Advertise agent password-verifier support in stemcell metadata

[Alphasite]

Advertise agent capabilities to support password-exposure hardening following the discovered CVE involving reusable HTTPS agent passwords in cloud VM metadata.

The builder queries the installed agent with bosh-agent -features during the agent stage and includes its reported capabilities in stemcell.MF. The companion CLI enables password hashing only when http-password-hmac-sha256 is advertised. This ties capability detection to the actual packaged binary without a release-version threshold or API-version bump.

Older agents reject the new flag; failed probes overwrite stale results with an empty list and retain legacy behavior. Missing or empty results omit the manifest field. Malformed successful probe output fails packaging. The temporary feature JSON is excluded from the stemcell archive.

Companion drafts:

• Agent: Harden HTTPS agent metadata with password verifiers bosh-agent#487 (adds verifier support and the feature-reporting flag).
• CLI: Harden create-env agent passwords in cloud metadata bosh-cli#742 (reads the capability marker).

The currently pinned agent is unchanged. The capability will activate when the normal agent release bump includes the supporting agent. This draft targets ubuntu-jammy, the earliest supported branch, for subsequent merge-forward into ubuntu-noble and ubuntu-resolute.

Validation before the capability rename: 16 packaging and probe examples passed, covering manifest and archive propagation, legacy compatibility, stale-feature clearing, and malformed metadata. Ruby Standard checks and shell syntax checks passed. The capability fixtures now use the HMAC marker; those examples have not been rerun for this revision. A full Linux stemcell image build was not run.

Password verifiers harden newly written metadata. Rotate previously exposed credentials to invalidate historical copies. Existing VMs are not rewritten by a no-change create-env run, and TLS private keys and other metadata secrets remain exposed. The companion CLI also has an explicit agent.mbus requirement requiring rollout review.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}