Repository navigation
Conversation
Defer provisioning/unseal until policy verification succeeds. Add refusal and accepting controls through the real loader with synthetic TPM seams. Clarify empty-owner-password access and config-digest upgrade scope. Refs agentrust-io#782; author-adoption companion to agentrust-io#779. Prepared with OpenAI Codex. Signed-off-by: Srinivasa Dinakar Jainti <[email protected]>
1 task done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Superseded by the revised upstream draft agentrust-io#840 after agentrust-io#779 merged and review identified later startup refusals. Keep agentrust-io#840 as the canonical review venue. This historical policy-only candidate is not the complete fix. The separate lifecycle controls in #5 remain separate.
Problem and change
A rejected policy bundle can leave a first-start signing key sealed to the rejected configuration. This companion to agentrust-io#782 moves provisioning/unseal after the existing policy verification, while retaining early public-key discovery for the attestation nonce. It also clarifies the empty-owner-password/device/store access boundary in the module and security-model documentation, and corrects the configuration-digest migration scope.
Based exactly on parent PR agentrust-io#779 at dd07fac. This is an adoption candidate for the assigned owner @rajnisht7 and parent author @Yatsuiii, not a competing upstream PR. Do not merge this frozen review base into upstream main; cherry-pick the correction onto the selected branch or submit it after agentrust-io#779 lands.
Validation
Linux / Python 3.11.17, reused development environment, explicit checkout PYTHONPATH:
The first full-suite attempt ended with a native-library 'lookup self' error. The session-close file then passed 41/41 alone. A complete retry had nine failures caused by inherited SOCKS proxy configuration without socksio. The final complete run removed proxy environment variables for that test process only and passed. No dependency or application workaround was committed.
Evidence limits and security impact
Tests use the real policy loader with synthetic TPM seams. No fresh lock installation, swtpm/hardware execution, hosted CI, independent review or deployed recovery claim. The change prevents the finish/provisioning call on the covered policy refusals; early store locking and measurement still occur. This does not establish an atomic measured-policy snapshot or address later startup failures, and it does not alter TPM policy, key rotation, or evidence semantics. Optional reseal/rotation unit additions from agentrust-io#782 are outside this companion.
Signing-key lifecycle changes require the security review and two independent maintainer approvals before upstream acceptance. Parent ownership and existing review gates remain. No issue closure or merge requested by this draft.
DCO and assistance
Signed-off-by: Srinivasa Dinakar Jainti [email protected]
Prepared with OpenAI Codex. The source contract is the existing agentrust-io#782 report and agentrust-io#779 startup/sealing implementation; no new cryptographic mechanism is proposed.