admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

GL-6 Gate-0 ruling (G3): v1.11.2 — anonymous artifact fetch supported

Browse Source 
Operator ruling at the GL-6 drill's Gate 0: the Felhom artifacts are
world-readable by design; an EMPTY git.username/git.token in the customer
config now WARNS and fetches anonymously instead of dying at step 5/8
(the hub-vouched sha256 stays the integrity root; a configured credential
is still used when present; curl auth args are conditional because -u with
an empty token 401s even on public content). All 12 installer fetch
targets validated 200 anonymously before shipping. Harness: +GL6-ANON
shape case; GL4-C2 assertion updated for the v1.11.1 pinned constants
(the benign overrides-notice is not a die). Drill record carries the
deviation.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
This commit is contained in:
authentik Default Admin
2026-07-08 12:28:51 +02:00
parent bd97bc3474
commit 0640aa06ea
3 changed files with 129 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/hostinstall-mode-harness.sh
+19 -2
View File
@@ -215,10 +215,14 @@ expect_die "GL4-C3e key file: missing file refused" \
-- --customer-id t --mode appliance --operator-pubkey-file "$WORK/keys-nonexistent"
# GL4-C2 (positive shape, runtime): a VALID key file passes resolution — the script must die LATER
# (root/pveum/hub preflight, machine-dependent) and NEVER with a key-file error.
# (root/pveum/hub preflight, machine-dependent) and NEVER with a key-file ERROR. Since v1.11.1 the
# constants are pinned, so the benign "file overrides constants" NOTICE legitimately appears —
# assert on the actual die messages, not on any mention of the flag.
printf 'operational %s\nrecovery ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFakeFakeRecovery felhom-rec-1\n' "$GOODKEY" > "$WORK/keys-good"
run_script --customer-id t --mode appliance --operator-pubkey-file "$WORK/keys-good" --hub-url https://127.0.0.1:9
if [[ $rc -ne 0 && "$out" != *"--operator-pubkey-file"* && "$out" != *"authorized_keys line"* && "$out" != *"unknown role"* ]]; then
if [[ $rc -ne 0 && "$out" != *"authorized_keys line"* && "$out" != *"unknown role"* \
&& "$out" != *"has no key lines"* && "$out" != *"key line has no comment"* \
&& "$out" != *"--operator-pubkey-file not found"* ]]; then
verdict PASS "GL4-C2 valid key file accepted (dies later, not at key parse)"
else
verdict FAIL "GL4-C2 valid key file accepted" "rc=$rc; $(echo "$out" | tail -2 | tr '\n' ' ')"
@@ -264,6 +268,19 @@ else
verdict FAIL "GL4-D disclosure↔uninstall parity" "could not locate the uninstall section"
fi
# GL6-ANON (v1.11.2, the Gate-0 operator ruling): empty git creds warn + fetch anonymously — the
# resolve must NOT die on an empty token, and every artifact fetch must build its auth args
# conditionally (a curl -u with an empty token would 401 even on world-readable content).
if grep -q 'fetching artifacts ANONYMOUSLY' "$SCRIPT" \
&& grep -B1 'fetching artifacts ANONYMOUSLY' "$SCRIPT" | grep -q 'log_warn' \
&& ! grep -q 'no git token in controller.yaml — cannot fetch' "$SCRIPT" \
&& [ "$(grep -c '_git_auth_args _auth' "$SCRIPT")" -ge 2 ] \
&& ! grep -E 'curl -fsS -u "\$\{GIT_USER\}' "$SCRIPT" >/dev/null; then
verdict PASS "GL6-ANON empty-cred anonymous-fetch fallback (warn-not-die + conditional auth)"
else
verdict FAIL "GL6-ANON empty-cred anonymous-fetch fallback (warn-not-die + conditional auth)"
fi
# GL4-INV: no forced/lazy unmount and no format op on the drives root — REAL invocations only
# (comment lines and log_* guidance strings legitimately SAY "never umount -l/-f").
if ! grep -vE '^[[:space:]]*#|log_(warn|info|dry|error|success|skip)' "$SCRIPT" | grep -E 'umount +-(l|f)' >/dev/null \