Probe: lifecycle timing bounds 600s/300s (audit G12) #56

New issue

Open

opened 2026-09-20 03:48:34 +00:00 by larandar · 0 comments

larandar commented

2026-09-20 03:48:34 +00:00

Owner

Probe paths: openbao-plugin/src/lease.rs, openbao-plugin/src/backend.rs, and openbao-plugin/src/issue.rs.

Result schema: renewal timestamp; predecessor acceptance or rejection; exact invalidation time compared with the 600s and 300s bounds.

Evidence: audit 2026-09-19/20 G12 and S7-F4.

The ratified contract requires renewal no later than 10 minutes before expiry and predecessor overlap no greater than 5 minutes, but the plugin stores displaced predecessors valid until explicit invalidation with no renewBefore, scheduler, or capture-double proving the bounds. Probe paths: openbao-plugin/src/lease.rs, openbao-plugin/src/backend.rs, and openbao-plugin/src/issue.rs. Result schema: renewal timestamp; predecessor acceptance or rejection; exact invalidation time compared with the 600s and 300s bounds. Evidence: audit 2026-09-19/20 G12 and S7-F4.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Ting/Vedanta#56

No description provided.

Rows
Columns