Repository navigation
Conversation
…ry phase; srv13 plan OpenBMC 03.22.00 on the ASRock ALTRAD8UD-1L2T answers every request made with the published credential with HTTP 403 and the DMTF Base registry message PasswordChangeRequired, admitting only a PATCH of the account's Password (a wrong password is 401). gunbc.tools.bmc_onboard read that 403 as a failed factory login: the probe fell through to "custody holds no stored credential" (CredentialStateUnknown) and the acquire step stopped, so a freshly flashed BMC could not be onboarded although the rotation it demands is the one bmc_rotate_credential performs. extdeps.bmc.redfish redfish_password_change_verdict reads @Message.ExtendedInfo[].MessageId (top level, as bmcweb sends it, or inside the standard error object) for a Base.*.PasswordChangeRequired id; factory_login_accepted admits the published credential on success or on that verdict, and both the probe and the acquire step use it. srv13 (operator naming, carried here from #13552): HostIdentity and hostname rows, srv13_baseboard (board and BMC endpoint as first contact observed them), srv13_onboarding_plan, and srv13_converge_credential through the token-source selection. Run 2026-10-08: factory 403 -> secret bmc-srv13-admin created, version 1 stored and read back -> PATCH -> re-auth 200; factory now 401. Witness: redfish_password_change 2/2, over the 403 body captured from srv13 plus Base/non-Base/success/plain-text controls. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b2213d0a31
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Comment on lines
+187
to
+190
| match json_field(obj: doc, key: "error") { | ||
| FieldRead { value: err } => | ||
| if redfish_extended_info_requires_password_change(holder: err) { RedfishPasswordChangeRequired } else { RedfishPasswordChangeNotIndicated } | ||
| _ => RedfishPasswordChangeNotIndicated |
There was a problem hiding this comment.
When a controller reports PasswordChangeRequired only in error.code and omits @Message.ExtendedInfo, this arm returns RedfishPasswordChangeNotIndicated, causing a fresh BMC to fall through to custody and fail onboarding. The Redfish error-response rules instruct clients to inspect extended info first and fall back to code when it is absent (DMTF Redfish specification); parse error.code with the same message-ID predicate as a fallback.
Useful? React with 👍 / 👎.
Contributor
Author
|
Witness sweep complete (fresh claim_batch, every witness importing a changed module): 136 files, 2289 tests, 2132 pass, 86 fail, 2 files refuse to typecheck. Every failing file reproduces identically on origin/main 9f52972 (same counts; the two type refusals are the same optional-vs-required No failure is introduced by this PR. Full per-file results: |
…and JsonValue, no wildcards The required floor refused NonFoldResidueRosterDiverged on two wildcard arms over closed coproducts in extdeps.bmc.redfish. Every arm is now spelled, so a new variant reaches a compile refusal rather than the default. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 9, 2026
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
OpenBMC 03.22.00 on the ASRock ALTRAD8UD-1L2T answers every request made with
the published credential with HTTP 403 and the DMTF Base registry message
PasswordChangeRequired, admitting only a PATCH of the account's Password
(a wrong password is 401). gunbc.tools.bmc_onboard read that 403 as a failed
factory login: the probe fell through to "custody holds no stored credential"
(CredentialStateUnknown) and the acquire step stopped, so a freshly flashed BMC
could not be onboarded although the rotation it demands is the one
bmc_rotate_credential performs.
extdeps.bmc.redfish redfish_password_change_verdict reads
@Message.ExtendedInfo[].MessageId (top level, as bmcweb sends it, or inside the
standard error object) for a Base.*.PasswordChangeRequired id;
factory_login_accepted admits the published credential on success or on that
verdict, and both the probe and the acquire step use it.
srv13 (operator naming, carried here from #13552): HostIdentity and hostname
rows, srv13_baseboard (board and BMC endpoint as first contact observed them),
srv13_onboarding_plan, and srv13_converge_credential through the token-source
selection. Run 2026-10-08: factory 403 -> secret bmc-srv13-admin created,
version 1 stored and read back -> PATCH -> re-auth 200; factory now 401.
Witness: redfish_password_change 2/2, over the 403 body captured from srv13
plus Base/non-Base/success/plain-text controls.
Sweep of every witness importing a changed module (fresh claim_batch), at PR open, still running:
The fabric_cell_acquire (2) and fabric_cell_evidence_algebra (1) failures reproduce identically on origin/main 9f52972.
🤖 Generated with Claude Code