Publish curated Unraid-AppOps-Gateway source from 451646fee806a47e3256731766980a05a262dcdd

backend/app/services/forge_bootstrap_preflight.py

@@ -14,6 +14,12 @@ from ..schemas.forge_bootstrap import ForgeBootstrapPreflightV1
 from .audit_logger import log_event
 from .deployment_broker import DeploymentBrokerClient
 from .enrollment_plane import EnrollmentPlane
+from .forge_bootstrap_apply import (
+    _FORGE_SOURCE_URL,
+    _protected_forge_private_package_owner,
+    canonical_preflight_receipt,
+    forge_oidc_attestation_matches,
+)
 from .policy_engine import evaluate_policy
 from .secret_store import get_secret, has_secret
 
@@ -71,6 +77,21 @@ _STATUS_DETAILS = {
         "blocked": "A configured required push validation context rejected this exact commit.",
         "unknown": "Exact-commit push validation is not configured or cannot be verified.",
     },
+    "image_registry": {
+        "passed": "The fixed private Forge image owner and both immutable image digests are authenticated and pullable.",
+        "blocked": "One or both immutable Forge image digests are unavailable from the registry.",
+        "unknown": "Registry publication or pull authorization could not be verified.",
+    },
+    "oidc": {
+        "passed": "The fixed Forge OIDC provider, application, and role groups are ready.",
+        "blocked": "The Forge OIDC proof is missing, mismatched, or differs from the protected AppOps mapping and signing-key IDs.",
+        "unknown": "The fixed Forge OIDC configuration could not be verified.",
+    },
+    "secret_delivery": {
+        "passed": "The fixed Forge secret files have the required safe metadata.",
+        "blocked": "One or more fixed Forge secret files are missing or unsafe.",
+        "unknown": "The fixed Forge secret-file metadata could not be verified.",
+    },
 }
 
 
@@ -114,10 +135,6 @@ def _checked_controller_result(
         raw = raw_checks.get(name)
         if not isinstance(raw, dict) or set(raw) != {"status"} or raw.get("status") not in {"passed", "blocked", "unknown"}:
             return None
-        # CI, registry access, OIDC and secret delivery are intentionally
-        # unknown until a configured, source-authenticated proof exists.
-        if name in {"image_registry", "oidc", "secret_delivery"} and raw["status"] != "unknown":
-            return None
         checks.append(_check(name, raw["status"]))
     statuses = [item["status"] for item in checks]
     expected_status = "preflight_blocked" if "blocked" in statuses else "preflight_unknown" if "unknown" in statuses else "preflight_ok"
@@ -126,7 +143,7 @@ def _checked_controller_result(
     raw_evidence = result.get("evidence", {})
     if not isinstance(raw_evidence, dict) or set(raw_evidence) - {
         "mainRevision", "sourceManifestSha256", "resourceCollisionCount",
-        "workspaceImagePresent", "frontdoorImagePresent",
+        "workspaceImagePresent", "frontdoorImagePresent", "attestations",
     }:
         return None
     evidence: dict[str, Any] = {}
@@ -148,6 +165,84 @@ def _checked_controller_result(
             if not isinstance(value, bool):
                 return None
             evidence[name] = value
+    attestations = raw_evidence.get("attestations")
+    oidc_rejected = False
+    validated_attestations: dict[str, dict[str, Any]] = {}
+    if attestations is not None:
+        if not isinstance(attestations, dict) or set(attestations) - {
+            "push_validation", "image_registry", "oidc", "secret_delivery",
+        }:
+            return None
+        push = attestations.get("push_validation")
+        if push is not None and (
+            not isinstance(push, dict)
+            or set(push) != {"context", "conclusion", "revision"}
+            or push.get("context") != "Managed validation / full (push)"
+            or push.get("conclusion") != "success"
+            or push.get("revision") != profile.revision
+        ):
+            return None
+        if push is not None:
+            validated_attestations["push_validation"] = dict(push)
+        registry = attestations.get("image_registry")
+        private_owner = _protected_forge_private_package_owner()
+        if registry is not None and (
+            not isinstance(registry, dict)
+            or private_owner is None
+            or registry.get("workspacePullable") is not True
+            or registry.get("frontdoorPullable") is not True
+            or registry != {
+                "owner": private_owner,
+                "ownerVisibility": "private",
+                "workspaceDigest": profile.workspace_image_digest,
+                "frontdoorDigest": profile.frontdoor_image_digest,
+                "workspacePullable": True,
+                "frontdoorPullable": True,
+                "workspaceSource": _FORGE_SOURCE_URL,
+                "workspaceRevision": profile.revision,
+                "frontdoorSource": _FORGE_SOURCE_URL,
+                "frontdoorRevision": profile.revision,
+            }
+        ):
+            return None
+        if registry is not None:
+            validated_attestations["image_registry"] = dict(registry)
+        oidc = attestations.get("oidc")
+        if oidc is not None:
+            if raw_checks["oidc"]["status"] != "passed":
+                return None
+            if forge_oidc_attestation_matches(oidc):
+                validated_attestations["oidc"] = dict(oidc)
+            else:
+                oidc_rejected = True
+        elif raw_checks["oidc"]["status"] == "passed":
+            oidc_rejected = True
+        secret_delivery = attestations.get("secret_delivery")
+        if secret_delivery is not None and (
+            not isinstance(secret_delivery, dict)
+            or set(secret_delivery) != {"requiredFilesReady", "metadataSha256"}
+            or secret_delivery.get("requiredFilesReady") is not True
+            or not isinstance(secret_delivery.get("metadataSha256"), str)
+            or not re.fullmatch(r"^[0-9a-f]{64}$", secret_delivery["metadataSha256"])
+        ):
+            return None
+        if secret_delivery is not None:
+            validated_attestations["secret_delivery"] = dict(secret_delivery)
+    if any(
+        raw_checks[name]["status"] == "passed" and
+        (not isinstance(attestations, dict) or name not in attestations)
+        for name in ("push_validation", "image_registry", "secret_delivery")
+    ):
+        return None
+    if raw_checks["oidc"]["status"] == "passed" and "oidc" not in validated_attestations:
+        oidc_rejected = True
+    if oidc_rejected:
+        for check in checks:
+            if check["name"] == "oidc":
+                check.update(_check("oidc", "blocked"))
+                break
+    if validated_attestations:
+        evidence["attestations"] = validated_attestations
     return checks, evidence
 
 
@@ -260,6 +355,7 @@ class ForgeBootstrapPreflightService:
             },
             evidence_json={
                 "profile": "forge-production-bootstrap",
+                "policyId": exact[0].id if policy_ready else None,
                 "workspaceImageDigest": profile.workspace_image_digest,
                 "frontdoorImageDigest": profile.frontdoor_image_digest,
                 "controller": controller_evidence,
@@ -302,6 +398,7 @@ class ForgeBootstrapPreflightService:
             "status": job.status,
             "stage": job.stage,
             "preflight": job.preflight_json,
+            "preflightSha256": canonical_preflight_receipt(job),
             "evidence": job.evidence_json,
             "result": job.result_summary,
             "brokerRequestId": job.broker_request_id,