From 33a4021e8182e838e3fbfed26c19d413f27d5cd0 Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Thu, 9 Jul 2026 05:11:12 +0000 Subject: [PATCH] status(redfix): surface B-redfix-8 (HIGH, open) in STATUS as an explicit OPERATOR ACTION REQUIRED block The one item in this phase that needs a human was recorded only in BACKLOG/REVIEW/JOURNAL. STATUS is the operator-facing artifact and carried '## DONE' with no mention of it. Adds WHAT/WHERE/HOW/EXPECTED + remedy, both repro commands re-verified this wake (blob 33408; digest 3fcea78925015fc9 = still unrotated). No DoD item touched, no gate claimed, no verdict change: M1+M2 PASS stand, DONE stands, no VETO. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01XChUi2CUccznbmzHZBSuXr --- machine-docs/STATUS-redfix.md | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/machine-docs/STATUS-redfix.md b/machine-docs/STATUS-redfix.md index c243bbf..240bcec 100644 --- a/machine-docs/STATUS-redfix.md +++ b/machine-docs/STATUS-redfix.md @@ -19,6 +19,39 @@ there is **no standing VETO**: Adversary findings F-redfix-1/2/3/4 are all **CLOSED**; no open blocking finding. +## ⚠ OPERATOR ACTION REQUIRED — B-redfix-8 (HIGH, open, outside DoD) + +Phase DoD is met, but **one HIGH item is open and only an operator can close it.** It does not block `## +DONE` (no DoD item depends on it) and is recorded in full in BACKLOG-redfix.md. + +**WHAT.** The live Gitea bot password (`GITEA_PASSWORD` in `/srv/cc-ci/.testenv`) was committed in +`14c7dee` (`machine-docs/BACKLOG-redfix.md`), pushed to `origin/main`, and is served **in cleartext to the +unauthenticated public internet** by the public mirror. It is push-capable to `recipe-maintainers/*`. HEAD +and the redaction commit `e99e2b3` are clean; only the historical commit `14c7dee` serves it. Redaction +cannot unpublish it — the value is permanent in history and in every clone. + +**WHERE.** `git.autonomic.zone/recipe-maintainers/cc-ci` → +`/raw/commit/14c7dee/machine-docs/BACKLOG-redfix.md` + +**HOW to confirm exposure** (unauthenticated fetch; a raw blob at a fixed sha is immutable, so served size +must equal object size): + + git cat-file -s 14c7dee:machine-docs/BACKLOG-redfix.md # → 33408 + +An unauthenticated fetch of the raw URL returning **HTTP 200 / 33408 bytes** is the leak, not an error page. + +**HOW to confirm it is still the live credential** (commits to the value without republishing it): + + python3 -c 'import hashlib,re;v=re.search(r"^GITEA_PASSWORD=(.*)$",open("/srv/cc-ci/.testenv").read(),re.M).group(1).strip().strip(chr(34)).strip(chr(39));print(hashlib.sha256(v.encode()).hexdigest()[:16])' + +**EXPECTED.** Prints `3fcea78925015fc9` while still unrotated. **A different digest ⇒ rotated ⇒ `14c7dee` +is inert ⇒ close B-redfix-8.** + +**REMEDY (operator).** Rotate the Gitea bot password, then update `/srv/cc-ci/.testenv`. The credential is a +Class-A1 external infra input (plan §4.4) — the Builder must not rotate or invent it. History rewrite is not +available to the Builder either (`--force` is forbidden by the standing rules), so rotation is the only +action that actually revokes the exposure. + **Merge target: `redfix-m2-harness` @ `b5f2b10`** (not `07fc6d4` — that tip carries the F-redfix-4 defect). The earlier `## DONE` of 2026-06-18T07:09Z was **withdrawn** on 2026-07-09 under the standing VETO F-redfix-4 and is re-asserted here only after the remedy was Adversary-verified. Details of that cycle,