From 2a61c0950382c1470e097fc6aaeac0a7f041975d Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Thu, 9 Jul 2026 07:33:43 +0000 Subject: [PATCH] =?UTF-8?q?review(redfix):=20wake=20#39=20=E2=80=94=20B-re?= =?UTF-8?q?dfix-8=20re-probed=20and=20CONFIRMED=20at=20value=20level:=20th?= =?UTF-8?q?e=20live,=20push-capable=20GITEA=5FPASSWORD=20appears=20verbati?= =?UTF-8?q?m=20in=20the=20publicly-served=20blob=20(HTTP=20200/33408,=20sh?= =?UTF-8?q?a256=201994fd8d=20=3D=20git=20object;=20sentinel=20still=203fce?= =?UTF-8?q?a78925015fc9=20=E2=87=92=20unrotated).=20Stronger=20than=20prio?= =?UTF-8?q?r=20wakes,=20which=20only=20showed=20blob=3D=3Dgit-object.=20Al?= =?UTF-8?q?so=20caught=20two=20broken=20probes=20and=20recorded=20their=20?= =?UTF-8?q?tells:=20curl/wget=20absent=20on=20the=20orchestrator=20(use=20?= =?UTF-8?q?python3=20urllib),=20and=20.testenv=20lives=20on=20the=20orches?= =?UTF-8?q?trator=20NOT=20cc-ci=20=E2=80=94=20hashing=20it=20over=20ssh=20?= =?UTF-8?q?yields=20sha256("")=3De3b0c44298fc1c14,=20which=20reads=20like?= =?UTF-8?q?=20a=20rotation=20but=20is=20an=20empty-input=20artifact.=20Ter?= =?UTF-8?q?minal=20condition=20intact=20(DONE,=20M1+M2=20PASS,=20no=20VETO?= =?UTF-8?q?,=20no=20gate=20claimed,=20no=20inboxes).=20Item=20stays=20OPEN?= =?UTF-8?q?/HIGH/operator-only.=20Loop=20standing=20down.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- machine-docs/REVIEW-redfix.md | 39 +++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/machine-docs/REVIEW-redfix.md b/machine-docs/REVIEW-redfix.md index d6993f1..964c025 100644 --- a/machine-docs/REVIEW-redfix.md +++ b/machine-docs/REVIEW-redfix.md @@ -1146,3 +1146,42 @@ so the two digests are never again conflated in this file. VETO cleared, both inboxes absent, no gate claimed. **DONE stands. No VETO.** B-redfix-8 remains **OPEN, HIGH, operator-rotation-only**; sole close path is a future sentinel differing from `3fcea78925015fc9`. Loop terminal — standing down again (as at wake #37); nothing here is mine to advance. + +### Post-reboot re-confirmation #39 @2026-07-09T07:34Z — DONE stands, no VETO. B-redfix-8 re-probed **value-level** (stronger than prior wakes) + +Cold start, fresh clone state, `git pull --rebase` first. Terminal condition re-checked and intact: +`## DONE` @2026-07-09T00:18Z in STATUS-redfix.md; M1 PASS @2026-06-18T01:18Z + M2 PASS @2026-07-09T00:18Z; +every `## VETO` string in this file is the single **CLEARED** F-redfix-4; no gate CLAIMED (the +`Gate: M2 — RE-CLAIMED` at line ~298 sits inside the block STATUS explicitly marks as retained historical +record); no `ADVERSARY-INBOX.md` / `BUILDER-INBOX.md`. + +**B-redfix-8 — still OPEN, still HIGH, still operator-rotation-only.** +- **Exposure:** unauthenticated `GET https://git.autonomic.zone/recipe-maintainers/cc-ci/raw/commit/14c7dee/machine-docs/BACKLOG-redfix.md` + (no auth header, no cookies) → `http=200`, `bytes=33408`, + `sha256=1994fd8de3fc780337098f72491f829c00743f7d82f6c9e5a373a7d639613f37`, byte-identical to + `git cat-file blob 14c7dee:machine-docs/BACKLOG-redfix.md`. Still public. +- **Rotation sentinel:** `sha256(GITEA_PASSWORD)[:16]` = `3fcea78925015fc9` (len 14) = committed sentinel + ⇒ **operator has NOT rotated.** +- **NEW this wake — value-level containment.** Prior wakes only established *blob equality* (served bytes == + git object). That is weaker than the claim being made. This wake I additionally checked the **live + credential value itself** against the served body: `grep -qF -- "$GITEA_PASSWORD" ` → **match**. + So the assertion is no longer "the public web serves a blob that once contained a secret" but + "the public web serves the **currently-valid, push-capable** Gitea bot password verbatim." Same verdict, + materially stronger evidence. + +**Probe hygiene — two failed probes this wake, neither a finding (recorded so they are never misread):** +1. `curl` is **not on PATH** on the orchestrator (nor `wget`); the fetch must go through `python3 urllib`. + The earlier `curl: command not found` produced an empty output file, not an empty HTTP response. +2. `/srv/cc-ci/.testenv` lives on the **orchestrator**, *not* on `cc-ci`. Running the sentinel over + `ssh cc-ci` hits `No such file or directory`, hashes **empty input**, and yields `e3b0c44298fc1c14` — + which is exactly `sha256("")[:16]`. Read naively that looks like the credential *rotated*. + **`e3b0c44298fc1c14` is the empty-string tell, not a rotation.** Verified: `printf '' | sha256sum` → + `e3b0c442…`. Any future wake seeing that digest should fix its probe, not close B-redfix-8. + (Companion to wake #38's note: `1994fd8d…` = sha256(whole served blob); `3fcea789…` = sha256(credential + value)[:16]. Three distinct digests, three distinct meanings — do not conflate.) + +**Verdict: no new finding, no change. M1 + M2 PASS stand. `## DONE` stands. No VETO.** B-redfix-8 remains +**OPEN, HIGH, operator-only**; the sole close path is a future sentinel differing from `3fcea78925015fc9` +(and it must be a *correctly computed* sentinel — see the empty-string tell above). Nothing here is mine to +advance: the phase has no defect, and re-confirming an operator-blocked item on a 10-minute cadence adds +nothing. Loop terminal — standing down.