transit: warn when irreversible config flags cannot be disabled - #32075
Open
SashaMIT wants to merge 1 commit into
Open
transit: warn when irreversible config flags cannot be disabled#32075SashaMIT wants to merge 1 commit into
SashaMIT wants to merge 1 commit into
Conversation
keys/<name>/config documents that exportable and allow_plaintext_backup cannot be disabled once set, but a write that supplies false still returns success with no warning while leaving the flags enabled. An operator can believe they revoked export or plaintext backup when nothing changed. Emit warnings on ignored disable attempts, matching the existing config-write warning pattern for forced min-version adjustments.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
dosubot
Bot
added
the
size:S
|
Deployment failed for project vault-ui with the following error: Learn More: https://vercel.com/docs/concepts/projects/project-configuration |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
transit/keys/<name>/configdocuments thatexportableandallow_plaintext_backupcannot be disabled once set. The write handler already enforces that (it never clears the flags), but a client that POSTsfalsestill gets a successful response with no warning while the policy stays enabled.An operator can believe they revoked key export or plaintext backup when nothing changed. That is a silent failure on a security-relevant setting, in the same class as ignored
key_usageson this endpoint.Fix
Emit warnings when a disable attempt is ignored:
Behavior is unchanged: flags remain one-way. Only the response now surfaces the no-op.
Test plan
TestTransit_ConfigSettings,TestTransit_KeyUsagesInConfigResponse,TestTransit_UpdateKeyConfigWithAutorotationpassMade with Cursor