Advertise agent capabilities in stemcell metadata by Alphasite · Pull Request #761 · cloudfoundry/bosh-linux-stemcell-builder

Alphasite · 2026-10-06T23:26:15Z

Why

bosh-cli needs to know whether a stemcell's agent accepts mbus password verifiers before it writes one into VM metadata instead of the plaintext password.

What

stemcell.MF now always includes agent_features. It is [] for now.
Add http-password-hmac-sha256 in a follow-up PR after the automated agent pin includes Harden HTTPS agent metadata with password verifiers bosh-agent#487.
Advertise the feature only after the pinned agent supports it. Until then, create-env keeps its existing plaintext behavior.

Tests

$ cd bosh-stemcell && bundle exec rspec spec/bosh/stemcell/stemcell_packager_spec.rb
12 examples, 0 failures
$ bundle exec standardrb bosh-stemcell/lib/bosh/stemcell/stemcell_packager.rb bosh-stemcell/spec/bosh/stemcell/stemcell_packager_spec.rb
(no output, exit 0)

Walkthrough

StemcellPackager#manifest now adds an empty agent_features array to the generated manifest. The spec checks that the array is present in the working manifest and preserved in the archived stemcell.MF.

Suggested reviewers: selzoc

Priority: ⬇️ Low

Merge Risk

Merge Risk: ⚪ Minimal · up to aa622

The stemcell manifest now includes an empty capability list, so it does not advertise the deferred hashed-password capability. No concrete merge-blocking risk is established; the change is ready for normal checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to aa622

The new field is always empty, so it does not advertise password-verifier support or introduce a configurable capability. Packaging behavior remains unchanged. Risk is limited, but the downstream consumer's treatment of an empty list versus an absent field has not been verified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

inferred — The direct exposure is the generated stemcell metadata and its consumers. The inspected producer change adds no new configurable input, command execution path, or privilege transition. Security effects in the external credential-selection consumer remain unverified.

Trust Boundaries and Controls

observed — The inspected local Archive reader loads the manifest as metadata and accesses existing identity and cloud-property fields. It contains no agent_features capability gate and does not reject the added key. This does not establish the behavior of external consumers.

Resilience and Maintainability Implications

inferred — The field adds no lifecycle operation, recovery branch, or synchronization requirement. Manifest writing and tarball creation remain nontransactional operations on caller-selected paths. Their interruption and concurrent-use limitations predate this PR; the empty field introduces no affirmative capability claim that could become mismatched with the image.

Hardening Proposals

proposed — Before advertising a nonempty capability list, verify that downstream consumers require exact feature membership rather than field presence, preserve conservative behavior for absent and empty lists, and select verifiers only for a supporting bundled agent.

Pre-merge checks | 4 | 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check		The title clearly summarizes the main change: adding agent capability information to stemcell metadata.
Description check		The description explains the motivation, implementation, follow-up plan, related work, and test results. It does not explicitly confirm the merge-forward branch strategy or AI review feedback status, …
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Alphasite · 2026-10-08T22:19:12Z

Codex agent here. Fixed the Standard Ruby failure caused by the extra blank line after inlining the feature list (1f1a44f).

bosh-cli needs to know whether a stemcell's agent accepts salted HMAC-SHA256 mbus password verifiers before it puts one, rather than the plaintext password, into VM metadata. Advertise agent capabilities in stemcell.MF as an agent_features list. The list stays empty until a separate PR bumps to a bosh-agent release that supports verifiers and adds "http-password-hmac-sha256" in the same change. Listing the feature with an older agent would make create-env fail with a 401. ai-assisted=yes TNZ-129825 Co-Authored-By: Chris Selzo <chris.selzo@broadcom.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Alphasite · 2026-10-09T18:33:12Z

          "sha1" => image_checksum,
          "operating_system" => "#{definition.operating_system.name}-#{definition.operating_system.version}",
          "stemcell_formats" => infrastructure.stemcell_formats,
+          "agent_features" => [],


should this pr also add the hashed-password capability or do we split that into its own pr?

Oh i see:

http-password-hmac-sha256 will be added in the same PR that bumps stemcell_builder/stages/bosh_go_agent/assets/bosh-agent-version to a release that includes cloudfoundry/bosh-agent#487.

im guessing it wont literally be in the same pr? since that bump is automated, there will be a follow up which adds this?

Codex agent here. A follow-up capability PR after the automated supporting-agent bump is safe. Until activation, create-env keeps using plaintext. The feature must be advertised only once the pinned agent supports it. Updated the PR wording to describe that sequence.

Alphasite · 2026-10-09T18:34:59Z

Cant literally approve since this is my pr, but i think your rehash of it is good. I'd just like to see a reply to my comment

Alphasite · 2026-10-09T18:37:52Z

Codex agent here. Yes, a follow-up capability PR after the automated supporting-agent bump is safe. Until activation, create-env keeps using plaintext. The capability must be advertised only once the pinned agent supports it. Updated the PR wording to describe that sequence.

a-hassanin

LGTM

This was referenced Oct 6, 2026

Harden HTTPS agent metadata with password verifiers cloudfoundry/bosh-agent#487

Open

Harden create-env agent passwords in cloud metadata cloudfoundry/bosh-cli#742

Draft

cf-foundation-community-automation Bot added this to Foundational Infrastructure Working Group Oct 7, 2026

Alphasite changed the title ~~Advertise agent password-verifier support in stemcell metadata~~ Expose general stemcell features in metadata Oct 8, 2026

Alphasite force-pushed the tnz-129825-advertise-agent-password-verifiers branch from 0b271b3 to 3ede7d1 Compare October 8, 2026 18:51