admin/felhom-controller
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

v0.107.0: key-auth-first bridge + staged-secret wipe on escrow confirm

Browse Source 
Key-auth-first: a KeyAuthProber seam lets the bridge skip consume+install
when the already-installed key still authenticates (pinned to the freshly
verified host key) — descriptor changes on provisioned guests no longer
loop on consume-404. Fingerprint verify still precedes everything.

Wipe-on-escrowed: confirm-escrow now calls the agent's new
DELETE /escrow/stage-secret (v0.78.0) best-effort, closing the hygiene gap
where a ceremony-less confirm left the staged password file behind.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
This commit is contained in:
authentik Default Admin
2026-07-09 22:26:53 +02:00
parent 42af088308
commit a38c743926
9 changed files with 241 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+21
View File
@@ -1,5 +1,26 @@
## Changelog
### v0.107.0 — offsite hardening: key-auth-first bridge + staged-secret wipe on confirm (2026-07-09)
Part of the offsite-provisioning hardening bundle (pairs with hub v0.39.0 + agent v0.78.0).
- **Key-auth-first (`internal/offsiteapply`):** new `KeyAuthProber` seam (`SFTPKeyAuthProber` — probes the
ALREADY-INSTALLED key against the descriptor target, pinned to the freshly-verified known_hosts). On a
descriptor change where the existing key still authenticates, the bridge **re-pins + reconfigures WITHOUT
consuming a one-time password** — kills the stale-descriptor consume-404 loop seen twice in the live e2e,
and shrinks the re-issue blast radius to genuinely-fresh guests. The probe NEVER bypasses the fingerprint
verify (scan+verify still precedes it; a mismatch refuses before any probe). Fresh guests (no key / auth
refused) fall through to the full verify→consume→install path unchanged.
Tests + red-proofs: probe-success with a panicking consumer (drop the skip → panic → FAIL); fresh-guest
fallthrough (early-return on probe-fail → nothing applies → FAIL); mismatch now also asserts the probe
never runs on a failed identity check.
- **Staged-secret wipe (`internal/web` + `internal/agentapi`):** `WipeStagedEscrowSecret` (DELETE
`/escrow/stage-secret`, agent ≥ v0.78.0); the confirm-escrow handler wipes the agent-staged repo password
whenever `EscrowState` flips to `escrowed` — best-effort (a wipe failure logs a loud ERROR but never fails
the confirm; re-confirm retries). Closes the fork-4 hygiene gap where a confirm without a fresh ceremony
left the staged 0600 file behind (observed live in the e2e's Option-A close). Test: confirm wipes exactly
once; a failing wipe still confirms + logs "NOT wiped".
### v0.106.1 — offsite apply-bridge: ssh-copy-id -s needs ~/.ssh to exist (live finding F3) (2026-07-09)
First supervised live apply: scan+verify passed, the one-time password was consumed, then `ssh-copy-id -s`