fix(liquio): build valid Cabinet JWTs and fail closed

karsten commented

2026-10-27 18:22:40 +00:00

Owner

Minimal native JWT repair authored by Adrian, original candidate 0eb8181ca9124ecb6d129234cc38ff125ec4e5c0 plus diagnostic stage markers. Exact complete production/test blobs retained. Explicit openssl dependency, fail-closed base64 output and non-empty JWT segments. Existing credential reuse, role and ownership behavior unchanged. Operator tests: four focused Helm/pytest passed; exact shell/JWT block with jq+openssl makes valid JSON and Python-verified HMAC, unavailable OpenSSL exits1 with no token. No new technical leader review; prior independent legacy-reuse approval remains limited to unchanged bytes. No extra review required for this bounded dependency/fail-closed correction under the current KISS contract.

Evidence: https://hex.local.samaschke.de/api/attachments/15094424-61e0-40e9-b5de-c97b80d118ce/content . Hosted CI unavailable (no workflows); not green. Normal pinned-head merge, no policy overrides. Publication, rollout and business acceptance are distinct.

Minimal native JWT repair authored by Adrian, original candidate 0eb8181ca9124ecb6d129234cc38ff125ec4e5c0 plus diagnostic stage markers. Exact complete production/test blobs retained. Explicit openssl dependency, fail-closed base64 output and non-empty JWT segments. Existing credential reuse, role and ownership behavior unchanged. Operator tests: four focused Helm/pytest passed; exact shell/JWT block with jq+openssl makes valid JSON and Python-verified HMAC, unavailable OpenSSL exits1 with no token. No new technical leader review; prior independent legacy-reuse approval remains limited to unchanged bytes. No extra review required for this bounded dependency/fail-closed correction under the current KISS contract. Evidence: https://hex.local.samaschke.de/api/attachments/15094424-61e0-40e9-b5de-c97b80d118ce/content . Hosted CI unavailable (no workflows); not green. Normal pinned-head merge, no policy overrides. Publication, rollout and business acceptance are distinct.

karsten added 2 commits

2026-10-27 18:22:40 +00:00

im-provision: log non-secret stage markers (token/user presence, reuse validity, Cabinet probe) 8a274984b1

im-provision: install openssl and never build a JWT from empty segments 87ea1c80e6

karsten merged commit 412abbc1c1 into main

2026-10-27 18:22:48 +00:00

karsten referenced this pull request from a commit

2026-10-27 18:22:50 +00:00

Merge pull request 'fix(liquio): build valid Cabinet JWTs and fail closed' (#199) from hex-73/liquio-jwt-tooling-fix into main

Rows
Columns

fix(liquio): build valid Cabinet JWTs and fail closed #199