172 lines
7.6 KiB
JSON
172 lines
7.6 KiB
JSON
{
|
|
"date": "2026-10-12",
|
|
"gap_refs": [
|
|
"G08",
|
|
"G09",
|
|
"G04",
|
|
"G12"
|
|
],
|
|
"owner_task": "NK-WP-0049-T02",
|
|
"manifest": {
|
|
"repo": "net-kingdom",
|
|
"base_head": "6ae4708ea061048f84fe59dcee3f482c69e291f9",
|
|
"files": [
|
|
{
|
|
"path": "sso-mfa/k8s/privacyidea/bootstrap-admin.sh",
|
|
"before": "b7769727e2f199ba8d8455bdeef3de4df954f01d33d46b5ebbd7af6fc015de63",
|
|
"after": "1a11738c1790cc6b5f23ed40f02971591eb76afa486be89d5535b0027aca6989"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/privacyidea/bootstrap-admin.py",
|
|
"before": null,
|
|
"after": "b81b5c3806dbdf03ea7cac37884cc368de0f0ef7880ac326b67af3a291c35890"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/privacyidea/bootstrap-admin-remote.py",
|
|
"before": null,
|
|
"after": "c83c3a5c9a753a8afec90c35ce5ddbfc15f7b8aff437065f428109d9c5774b89"
|
|
},
|
|
{
|
|
"path": "tests/test_admin_bootstrap.py",
|
|
"before": null,
|
|
"after": "505925378e4d662b3c2077c7f22a748159abb11eb48e432f301187745b6fb0fd"
|
|
},
|
|
{
|
|
"path": "tests/test_admin_bootstrap_privacyidea.py",
|
|
"before": null,
|
|
"after": "1652a31b52e7ca6af1442ebf2191731cb501de0837ffef945bbc7d1a6b8e6d3e"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/privacyidea/README.md",
|
|
"before": "2b4b99a9d0b2d6cb9c129125b3ff003dbd925d89ae7ee770ff187718796d9551",
|
|
"after": "aeaed29e3d8a6f914e6758a1788c312760503b72473701685012366177069c09"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/privacyidea/deployment.yaml",
|
|
"before": "79f0bf9eaab5482509cd9d18bb0fa42b9f1a9cab33e7c1e504486b2d1e24e409",
|
|
"after": "c6da8950b5daf61ba7b3238f7a6d3d3a05eabb835369b1c4e397cce1f5eab5e6"
|
|
},
|
|
{
|
|
"path": "sso-mfa/k8s/verify-t04.sh",
|
|
"before": "6911d45e8dd76aea3663d02393c98d30d5d3f8168c2a33326eedcff1a4a9d9b4",
|
|
"after": "b34c6b43bf1e1a2274df3014436e9c9993a1c17bc6d81d482a80f4fd56365ce6"
|
|
},
|
|
{
|
|
"path": "sso-mfa/WORKPLAN.md",
|
|
"before": "611390e9bfad1b53fa471bf0e2a3b0b8ea8094c99cbffd69e17a785b6b819e85",
|
|
"after": "5b76896a6c322810dc99c4539046ff40f53498bac4a9b28ab06f23bb635cfdf3"
|
|
},
|
|
{
|
|
"path": "docs/security-bootstrap-age-custody.md",
|
|
"before": "0110b1e2f184e0ae700e7278b6f1d9b9136cb07872ec72f74c3c580131f5a1ec",
|
|
"after": "8c6d0834e69b0fa071eea38829043b89d0e1ab0f8196bbb758117db49a6fb408"
|
|
},
|
|
{
|
|
"path": "workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md",
|
|
"before": "d2f56748a25111a096cefab330d5aa51a248e0864c3f91d35c1ebc7ab34d7c64",
|
|
"after": "fb5a977cc7d90c0e911b0671af15b315bef5cfd637441db75aad7b2659468f5a"
|
|
}
|
|
]
|
|
},
|
|
"source_commit": "19a1c75d309991de8654c4b7a9eeffea8fb90b18",
|
|
"source_pushed": true,
|
|
"architecture_basis": {
|
|
"scope": "NetKingdom current profile; source inspection, not live consumer inventory",
|
|
"observations": [
|
|
"NetKingdom SCOPE.md declares Keycloak enterprise federation backlog",
|
|
"Current KeyCape source provisions a pi-admin token through keycape/create-pi-token.sh and references it in keycape/create-secrets.sh",
|
|
"No trigger-admin consumer reference found in reviewed KeyCape or Platform source; NetKingdom references are legacy bootstrap/docs/readiness expectations",
|
|
"NetKingdom runtime package ownership is external under ADR-0015; this repair does not authorize managed deployment"
|
|
]
|
|
},
|
|
"verification": {
|
|
"original_entrypoint_regressions": {
|
|
"failed": 14,
|
|
"passed": 2
|
|
},
|
|
"final_focused": {
|
|
"passed": 36,
|
|
"failed": 0,
|
|
"warnings": 4,
|
|
"seconds": 13.32,
|
|
"scope": "29 entry-point/controller tests and seven actual privacyIDEA 3.12.2 model tests using disposable SQLite"
|
|
},
|
|
"initial_full_suite_attempt": {
|
|
"collection_errors": 4,
|
|
"cause": "Disposable test environment lacked existing repository jsonschema dependency; installed it and reran full suite"
|
|
},
|
|
"actual_checkout_full_suite": {
|
|
"passed": 288,
|
|
"subtests_passed": 29,
|
|
"failed": 0,
|
|
"skipped": 0,
|
|
"warnings": 4,
|
|
"seconds": 44.81,
|
|
"command": "PATH=/tmp/netkingdom-sops-tools:$PATH PYTHONDONTWRITEBYTECODE=1 /tmp/netkingdom-admin-output-fix/venv/bin/python -m pytest -p no:cacheprovider tests tools -q --tb=short --disable-warnings",
|
|
"warning_scope": "Four upstream dependency deprecation warnings"
|
|
},
|
|
"test_dependencies": "admin-bootstrap-test-requirements.txt"
|
|
},
|
|
"controls": [
|
|
"No automatic legacy trigger-admin account/policy/Secret creation or misleading current readiness requirement",
|
|
"Private owned regular single-link service input; no shell evaluation, no credential argv or environment assignment",
|
|
"One pod, credential on kubectl stdin, sanitized diagnostics and exact value-free receipt",
|
|
"Version-scoped 3.12.2 adapter verifies existing password without updates",
|
|
"New account/policy insert-only writes share transaction; uniqueness conflicts roll back instead of overwriting",
|
|
"Scoped pi-admin policy; broad legacy policies, multi-admin migration and external administrative realms refused",
|
|
"MFA/effective-policy acceptance explicitly separated from bootstrap success"
|
|
],
|
|
"proof_limits": [
|
|
"No live account, policy, Secret or credential was accessed, changed or revoked",
|
|
"Disposable SQLite exercises actual privacyIDEA models; deployed image/PostgreSQL/native permissions and MFA remain unverified",
|
|
"Policy controller/transport tests use synthetic data and fake kubectl",
|
|
"Existing trigger credentials/Secrets are not removed; inventory and authorized revocation remain required",
|
|
"KeyCape full-admin token issue/delivery/least-privilege/refresh and other delegated callers remain open",
|
|
"Existing custom policies or SUPERUSER_REALM configuration require owner-reviewed profile migration",
|
|
"An error after DB commit can leave created state; rerun verification uses the same credential, never resets it",
|
|
"No runtime agent isolation or hostile same-UID guarantee"
|
|
],
|
|
"source_basis": [
|
|
{
|
|
"url": "https://github.com/privacyidea/privacyidea/blob/v3.12.2/privacyidea/cli/pimanage/admin.py",
|
|
"sha256": "5d4a4c89058f2aa6f0307bab06b684f190084e9a198d36243d3306c4d546fa6f"
|
|
},
|
|
{
|
|
"url": "https://github.com/privacyidea/privacyidea/blob/v3.12.2/privacyidea/lib/auth.py",
|
|
"sha256": "bd1b14c4dd6e906570e6a89e9bb444e82e4e5fca06f7411a7406a16cae7019e9"
|
|
},
|
|
{
|
|
"url": "https://github.com/privacyidea/privacyidea/blob/v3.12.2/privacyidea/models/config.py",
|
|
"sha256": "b0727db3643613b76f5c8b31256945a1259d26ef2b1878525ecb20dde4cb05ea"
|
|
},
|
|
{
|
|
"url": "https://github.com/privacyidea/privacyidea/blob/v3.12.2/privacyidea/models/policy.py",
|
|
"sha256": "4a5bb2f8fb8f89f9ab93f9dde588c440d08a5358161ed4faeff95d8b1368c02c"
|
|
},
|
|
{
|
|
"url": "https://github.com/privacyidea/privacyidea/blob/v3.12.2/privacyidea/lib/policy.py",
|
|
"sha256": "903284a68602c0e7cbe20c40348b6394ba491a6a0beac251553e00332ea3dcb6"
|
|
},
|
|
{
|
|
"url": "https://github.com/privacyidea/privacyidea/blob/v3.12.2/privacyidea/cli/__init__.py",
|
|
"sha256": "a89d3ccd773d5275fbe06ca86871af15ed61e7c822287c964b32d7e25e311244"
|
|
}
|
|
],
|
|
"statehub_sync": {
|
|
"owner": {
|
|
"fail": 0,
|
|
"automation_error": 0,
|
|
"warn": 32,
|
|
"info": 5
|
|
},
|
|
"custodian": {
|
|
"fail": 0,
|
|
"automation_error": 0,
|
|
"warn": 7,
|
|
"info": 4
|
|
},
|
|
"custodian_note": "DB reconciliation succeeded; sandbox prevented automatic working-memory Git commit. Scoped assessment and evidence committed separately."
|
|
},
|
|
"source_implementation_decision_id": "765c47a9-6f4f-488f-ac13-27073a10289f",
|
|
"progress_id": "87746c12-8197-46b8-95a4-4f6742ec2643"
|
|
}
|