Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Follow-ups from #779: seal after bundle verification, owner-auth wording, config-digest changelog

Open
  • Is something wrong?
#782 0 comments 0 reactions 1 assignee View on GitHub

Maintainers usually reply within 1 day

@rajnisht7 is already working on this.

Since Oct 20, 2026.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
57/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
python
Domain
security

Research direction

Start with startup.py at the referenced lines 542 and 693 to trace when the key is sealed and the policy bundle is checked. Then review seal.py, the security model doc, and the CHANGELOG entries for the two wording fixes. Done means the key is not left sealed to a failed bundle digest, the documentation accurately describes the TPM owner password and access requirements, and the changelog says the config digest changes on every deployment upgrade.

Written by the indexing model from the issue text.

Description

Three follow-ups from the review of #779 at dd07fac. None blocks the merge; each is small.

  1. Seal after the policy bundle verifies. On the first start the key is sealed (startup.py:542) before the bundle is checked (:693). If that bundle fails, the start aborts but leaves the store sealed to the bad digest, so the next good start refuses with SEALED_KEY_DIGEST_MISMATCH until someone runs rotate.
  2. Say plainly what protects the sealed key. Sealing works only with an empty TPM owner password, so any process that can open the TPM device and read sealed_key_dir can unseal. The security model doc and the seal.py docstring should say that.
  3. Correct the CHANGELOG line: the config digest changes for every deployment on upgrade, not only with sink_policy.

Optional: TPM-free unit tests for the reseal hash check and the post-rotation gate check.

Dominant language
Python
Stars
33
Forks
24
Avg merge
19h 50m
Merged PRs (30d)
75

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from agentrust-io/cmcp

All issues in agentrust-io/cmcp

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.