shankar0123 0c1bccd2dc Bundle L (Coverage Audit Closure): StepCA failure-mode + JWE coverage + CI threshold raise #1 ...

L.B closes C-005; L.A defers C-003 (refactor required); L.C operator-required (testcontainers); L.CI raises CI thresholds for ACME / StepCA / MCP.

L.B — StepCA (~580 LoC stepca/jwe_failure_test.go):

  Strategy: hermetic test-side RFC 3394 AES Key Wrap implementation

  constructs a valid step-ca PBES2-HS256+A128KW + A128GCM provisioner-

  key JWE in-test, exercises the full decrypt pipeline end-to-end.

  Coverage:    52.1% -> 90.4% (+38.3pp; +5.4 above 85% target)

    decryptProvisionerKey:  0%   -> 89.7%

    aesKeyUnwrap:           0%   -> 100.0%

    jwkToECDSA:             0%   -> 100.0%

    loadProvisionerKey:     0%   -> 76.9%

  Tests (24 functions):

    JWE round-trip pinning all 4 0%-covered helpers

    decryptProvisionerKey: 10 negative-path cases (malformed JSON,

      bad protected b64, malformed header JSON, unsupported alg,

      unsupported enc, bad p2s/encrypted_key/IV/ciphertext/tag b64)

    Wrong-password path: AES key unwrap integrity check fail

    aesKeyUnwrap: too-short, not-mult-of-8, bad-KEK-size, bad-IV

    jwkToECDSA: unsupported curve + bad x/y/d b64 + all-curves

    loadProvisionerKey: round-trip + file-not-found

    IssueCertificate failure modes (network/5xx/401/403)

    RevokeCertificate failure modes (network/5xx/403)

L.A — cmd/server (DEFERRED):

  cmd/server's 16.1% baseline is dominated by main()'s 1041-LoC

  startup body which is 0%-covered. The other named functions

  (preflight* + buildFinalHandler + tls.go) are at 85-100% already.

  Lifting overall to >=75% requires a production-code refactor

  (extract main() into testable Run(*Config)) that exceeds Bundle

  L.A's test-only scope. Tracked as 'Bundle L.A-extended'.

L.C — Repository (OPERATOR-REQUIRED):

  testcontainers + Docker not available in sandbox. Operator runs

  go test -tags integration ./internal/repository/postgres/...

  on a workstation with Docker.

L.CI — CI threshold raise #1 (.github/workflows/ci.yml):

  ACME issuer:    >=50% (Bundle J floor; bumps to 85 with Pebble-mock)

  StepCA issuer:  >=80% (Bundle L.B floor with 10pp margin from 90.4)

  MCP:            >=85% (Bundle K floor with 8pp margin from 93.1)

  cmd/server raise deferred until Bundle L.A-extended lands.

  YAML validated; each gate fails CI with 'add tests, do not lower

  the gate' message matching L-010's pattern.

Verification:

  go vet ./internal/connector/issuer/stepca/...    clean

  gofmt -l                                          clean

  staticcheck -checks all                           clean

  go test -short ./internal/connector/issuer/stepca/   PASS, 90.4%

  go test -race -count=1                            PASS, 0 races

  python3 -c 'yaml.safe_load(...)'                   YAML OK

Audit deliverables:

  findings.yaml: C-005 status open -> closed; C-003 open -> deferred

  gap-backlog.md: closure log + C-005 strikethrough + C-003/C-004 notes

  coverage-matrix.md: stepca row at 90.4%

  closure-plan.md: Bundle L [~] with per-sub-bundle status

  CHANGELOG.md: [unreleased] Bundle L entry

2026-04-27 17:02:40 +00:00

..

ci.yml

Bundle L (Coverage Audit Closure): StepCA failure-mode + JWE coverage + CI threshold raise #1

2026-04-27 17:02:40 +00:00

release.yml

Bundle D: Documentation & transparency sweep — 8 findings closed

2026-04-27 00:47:15 +00:00

security-deep-scan.yml

Bundle G: Final audit closure — L-004 + D-003/4/5/7 closed; 54/55 + 7/7

2026-04-27 02:27:44 +00:00