demo-felhom is protected again, and the authorised recovery could never have worked

Browse Source

Checked before acting, and the check is the finding. The box's local key and the
hub's sealed escrow key hash to the SAME value (c60c8bc737a6b7c6...), and that
key answers "wrong password or no key found" against its own repository. Running
the recovery would have returned a key the box already held and which was already
proven not to open the store.

The store was written under 48741892f0ef4d59... -- host_escrow_superseded id=4,
superseded 2026-08-04 07:20:08, identity_blob NULL. The restic password lives
only in the identity bundle (escrow/identity.go:39, read by recover.go:91), so it
is unrecoverable by construction; the surviving K-escrow payload is 64 bytes, a
wrapped key, far too small to carry it. Same shape the register already records
for demo-hp, four hours the wrong side of the retention fix.

Took the operator's stated fallback instead: the orphan reset through the
customer's own card. Old store moved aside, never deleted, to
/home/felhom-repo.orphaned-20260810 (1.2 GB); fresh repository under the current
key; offbox_repo_reset audited hub-side. Then PROVEN rather than assumed --
last_status ok, 10s, and the snapshot's CONTENTS listed: opengist compose files,
manifest.json and volume-dumps/opengist_opengist_data.tar. Not an empty backup
calling itself successful.

R-202 gains hard evidence: the orphan card promises those set-aside backups may
be restorable later with their recovery code. For these 1.2 GB that is false and
unfixable, and it is said to the customers most likely to read it.

...

This commit is contained in:

authentik Default Admin

2026-08-10 10:10:43 +02:00

parent ed447f940e

commit 67eced8fbf

2 changed files with 7 additions and 7 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

documentation/backlog/OPEN-ITEMS.md

+2 -2

File diff suppressed because one or more lines are too long