Joseph Doherty
ac4c4d40dc
v2-ci / unit-tests (push) Has been cancelled
Adds scripts/validation/opcua-windows-service/: a phased PowerShell gate (Invoke-ServiceGate.ps1) that installs the known-good build as the real OtOpcUaHost service via Install-Services.ps1, seeds LocalDb through the production cache API (Seeder, built against the baseline tree), upgrades in place with config/PKI/LocalDb carried with their ACLs, starts/stops through the SCM, runs a strict SDK 2 probe matrix (Sign + SignAndEncrypt, valid/wrong/unknown/disabled/anonymous keys, untrusted client and server), exercises the ScriptWorker isolation, rolls back and cleans up. windev 2026-11-12 (efb9197a->438484fd->efb9197a): app cert CEF9D91F... reused byte-for-byte with identical PKI SDDL on every start, all gating checks pass, 0 secrets in logs. Findings filed: #879 (None endpoint cannot be dropped), #880 (SDK 2 client 65-char key vs SDK 1.5 server: rollback/QA risk), #883 (Install-ScriptWorkerIsolation.ps1 fails on pwsh 7 and 5.1; runtime isolation proven with the patch in the evidence directory). Claude-Session: https://claude.ai/code/session_01GT67ACmpMR7b9LGRPLijMi
212 lines
12 KiB
JSON
212 lines
12 KiB
JSON
{
|
|
"label": "b2reboot",
|
|
"observedOnly": true,
|
|
"osBootUtc": "2026-11-12T15:04:11.5000000Z",
|
|
"processStartUtc": "2026-11-12T15:04:50.3472397Z",
|
|
"service": {
|
|
"name": "OtOpcUaHost",
|
|
"state": "Running",
|
|
"startMode": "Auto",
|
|
"pathName": "\"C:\\OtOpcUa800\\OtOpcUa\\OtOpcUa.Host.exe\"",
|
|
"startName": "NT SERVICE\\OtOpcUaHost",
|
|
"processId": 6608,
|
|
"exitCode": 0,
|
|
"serviceSpecificExitCode": 0,
|
|
"envNames": [
|
|
"ASPNETCORE_URLS",
|
|
"Cluster__Hostname",
|
|
"Cluster__Port",
|
|
"Cluster__PublicHostname",
|
|
"Cluster__Roles__0",
|
|
"Cluster__SeedNodes__0",
|
|
"Cluster__SystemName",
|
|
"ConfigSource__ApiKey",
|
|
"ConfigSource__CentralFetchEndpoints__0",
|
|
"ConfigSource__FetchTimeoutSeconds",
|
|
"ConfigSource__Mode",
|
|
"DOTNET_ENVIRONMENT",
|
|
"OpcUa__AllowAnonymous",
|
|
"OpcUa__ApplicationName",
|
|
"OpcUa__ApplicationUri",
|
|
"OpcUa__AutoAcceptUntrustedClientCertificates",
|
|
"OpcUa__EnabledSecurityProfiles__0",
|
|
"OpcUa__EnabledSecurityProfiles__1",
|
|
"OpcUa__OpcUaPort",
|
|
"OpcUa__PublicHostname",
|
|
"OTOPCUA_ROLES",
|
|
"Secrets__SqlitePath",
|
|
"Security__Acl__Enabled",
|
|
"Security__ApiKeys__Pepper",
|
|
"Security__Ldap__Enabled",
|
|
"ZB_SECRETS_MASTER_KEY"
|
|
],
|
|
"envDigest": "fd534f8ddd55fa0502a7242efdf95a59dbcadb793620afe563117b1d5b9fe32c",
|
|
"exe": {
|
|
"path": "C:\\OtOpcUa800\\OtOpcUa\\OtOpcUa.Host.exe",
|
|
"sha256": "F9A193C6C7D224006094E26CE4CD1616961BCB9048FF38A468786618A26E3A91",
|
|
"productVersion": "1.0.0+efb9197a0f48802450474413c58b9d0c461b836d"
|
|
},
|
|
"opcUaCore": "1.5.378.182"
|
|
},
|
|
"health": [
|
|
{
|
|
"path": "/health/ready",
|
|
"status": 200,
|
|
"body": "{\"status\":\"Healthy\",\"totalDurationMs\":25.365,\"entries\":{\"opcua-endpoint\":{\"status\":\"Healthy\",\"description\":\"OPC UA endpoint is listening\",\"durationMs\":5.3026,\"data\":{\"status\":\"Started\"}},\"script-runner\":{\"status\":\"Healthy\",\"description\":\"Scripts run in process (Scripting:Runner=InProcess).\",\"durationMs\":5.4619},\"akka\":{\"status\":\"Healthy\",\"description\":\"Akka cluster member status: Up\",\"durationMs\":7.9438,\"data\":{\"selfAddress\":\"akka.tcp://otopcua@127.0.0.1:18801\",\"selfRoles\":[\"driver\"],\"memberCount\":1,\"unreachableCount\":0,\"leader\":\"akka.tcp://otopcua@127.0.0.1:18801\"}}}}"
|
|
},
|
|
{
|
|
"path": "/healthz",
|
|
"status": 200,
|
|
"body": "Healthy"
|
|
},
|
|
{
|
|
"path": "/health/active",
|
|
"status": 200,
|
|
"body": "{\"status\":\"Healthy\",\"totalDurationMs\":7.3351,\"entries\":{\"opcua-endpoint\":{\"status\":\"Healthy\",\"description\":\"OPC UA endpoint is listening\",\"durationMs\":0.1093,\"data\":{\"status\":\"Started\"}},\"akka\":{\"status\":\"Healthy\",\"description\":\"Akka cluster member status: Up\",\"durationMs\":0.1924,\"data\":{\"selfAddress\":\"akka.tcp://otopcua@127.0.0.1:18801\",\"selfRoles\":[\"driver\"],\"memberCount\":1,\"unreachableCount\":0,\"leader\":\"akka.tcp://otopcua@127.0.0.1:18801\"}},\"cluster-primary\":{\"status\":\"Healthy\",\"description\":\"Active node for role \\u0027driver\\u0027 (oldest Up member).\",\"durationMs\":3.9423,\"data\":{\"selfAddress\":\"akka.tcp://otopcua@127.0.0.1:18801\",\"activeRole\":\"driver\",\"activeNode\":\"akka.tcp://otopcua@127.0.0.1:18801\"}},\"localdb-replication\":{\"status\":\"Healthy\",\"description\":\"LocalDb replication is not configured on this node (default-OFF).\",\"durationMs\":4.3108}}}"
|
|
}
|
|
],
|
|
"snapshot": {
|
|
"certs": [
|
|
{
|
|
"file": "OtOpcUaGate800 [CEF9D91F8CBC0EE78B317D3AA51EB40CD9C41ACA].der",
|
|
"sha256": "F38E6B2EC17CB6F5A67F9F1BC56BF3AF522650D7F5A6E0F2C8D0B10BE1E3F845",
|
|
"thumbprint": "CEF9D91F8CBC0EE78B317D3AA51EB40CD9C41ACA",
|
|
"subject": "CN=OtOpcUaGate800, O=OPC Foundation",
|
|
"notBefore": "2026-11-11T00:00:00.0000000Z",
|
|
"notAfter": "2027-11-11T00:00:00.0000000Z",
|
|
"keySize": 2048
|
|
}
|
|
],
|
|
"pki": [
|
|
{
|
|
"path": "pki\\own",
|
|
"dir": true,
|
|
"sha256": null,
|
|
"sddl": "O:S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059G:S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059D:AI(A;OICIID;0x1301bf;;;S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)"
|
|
},
|
|
{
|
|
"path": "pki\\own\\certs",
|
|
"dir": true,
|
|
"sha256": null,
|
|
"sddl": "O:S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059G:S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059D:AI(A;OICIID;0x1301bf;;;S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)"
|
|
},
|
|
{
|
|
"path": "pki\\own\\certs\\OtOpcUaGate800 [CEF9D91F8CBC0EE78B317D3AA51EB40CD9C41ACA].der",
|
|
"dir": false,
|
|
"sha256": "F38E6B2EC17CB6F5A67F9F1BC56BF3AF522650D7F5A6E0F2C8D0B10BE1E3F845",
|
|
"sddl": "O:S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059G:S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059D:AI(A;ID;0x1301bf;;;S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059)(A;ID;FA;;;SY)(A;ID;FA;;;BA)"
|
|
},
|
|
{
|
|
"path": "pki\\own\\private",
|
|
"dir": true,
|
|
"sha256": null,
|
|
"sddl": "O:S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059G:S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059D:AI(A;OICIID;0x1301bf;;;S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)"
|
|
},
|
|
{
|
|
"path": "pki\\own\\private\\OtOpcUaGate800 [CEF9D91F8CBC0EE78B317D3AA51EB40CD9C41ACA].pfx",
|
|
"dir": false,
|
|
"sha256": "D0130A14E33ACF4F7EF0859790ACA7CBF4EBDE1ECB90163B6C528E89FF53B07D",
|
|
"sddl": "O:S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059G:S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059D:AI(A;ID;0x1301bf;;;S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059)(A;ID;FA;;;SY)(A;ID;FA;;;BA)"
|
|
},
|
|
{
|
|
"path": "pki\\rejected",
|
|
"dir": true,
|
|
"sha256": null,
|
|
"sddl": "O:S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059G:S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059D:AI(A;OICIID;0x1301bf;;;S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)"
|
|
},
|
|
{
|
|
"path": "pki\\rejected\\certs",
|
|
"dir": true,
|
|
"sha256": null,
|
|
"sddl": "O:S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059G:S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059D:AI(A;OICIID;0x1301bf;;;S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)"
|
|
},
|
|
{
|
|
"path": "pki\\rejected\\certs\\Gate800Client [C91ACD459294599052131D438FE9C4F4128637F5].der",
|
|
"dir": false,
|
|
"sha256": "7964A941068908D23C1875F2F4E2CBA91510915B5BCDF563614E5B6E314F54B9",
|
|
"sddl": "O:S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059G:S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059D:AI(A;ID;0x1301bf;;;S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059)(A;ID;FA;;;SY)(A;ID;FA;;;BA)"
|
|
},
|
|
{
|
|
"path": "pki\\trusted",
|
|
"dir": true,
|
|
"sha256": null,
|
|
"sddl": "O:S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059G:S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059D:AI(A;OICIID;0x1301bf;;;S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)"
|
|
},
|
|
{
|
|
"path": "pki\\trusted\\certs",
|
|
"dir": true,
|
|
"sha256": null,
|
|
"sddl": "O:S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059G:S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059D:AI(A;OICIID;0x1301bf;;;S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)"
|
|
},
|
|
{
|
|
"path": "pki\\trusted\\certs\\Gate800Client [7F8DAF694729411881528567DA4CAB8EB2C7BFFC].der",
|
|
"dir": false,
|
|
"sha256": "CB8C21F6006FBAE742A0AC7F110BA28B05C1C22897C0EE3E920B711EC6CE4BCE",
|
|
"sddl": "O:BAG:S-1-5-21-3358580898-976645380-93926719-513D:AI(A;ID;0x1301bf;;;S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059)(A;ID;FA;;;SY)(A;ID;FA;;;BA)"
|
|
},
|
|
{
|
|
"path": "pki\\trusted\\certs\\OtOpcUaClient [F93FDAF3671D24914535075DC23E90C76B60BAE6].der",
|
|
"dir": false,
|
|
"sha256": "901F62E2649C3BF57B4998E230DECD5F85ED38F1003B54E9CDDE823256C90671",
|
|
"sddl": "O:BAG:S-1-5-21-3358580898-976645380-93926719-513D:AI(A;ID;0x1301bf;;;S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059)(A;ID;FA;;;SY)(A;ID;FA;;;BA)"
|
|
},
|
|
{
|
|
"path": "pki\\trusted\\certs\\OtOpcUaGate800 [CEF9D91F8CBC0EE78B317D3AA51EB40CD9C41ACA].der",
|
|
"dir": false,
|
|
"sha256": "F38E6B2EC17CB6F5A67F9F1BC56BF3AF522650D7F5A6E0F2C8D0B10BE1E3F845",
|
|
"sddl": "O:S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059G:S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059D:AI(A;ID;0x1301bf;;;S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059)(A;ID;FA;;;SY)(A;ID;FA;;;BA)"
|
|
}
|
|
],
|
|
"data": [
|
|
{
|
|
"path": "data\\otopcua-localdb.db",
|
|
"dir": false,
|
|
"length": 90112,
|
|
"sddl": "O:S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059G:S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059D:AI(A;ID;0x1301bf;;;S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059)(A;ID;FA;;;SY)(A;ID;FA;;;BA)"
|
|
},
|
|
{
|
|
"path": "data\\otopcua-localdb.db-shm",
|
|
"dir": false,
|
|
"length": 32768,
|
|
"sddl": "O:S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059G:S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059D:AI(A;ID;0x1301bf;;;S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059)(A;ID;FA;;;SY)(A;ID;FA;;;BA)"
|
|
},
|
|
{
|
|
"path": "data\\otopcua-localdb.db-wal",
|
|
"dir": false,
|
|
"length": 0,
|
|
"sddl": "O:S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059G:S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059D:AI(A;ID;0x1301bf;;;S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059)(A;ID;FA;;;SY)(A;ID;FA;;;BA)"
|
|
}
|
|
],
|
|
"roots": {
|
|
"install": "O:BAG:S-1-5-21-3358580898-976645380-93926719-513D:AI(A;OICI;0x1200a9;;;S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)",
|
|
"appsettings": [
|
|
{
|
|
"file": "appsettings.admin-driver.json",
|
|
"sha256": "ECA047204CF6A9B4D89628D7EE2048BC68D46DB55DCB4AE9BCF24DBE9E44CD46",
|
|
"sddl": "O:BAG:S-1-5-21-3358580898-976645380-93926719-513D:AI(A;ID;0x1200a9;;;S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059)(A;ID;FA;;;SY)(A;ID;FA;;;BA)"
|
|
},
|
|
{
|
|
"file": "appsettings.admin.json",
|
|
"sha256": "BB08F16D701697FCD70695B75D81A4B09BCE57DAAA95D6FD81FF469258AD3530",
|
|
"sddl": "O:BAG:S-1-5-21-3358580898-976645380-93926719-513D:AI(A;ID;0x1200a9;;;S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059)(A;ID;FA;;;SY)(A;ID;FA;;;BA)"
|
|
},
|
|
{
|
|
"file": "appsettings.Development.json",
|
|
"sha256": "169A54D22027E13823AF0D41C1314A6D3E44852041C8B35AA80478A88399FE1B",
|
|
"sddl": "O:BAG:S-1-5-21-3358580898-976645380-93926719-513D:AI(A;ID;0x1200a9;;;S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059)(A;ID;FA;;;SY)(A;ID;FA;;;BA)"
|
|
},
|
|
{
|
|
"file": "appsettings.driver.json",
|
|
"sha256": "A7DC1AB1DB2E93F1A6E78B7B1B425720C3C610CB406E6266F0DBE2EBE01BADAF",
|
|
"sddl": "O:BAG:S-1-5-21-3358580898-976645380-93926719-513D:AI(A;ID;0x1200a9;;;S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059)(A;ID;FA;;;SY)(A;ID;FA;;;BA)"
|
|
},
|
|
{
|
|
"file": "appsettings.json",
|
|
"sha256": "89F72ACADED7F2D3CA434F2D922FE4DACCDC03AA342F3973D35A160BE9221B2A",
|
|
"sddl": "O:BAG:S-1-5-21-3358580898-976645380-93926719-513D:AI(A;ID;0x1200a9;;;S-1-5-80-3928861625-3486739760-3962757976-1980707066-3667558059)(A;ID;FA;;;SY)(A;ID;FA;;;BA)"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
}
|