105 lines
4.1 KiB
JSON
105 lines
4.1 KiB
JSON
{
|
|
"date": "2026-10-12",
|
|
"gap": "G08",
|
|
"owner_task": "NK-WP-0049-T02",
|
|
"manifest": {
|
|
"repo": "net-kingdom",
|
|
"base_head": "4cf26a9bc869dc81df086240243376f67fdbf795",
|
|
"files": [
|
|
{
|
|
"path": "Makefile",
|
|
"before": "571adaae4e2b4a7ce902c72e96815ce30aed1b0833f5774b0b2615fdcfe73eb6",
|
|
"after": "10af0bd3e1039577e0d78ea14ac92171864029a5d6d0d8c9757144ff1e0991bc"
|
|
},
|
|
{
|
|
"path": ".sops.yaml",
|
|
"before": "a5dc960f1ef20eb29d216e196e04475f2305cf862497dfc43458a59b25c71488",
|
|
"after": "57ab1a79708d5720a9829162eebfd10f0e0dc76e1851982b215b9b7961aa4e01"
|
|
},
|
|
{
|
|
"path": "sso-mfa/bootstrap/sops-private.py",
|
|
"before": null,
|
|
"after": "635c0d3ea42ec3864ec4af21a6fc04d244a8ab72d089b71389addcc963c3f496"
|
|
},
|
|
{
|
|
"path": "tests/test_sops_private.py",
|
|
"before": null,
|
|
"after": "b29c3759aacf7ab31b8a7909fe947b05b0ae5fe2acea88a5dac7e996101cb354"
|
|
},
|
|
{
|
|
"path": "docs/security-bootstrap-age-custody.md",
|
|
"before": "d499fc515b7c8323455d192167e5f3721596bedd60d6b0ddc3b3aba7ae092922",
|
|
"after": "ff443e924b44aa39d395b40761d6587e7ebe2cc375861f58bffc53e26e11e92c"
|
|
},
|
|
{
|
|
"path": "workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md",
|
|
"before": "543df4936f0f9782622ccad0b57f9fb628514b4776d3df8ba5ce24455f80ce11",
|
|
"after": "7ec8f342b96b96608aa8aa83d7cc623c9140fb1a76c46006230c848832538833"
|
|
}
|
|
]
|
|
},
|
|
"source_commit": "681c5b0ea17cb3e945ecf0763da8785439703fd4",
|
|
"source_pushed": true,
|
|
"test_tool": {
|
|
"version": "3.13.3",
|
|
"source": "https://github.com/getsops/sops/releases/download/v3.13.3/sops-v3.13.3.linux.amd64",
|
|
"sha256": "e5bec3346a873ae91d871550f3e698c1aad962aff462a080e40f25fde17fef6b",
|
|
"verification": "Compared against checksum from the same official release; detached signature not verified."
|
|
},
|
|
"verification": {
|
|
"original_make_regressions": {
|
|
"failed": 11,
|
|
"passed": 0
|
|
},
|
|
"final_focused_real_sops": {
|
|
"passed": 21,
|
|
"failed": 0
|
|
},
|
|
"actual_checkout_full_suite": {
|
|
"passed": 227,
|
|
"failed": 0,
|
|
"skipped": 0,
|
|
"seconds": 28.75,
|
|
"command": "PATH=/tmp/netkingdom-sops-tools:$PATH PYTHONDONTWRITEBYTECODE=1 python3 -m pytest -p no:cacheprovider tests tools -q --tb=short"
|
|
}
|
|
},
|
|
"controls": [
|
|
"public-only setup and no permanent key requirement",
|
|
"FILE/OUTPUT passed as environment data rather than shell code",
|
|
"registered recipient and matching explicit owned private key",
|
|
"bounded age-only JSON/YAML metadata, no plugins/groups/external providers",
|
|
"isolated SOPS HOME/XDG and minimal credential environment",
|
|
"inherited key descriptor avoids pathname replacement in child",
|
|
"new private output outside normal, linked and bare Git worktrees",
|
|
"atomic no-overwrite publication and prepublication failure cleanup",
|
|
"raw tool and parser diagnostics suppressed"
|
|
],
|
|
"proof_limits": [
|
|
"Disposable inputs/keys only; no live root or encrypted production artifact accessed",
|
|
"Official release checksum comparison is not detached signature verification or production toolchain admission",
|
|
"Successful plaintext is intentionally retained in the requested private output until operator cleanup",
|
|
"No SIGKILL/hostile same-UID/copy-retention or task-isolation guarantee",
|
|
"Other direct editor/rotate and delegated helpers remain open",
|
|
"Native off-host isolated recovery receipt and current caller acceptance are still required"
|
|
],
|
|
"source_basis": [
|
|
"https://github.com/getsops/sops/blob/v3.13.3/age/keysource.go",
|
|
"https://github.com/getsops/sops/releases/tag/v3.13.3"
|
|
],
|
|
"statehub_sync": {
|
|
"owner": {
|
|
"fail": 0,
|
|
"automation_error": 0,
|
|
"warn": 32,
|
|
"info": 5
|
|
},
|
|
"custodian": {
|
|
"fail": 0,
|
|
"automation_error": 0,
|
|
"warn": 7,
|
|
"info": 4
|
|
},
|
|
"custodian_note": "DB reconciliation succeeded; sandbox prevented automatic working-memory Git commit. Scoped assessment/evidence committed separately."
|
|
},
|
|
"source_implementation_decision_id": "d5eb261b-6bbd-5186-bf88-849fe603ca5e"
|
|
}
|