache),str(cache),
|
||||
'--chdir',str(work/'source'),'--','env','-i']+[k+'='+v for k,v in env.items()]
|
||||
|
||||
def run(work,name,args,env=None,offline=False,cwd=None):
|
||||
actual=sandbox(work,env)+args if offline else args
|
||||
start=time.time()
|
||||
with (work/(name+'.log')).open('w') as out:
|
||||
proc=subprocess.Popen(actual,cwd=cwd or work,env={"PATH":"/usr/bin:/bin","HOME":str(work/"home")} if offline else env,stdout=out,stderr=subprocess.STDOUT)
|
||||
save(work/'process.json',{'phase':name,'pid':proc.pid,'driver_pid':os.getpid(),'argv':args,'state':'running'})
|
||||
code=proc.wait()
|
||||
result={'phase':name,'argv':args,'returncode':code,'seconds':round(time.time()-start,2)}
|
||||
save(work/(name+'-result.json'),result);save(work/'process.json',dict(result,state='complete',pid=None,driver_pid=None))
|
||||
print(json.dumps(result),flush=True)
|
||||
if code:raise RuntimeError('phase failed; retained log: '+str(work/(name+'.log')))
|
||||
return result
|
||||
|
||||
def checked_inputs(work):
|
||||
for n,h in LOCK['host_tools'].items():check(n,h)
|
||||
for n,h in LOCK['lockfiles'].items():check(work/'source'/n,h)
|
||||
for x in LOCK['reviewed_outputs']:check(work/'source'/x['path'],x['sha256'])
|
||||
|
||||
def prepare(a,work):
|
||||
if work.exists():raise ValueError('workspace must be new; existing trial is never restarted or overwritten')
|
||||
for n,key in [('source_archive','source_archive_sha256'),('go_archive','go_archive_sha256'),('node_archive','node_archive_sha256')]:
|
||||
if not getattr(a,n):raise ValueError('explicit '+n+' required')
|
||||
check(getattr(a,n),LOCK[key])
|
||||
if not a.module_cache:raise ValueError('explicit public module cache required')
|
||||
cache=Path(a.module_cache).resolve();assert cache.is_dir()
|
||||
check(INPUTS/LOCK['patch_file'],LOCK['patch_sha256'])
|
||||
for n,h in LOCK['host_tools'].items():check(n,h)
|
||||
work.mkdir(parents=True);(work/'home').mkdir()
|
||||
with tarfile.open(a.source_archive) as t:
|
||||
# The official archive is digest-bound before any member is extracted.
|
||||
parent=work/'unpacked';parent.mkdir();t.extractall(parent,filter='data')
|
||||
folders=list(parent.iterdir());assert len(folders)==1 and folders[0].is_dir();folders[0].rename(work/'source');parent.rmdir()
|
||||
for n in ['go_archive','node_archive']:
|
||||
with tarfile.open(getattr(a,n)) as t:t.extractall(work,filter='data')
|
||||
for n in ['empty.npmrc','empty-global.npmrc']:(work/n).write_text('')
|
||||
if a.go_cache_seed:shutil.copytree(Path(a.go_cache_seed).resolve(),work/'gocache')
|
||||
if a.npm_cache_seed:shutil.copytree(Path(a.npm_cache_seed).resolve(),work/'npm-cache')
|
||||
subprocess.run(['/usr/bin/git','apply','--check',str(INPUTS/LOCK['patch_file'])],cwd=work/'source',check=True,env={'PATH':'/usr/bin:/bin','HOME':str(work/'home'),'GIT_CONFIG_NOSYSTEM':'1','GIT_CONFIG_GLOBAL':'/dev/null'})
|
||||
subprocess.run(['/usr/bin/git','apply',str(INPUTS/LOCK['patch_file'])],cwd=work/'source',check=True,env={'PATH':'/usr/bin:/bin','HOME':str(work/'home'),'GIT_CONFIG_NOSYSTEM':'1','GIT_CONFIG_GLOBAL':'/dev/null'})
|
||||
save(work/'prepared.json',{'module_cache':str(cache),'lock_sha256':digest(INPUTS/'inputs.lock.json'),'public_archives_verified':True})
|
||||
checked_inputs(work)
|
||||
packages=json.loads((work/'source/package-lock.json').read_text())['packages']
|
||||
for name,package in packages.items():
|
||||
if not name:continue
|
||||
if not package.get('resolved','').startswith('https://registry.npmjs.org/') or not package.get('integrity','').startswith('sha512-'):
|
||||
raise ValueError('non-public/non-integrity-bound npm package: '+name)
|
||||
print(json.dumps({'prepared':True,'lockfile_npm_packages':len(packages)-1}))
|
||||
|
||||
def normalize(folder):
|
||||
epoch=LOCK['source_date_epoch']
|
||||
for root,dirs,files in os.walk(folder):
|
||||
dirs[:]=[x for x in dirs if x not in ('node_modules','.git')]
|
||||
for n in files:
|
||||
p=Path(root)/n
|
||||
if not p.is_symlink():os.utime(p,(epoch,epoch))
|
||||
os.utime(root,(epoch,epoch))
|
||||
|
||||
def build(work):
|
||||
checked_inputs(work);env=base_env(work)
|
||||
run(work,'verify-go-modules',['go','mod','verify'],env,True)
|
||||
run(work,'npm-offline-ci',['npm','ci','--offline','--ignore-scripts','--no-audit','--no-fund'],env,True)
|
||||
normalize(work/'source')
|
||||
version=['GOFLAGS=-trimpath -buildvcs=false -p=4','RELEASE_VERSION='+LOCK['release_version'],'FORGEJO_VERSION='+LOCK['release_version'],'FORGEJO_VERSION_API='+LOCK['release_version']]
|
||||
run(work,'frontend',['make']+version+['frontend'],env,True)
|
||||
for n in ['public','options','templates','modules/migration/schemas']:normalize(work/'source'/n)
|
||||
run(work,'embedded-and-static-backend',['make']+version+['TAGS='+LOCK['tags'],'go-check','generate-backend','static-executable'],env,True)
|
||||
checked_inputs(work)
|
||||
save(work/'build.json',{'binary_sha256':digest(work/'source/gitea'),'source_locks_preserved':True,'frontend_built':True,'tags':LOCK['tags'],'image_deployment_selected':False})
|
||||
|
||||
def verify(work):
|
||||
checked_inputs(work);binary=work/'source/gitea'
|
||||
target=work/'embedded-extracted'
|
||||
if target.exists():raise ValueError('retain prior verification; extraction target already exists')
|
||||
target.mkdir()
|
||||
# No source, asset tree, host /usr, libraries, configuration or HOME is
|
||||
# exposed to the executable. A filesystem fallback cannot pass this proof.
|
||||
bare=['bwrap','--unshare-net','--unshare-pid','--proc','/proc','--dev','/dev',
|
||||
'--tmpfs','/tmp','--dir','/app','--ro-bind',str(binary),'/app/forgejo',
|
||||
'--bind',str(target),'/results','--chdir','/tmp','--clearenv']
|
||||
for k,v in {'PATH':'/nonexistent','HOME':'/tmp/home','USER':'builder','USERNAME':'builder',
|
||||
'GITEA_WORK_DIR':'/tmp/work','GITEA_CUSTOM':'/tmp/custom',
|
||||
'GITEA_APP_INI':'/tmp/absent-app.ini','TZ':'UTC','LC_ALL':'C'}.items():
|
||||
bare+=['--setenv',k,v]
|
||||
bare+=['--','/app/forgejo']
|
||||
outer={'PATH':'/usr/bin:/bin','HOME':str(work/'home')}
|
||||
run(work,'binary-version',bare+['--version'],outer)
|
||||
run(work,'new-cli-help',bare+['admin','auth','add-oauth','--help'],outer)
|
||||
assert '--required-claim-values' in (work/'new-cli-help.log').read_text()
|
||||
assert '--secret-file' in (work/'new-cli-help.log').read_text()
|
||||
run(work,'embedded-extract',bare+['embedded','extract','--include-vendored','--destination','/results','**'],outer)
|
||||
records={}
|
||||
for folder in ['public','options','templates']:
|
||||
for f in sorted((work/'source'/folder).rglob('*')):
|
||||
if not f.is_file():continue
|
||||
n=str(f.relative_to(work/'source'));q=target/n
|
||||
if not q.is_file() or digest(f)!=digest(q):raise ValueError('embedded asset missing/different: '+n)
|
||||
records[n]=digest(f)
|
||||
assert 'public/assets/js/index.js' in records and 'public/assets/css/index.css' in records
|
||||
assert 'public/assets/licenses.txt' in records
|
||||
save(work/'embedded-files.json',records)
|
||||
readelf=subprocess.run(['/usr/bin/readelf','-l',str(binary)],capture_output=True,text=True,check=True,env={'PATH':'/usr/bin:/bin'})
|
||||
assert 'INTERP' not in readelf.stdout
|
||||
save(work/'verification.json',{'binary_sha256':digest(binary),'embedded_files':len(records),
|
||||
'embedded_file_manifest_sha256':digest(work/'embedded-files.json'),'all_public_options_templates_exact':True,
|
||||
'no_source_assets_libraries_or_host_config_mounted':True,
|
||||
'no_dynamic_interpreter':True,'new_cli_flag_present':True,'network':'bwrap --unshare-net',
|
||||
'source_locks_preserved':True,'architecture_approval':False,'native_admission':False})
|
||||
print((work/'verification.json').read_text())
|
||||
|
||||
def container(work):
|
||||
verified=json.loads((work/'verification.json').read_text());check(work/'source/gitea',verified['binary_sha256'])
|
||||
context=work/'container-context'
|
||||
if context.exists():raise ValueError('container trial already exists; retain evidence before an explicit revised trial')
|
||||
archive_path=work/'image.oci.tar'
|
||||
if archive_path.exists():raise ValueError('retain existing OCI artifact; never overwrite it')
|
||||
base_bytes=(INPUTS/'runtime-base-config.json').read_bytes()
|
||||
assert hashlib.sha256(base_bytes).hexdigest()==LOCK['runtime_base_config_sha256']
|
||||
original=json.loads(base_bytes)
|
||||
epoch=max(LOCK['source_date_epoch'],math.ceil(datetime.datetime.fromisoformat(original['created'].replace('Z','+00:00')).timestamp()))
|
||||
context.mkdir();shutil.copyfile(work/'source/gitea',context/'gitea')
|
||||
os.utime(context/'gitea',(LOCK['source_date_epoch'],)*2)
|
||||
(context/'Dockerfile').write_text('FROM '+LOCK['runtime_base']+'\nARG SOURCE_DATE_EPOCH\nLABEL org.opencontainers.image.version="'+LOCK['release_version']+'" org.opencontainers.image.revision="'+LOCK['source_commit']+'" org.railiance.source.patch.sha256="'+LOCK['patch_sha256']+'"\nCOPY --chown=0:0 --chmod=755 gitea /app/gitea/gitea\n')
|
||||
os.utime(context/'Dockerfile',(LOCK['source_date_epoch'],)*2)
|
||||
config=work/'docker-config';config.mkdir(exist_ok=True)
|
||||
env={'PATH':'/usr/bin:/bin','HOME':str(work/'home'),'DOCKER_CONFIG':str(config),'DOCKER_HOST':'unix:///var/run/docker.sock'}
|
||||
# SOURCE_DATE_EPOCH alone does not normalise COPY parent-directory mtimes.
|
||||
# OCI output permits layer rewriting without the Docker-store unpack conflict.
|
||||
# The epoch never predates the immutable base, preserving its exact layer prefix.
|
||||
run(work,'container-build',['docker','buildx','build','--output','type=oci,dest='+str(archive_path)+',rewrite-timestamp=true',
|
||||
'--no-cache','--platform',LOCK['platform'],'--pull=false','--network=none','--provenance=false','--sbom=false',
|
||||
'--metadata-file',str(work/'image-build-metadata.json'),'--build-arg','SOURCE_DATE_EPOCH='+str(epoch),str(context)],env)
|
||||
metadata=json.loads((work/'image-build-metadata.json').read_text())
|
||||
with tarfile.open(archive_path) as archive:
|
||||
index_bytes=archive.extractfile('index.json').read();index=json.loads(index_bytes)
|
||||
assert len(index['manifests'])==1
|
||||
descriptor=index['manifests'][0]
|
||||
assert descriptor['platform']=={'architecture':'amd64','os':'linux'}
|
||||
assert descriptor['digest']==metadata['containerimage.digest']
|
||||
def blob(d):
|
||||
value=archive.extractfile('blobs/sha256/'+d.split(':')[1]).read()
|
||||
assert 'sha256:'+hashlib.sha256(value).hexdigest()==d
|
||||
return value
|
||||
manifest=json.loads(blob(descriptor['digest']))
|
||||
config_digest=manifest['config']['digest'];config=json.loads(blob(config_digest))
|
||||
assert config_digest==metadata['containerimage.config.digest']
|
||||
for layer in manifest['layers']:blob(layer['digest'])
|
||||
assert config['rootfs']['diff_ids'][:-1]==original['rootfs']['diff_ids']
|
||||
assert config['architecture']=='amd64' and config['os']=='linux'
|
||||
for key in ['User','Entrypoint','Cmd','Env','WorkingDir','Volumes']:
|
||||
assert config['config'].get(key)==original['config'].get(key),key
|
||||
labels=dict(original['config'].get('Labels',{}))
|
||||
labels.update({'org.opencontainers.image.version':LOCK['release_version'],
|
||||
'org.opencontainers.image.revision':LOCK['source_commit'],'org.railiance.source.patch.sha256':LOCK['patch_sha256']})
|
||||
assert config['config'].get('Labels')==labels
|
||||
assert config['config']['User']=='1000:1000'
|
||||
expected_created=datetime.datetime.fromtimestamp(epoch,datetime.timezone.utc).isoformat(timespec='seconds').replace('+00:00','Z')
|
||||
assert config['created']==expected_created
|
||||
found=False
|
||||
last='blobs/sha256/'+manifest['layers'][-1]['digest'].split(':')[1]
|
||||
with tarfile.open(fileobj=archive.extractfile(last),mode='r|*') as layer:
|
||||
for member in layer:
|
||||
name=member.name.lstrip('./');assert name in ('app','app/gitea','app/gitea/gitea')
|
||||
if name=='app/gitea/gitea':
|
||||
h=hashlib.sha256();stream=layer.extractfile(member)
|
||||
for block in iter(lambda:stream.read(1024*1024),b''):h.update(block)
|
||||
assert h.hexdigest()==verified['binary_sha256'];found=True
|
||||
assert found
|
||||
save(work/'container-result.json',{'image_manifest_digest':descriptor['digest'],'config_digest':config_digest,
|
||||
'oci_index_sha256':hashlib.sha256(index_bytes).hexdigest(),'archive_sha256':digest(archive_path),
|
||||
'artifact_path':str(archive_path),'source_epoch':LOCK['source_date_epoch'],'container_epoch':epoch,
|
||||
'all_base_layers_and_rootless_runtime_config_preserved':True,'all_oci_blob_digests_verified':True,
|
||||
'final_layer_binary_exact':True,'registry_publication':False,'deployment_tag':None,
|
||||
'host_or_secret_mounts':False,'privileged_containers':False,'local_runtime_image_loaded':False})
|
||||
print((work/'container-result.json').read_text())
|
||||
|
||||
def main():
|
||||
parser=argparse.ArgumentParser(description=__doc__)
|
||||
parser.add_argument('phase',choices=['prepare','acquire-npm','build','verify','container'])
|
||||
parser.add_argument('--workspace',required=True)
|
||||
for n in ['source-archive','go-archive','node-archive','module-cache','go-cache-seed','npm-cache-seed']:parser.add_argument('--'+n)
|
||||
a=parser.parse_args();work=Path(a.workspace).resolve()
|
||||
if not str(work).startswith('/tmp/'):raise ValueError('isolated build workspace must be under /tmp')
|
||||
if a.phase=='prepare':return prepare(a,work)
|
||||
assert json.loads((work/'prepared.json').read_text())['lock_sha256']==digest(INPUTS/'inputs.lock.json')
|
||||
if a.phase=='acquire-npm':
|
||||
checked_inputs(work);env=base_env(work);env['NPM_CONFIG_OFFLINE']='false'
|
||||
return run(work,'npm-public-acquire',['npm','ci','--ignore-scripts','--no-audit','--no-fund'],env,cwd=work/'source')
|
||||
{'build':build,'verify':verify,'container':container}[a.phase](work)
|
||||
|
||||
if __name__=='__main__':main()
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
{
|
||||
"source_owner_commit": "git:3fb031a47ff5379358fd8cc230b40961b3b5d3a8",
|
||||
"full_frontend_static_build_passed": true,
|
||||
"embedded_assets_exact": 2234,
|
||||
"binary_sha256": "sha256:52f1e111ab17b9c8f2841b0815075df5812b066be45326abe50d140d8a231c34",
|
||||
"actual_CLI_checks": 48,
|
||||
"OCI": {
|
||||
"two_fresh_no_cache_OCI_exports_exact": true,
|
||||
"compared_fields": {
|
||||
"image_manifest_digest": "sha256:fc93a924b6e5f80a1dbf2a371dfd2e09fab10baa1cbca189bf61602009438822",
|
||||
"config_digest": "sha256:f72e76f0ed5c0bd75d0727d1fc28a731a2bcdc90cfe15df534098444d81385c5",
|
||||
"oci_index_sha256": "dc86ae233589dec919932834ecf990e1d07a16db4d240c2772ea5fa08a940671",
|
||||
"archive_sha256": "7307e1d9a26aa6284270dac8b751a71ae02338be090511d192e14865c5e485d9"
|
||||
},
|
||||
"same_verified_binary": true,
|
||||
"second_source_build_claimed": false,
|
||||
"registry_publication": false,
|
||||
"native_admission": false
|
||||
},
|
||||
"native_gates_closed": 0,
|
||||
"independent_owner_assent": false
|
||||
}
|
||||
|
|
@ -0,0 +1,81 @@
|
|||
"""Run public dependency preparation or isolated actual consumer package tests."""
|
||||
from pathlib import Path
|
||||
import argparse
|
||||
import hashlib
|
||||
import json
|
||||
import subprocess
|
||||
import time
|
||||
|
||||
HERE = Path(__file__).resolve().parent
|
||||
WORK = Path('/tmp/custodian-forgejo-successor-r3')
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument('action', choices=['test', 'build'])
|
||||
parser.add_argument('--attempt', type=int, default=1)
|
||||
parser.add_argument('--workspace', type=Path, default=WORK)
|
||||
parser.add_argument('--module-cache', type=Path, required=True)
|
||||
parser.add_argument('--go-cache', type=Path, required=True)
|
||||
args = parser.parse_args()
|
||||
WORK = args.workspace.resolve()
|
||||
assert WORK.is_relative_to('/tmp') and WORK.is_dir()
|
||||
for cache in [args.module_cache, args.go_cache]:
|
||||
assert cache.resolve().is_relative_to('/tmp') and cache.is_dir()
|
||||
stem = f'consumer-{args.action}-attempt{args.attempt}'
|
||||
assert not (HERE / (stem + '.json')).exists()
|
||||
argv = ['bwrap', '--unshare-pid', '--die-with-parent', '--new-session']
|
||||
if args.action in ['test', 'build']:
|
||||
argv += ['--unshare-net']
|
||||
for name in ['/usr', '/lib', '/lib64']:
|
||||
argv += ['--ro-bind', name, name]
|
||||
argv += ['--symlink', 'usr/bin', '/bin', '--proc', '/proc', '--dev', '/dev',
|
||||
'--tmpfs', '/tmp', '--bind', str(WORK), '/work',
|
||||
'--ro-bind', '/home/worsch/go/pkg/mod/cache/download', '/cached',
|
||||
'--ro-bind', '/etc/ssl/certs', '/etc/ssl/certs',
|
||||
'--ro-bind', '/etc/resolv.conf', '/etc/resolv.conf', '--chdir', '/work/source', '--clearenv']
|
||||
argv += ['--ro-bind', str(args.module_cache.resolve()), '/work/modules',
|
||||
'--bind', str(args.go_cache.resolve()), '/work/gocache']
|
||||
if args.action == 'test':
|
||||
fixtures = WORK / 'descriptor-fixtures'
|
||||
fixtures.mkdir(exist_ok=True)
|
||||
for name, value in [('race', 'A' * 64), ('race-replacement', 'B' * 64)]:
|
||||
file = fixtures / name
|
||||
if file.exists():
|
||||
file.chmod(0o600)
|
||||
file.write_text(value)
|
||||
file.chmod(0o400)
|
||||
argv += ['--dir', '/run', '--ro-bind', str(fixtures), '/run/forgejo-oidc',
|
||||
'--bind', str(fixtures), '/run/writable-input']
|
||||
env = {'PATH': '/work/go/bin:/usr/bin:/bin', 'HOME': '/work/home', 'GOPATH': '/work/gopath',
|
||||
'GOTOOLCHAIN': 'local', 'GOPROXY': 'off' if args.action in ['test', 'build'] else 'file:///cached,https://proxy.golang.org',
|
||||
'GOSUMDB': 'off' if args.action in ['test', 'build'] else 'sum.golang.org', 'GOVCS': '*:off',
|
||||
'GOMODCACHE': '/work/modules', 'GOCACHE': '/work/gocache', 'GOMAXPROCS': '4',
|
||||
'CGO_ENABLED': '1', 'GIT_CONFIG_NOSYSTEM': '1', 'GIT_CONFIG_GLOBAL': '/work/home/test.gitconfig', 'GIT_TERMINAL_PROMPT': '0'}
|
||||
for key, value in env.items():
|
||||
argv += ['--setenv', key, value]
|
||||
command = ['go', 'mod', args.action] if args.action != 'test' else ['go', 'test', '-p', '1', '-json', '-tags', 'sqlite sqlite_unlock_notify',
|
||||
'./services/auth/source/oauth2', './cmd', './models/auth', './models/db', '-run',
|
||||
'TestAccessEngine|TestVerifiedApplicationIdentity|TestRequired|TestCurrent|TestPrivateSecret|TestSourceOperation|TestSensitiveSQL', '-count=1']
|
||||
if args.action == 'build':
|
||||
command = ['go', 'build', '-p', '4', '-tags', 'sqlite sqlite_unlock_notify', '-o', '/work/forgejo', '.']
|
||||
argv += ['--'] + command
|
||||
if (HERE / 'composed-source-inventory.json').exists():
|
||||
manifest = json.loads((HERE / 'composed-source-inventory.json').read_text())
|
||||
for row in manifest['files']:
|
||||
assert hashlib.sha256((WORK / 'source' / row['path']).read_bytes()).hexdigest() == row['after_sha256'], row['path']
|
||||
selected = {row['path'] for row in manifest['files']}
|
||||
else:
|
||||
selected = {row['path'] for row in json.loads((HERE / 'consumer-reconstruction.json').read_text())['paths']}
|
||||
|
||||
selected.update(str(item.relative_to(WORK / 'source')) for item in (WORK / 'source/third_party/access-engine-pep').rglob('*') if item.is_file())
|
||||
selected.update(['go.mod', 'go.sum'])
|
||||
source_pins = {name: 'sha256:' + hashlib.sha256((WORK / 'source' / name).read_bytes()).hexdigest() for name in sorted(selected)}
|
||||
started = time.monotonic()
|
||||
with (HERE / (stem + '.log')).open('xb') as log:
|
||||
run = subprocess.run(argv, stdout=log, stderr=subprocess.STDOUT, timeout=900)
|
||||
pins = {name: 'sha256:' + hashlib.sha256((WORK / 'source' / name).read_bytes()).hexdigest() for name in ['go.mod', 'go.sum']}
|
||||
result = {'returncode': run.returncode, 'seconds': round(time.monotonic() - started, 2),
|
||||
'argv': argv, 'workspace': str(WORK), 'module_hashes': pins,
|
||||
'composed_source_pins': source_pins,
|
||||
'network': 'disabled' if args.action in ['test', 'build'] else 'public module download only', 'pid_namespace': 'private', 'real_credentials': False}
|
||||
(HERE / (stem + '.json')).write_text(json.dumps(result, indent=2) + '\n')
|
||||
print(json.dumps({'action': args.action, 'returncode': run.returncode, 'seconds': result['seconds']}))
|
||||
raise SystemExit(run.returncode)
|
||||
|
|
@ -1,5 +1,6 @@
|
|||
"""Check the actual issued token in a separate copy of the consumer package."""
|
||||
from pathlib import Path
|
||||
import argparse
|
||||
import hashlib
|
||||
import json
|
||||
import shutil
|
||||
|
|
@ -8,13 +9,23 @@ import tempfile
|
|||
import time
|
||||
|
||||
HERE = Path(__file__).resolve().parent
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument('--phase', choices=['before', 'after'], default='before')
|
||||
parser.add_argument('--issuer-result', type=Path)
|
||||
parser.add_argument('--attempt', type=int, default=1)
|
||||
args = parser.parse_args()
|
||||
suffix = '' if args.attempt == 1 else '-attempt' + str(args.attempt)
|
||||
ROOT = HERE.parents[3]
|
||||
BASE = ROOT / 'docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2'
|
||||
WORK = Path(tempfile.mkdtemp(prefix='custodian-forgejo-wire-'))
|
||||
original = Path('/tmp/custodian-forgejo-successor-attempt2/source/services/auth/source/oauth2')
|
||||
shutil.copytree(original, WORK / 'oauth2')
|
||||
shutil.copyfile(HERE / 'consumer_wire_test.go', WORK / 'oauth2/keycape_wire_test.go')
|
||||
issued = json.loads((HERE / 'issuer-fixture-result.json').read_text())
|
||||
wire_test = 'consumer_wire_test.go' if args.phase == 'before' else 'consumer_wire_after_test.go'
|
||||
shutil.copyfile(HERE / wire_test, WORK / 'oauth2/keycape_wire_test.go')
|
||||
if args.phase == 'after':
|
||||
for item in (HERE / 'consumer-source').glob('*.go'):
|
||||
shutil.copyfile(item, WORK / 'oauth2' / item.name)
|
||||
issued = json.loads((args.issuer_result or HERE / 'issuer-fixture-result.json').read_text())
|
||||
assert issued['returncode'] == 0
|
||||
fixture = Path(issued['workspace']) / 'identity.json'
|
||||
assert hashlib.sha256(fixture.read_bytes()).hexdigest() == issued['fixture_sha256']
|
||||
|
|
@ -23,15 +34,18 @@ argv = prior['argv'][:prior['argv'].index('--')]
|
|||
argv += ['--ro-bind', str(WORK / 'oauth2'), '/work/source/services/auth/source/oauth2',
|
||||
'--ro-bind', str(fixture), '/work/keycape-wire-fixture.json',
|
||||
'--setenv', 'CUSTODIAN_SYNTHETIC_IDENTITY_FIXTURE', '/work/keycape-wire-fixture.json']
|
||||
selector = '^TestAccessEngineActualKeyCapeIssuer$' if args.phase == 'before' else 'TestAccessEngine|TestVerifiedApplicationIdentity|TestRequired|TestCurrent'
|
||||
argv += ['--', 'go', 'test', '-p', '1', '-json', '-tags', 'sqlite sqlite_unlock_notify',
|
||||
'./services/auth/source/oauth2', '-run', '^TestAccessEngineActualKeyCapeIssuer$', '-count=1']
|
||||
assert not (HERE / 'consumer-before.json').exists()
|
||||
'./services/auth/source/oauth2', '-run', selector, '-count=1']
|
||||
result_path = HERE / ('consumer-' + args.phase + suffix + '.json')
|
||||
assert not result_path.exists()
|
||||
started = time.monotonic()
|
||||
with (HERE / 'consumer-before.jsonl').open('xb') as log:
|
||||
with (HERE / ('consumer-' + args.phase + suffix + '.jsonl')).open('xb') as log:
|
||||
run = subprocess.run(argv, stdout=log, stderr=subprocess.STDOUT, timeout=180)
|
||||
(HERE / 'consumer-before.json').write_text(json.dumps({'returncode': run.returncode,
|
||||
result_path.write_text(json.dumps({'returncode': run.returncode,
|
||||
'seconds': round(time.monotonic() - started, 2), 'workspace': str(WORK), 'argv': argv,
|
||||
'actual_issuer_source': issued['source_commit'], 'fixture_sha256': issued['fixture_sha256'],
|
||||
'consumer_source_pins': {item.name: 'sha256:' + hashlib.sha256(item.read_bytes()).hexdigest() for item in sorted((WORK / 'oauth2').glob('*.go'))},
|
||||
'fixture_values_published': False, 'synthetic_authentication': True, 'real_credentials': False}, indent=2) + '\n')
|
||||
print(json.dumps({'returncode': run.returncode, 'actual_issuer_source': issued['source_commit'], 'fixture_values_published': False}))
|
||||
raise SystemExit(run.returncode)
|
||||
|
|
|
|||
|
|
@ -0,0 +1,8 @@
|
|||
{
|
||||
"passed_including_subtests": 93,
|
||||
"skipped": 0,
|
||||
"failed": 0,
|
||||
"receipt": "consumer-test-attempt1.json",
|
||||
"complete_terminal_receipt_checked": true,
|
||||
"native_gates_closed": 0
|
||||
}
|
||||
|
|
@ -0,0 +1,107 @@
|
|||
import pathlib,subprocess,json,sqlite3,os,shlex,time
|
||||
import argparse,shutil
|
||||
parser=argparse.ArgumentParser(description='Actual static-release CLI against a new synthetic SQLite workspace')
|
||||
parser.add_argument('--workspace',type=pathlib.Path,required=True)
|
||||
parser.add_argument('--binary',type=pathlib.Path,required=True)
|
||||
args=parser.parse_args()
|
||||
w=args.workspace.resolve()
|
||||
assert w.is_relative_to('/tmp') and not w.exists()
|
||||
w.mkdir();(w/'home').mkdir()
|
||||
shutil.copyfile(args.binary,w/'forgejo');(w/'forgejo').chmod(0o755)
|
||||
fixtures=w/'fixtures'; fixtures.mkdir(exist_ok=True)
|
||||
A='AbCdEf012345678-'*4;B='ZyXwVu_987654321'*4 # synthetic exact64
|
||||
assert len(A)==64 and len(B)==64
|
||||
for name,data,mode in [('good',A,0o400),('replacement',B,0o440),('newline',A+'\n',0o400),('short',A[:-1],0o400),('long',A+'A',0o400),('badbyte',A[:-1]+'=',0o400),('world',A,0o444),('writable',A,0o600),('executable',A,0o500),('empty','',0o400),('CLIENT_SECRET','',0o400)]:
|
||||
p=fixtures/name
|
||||
if p.exists():p.chmod(0o600)
|
||||
p.write_text(data);p.chmod(mode)
|
||||
for name in ['symlink']:
|
||||
p=fixtures/name
|
||||
if not p.exists():p.symlink_to('good')
|
||||
if not (fixtures/'fifo').exists():os.mkfifo(fixtures/'fifo',0o400)
|
||||
(fixtures/'directory').mkdir(exist_ok=True)
|
||||
(fixtures/'badparent').mkdir(exist_ok=True);(fixtures/'badparent').chmod(0o777)
|
||||
if (fixtures/'badparent/value').exists():(fixtures/'badparent/value').chmod(0o600)
|
||||
(fixtures/'badparent/value').write_text(A);(fixtures/'badparent/value').chmod(0o400)
|
||||
if not (fixtures/'parentlink').exists():(fixtures/'parentlink').symlink_to('directory',target_is_directory=True)
|
||||
(w/'runtime').mkdir(exist_ok=True)
|
||||
dbfile=w/'runtime/test.db'
|
||||
if dbfile.exists():dbfile.unlink() # isolated synthetic test database only
|
||||
ini=w/'runtime/app.ini';ini.write_text(f'''APP_NAME = synthetic-private-input-test
|
||||
RUN_USER = worsch
|
||||
WORK_PATH = {w}/runtime
|
||||
[security]
|
||||
INSTALL_LOCK = true
|
||||
SECRET_KEY = SYNTHETIC-TEST-KEY
|
||||
[database]
|
||||
DB_TYPE = sqlite3
|
||||
SLOW_QUERY_THRESHOLD = 1ns
|
||||
PATH = {w}/runtime/test.db
|
||||
[server]
|
||||
APP_DATA_PATH = {w}/runtime/data
|
||||
OFFLINE_MODE = true
|
||||
[repository]
|
||||
ROOT = {w}/runtime/repos
|
||||
[log]
|
||||
MODE = console
|
||||
LEVEL = Error
|
||||
''')
|
||||
env={'PATH':'/usr/bin:/bin','HOME':str(w/'home'),'GIT_CONFIG_NOSYSTEM':'1','GIT_CONFIG_GLOBAL':str(w/'home/test.gitconfig'),'GIT_TERMINAL_PROMPT':'0','USER':'worsch','GITEA_WORK_DIR':str(w/'runtime')}
|
||||
base=['bwrap','--unshare-pid','--unshare-net','--ro-bind','/usr','/usr','--ro-bind','/lib','/lib','--ro-bind','/lib64','/lib64','--symlink','usr/bin','/bin','--proc','/proc','--dev','/dev','--tmpfs','/tmp','--bind',str(w),str(w),'--dir','/run','--ro-bind',str(fixtures),'/run/forgejo-oidc','--ro-bind',str(fixtures/'good'),'/run/forgejo-oidc/CLIENT_SECRET','--bind',str(fixtures),'/run/writable-input','--chdir',str(w/'runtime'),'--','env','-i']+[k+'='+v for k,v in env.items()]+[str(w/'forgejo'),'--config',str(ini)]
|
||||
results=[]
|
||||
def run(args,ok=True,reason=None):
|
||||
p=subprocess.run(base+args,capture_output=True,text=True,timeout=60); output=p.stdout+p.stderr
|
||||
assert A not in output and B not in output, 'synthetic input leaked in output'
|
||||
assert all(A not in arg and B not in arg for arg in base+args), 'synthetic input in argv'
|
||||
assert all(A not in v and B not in v for v in env.values()), 'synthetic input in env'
|
||||
results.append({'operation':args,'returncode':p.returncode,'stdout_stderr_secret_absent':True})
|
||||
(w/'cli-attempts.json').write_text(json.dumps(results,indent=2))
|
||||
if (p.returncode==0)!=ok:raise AssertionError('CLI unexpected status: '+repr(args)+'\n'+output[-5000:])
|
||||
if reason:assert reason in output,output[-2000:]
|
||||
return p
|
||||
run(['migrate'])
|
||||
clean_ini=ini.read_text()
|
||||
ini.write_text(clean_ini.replace('DB_TYPE = sqlite3', 'DB_TYPE = sqlite3\nLOG_SQL = true'))
|
||||
run(['admin','auth','add-oauth','--name','refused-debug-logging','--provider','github','--secret-file','/run/forgejo-oidc/CLIENT_SECRET'],False,'OAuth configuration requires SQL logging disabled')
|
||||
ini.write_text(clean_ini)
|
||||
def rows():
|
||||
with sqlite3.connect(w/'runtime/test.db') as db:return db.execute('select id,name,cfg from login_source order by id').fetchall()
|
||||
def cfg():return json.loads(rows()[0][2])
|
||||
run(['admin','auth','add-oauth','--name','synthetic-oauth','--provider','github','--key','synthetic-public-id','--secret-file','/run/forgejo-oidc/CLIENT_SECRET','--group-claim-name','groups','--admin-group','unchanged-admin','--scopes','read:user,user:email'])
|
||||
assert len(rows())==1 and cfg()['ClientSecret']==A
|
||||
id=str(rows()[0][0]); before=cfg()
|
||||
run(['admin','auth','update-oauth','--id',id,'--icon-url','https://synthetic.invalid/icon'])
|
||||
assert cfg()['ClientSecret']==A
|
||||
preserved=cfg()
|
||||
run(['admin','auth','update-oauth','--id',id,'--secret-file','/run/forgejo-oidc/replacement'])
|
||||
after=cfg();assert after['ClientSecret']==B
|
||||
assert {k:v for k,v in after.items() if k!='ClientSecret'}=={k:v for k,v in preserved.items() if k!='ClientSecret'},'secret replacement changed unrelated config'
|
||||
# Guarded inactive source exercises actual update omission and strict list semantics
|
||||
# without discovery/network or claiming a browser login.
|
||||
with sqlite3.connect(w/'runtime/test.db') as db:
|
||||
guarded=after|{'Provider':'openidConnect','OpenIDConnectAutoDiscoveryURL':'https://synthetic.invalid/.well-known/openid-configuration','RequiredClaimName':'groups','RequiredClaimValues':['forge-admins','forge-coulomb-owners','forge-coulomb-readers']}
|
||||
db.execute('update login_source set is_active=0,cfg=? where id=?',(json.dumps(guarded),id))
|
||||
run(['admin','auth','update-oauth','--id',id,'--name','synthetic-guarded'])
|
||||
assert cfg()['RequiredClaimValues']==guarded['RequiredClaimValues'] and cfg()['ClientSecret']==B
|
||||
run(['admin','auth','update-oauth','--id',id,'--secret-file','/run/forgejo-oidc/good'])
|
||||
assert cfg()['ClientSecret']==A and cfg()['RequiredClaimValues']==guarded['RequiredClaimValues']
|
||||
for path in ['/run/forgejo-oidc/'+n for n in ['newline','short','long','badbyte','world','writable','executable','empty','symlink','fifo','directory','missing','badparent/value','parentlink/value']]+['relative','','/run/forgejo-oidc/../forgejo-oidc/good','/run/writable-input/good']:
|
||||
before=rows()
|
||||
for cmd in [['admin','auth','add-oauth','--name','refused','--provider','github'],['admin','auth','update-oauth','--id',id,'--name','refused']]:
|
||||
run(cmd+['--secret-file',path],False,'secret-file input refused')
|
||||
assert rows()==before,'failure changed DB'
|
||||
for action in [['add-oauth','--name','refused'],['update-oauth','--id',id]]:
|
||||
before=rows();run(['admin','auth']+action+['--secret','','--secret-file','/run/forgejo-oidc/good'],False,'mutually exclusive');assert rows()==before
|
||||
# Failure to clear/ambiguously replace gate keeps stored application bytes unchanged.
|
||||
before=rows();run(['admin','auth','update-oauth','--id',id,'--required-claim-values',''],False);assert rows()==before
|
||||
# Actual XORM error hook under a failing SQLite trigger must not disclose cfg.
|
||||
before=rows()
|
||||
with sqlite3.connect(w/'runtime/test.db') as database:
|
||||
database.execute("create trigger synthetic_private_error before update on login_source begin select raise(abort, 'synthetic-db-failure'); end")
|
||||
run(['admin','auth','update-oauth','--id',id,'--secret-file','/run/forgejo-oidc/replacement'],False,'OAuth source update failed')
|
||||
assert rows()==before
|
||||
with sqlite3.connect(w/'runtime/test.db') as database:database.execute('drop trigger synthetic_private_error')
|
||||
# Legacy explicit secret remains supported; synthetic legacy string is not private input.
|
||||
run(['admin','auth','update-oauth','--id',id,'--secret','synthetic-legacy-literal'])
|
||||
assert cfg()['ClientSecret']=='synthetic-legacy-literal' and cfg()['RequiredClaimValues']==guarded['RequiredClaimValues']
|
||||
(w/'cli-results.json').write_text(json.dumps({'passed':True,'subprocesses':len(results),'real_backend_cli_and_sqlite':True,'network':'disabled by bwrap','secret_inputs':'synthetic only','values_never_in_argv_env_output':True,'actual_browser_login':False,'actual_readonly_file_bind':True,'replacement_preserves_other_config':True,'unsafe_SQL_logging_refused':True,'actual_error_and_slow_hooks_no_leak':True},indent=2));print('CLI integrations passed:',len(results))
|
||||
|
|
@ -1331,11 +1331,25 @@ retained. The original browser packet requires human browser sign-in with client
|
|||
MFA; agent/service access and their scoped tokens remain a separate owner route.
|
||||
|
||||
Actual KeyCape source `d803e928` emits `assurance` as an object with level, methods,
|
||||
MFA, source and authentication time. The candidate's string-claim fixture does
|
||||
not implement that wire contract. `forgejo-keycape-claims-r1` now exercises the
|
||||
actual issuer handler with synthetic authentication and a test key. Its consumer
|
||||
regression drives the required parser/freshness/provenance correction; a passing
|
||||
synthetic callback is not an actual issuer or factor acceptance receipt. Full
|
||||
MFA, source and authentication time. `forgejo-keycape-claims-r1` reproduces the
|
||||
preceding string parser's rejection through the actual issuer handler using
|
||||
synthetic authentication and a test key. The correction preserves the typed
|
||||
object and tenant provenance, validates authentication time and limits identity
|
||||
validity by the earliest authentication-age, token-age or expiration boundary.
|
||||
All 77 actual-issuer/provider/callback test and subtest results pass, including
|
||||
actual provider discovery/FetchUser/UserInfo subject joining, authenticated
|
||||
ALLOW/DENY and spoofed UserInfo; the complete selected composed package suite
|
||||
passes 93 results with no skips. The new 37-path patch reconstructs exactly from
|
||||
the official archive. Apps `3fb031a4` publishes the five-file build-source
|
||||
integration with all nine task UUIDs preserved and T09 in progress. Independent
|
||||
owner review and operational admission remain open. The fresh complete frontend
|
||||
and static release build passes. All 2,234 embedded assets are exact, the binary
|
||||
needs no dynamic interpreter, and all 48 actual release CLI/SQLite checks pass.
|
||||
Two fresh no-cache local OCI exports of that binary reproduce the same complete
|
||||
archive, image manifest, config and index, with every base layer and rootless
|
||||
runtime setting preserved. This is one source build and two local exports;
|
||||
registry publication and operational admission are still pending.
|
||||
A passing synthetic callback is not an actual issuer or factor acceptance receipt. Full
|
||||
resource/operation/inverse coverage, source/package re-freeze, custody and native
|
||||
admission remain existing owner work. All sixteen native gates remain open.
|
||||
|
||||
|
|
|
|||
|
|
@ -98,15 +98,31 @@ reconstruct exactly from the pinned official archive. Source and proof inventory
|
|||
`docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/`.
|
||||
|
||||
Actual issuer-source inspection found a further mandatory interoperability gap:
|
||||
KeyCape emits a structured `assurance` object; the candidate expects a string.
|
||||
The actual TokenHandler fixture in `forgejo-keycape-claims-r1` supplies the next
|
||||
producer-consumer regression. Implement that source shape, actual authentication
|
||||
time freshness and retained provenance before native acceptance. Existing T43 /
|
||||
KeyCape emits a structured `assurance` object; the preceding candidate expected a
|
||||
string. The actual TokenHandler fixture reproduced the rejection. The corrected
|
||||
consumer preserves the signed object and tenant provenance, validates its actual
|
||||
authentication time, and bounds identity validity by authentication age, token
|
||||
age and expiry. All 77 actual-issuer/provider/callback test and subtest results
|
||||
pass, including real discovery/FetchUser/UserInfo joining, signed ALLOW/DENY and
|
||||
UserInfo spoof refusal; all 93 selected composed
|
||||
package results pass without skips. The new 37-path patch replays exactly against
|
||||
the official source archive. The fresh complete frontend/static release build
|
||||
passes; all 2,234 embedded assets match and all 48 actual release CLI/SQLite
|
||||
checks pass. Evidence is in `forgejo-keycape-claims-r1`; these are synthetic
|
||||
authentication/source and local artifact proofs.
|
||||
Two fresh no-cache local OCI exports from that verified binary have identical
|
||||
manifest/config/index/archive digests, preserving all base layers and rootless
|
||||
runtime configuration. No second source build or operational admission is claimed.
|
||||
Apps `3fb031a4` publishes the five-file build-source integration at the primary
|
||||
hub, preserves all nine task UUIDs and starts existing RAPPS16-T09. Independent
|
||||
owner review and operational admission of that revision remain open.
|
||||
Existing T43 /
|
||||
RAPPS16-T09 also retain ongoing HTTP/API/Git/SSH and operation/inverse coverage;
|
||||
T41/T42 retain full release integration, exclusion and private journal custody.
|
||||
The full completion audit now enumerates all sixteen gates, thirteen named gaps
|
||||
and 116 SEC-DSM ledger entries under `cust80-completion-r1`. No native gate or
|
||||
coordinator task is closed by these source results; the full user goal is active.
|
||||
`cust80-completion-r2` retains that full scope and records this source progress.
|
||||
|
||||
2026-10-18 resumed application review: completed the interrupted seventeen-file
|
||||
release-build evidence checkpoint as `8951d324`, preserving the staged brief and
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue