feat/ubi-base #20

Merged

mhahl merged 14 commits from feat/ubi-base into main 2026-08-24 23:49:17 +00:00

Conversation 0 Commits 14 Files changed 23 +666 -45

mhahl commented 2026-08-23 13:30:09 +00:00

Owner

Copy link

No description provided.

mhahl added 14 commits 2026-08-23 13:30:09 +00:00

feat(build): switch app image to Red Hat UBI9; SoftHSM2 dev-only ... ceb61246fa

- Multi-stage UBI build: wheels compiled in ubi9/python-312, runtime on
  ubi9/python-312-minimal with no compiler or package toolchain.
- Prod image no longer ships softhsm2/opensc (EPEL-only, dev stand-in
  for real HSMs). New 'dev' target layers EPEL + SoftHSM2 for the local
  Compose HSM flow; compose.yml now builds that target.
- uid 10001 'appuser' kept so K8s securityContexts and Compose tmpfs
  mounts stay unchanged.
- libsofthsm2.so path moves /usr/lib -> /usr/lib64 on EL: seed_mock and
  HSM docs updated.

Merge branch 'main' into feat/ubi-base 3c0ab4570d

feat(audit): mirror audit events to stdout as JSON lines ... b96aeef132

log_secret/log_org now emit one machine-parseable JSON record per audit
row on the 'corvus.audit' logger (stdout handler attached in create_app,
isolated from gunicorn prefixes). Container log shippers — rsyslog
imfile/journald, Splunk forwarder/HEC — can relay these to a SIEM.

Fields: ts (ISO-8601 UTC), event=secret_audit|org_audit, action, actor,
project_id/team_id/secret_id, secret_key (name only; values are never
logged), detail. Console emission is best-effort and never blocks or
fails the DB write.

feat(ui): use favicon.svg as the app favicon e80c0fb784

add favicon cc7a02c0b1

fix(build): use dnf in UBI python-312 builder stage ... 9aa2c55252

The non-minimal ubi9/python-312 image ships dnf, not microdnf
(microdnf is only in the -minimal runtime image).

fix(build): run UBI stage setup as root ... 456770638a

UBI python images default to non-root uid 1001; dnf/useradd/pip setup
steps need explicit USER root. Runtime still ends as appuser (10001).

docs: fix broken relative link in building.md 3f16d6acd3

fix(build): install SoftHSM from AlmaLinux AppStream on the UBI dev image ... c49acb5b61

EPEL 9 has no softhsm2 package. Pull EL9 softhsm for Compose only, and
allow /usr/lib64 so python-pkcs11 can load libsofthsm2.so.

Merge branch 'feat/ubi-base' of https://git.sigaint.au/Sigaint/corvus into feat/ubi-base 2ccc37ef39

fix(ui): style secret value copy button f1582752f3

fix(ui): disable reveal for unauthorized viewers 7ac72b2870

Modernize secret reveal-denied page as empty state be7c8f009d

fix(secrets): bind crypto provider correctly on view-page save ... bd67689901

encrypt_for_project() returns (ciphertext, provider). Splatting that into
the UPDATE bound provider as note and note as expires_at, so Postgres
rejected the timestamp and the edit form 500'd.

Add a unit test for the bind order and opt-in live tests that create,
edit, and delete a secret against a running app.

mhahl merged commit 0a289085d5 into main 2026-08-24 23:49:17 +00:00

mhahl referenced this pull request from a commit 2026-08-24 23:49:19 +00:00

Merge pull request 'feat/ubi-base' (#20) from feat/ubi-base into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Sigaint/corvus!20

No description provided.