gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ci): eliminate audit-signature flake + self-heal deploy docker access

Browse Source 
Two comprehensive CI fixes:

1. Adversarial harness flake (PASS=42 FAIL=2, state-dependent):
   governance-check.sh re-exported audit-public.pem only when GENERATING a
   new signing key. On a CI runner where the off-repo private key PERSISTS
   across runs, the checked-out (Vault-signed) audit-public.pem drifted out
   of sync with the local re-signing key, so verify-audit-chain.sh rejected a
   genuine head ("H5/H2 verifies the genuine signed chain"). Now always
   re-export the public key matching the signing key — mirrors the same fix
   already applied to tool-audit-lib.sh (c31987c). Reproduced the exact
   FAIL=2 locally with a drifted persisted key; now deterministically 44/44.

2. Deploy docker.sock permission denied:
   Added a self-healing preflight to deploy-okr that ensures the deploy user
   is in the docker group on the web VPS (idempotent, passwordless sudo) and
   proves a fresh SSH session can reach the daemon before streaming images.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
thanhnv
2026-07-01 21:44:20 +09:00
co-authored by Claude Opus 4.8
parent c31987caa2
commit 82011a0c67
2 changed files with 23 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AINative_OKR_CASAN5/.specify/scripts/bash/governance-check.sh
+5 -1
View File
@@ -157,8 +157,12 @@ if command -v openssl >/dev/null 2>&1; then
if [[ ! -f "$AUDIT_PRIV" ]]; then
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out "$AUDIT_PRIV" 2>/dev/null
chmod 600 "$AUDIT_PRIV"
openssl rsa -in "$AUDIT_PRIV" -pubout -out "$AUDIT_PUB" 2>/dev/null
fi
# Always re-export the public key so it matches the private key we sign with.
# Without this, a private key that PERSISTS on a CI runner drifts out of sync
# with a freshly checked-out audit-public.pem (e.g. one committed after a
# Vault-KMS signing), and verify-audit-chain.sh would reject a genuine head.
openssl rsa -in "$AUDIT_PRIV" -pubout -out "$AUDIT_PUB" 2>/dev/null || true
printf '%s' "$RECORD_HASH" > "$AUDIT_DIR/audit-head.txt"
openssl dgst -sha256 -sign "$AUDIT_PRIV" -out "$AUDIT_DIR/audit-head.sig" "$AUDIT_DIR/audit-head.txt" 2>/dev/null || true
fi