Sigaint/corvus
2
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions 7

feat/ubi-base #20

Open
mhahl wants to merge 14 commits from feat/ubi-base into main
pull from: feat/ubi-base
merge into: Sigaint:main
Conversation 0 Commits 14 Files changed 23 +666 -45
mhahl commented 2026-08-23 13:30:09 +00:00
Owner
Copy link
No description provided. 
- Multi-stage UBI build: wheels compiled in ubi9/python-312, runtime on
  ubi9/python-312-minimal with no compiler or package toolchain.
- Prod image no longer ships softhsm2/opensc (EPEL-only, dev stand-in
  for real HSMs). New 'dev' target layers EPEL + SoftHSM2 for the local
  Compose HSM flow; compose.yml now builds that target.
- uid 10001 'appuser' kept so K8s securityContexts and Compose tmpfs
  mounts stay unchanged.
- libsofthsm2.so path moves /usr/lib -> /usr/lib64 on EL: seed_mock and
  HSM docs updated.
log_secret/log_org now emit one machine-parseable JSON record per audit
row on the 'corvus.audit' logger (stdout handler attached in create_app,
isolated from gunicorn prefixes). Container log shippers — rsyslog
imfile/journald, Splunk forwarder/HEC — can relay these to a SIEM.

Fields: ts (ISO-8601 UTC), event=secret_audit|org_audit, action, actor,
project_id/team_id/secret_id, secret_key (name only; values are never
logged), detail. Console emission is best-effort and never blocks or
fails the DB write.
The non-minimal ubi9/python-312 image ships dnf, not microdnf
(microdnf is only in the -minimal runtime image).
UBI python images default to non-root uid 1001; dnf/useradd/pip setup
steps need explicit USER root. Runtime still ends as appuser (10001).
EPEL 9 has no softhsm2 package. Pull EL9 softhsm for Compose only, and
allow /usr/lib64 so python-pkcs11 can load libsofthsm2.so.
fix(secrets): bind crypto provider correctly on view-page save
Some checks are pending
CI / tox py + lint (pull_request) Waiting to run
Details
bd67689901 
encrypt_for_project() returns (ciphertext, provider). Splatting that into
the UPDATE bound provider as note and note as expires_at, so Postgres
rejected the timestamp and the edit form 500'd.

Add a unit test for the bind order and opt-in live tests that create,
edit, and delete a secret against a running app.
Some checks are pending
CI / tox py + lint (pull_request) Waiting to run
Details
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin feat/ubi-base:feat/ubi-base
git switch feat/ubi-base

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff feat/ubi-base
git switch feat/ubi-base
git rebase main
git switch main
git merge --ff-only feat/ubi-base
git switch feat/ubi-base
git rebase main
git switch main
git merge --no-ff feat/ubi-base
git switch main
git merge --squash feat/ubi-base
git switch main
git merge --ff-only feat/ubi-base
git switch main
git merge feat/ubi-base
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Sigaint/corvus!20
No description provided.