diff --git a/deploy/openbao-autonomy/admin-bootstrap-openbao-autonomy-v1-v3.self-test.json b/deploy/openbao-autonomy/admin-bootstrap-openbao-autonomy-v1-v3.self-test.json index daf1e75..1b37d0c 100644 --- a/deploy/openbao-autonomy/admin-bootstrap-openbao-autonomy-v1-v3.self-test.json +++ b/deploy/openbao-autonomy/admin-bootstrap-openbao-autonomy-v1-v3.self-test.json @@ -1 +1 @@ -{"checks": {"72h_acceptance_gate": true, "approle_implemented": true, "approle_secret_not_persisted_in_hcl": true, "approle_secret_survives_isolated_restore": true, "audit_implemented": true, "backup_implemented": true, "branch_protection_gate_not_bypassable": true, "charter_store_sign_verify": true, "continuous_optimization_implemented": true, "declarative_self_initialization": true, "embedded_shell_syntax": true, "exact_checksum_duplicate_rejected": true, "exact_checksum_good_fixture": true, "exact_checksum_missing_rejected": true, "fault_injection_implemented": true, "fault_injection_systemd_sandbox": true, "gitea_1_22_6_rejected": true, "gitea_1_23_0_accepted": true, "gitea_1_27_nonempty_tag_allowlist": true, "gitea_probe_traversal_and_cleanup": true, "gitea_tag_api_version_gate": true, "isolated_restore_implemented": true, "isolated_restore_uses_private_ephemeral_audit_sink": true, "kv_v2_implemented": true, "machine_credential_persisted": true, "masked_systemd_units_do_not_change_dev_null": true, "no_git_force_push": true, "no_git_tag_mutation": true, "openbao_2_6_heredoc_compatible": true, "openbao_2_6_runtime_verifier": true, "openbao_config_memfd_injection": true, "openbao_ready_gate_not_bypassable": true, "outer_bash_syntax": true, "policy_implemented": true, "ready_not_predeclared": true, "restored_approle_login_has_bounded_readiness_retry": true, "root_token_not_persisted": true, "runtime_state_directory_remains_writable": true, "self_contained_no_sibling_preflight": true, "self_init_marker_bound_to_raft_lifecycle": true, "self_init_secret_removal_implemented": true, "systemd_credentials_mandatory": true, "systemd_runtime_directories": true, "tag_protection_gate_implemented": true, "transit_charter_key_implemented": true, "transit_runtime_key_implemented": true}, "passed": 46, "runtime_claims": false, "schema": "AIOS_OPENBAO_BOOTSTRAP_STATIC_SELF_TEST_V3", "scope": "static_and_fixture_only", "script_sha256": "4d319cddb75a1c3bb64ab122d783cf7b01347e0f3d1d893195850e6b17e061e0", "total": 46} +{"checks": {"72h_acceptance_gate": true, "approle_implemented": true, "approle_secret_not_persisted_in_hcl": true, "approle_secret_survives_isolated_restore": true, "audit_implemented": true, "backup_implemented": true, "branch_protection_gate_not_bypassable": true, "charter_store_sign_verify": true, "continuous_optimization_implemented": true, "declarative_self_initialization": true, "embedded_shell_syntax": true, "exact_checksum_duplicate_rejected": true, "exact_checksum_good_fixture": true, "exact_checksum_missing_rejected": true, "fault_injection_does_not_require_service_it_kills": true, "fault_injection_implemented": true, "fault_injection_systemd_sandbox": true, "gitea_1_22_6_rejected": true, "gitea_1_23_0_accepted": true, "gitea_1_27_nonempty_tag_allowlist": true, "gitea_probe_traversal_and_cleanup": true, "gitea_tag_api_version_gate": true, "isolated_restore_implemented": true, "isolated_restore_uses_private_ephemeral_audit_sink": true, "kv_v2_implemented": true, "machine_credential_persisted": true, "masked_systemd_units_do_not_change_dev_null": true, "no_git_force_push": true, "no_git_tag_mutation": true, "openbao_2_6_heredoc_compatible": true, "openbao_2_6_runtime_verifier": true, "openbao_config_memfd_injection": true, "openbao_ready_gate_not_bypassable": true, "outer_bash_syntax": true, "policy_implemented": true, "ready_not_predeclared": true, "restored_approle_login_has_bounded_readiness_retry": true, "root_token_not_persisted": true, "runtime_state_directory_remains_writable": true, "self_contained_no_sibling_preflight": true, "self_init_marker_bound_to_raft_lifecycle": true, "self_init_secret_removal_implemented": true, "systemd_credentials_mandatory": true, "systemd_runtime_directories": true, "tag_protection_gate_implemented": true, "transit_charter_key_implemented": true, "transit_runtime_key_implemented": true}, "passed": 47, "runtime_claims": false, "schema": "AIOS_OPENBAO_BOOTSTRAP_STATIC_SELF_TEST_V3", "scope": "static_and_fixture_only", "script_sha256": "09a67ed758a8c0796e437c79b5b114f27cfdfe196f45a68ed64166f60640c6d0", "total": 47} diff --git a/deploy/openbao-autonomy/admin-bootstrap-openbao-autonomy-v1-v3.sh b/deploy/openbao-autonomy/admin-bootstrap-openbao-autonomy-v1-v3.sh index 5271b6c..30e8e66 100755 --- a/deploy/openbao-autonomy/admin-bootstrap-openbao-autonomy-v1-v3.sh +++ b/deploy/openbao-autonomy/admin-bootstrap-openbao-autonomy-v1-v3.sh @@ -27,7 +27,7 @@ PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin export PATH export LC_ALL=C -readonly SCRIPT_VERSION="3.3.0" +readonly SCRIPT_VERSION="3.3.1" readonly SCRIPT_PATH="$(readlink -f "${BASH_SOURCE[0]}")" readonly SCRIPT_SHA256="$(sha256sum "$SCRIPT_PATH" | awk '{print $1}')" readonly OPENBAO_PRIMARY_GPG_FPR="66D15FDD87287219C8E15478D200CD702853E6D0" @@ -3670,7 +3670,10 @@ EOF [Unit] Description=AIOS OpenBao Controlled Fault Injection After=aios-openbao.service -Requires=aios-openbao.service +# The test deliberately kills OpenBao and waits for Restart=on-failure. +# Requires= would stop and restart this oneshot with its dependency, causing +# repeated SIGKILLs until OpenBao hit StartLimitBurst. +Wants=aios-openbao.service [Service] Type=oneshot @@ -4201,6 +4204,10 @@ checks = { and '[[ "$login_ready" == true ]]' in body, "fault_injection_implemented": 'systemctl kill --kill-who=main --signal=SIGKILL' in body, + "fault_injection_does_not_require_service_it_kills": + 'Wants=aios-openbao.service' in body + and 'Requires=aios-openbao.service\n\n[Service]\nType=oneshot\nRuntimeDirectory=aios-openbao-fault' not in body + and 'repeated SIGKILLs until OpenBao hit StartLimitBurst' in body, "continuous_optimization_implemented": 'AIOS_AUTONOMY_OPTIMIZATION_EVENT_V1' in body, "72h_acceptance_gate": diff --git a/deploy/openbao-autonomy/admin-bootstrap-openbao-autonomy-v1-v3.sha256 b/deploy/openbao-autonomy/admin-bootstrap-openbao-autonomy-v1-v3.sha256 index 52f8a8c..1953c91 100644 --- a/deploy/openbao-autonomy/admin-bootstrap-openbao-autonomy-v1-v3.sha256 +++ b/deploy/openbao-autonomy/admin-bootstrap-openbao-autonomy-v1-v3.sha256 @@ -1 +1 @@ -4d319cddb75a1c3bb64ab122d783cf7b01347e0f3d1d893195850e6b17e061e0 admin-bootstrap-openbao-autonomy-v1-v3.sh +09a67ed758a8c0796e437c79b5b114f27cfdfe196f45a68ed64166f60640c6d0 admin-bootstrap-openbao-autonomy-v1-v3.sh diff --git a/deploy/openbao-autonomy/checksums.sha256 b/deploy/openbao-autonomy/checksums.sha256 index 5a4eb58..13a7285 100644 --- a/deploy/openbao-autonomy/checksums.sha256 +++ b/deploy/openbao-autonomy/checksums.sha256 @@ -1,4 +1,4 @@ -1ce5f8f44bdeea936c5f4c45c12caa9fd838d3967f172cc84c48121efe1cd77e admin-bootstrap-openbao-autonomy-v1-v3.self-test.json -4d319cddb75a1c3bb64ab122d783cf7b01347e0f3d1d893195850e6b17e061e0 admin-bootstrap-openbao-autonomy-v1-v3.sh -2ab4883323887d3f92bfd77764de3e621cdf6960a29237a6dac2af71b557a739 admin-bootstrap-openbao-autonomy-v1-v3.sha256 +dc6712bb7a7d57f6054c6b38c3b60a8f40b8f12e41c7cbeac842dcc1738d26af admin-bootstrap-openbao-autonomy-v1-v3.self-test.json +09a67ed758a8c0796e437c79b5b114f27cfdfe196f45a68ed64166f60640c6d0 admin-bootstrap-openbao-autonomy-v1-v3.sh +6332f848f5346c2bb22becf318f2e8f42068e453b9ea59f3c80f0436b6b56c84 admin-bootstrap-openbao-autonomy-v1-v3.sha256 c355df01c83c2801ae3a0df43806c562ee70f97c9aa558e3f67dd097efa5ac99 test-admin-bootstrap-openbao-autonomy-v1-v3.sh