1
90%
main: 90%

Ran 07 Aug 2026 10:02PM UTC

Files 1019

Run time 22s

Badge

Embed ▾

Committed 07 Aug 2026 09:28PM UTC coverage: 89.655% (+0.02%) from 89.64%

Job # 31221755962.1

Build Type

push

github

Committed by

np5

Commit Message

mdm: ask for the security info when a rotation does not return the key

RotateFileVaultKey can return the new PRK encrypted with the reply
certificate, but RotateResult and EncryptedNewRecoveryKey are both optional in
Apple's schema, and the CMS payload can fail to decrypt. In those cases the
new key was only collected at the next inventory update, leaving Zentral with
a stale PRK - and a stale filevault_prk_updated_at, which is what the interval
rotation keys off - for as long as the inventory interval.

Fall back on the escrowed key when the acknowledged rotation did not give us
one: FDE_PersonalRecoveryKeyCMS in the security info response carries it. That
is what SetupFileVault already did for the first escrow, so both go through
SecurityInfo.create_for_prk_escrow now, which shares the delay and does not
queue a second command when one is already pending.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Coverage Stats

50170 of 55959 relevant lines covered (89.65%)

0.9 hits per line

zentralopensource / zentral / 31221755962 / 1
90%
main: 90%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 31221755962.1

zentralopensource / zentral / 31221755962 / 1 90% main: 90%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 31221755962.1

zentralopensource / zentral / 31221755962 / 1
90%
main: 90%

README BADGES
x