mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-10-13 16:54:48 +00:00
Record hardened secure runtime qualification
This commit is contained in:
Pulse Test
parent
b2543c5c6e
commit
1fbcaa04a4
4 changed files with 251 additions and 11 deletions
|
|
@ -114,14 +114,19 @@ host mutation; its rollback claim predates irreversible credential reduction;
|
|||
and its secret-free receipt is hash-bound but not independently authenticated.
|
||||
It is historical evidence, not qualification of the current implementation.
|
||||
|
||||
The v3 guarded lab now requires a real verified apt-cache mutation, a separate
|
||||
The v3 guarded lab requires a real verified apt-cache mutation, a separate
|
||||
stale-fingerprint refusal, durable receipt replay, an observed collector
|
||||
authority-reduction request (with persistence covered by API regressions),
|
||||
complete boundary-source hashes, and artifact Go build stamps for
|
||||
the exact clean commit. `scripts/release_control/secure_runtime_attestation.py`
|
||||
rejects older receipts and labels accepted evidence as artifact-bound,
|
||||
self-attested systemd evidence rather than independently authenticated proof.
|
||||
The repository still needs a fresh exact committed release-candidate run,
|
||||
complete boundary-source hashes, and artifact Go build stamps for the exact
|
||||
clean commit. A fresh Ubuntu 24.04.4/systemd 255 run at committed main
|
||||
`b2543c5c6e03bc8f38502098d3a356983d0d41b2` passed all twelve scenarios; its
|
||||
separate receipt and attestation are recorded as
|
||||
`internal/records/secure-agent-runtime-systemd-receipt-v3-2026-08-30.json` and
|
||||
`internal/records/secure-agent-runtime-committed-main-attestation-v3-2026-08-30.json`.
|
||||
`scripts/release_control/secure_runtime_attestation.py` rejects older receipts
|
||||
and labels accepted evidence as artifact-bound, self-attested systemd evidence
|
||||
rather than independently authenticated proof. The repository still needs a
|
||||
fresh exact committed release-candidate run,
|
||||
representative Proxmox, SMART, Docker and rootless Podman telemetry/action
|
||||
parity, appliance profiles, and the external security review. Until those
|
||||
proofs are recorded, the safe profile remains opt-in and provider degradation
|
||||
|
|
|
|||
|
|
@ -0,0 +1,87 @@
|
|||
{
|
||||
"schema_version": 3,
|
||||
"attestation_tool": "scripts/release_control/secure_runtime_attestation.py",
|
||||
"attestation_tool_sha256": "5bc6dcdf18da9e62fb5302fe7ed896d307d26656582c09867550458bc2ed2b78",
|
||||
"proof_classification": "committed-main-artifact-bound-self-attested-systemd",
|
||||
"qualified_commit": "b2543c5c6e03bc8f38502098d3a356983d0d41b2",
|
||||
"qualified_ref_at_run": "b2543c5c6e03bc8f38502098d3a356983d0d41b2",
|
||||
"main_ref_verified": "origin/main",
|
||||
"main_ref_commit_at_attestation": "b2543c5c6e03bc8f38502098d3a356983d0d41b2",
|
||||
"qualified_commit_reachable_from_main": true,
|
||||
"build_checkout": "detached-worktree",
|
||||
"build_checkout_clean_except_lab_artifacts": true,
|
||||
"disposable_vm_guard_receipt_claim_validated": true,
|
||||
"execution_receipt_authentication": "none-secret-free-self-attestation",
|
||||
"receipt_path": "docs/release-control/v6/internal/records/secure-agent-runtime-systemd-receipt-v3-2026-08-30.json",
|
||||
"receipt_sha256": "be463420af43e3183376498687756768eff2de7313e276937ce17c2a5bda9ffe",
|
||||
"source_hashes_match_commit": true,
|
||||
"source_hashes": {
|
||||
"cmd/pulse-agent-helper/main.go": "3da1978e6e70d29cc22f070c5ada1f6a5f516f6a6643a3b27f23a4adf9ade866",
|
||||
"cmd/pulse-agent-runner/main.go": "bae603eb267c945fe96cf88397474d2d75916d2b27265e691f91aa4932944eca",
|
||||
"cmd/pulse-agent/main.go": "73527ea1c0513804fcbf64fa1b924fa7f29dc5441cd98ed2c0e2f53ddd621ca8",
|
||||
"internal/actionrunner/runner.go": "d32a2e6810267a12096d0865f4af4326db9caf4ccb56aba02955a97bbef6ca66",
|
||||
"internal/actionrunner/transport.go": "6e39ea82bc0b31300e9bdbcc3fed5c1fa2348166bbaf6ce0e95ce5adb44ee5d0",
|
||||
"internal/actionrunner/types.go": "fe4244e20fbda21b1c174ed9556fc68c8c028edd0db93597066aacc1ed32997d",
|
||||
"internal/agentexec/server.go": "2dbd41698990b314c776c91324469f2bcfbb40216ebc466ff962d08aa3f6edc0",
|
||||
"internal/agentexec/types.go": "428a06918af94c803c720d282d5123149e70c5bf2dbdfd06613495d54d8f9b0d",
|
||||
"internal/agentexec/verifier_postconditions.go": "27f68d4f05e45803f65a1dd3c7e38d41ca39ab88d9f1a574dc4739911b8391cc",
|
||||
"internal/agenthelper/server.go": "70ef4f2299cf5d3347520906e62e8d7307d67624f60232c9bcbafbc6035e3ebe",
|
||||
"internal/agenthelper/update_activation.go": "cdaae1da9459d5cbbd9f84dce6e6e3234bc03ed4739e78292161d2faa98d2445",
|
||||
"internal/agentupdate/privileged_update.go": "1e27b3d94087e85139dfbfeb86b78e6444ee9b80bd97bdbf698d0d2dadd6c624",
|
||||
"internal/agentupdate/update.go": "ad885a99ce679fc30c5155147961f1e970fec031e25f5b69ea9814795d2f335d",
|
||||
"internal/api/action_runner_credentials.go": "5ec0dca0aadca4b061161bfb68b78a5ca4cd29cf752349ab88f539c388b54a4c",
|
||||
"internal/api/agent_exec_token_binding.go": "20b1dd4657d332677a7cfb64c12f4f8ce688a69be54906f4517981448cfaec21",
|
||||
"internal/api/agenttokens/install.go": "75849cbefc683da6368718190153149b869534c518ba16ed627180da86d688aa",
|
||||
"internal/api/collector_authority.go": "3533b2bf6e6cc3d766f10537325dd72f7b0b708385c1ff3f9228c79d535c6f14",
|
||||
"internal/hostagent/storage_cleanup.go": "6bf8a9457ae63fb4cdf375660cb85a15302aa29fdc303e1ed9a2cfc71abf3c0f",
|
||||
"internal/operationreceipt/store.go": "6f40b4422fde09e81fc989b9b5f35066ebb3276e20bb0903a554414b69e6f6fe",
|
||||
"internal/operationreceipt/types.go": "08b86678dfe55b5ec29c94ef96de15e9e3f416a9db656481f8ae833b38538dfa",
|
||||
"scripts/install.sh": "e90189cf2dde51a36aea56281d77250d97a16c6cc759d95122a1d713b25f4ac0",
|
||||
"scripts/installtests/secure_runtime_systemd_lab_test.go": "77f259bfd821a1a20099003bd8a2458bc5a6b11d49ab48e3940674d7b6a67c33",
|
||||
"scripts/release_control/secure_runtime_attestation.py": "5bc6dcdf18da9e62fb5302fe7ed896d307d26656582c09867550458bc2ed2b78"
|
||||
},
|
||||
"artifact_hashes_match_receipt": true,
|
||||
"artifact_hashes": {
|
||||
"collector_v1": "fe8c0fc7d965054e08eb9ba1c7d21cc4180e1533293bba1f4a1b7448666763ee",
|
||||
"collector_v2": "fa9a1294ef7690ca55352672ab5f5a0b345f3e44daf0261d56174f09943cc51b",
|
||||
"helper": "57d91f91a6db8c3f9a7e6bef0f00adb3bb12397e81eb2e1c904aecb406d4082f",
|
||||
"runner": "cb25375db2c1770e3203f8401008f6e11eeac08b9aee7c7485ab3b95c63099a3"
|
||||
},
|
||||
"artifact_build_identity": {
|
||||
"collector_v1": {
|
||||
"package": "github.com/rcourtman/pulse-go-rewrite/cmd/pulse-agent",
|
||||
"vcs_revision": "b2543c5c6e03bc8f38502098d3a356983d0d41b2",
|
||||
"vcs_modified": "false"
|
||||
},
|
||||
"collector_v2": {
|
||||
"package": "github.com/rcourtman/pulse-go-rewrite/cmd/pulse-agent",
|
||||
"vcs_revision": "b2543c5c6e03bc8f38502098d3a356983d0d41b2",
|
||||
"vcs_modified": "false"
|
||||
},
|
||||
"helper": {
|
||||
"package": "github.com/rcourtman/pulse-go-rewrite/cmd/pulse-agent-helper",
|
||||
"vcs_revision": "b2543c5c6e03bc8f38502098d3a356983d0d41b2",
|
||||
"vcs_modified": "false"
|
||||
},
|
||||
"runner": {
|
||||
"package": "github.com/rcourtman/pulse-go-rewrite/cmd/pulse-agent-runner",
|
||||
"vcs_revision": "b2543c5c6e03bc8f38502098d3a356983d0d41b2",
|
||||
"vcs_modified": "false"
|
||||
}
|
||||
},
|
||||
"host": {
|
||||
"os": "Ubuntu 24.04.4 LTS",
|
||||
"kernel": "Linux 6.8.0-117-generic #117-Ubuntu SMP PREEMPT_DYNAMIC Thu May 7 17:26:37 UTC 2026 aarch64 GNU/Linux",
|
||||
"systemd": "systemd 255 (255.4-1ubuntu8.15)",
|
||||
"architecture": "arm64"
|
||||
},
|
||||
"scenario_count": 12,
|
||||
"all_scenarios_passed": true,
|
||||
"test_elapsed_seconds": 114.26,
|
||||
"default_changed": false,
|
||||
"residual_proof": [
|
||||
"exact-release-candidate",
|
||||
"representative-provider-and-appliance",
|
||||
"external-security-review"
|
||||
]
|
||||
}
|
||||
|
|
@ -95,13 +95,38 @@ scenario outcomes. It proves neither a successful action-runner host mutation
|
|||
nor the post-audit credential, rollback, update-artifact, and runner-unit
|
||||
hardening. It is retained as historical, hash-bound self-attested evidence.
|
||||
|
||||
## Current schema-v3 committed-main evidence
|
||||
|
||||
A newly created disposable arm64 Colima profile ran Ubuntu 24.04.4, kernel
|
||||
6.8.0-117, and systemd 255 from a detached clean checkout at committed main
|
||||
`b2543c5c6e03bc8f38502098d3a356983d0d41b2`. All four exercised commands carry
|
||||
that exact clean Go VCS revision, and the two collector commands report distinct
|
||||
qualification versions. The guarded lab passed all twelve scenarios in 114.26
|
||||
seconds, including the verified apt-cache mutation, stale-fingerprint refusal,
|
||||
durable terminal receipt replay, irreversible collector authority-reduction
|
||||
request, rollback without command-authority resurrection, exact runner
|
||||
credential rotation, self-revocation, and collector/helper continuity.
|
||||
|
||||
The secret-free schema-v3 receipt is
|
||||
`secure-agent-runtime-systemd-receipt-v3-2026-08-30.json` with SHA-256
|
||||
`be463420af43e3183376498687756768eff2de7313e276937ce17c2a5bda9ffe`. The
|
||||
separate `secure-agent-runtime-committed-main-attestation-v3-2026-08-30.json`
|
||||
has SHA-256
|
||||
`e1339f73704883aec19225d886188dad78338659b16a11e785091b41bbf0f0c1` and
|
||||
verifies the receipt, current-main ancestry at attestation time, all required
|
||||
boundary-source hashes, all artifact hashes, the expected Go command packages,
|
||||
and clean exact-commit Go VCS identities. The authority-reduction request was
|
||||
observed by the systemd fixture; durable production-store reduction and exact
|
||||
session invalidation remain established by the focused API regressions rather
|
||||
than by this in-process fixture. The receipt remains operator-produced,
|
||||
unauthenticated, artifact-bound self-attestation rather than independent proof.
|
||||
|
||||
## Proof classification and residuals
|
||||
|
||||
Focused regressions cover the current semantics. A fresh schema-v3 guarded
|
||||
systemd receipt is still required and must demonstrate the real apt-cache
|
||||
mutation plus stale-fingerprint refusal. Even that self-attested receipt is not
|
||||
a substitute for exact release-candidate evidence, representative
|
||||
provider/appliance qualification, or external review.
|
||||
Focused regressions and the schema-v3 guarded systemd evidence cover the current
|
||||
committed-main semantics. They are not a substitute for exact release-candidate
|
||||
reproduction, representative provider/appliance qualification, or external
|
||||
review.
|
||||
|
||||
The safe profile therefore remains opt-in. The default may not ratchet until
|
||||
the exact release candidate reproduces the complete systemd result;
|
||||
|
|
|
|||
|
|
@ -0,0 +1,123 @@
|
|||
{
|
||||
"schema_version": 3,
|
||||
"completed_at": "2026-08-30T13:53:50.40355539Z",
|
||||
"source_hashes": {
|
||||
"cmd/pulse-agent-helper/main.go": "3da1978e6e70d29cc22f070c5ada1f6a5f516f6a6643a3b27f23a4adf9ade866",
|
||||
"cmd/pulse-agent-runner/main.go": "bae603eb267c945fe96cf88397474d2d75916d2b27265e691f91aa4932944eca",
|
||||
"cmd/pulse-agent/main.go": "73527ea1c0513804fcbf64fa1b924fa7f29dc5441cd98ed2c0e2f53ddd621ca8",
|
||||
"internal/actionrunner/runner.go": "d32a2e6810267a12096d0865f4af4326db9caf4ccb56aba02955a97bbef6ca66",
|
||||
"internal/actionrunner/transport.go": "6e39ea82bc0b31300e9bdbcc3fed5c1fa2348166bbaf6ce0e95ce5adb44ee5d0",
|
||||
"internal/actionrunner/types.go": "fe4244e20fbda21b1c174ed9556fc68c8c028edd0db93597066aacc1ed32997d",
|
||||
"internal/agentexec/server.go": "2dbd41698990b314c776c91324469f2bcfbb40216ebc466ff962d08aa3f6edc0",
|
||||
"internal/agentexec/types.go": "428a06918af94c803c720d282d5123149e70c5bf2dbdfd06613495d54d8f9b0d",
|
||||
"internal/agentexec/verifier_postconditions.go": "27f68d4f05e45803f65a1dd3c7e38d41ca39ab88d9f1a574dc4739911b8391cc",
|
||||
"internal/agenthelper/server.go": "70ef4f2299cf5d3347520906e62e8d7307d67624f60232c9bcbafbc6035e3ebe",
|
||||
"internal/agenthelper/update_activation.go": "cdaae1da9459d5cbbd9f84dce6e6e3234bc03ed4739e78292161d2faa98d2445",
|
||||
"internal/agentupdate/privileged_update.go": "1e27b3d94087e85139dfbfeb86b78e6444ee9b80bd97bdbf698d0d2dadd6c624",
|
||||
"internal/agentupdate/update.go": "ad885a99ce679fc30c5155147961f1e970fec031e25f5b69ea9814795d2f335d",
|
||||
"internal/api/action_runner_credentials.go": "5ec0dca0aadca4b061161bfb68b78a5ca4cd29cf752349ab88f539c388b54a4c",
|
||||
"internal/api/agent_exec_token_binding.go": "20b1dd4657d332677a7cfb64c12f4f8ce688a69be54906f4517981448cfaec21",
|
||||
"internal/api/agenttokens/install.go": "75849cbefc683da6368718190153149b869534c518ba16ed627180da86d688aa",
|
||||
"internal/api/collector_authority.go": "3533b2bf6e6cc3d766f10537325dd72f7b0b708385c1ff3f9228c79d535c6f14",
|
||||
"internal/hostagent/storage_cleanup.go": "6bf8a9457ae63fb4cdf375660cb85a15302aa29fdc303e1ed9a2cfc71abf3c0f",
|
||||
"internal/operationreceipt/store.go": "6f40b4422fde09e81fc989b9b5f35066ebb3276e20bb0903a554414b69e6f6fe",
|
||||
"internal/operationreceipt/types.go": "08b86678dfe55b5ec29c94ef96de15e9e3f416a9db656481f8ae833b38538dfa",
|
||||
"scripts/install.sh": "e90189cf2dde51a36aea56281d77250d97a16c6cc759d95122a1d713b25f4ac0",
|
||||
"scripts/installtests/secure_runtime_systemd_lab_test.go": "77f259bfd821a1a20099003bd8a2458bc5a6b11d49ab48e3940674d7b6a67c33",
|
||||
"scripts/release_control/secure_runtime_attestation.py": "5bc6dcdf18da9e62fb5302fe7ed896d307d26656582c09867550458bc2ed2b78"
|
||||
},
|
||||
"artifact_hashes": {
|
||||
"collector_v1": "fe8c0fc7d965054e08eb9ba1c7d21cc4180e1533293bba1f4a1b7448666763ee",
|
||||
"collector_v2": "fa9a1294ef7690ca55352672ab5f5a0b345f3e44daf0261d56174f09943cc51b",
|
||||
"helper": "57d91f91a6db8c3f9a7e6bef0f00adb3bb12397e81eb2e1c904aecb406d4082f",
|
||||
"runner": "cb25375db2c1770e3203f8401008f6e11eeac08b9aee7c7485ab3b95c63099a3"
|
||||
},
|
||||
"artifact_versions": {
|
||||
"collector_v1": "v6.2.0-lab.1",
|
||||
"collector_v2": "v6.2.0-lab.2"
|
||||
},
|
||||
"disposable_vm_guard_sha256": "8e5627d75bbd86ab54f63cf4af8a63bdb5c134450e1cf75b0bf13095349fa68d",
|
||||
"os_release": "PRETTY_NAME=\"Ubuntu 24.04.4 LTS\"\nNAME=\"Ubuntu\"\nVERSION_ID=\"24.04\"\nVERSION=\"24.04.4 LTS (Noble Numbat)\"\nVERSION_CODENAME=noble\nID=ubuntu\nID_LIKE=debian\nHOME_URL=\"https://www.ubuntu.com/\"\nSUPPORT_URL=\"https://help.ubuntu.com/\"\nBUG_REPORT_URL=\"https://bugs.launchpad.net/ubuntu/\"\nPRIVACY_POLICY_URL=\"https://www.ubuntu.com/legal/terms-and-policies/privacy-policy\"\nUBUNTU_CODENAME=noble\nLOGO=ubuntu-logo",
|
||||
"kernel": "Linux 6.8.0-117-generic #117-Ubuntu SMP PREEMPT_DYNAMIC Thu May 7 17:26:37 UTC 2026 aarch64 GNU/Linux",
|
||||
"systemd_version": "systemd 255 (255.4-1ubuntu8.15)",
|
||||
"architecture": "arm64",
|
||||
"collector_service_user": "pulse-agent",
|
||||
"collector_process_uid": 996,
|
||||
"collector_authority": "monitoring-only",
|
||||
"ambient_capabilities_none": true,
|
||||
"helper_protocol_healthy": true,
|
||||
"state_identity_preserved": true,
|
||||
"docker_degraded": true,
|
||||
"action_runner_qualified": true,
|
||||
"action_mutation_verified": true,
|
||||
"collector_authority_reduction_request_observed": true,
|
||||
"action_receipt_kind": "pulse.host_storage_cleanup_result",
|
||||
"credential_rotated": true,
|
||||
"self_revoke_observed": true,
|
||||
"collector_continuity": true,
|
||||
"report_count": 49,
|
||||
"first_report_at": "2026-08-30T13:52:00.492231801Z",
|
||||
"last_report_at": "2026-08-30T13:53:50.369320394Z",
|
||||
"scenarios": [
|
||||
{
|
||||
"name": "legacy_root_command_capable_install",
|
||||
"passed": true,
|
||||
"detail": "root collector installed; docker_enabled=true"
|
||||
},
|
||||
{
|
||||
"name": "read_only_inspect",
|
||||
"passed": true,
|
||||
"detail": "stable installer-owned files unchanged"
|
||||
},
|
||||
{
|
||||
"name": "drop_in_fail_closed_rehearsal",
|
||||
"passed": true,
|
||||
"detail": "migration rejected before stable installer-owned files changed"
|
||||
},
|
||||
{
|
||||
"name": "safe_profile_apply",
|
||||
"passed": true,
|
||||
"detail": "fresh server lastSeen, least-privilege identity, typed helper health"
|
||||
},
|
||||
{
|
||||
"name": "explicit_safe_profile_rollback",
|
||||
"passed": true,
|
||||
"detail": "legacy binary and service identity restored without resurrecting collector command authority"
|
||||
},
|
||||
{
|
||||
"name": "automatic_failure_rollback",
|
||||
"passed": true,
|
||||
"detail": "frozen lastSeen prevented commit and restored binary/state identity without command authority"
|
||||
},
|
||||
{
|
||||
"name": "ordinary_update_non_migration",
|
||||
"passed": true,
|
||||
"detail": "binary updated while the downgraded root monitoring profile remained unchanged"
|
||||
},
|
||||
{
|
||||
"name": "final_safe_profile_apply",
|
||||
"passed": true,
|
||||
"detail": "collector continued reporting after committed migration"
|
||||
},
|
||||
{
|
||||
"name": "separate_action_runner_install",
|
||||
"passed": true,
|
||||
"detail": "root action runner registered independently while the collector remained non-root and reporting"
|
||||
},
|
||||
{
|
||||
"name": "typed_action_receipt",
|
||||
"passed": true,
|
||||
"detail": "verified apt cache mutation and durable terminal receipt; stale fingerprint refused before mutation; generic command dispatch denied"
|
||||
},
|
||||
{
|
||||
"name": "action_runner_credential_rotation",
|
||||
"passed": true,
|
||||
"detail": "mismatched invalidation was rejected, exact superseded session closed, replacement credential registered"
|
||||
},
|
||||
{
|
||||
"name": "action_runner_self_revoke",
|
||||
"passed": true,
|
||||
"detail": "uninstall revoked the exact host binding and removed only runner state; collector/helper continuity remained healthy"
|
||||
}
|
||||
]
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue