zentralopensource / zentral / 31221755962

90%

Build Type

push

github

Committed by np5

Commit Message

mdm: ask for the security info when a rotation does not return the key

RotateFileVaultKey can return the new PRK encrypted with the reply
certificate, but RotateResult and EncryptedNewRecoveryKey are both optional in
Apple's schema, and the CMS payload can fail to decrypt. In those cases the
new key was only collected at the next inventory update, leaving Zentral with
a stale PRK - and a stale filevault_prk_updated_at, which is what the interval
rotation keys off - for as long as the inventory interval.

Fall back on the escrowed key when the acknowledged rotation did not give us
one: FDE_PersonalRecoveryKeyCMS in the security info response carries it. That
is what SetupFileVault already did for the first escrow, so both go through
SecurityInfo.create_for_prk_escrow now, which shares the delay and does not
queue a second command when one is already pending.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Coverage Stats

15 of 15 new or added lines in 3 files covered. (100.0%)

56 existing lines in 7 files now uncovered.

50170 of 55959 relevant lines covered (89.65%)

0.9 hits per line