recipe-maintainers/cc-ci
0
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

status(redfix): surface B-redfix-8 (HIGH, open) in STATUS as an explicit OPERATOR ACTION REQUIRED block

Browse Source 
The one item in this phase that needs a human was recorded only in BACKLOG/REVIEW/JOURNAL.
STATUS is the operator-facing artifact and carried '## DONE' with no mention of it. Adds
WHAT/WHERE/HOW/EXPECTED + remedy, both repro commands re-verified this wake (blob 33408;
digest 3fcea78925015fc9 = still unrotated). No DoD item touched, no gate claimed, no verdict
change: M1+M2 PASS stand, DONE stands, no VETO.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XChUi2CUccznbmzHZBSuXr
This commit is contained in:
autonomic-bot
2026-07-09 05:11:12 +00:00
parent 9258694f4f
commit 33a4021e81
1 changed files with 33 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
machine-docs/STATUS-redfix.md
View File

@ -19,6 +19,39 @@ there is **no standing VETO**:
Adversary findings F-redfix-1/2/3/4 are all **CLOSED**; no open blocking finding.
## ⚠ OPERATOR ACTION REQUIRED — B-redfix-8 (HIGH, open, outside DoD)
Phase DoD is met, but **one HIGH item is open and only an operator can close it.** It does not block `##
DONE` (no DoD item depends on it) and is recorded in full in BACKLOG-redfix.md.
**WHAT.** The live Gitea bot password (`GITEA_PASSWORD` in `/srv/cc-ci/.testenv`) was committed in
`14c7dee` (`machine-docs/BACKLOG-redfix.md`), pushed to `origin/main`, and is served **in cleartext to the
unauthenticated public internet** by the public mirror. It is push-capable to `recipe-maintainers/*`. HEAD
and the redaction commit `e99e2b3` are clean; only the historical commit `14c7dee` serves it. Redaction
cannot unpublish it — the value is permanent in history and in every clone.
**WHERE.** `git.autonomic.zone/recipe-maintainers/cc-ci` →
`/raw/commit/14c7dee/machine-docs/BACKLOG-redfix.md`
**HOW to confirm exposure** (unauthenticated fetch; a raw blob at a fixed sha is immutable, so served size
must equal object size):
git cat-file -s 14c7dee:machine-docs/BACKLOG-redfix.md # → 33408
An unauthenticated fetch of the raw URL returning **HTTP 200 / 33408 bytes** is the leak, not an error page.
**HOW to confirm it is still the live credential** (commits to the value without republishing it):
python3 -c 'import hashlib,re;v=re.search(r"^GITEA_PASSWORD=(.*)$",open("/srv/cc-ci/.testenv").read(),re.M).group(1).strip().strip(chr(34)).strip(chr(39));print(hashlib.sha256(v.encode()).hexdigest()[:16])'
**EXPECTED.** Prints `3fcea78925015fc9` while still unrotated. **A different digest ⇒ rotated ⇒ `14c7dee`
is inert ⇒ close B-redfix-8.**
**REMEDY (operator).** Rotate the Gitea bot password, then update `/srv/cc-ci/.testenv`. The credential is a
Class-A1 external infra input (plan §4.4) — the Builder must not rotate or invent it. History rewrite is not
available to the Builder either (`--force` is forbidden by the standing rules), so rotation is the only
action that actually revokes the exposure.
**Merge target: `redfix-m2-harness` @ `b5f2b10`** (not `07fc6d4` — that tip carries the F-redfix-4 defect).
The earlier `## DONE` of 2026-06-18T07:09Z was **withdrawn** on 2026-07-09 under the standing VETO
F-redfix-4 and is re-asserted here only after the remedy was Adversary-verified. Details of that cycle,