feat(openbao): add autonomy runtime v1 candidate
This commit is contained in:
@@ -1 +1 @@
|
||||
{"checks": {"72h_acceptance_gate": true, "approle_implemented": true, "approle_secret_not_persisted_in_hcl": true, "approle_secret_survives_isolated_restore": true, "audit_implemented": true, "autonomy_tls_readers_use_ca_only_bind": true, "backup_implemented": true, "branch_protection_gate_not_bypassable": true, "charter_store_sign_verify": true, "continuous_optimization_implemented": true, "declarative_self_initialization": true, "embedded_shell_syntax": true, "exact_checksum_duplicate_rejected": true, "exact_checksum_good_fixture": true, "exact_checksum_missing_rejected": true, "fault_injection_does_not_require_service_it_kills": true, "fault_injection_failure_phase_evidence": true, "fault_injection_implemented": true, "fault_injection_missing_seal_reaches_static_seal_validation": true, "fault_injection_systemd_sandbox": true, "gitea_1_22_6_rejected": true, "gitea_1_23_0_accepted": true, "gitea_1_27_nonempty_tag_allowlist": true, "gitea_probe_traversal_and_cleanup": true, "gitea_tag_api_version_gate": true, "isolated_restore_implemented": true, "isolated_restore_uses_private_ephemeral_audit_sink": true, "kv_v2_implemented": true, "machine_credential_persisted": true, "masked_systemd_units_do_not_change_dev_null": true, "no_git_force_push": true, "no_git_tag_mutation": true, "openbao_2_6_heredoc_compatible": true, "openbao_2_6_runtime_verifier": true, "openbao_config_memfd_injection": true, "openbao_ready_gate_not_bypassable": true, "outer_bash_syntax": true, "policy_implemented": true, "ready_not_predeclared": true, "restored_approle_login_has_bounded_readiness_retry": true, "root_token_not_persisted": true, "runtime_state_directory_remains_writable": true, "self_contained_no_sibling_preflight": true, "self_init_marker_bound_to_raft_lifecycle": true, "self_init_secret_removal_implemented": true, "systemd_credentials_mandatory": true, "systemd_runtime_directories": true, "tag_protection_gate_implemented": true, "transit_charter_key_implemented": true, "transit_runtime_key_implemented": true}, "passed": 50, "runtime_claims": false, "schema": "AIOS_OPENBAO_BOOTSTRAP_STATIC_SELF_TEST_V3", "scope": "static_and_fixture_only", "script_sha256": "f8b84fe82fefc9bdf2ef2ef6945ea157af7ac8e9224963ebf6adb3f12205ced5", "total": 50}
|
||||
{"checks": {"72h_acceptance_gate": true, "approle_implemented": true, "approle_secret_not_persisted_in_hcl": true, "approle_secret_survives_isolated_restore": true, "audit_implemented": true, "autonomy_tls_readers_use_ca_only_bind": true, "backup_implemented": true, "backup_restore_share_without_openbao_private_key_group": true, "branch_protection_gate_not_bypassable": true, "charter_store_sign_verify": true, "continuous_optimization_implemented": true, "controller_uses_charter_only_bind": true, "declarative_self_initialization": true, "embedded_shell_syntax": true, "exact_checksum_duplicate_rejected": true, "exact_checksum_good_fixture": true, "exact_checksum_missing_rejected": true, "fault_injection_does_not_require_service_it_kills": true, "fault_injection_failure_phase_evidence": true, "fault_injection_implemented": true, "fault_injection_missing_seal_reaches_static_seal_validation": true, "fault_injection_systemd_sandbox": true, "gitea_1_22_6_rejected": true, "gitea_1_23_0_accepted": true, "gitea_1_27_nonempty_tag_allowlist": true, "gitea_probe_traversal_and_cleanup": true, "gitea_tag_api_version_gate": true, "isolated_restore_implemented": true, "isolated_restore_uses_private_ephemeral_audit_sink": true, "kv_v2_implemented": true, "machine_credential_persisted": true, "masked_systemd_units_do_not_change_dev_null": true, "no_git_force_push": true, "no_git_tag_mutation": true, "openbao_2_6_heredoc_compatible": true, "openbao_2_6_runtime_verifier": true, "openbao_config_memfd_injection": true, "openbao_ready_gate_not_bypassable": true, "outer_bash_syntax": true, "policy_implemented": true, "ready_not_predeclared": true, "restored_approle_login_has_bounded_readiness_retry": true, "root_token_not_persisted": true, "runtime_state_directory_remains_writable": true, "self_contained_no_sibling_preflight": true, "self_init_marker_bound_to_raft_lifecycle": true, "self_init_secret_removal_implemented": true, "systemd_credentials_mandatory": true, "systemd_runtime_directories": true, "tag_protection_gate_implemented": true, "transit_charter_key_implemented": true, "transit_runtime_key_implemented": true}, "passed": 52, "runtime_claims": false, "schema": "AIOS_OPENBAO_BOOTSTRAP_STATIC_SELF_TEST_V3", "scope": "static_and_fixture_only", "script_sha256": "2473b788633976d40fa59869ee501331f1bf375fc2b376e2622e55911ba220ab", "total": 52}
|
||||
|
||||
@@ -27,7 +27,7 @@ PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||
export PATH
|
||||
export LC_ALL=C
|
||||
|
||||
readonly SCRIPT_VERSION="3.3.4"
|
||||
readonly SCRIPT_VERSION="3.3.6"
|
||||
readonly SCRIPT_PATH="$(readlink -f "${BASH_SOURCE[0]}")"
|
||||
readonly SCRIPT_SHA256="$(sha256sum "$SCRIPT_PATH" | awk '{print $1}')"
|
||||
readonly OPENBAO_PRIMARY_GPG_FPR="66D15FDD87287219C8E15478D200CD702853E6D0"
|
||||
@@ -758,7 +758,7 @@ install_identities_and_directories() {
|
||||
|
||||
install -d -m 0750 -o root -g aios-autonomy "$ROOT" "$ROOT/bootstrap"
|
||||
install -d -m 0770 -o aios-autonomy -g aios-autonomy "$ROOT/state" "$ROOT/log" "$ROOT/optimization"
|
||||
install -d -m 0770 -o root -g aios-openbao "$ROOT/backups" "$ROOT/restore-tests"
|
||||
install -d -m 0770 -o root -g aios-autonomy "$ROOT/backups" "$ROOT/restore-tests"
|
||||
install -d -m 0750 -o aios-openbao -g aios-openbao "$BAO_ROOT" "$BAO_ROOT/raft"
|
||||
install -d -m 0750 -o root -g aios-openbao "$SEAL_DIR"
|
||||
install -d -m 0750 -o root -g aios-openbao "$BAO_ETC" "$TLS_DIR" "$CHARTER_DIR"
|
||||
@@ -2914,7 +2914,7 @@ with tarfile.open(snapshot, "r:gz") as archive:
|
||||
PY
|
||||
sha="$(sha256sum "$tmp" | awk '{print $1}')"
|
||||
chmod 0440 "$tmp"
|
||||
chgrp aios-openbao "$tmp"
|
||||
chgrp aios-autonomy "$tmp"
|
||||
mv -f "$tmp" "$final"
|
||||
tmp=""
|
||||
aios_revoke_self "$token"
|
||||
@@ -3581,6 +3581,7 @@ Group=aios-autonomy
|
||||
RuntimeDirectory=aios-autonomy-controller
|
||||
RuntimeDirectoryMode=0700
|
||||
BindReadOnlyPaths=${TLS_CA}:/run/aios-autonomy-controller/openbao-ca.crt
|
||||
BindReadOnlyPaths=${CHARTER_FILE}:/run/aios-autonomy-controller/charter.json
|
||||
ExecStart=${CONTROLLER_BIN}
|
||||
Restart=always
|
||||
RestartSec=10s
|
||||
@@ -3601,7 +3602,7 @@ Environment=AIOS_OPENBAO_CACERT=/run/aios-autonomy-controller/openbao-ca.crt
|
||||
Environment=AIOS_OPENBAO_ROLE_ID_FILE=${APPROLE_ROLE_ID_FILE}
|
||||
Environment=AIOS_OPENBAO_SECRET_ID_FILE=${APPROLE_SECRET_RUNTIME_PATH}
|
||||
Environment=AIOS_AUTONOMY_STATUS=${STATUS_FILE}
|
||||
Environment=AIOS_CHARTER_FILE=${CHARTER_FILE}
|
||||
Environment=AIOS_CHARTER_FILE=/run/aios-autonomy-controller/charter.json
|
||||
Environment=AIOS_CONTROLLER_INTERVAL_FILE=${CONTROLLER_INTERVAL_FILE}
|
||||
|
||||
[Install]
|
||||
@@ -4265,6 +4266,13 @@ checks = {
|
||||
'Environment=AIOS_OPENBAO_CACERT=/run/aios-autonomy-acceptance/openbao-ca.crt',
|
||||
])
|
||||
and ('SupplementaryGroups=' + 'aios-openbao') not in body,
|
||||
"backup_restore_share_without_openbao_private_key_group":
|
||||
'install -d -m 0770 -o root -g aios-autonomy "$ROOT/backups" "$ROOT/restore-tests"' in body
|
||||
and 'chgrp aios-autonomy "$tmp"' in body
|
||||
and 'SupplementaryGroups=aios-autonomy' in body,
|
||||
"controller_uses_charter_only_bind":
|
||||
'BindReadOnlyPaths=${CHARTER_FILE}:/run/aios-autonomy-controller/charter.json' in body
|
||||
and 'Environment=AIOS_CHARTER_FILE=/run/aios-autonomy-controller/charter.json' in body,
|
||||
"continuous_optimization_implemented":
|
||||
'AIOS_AUTONOMY_OPTIMIZATION_EVENT_V1' in body,
|
||||
"72h_acceptance_gate":
|
||||
|
||||
@@ -1 +1 @@
|
||||
f8b84fe82fefc9bdf2ef2ef6945ea157af7ac8e9224963ebf6adb3f12205ced5 admin-bootstrap-openbao-autonomy-v1-v3.sh
|
||||
2473b788633976d40fa59869ee501331f1bf375fc2b376e2622e55911ba220ab admin-bootstrap-openbao-autonomy-v1-v3.sh
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
16b3ba65dd6ac91b37e1bd5f5138328d41403844d75db0d3fbd424493ae00ba1 admin-bootstrap-openbao-autonomy-v1-v3.self-test.json
|
||||
f8b84fe82fefc9bdf2ef2ef6945ea157af7ac8e9224963ebf6adb3f12205ced5 admin-bootstrap-openbao-autonomy-v1-v3.sh
|
||||
b1680221be6c8aa783f8329770ecd5c146db53ebb59d221222b9bbae530b3270 admin-bootstrap-openbao-autonomy-v1-v3.sha256
|
||||
17b1b0abaffcdf85b4d0828df0256c20cf838f714dfeb2bbef821376f370665d admin-bootstrap-openbao-autonomy-v1-v3.self-test.json
|
||||
2473b788633976d40fa59869ee501331f1bf375fc2b376e2622e55911ba220ab admin-bootstrap-openbao-autonomy-v1-v3.sh
|
||||
899658d992027f3764d64b1afbafe852ca588632970e6a31e028b79cf9531df5 admin-bootstrap-openbao-autonomy-v1-v3.sha256
|
||||
c355df01c83c2801ae3a0df43806c562ee70f97c9aa558e3f67dd097efa5ac99 test-admin-bootstrap-openbao-autonomy-v1-v3.sh
|
||||
|
||||
Reference in New Issue
Block a user