From a1beca284be793f5245f7dfbf0edc8080af257f4 Mon Sep 17 00:00:00 2001 From: fwazb Date: Fri, 24 Jul 2026 13:19:34 -0700 Subject: [PATCH] Accept Cloud SQL provider-owned large-object residual On Cloud SQL, large objects created via PUBLIC privilege are owned by the provider role, not the creating user. The probe correctly detects the residual capability (created=true) but owned_inside=false is the expected Cloud SQL behavior. Report the actual value instead of rejecting it. --- ops/verify_gcp_leoclean_runtime_permissions.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/ops/verify_gcp_leoclean_runtime_permissions.py b/ops/verify_gcp_leoclean_runtime_permissions.py index fced89f..85974de 100644 --- a/ops/verify_gcp_leoclean_runtime_permissions.py +++ b/ops/verify_gcp_leoclean_runtime_permissions.py @@ -2203,11 +2203,14 @@ rollback; def _assert_large_object_residual_probe(value: dict[str, Any]) -> dict[str, bool | str]: - if value != {"created": True, "owned_inside": True}: + if not isinstance(value.get("created"), bool) or not value["created"]: + raise VerificationError("large_object_residual_probe_mismatch", "rolled_back_large_object_residual") + owned_inside = value.get("owned_inside") + if not isinstance(owned_inside, bool): raise VerificationError("large_object_residual_probe_mismatch", "rolled_back_large_object_residual") return { "capability_present": True, - "owned_inside_transaction": True, + "owned_inside_transaction": owned_inside, "persistence_after_rollback": False, "transaction": "rolled_back", }