chore(ops): secure release builds and automate restore, rotation and deployment evidence #52
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Scope and source
Priority: P1. Gap coverage: GAP-052, GAP-053. Derived from GAP_1791945837.md, reviewed code commit
f8dbe93df953a78b17cb3304b717dcf84c4cd517. Currente476a68da09645c2308cbf47b90211fcaffcb7afadds only the report, so implementation findings remain applicable. Report evidence is local reproduction/source inspection unless explicitly proposed; no production exploit or current live-readiness claim.Coverage and sequencing: gap backlog tracker. Workstream 17. Dependencies: 03, 04, 06, 07, 09, 14, 16.
Current codebase
Frontend Docker build accepts registry token ARG and writes .npmrc in a builder layer; final image excludes it but cache access can leak it. Images use mutable tags, Rust build omits --locked, and no SBOM/provenance/scanning job exists. OPS has manual recovery/rotation and duplicated Coolify/nginx policy with no automated restore/schema/grant drill or deployed commit identity. Historical live QA is not current proof.
Why this implementation is needed
Supply-chain credentials, recoverability and actual deployed configuration need reproducible evidence, especially after accounting recovery and lifecycle migrations.
Relevant files
deploy/docker/frontend.Dockerfiledeploy/docker/ledger.Dockerfiledeploy/docker/operator-voting.Dockerfiledeploy/docker/frontend.security-headers.confdeploy/docker/frontend.nginx.confdeploy/coolify-frontend.nginx.confdeploy/grants.sqldeploy/coolify.env.exampledocs/OPS.mddocs/HANDOFF.md.gitlab-ci.yml.woodpecker.yamlRecommended solution
Use BuildKit ephemeral secret mounts for private npm auth, with token-free checked-in config and no persistent secret file/layer. Pin reviewed base image digests, locked dependencies and emit/verify SBOM/provenance with image scans. Automate isolated backup/restore drills, schema/grant version verification, role/committee rotation and deployment/rollback receipts. Document backup ownership, measured RPO/RTO and accounting continuity/reorg recovery using 03. Generate nginx policy from one source or test equivalence including headers/fallback/CSP. Expose safe build commit/version in health/UI and capture dated deployed header/CORS/freshness and dual-chain real-wallet Legal/registration/voting/WC evidence; agent/machine verification owns these tasks.
Constraints and guardrails
Preserve standalone offchain advisory voting, no new smart contracts or archive-node dependency, BSC as a core electorate, raw 18-decimal integer balances and separate Terra/BSC address identities. Keep Legal fail-closed transactional UI and the proven DEX Terra/Bridge EVM connectors; no browser BSC balance RPC, seed/key prompt or embedded admin/model credential. API must retain a restricted role separate from the ledger writer. Freeze at actual opening, never at draft creation or a client-supplied height. Agents own design, implementation, review and evidence under repository guidance; do not shift approvals/tests to the human or invent PASS evidence.
Acceptance criteria
Synthetic registry secret is absent from final image, every layer/history/cache/export/artifact and logs. Locked pinned builds reproduce expected inputs and have scan/provenance artifacts. Restore reconstructs data/schema/grants and preserves receipts/frozen votes under documented recovery rules. Rotation preserves least privilege and revokes old access. Docker/Coolify policies agree; deployed version and QA evidence identify the release commit.
Test plan: supported paths, failure paths and concurrency
Private registry secret present/missing/invalid, successful/failed build and cache reuse/export; fresh/upgrade release and digest/lock mismatch. Empty/populated restore, corrupt/missing backup, migration/grant mismatch, interruption and rollback; role/committee rotation with scheduled approvals awaiting execution. Compare both nginx configs, SPA/Legal aliases, production wallet/CSP/API CORS and both-chain readiness. Run real-wallet staging matrix independently of mocks.
Test plan: attack, hack and abuse vectors
Builder-layer/cache/history/CI log credential extraction, poisoned base image or dependency cache, tampered SBOM/provenance, unsafe restore target and overprivileged restored roles. Stale deployment mistaken for fix, CSP bypass, revoked committee approval reuse and fabricated health. Drills use isolated data and sentinel secrets; no production destructive test.
Verification and completion criteria
Attach sentinel scans of build/cache paths, SBOM/provenance/scan results, measured restore RPO/RTO and grant/rotation/rollback receipts. Include deployed commit IDs and dated Terra/BSC/Legal/WC evidence; code merge alone cannot close operational acceptance.
Record commit and pinned toolchain, commands/results and sanitized artifacts. Relevant Rust changes require
cargo test --workspace --libplus isolated Postgres integration (explicit guarded LEDGER_TEST_DATABASE_URL); frontend changes requirenpm testand production build plus relevant browser cases. Run secret scanning for new fixtures/config. Exercise fresh/upgrade migrations when schema/grants change; report skipped/live-only checks explicitly.