Alan-Jowett / sonde / 25838120792

81%

push

github

feat: ingest inline ELF from DESIRED_STATE with full Prevail verification (#904)

* fix(docker): update azure-cli image digest to valid 2.86.0 manifest

The previous digest (sha256:2b798554...) was a tag manifest digest
that doesn't resolve as a content-addressable image reference.
Replace with the correct manifest list digest (sha256:925b5871...)
obtained from the Docker-Content-Digest header for the
2.86.0-azurelinux3.0 tag.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* feat: ingest inline ELF from DESIRED_STATE with full Prevail verification

When the Azure handler detects program divergence during node
reconciliation, it now embeds the original ELF binary (not the CBOR
image) in the DESIRED_STATE message. The gateway extracts the ELF,
runs full Prevail verification via ProgramLibrary::ingest_elf(), and
stores the verified program locally before applying the desired state.

Azure handler changes:
- ProgramImageRow gains elf_image field; original ELF stored alongside
  CBOR in the programs Azure Table during ProgramIngest
- load_program_image returns full ProgramImageRow (not just CBOR bytes)
- encode_desired_state embeds ELF at key 5, verification_profile at
  key 6, source_filename at key 7, abi_version at key 8
- Legacy rows without elf_image cause a warning and omit key 5

Gateway connector changes:
- ConnectorService gains ProgramLibrary for ELF verification
- apply_node_desired_state extracts keys 5-8; if key 5 is present,
  runs ingest_elf() with the profile from key 6 (default Resident)
- Validates ingested program hash matches declared assigned_program_hash
  (key 1); rejects on mismatch
- Stores verified program via Storage::store_program() before the
  existing validate_program_exists check

Specification updates:
- gateway-companion-api.md: key 5 renamed to assigned_program_elf;
  keys 6-8 added for metadata
- gateway-design.md: new section 13A.2.1 inline E... (continued)

42 of 102 new or added lines in 2 files covered. (41.18%)

34276 of 41283 relevant lines covered (83.03%)

194.39 hits per line