recipe-maintainers/cc-ci
0
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

status(redfix): record Adversary wake-#46 cold-verification of the strip remedy; consume BUILDER-INBOX

Browse Source 
Adversary confirmed all three claims and failed to refute "strip userinfo is safe" three ways:
no push through /etc/cc-ci origin; secrets submodule anonymously fetchable so submodule update
survives; nothing auto-pulls the checkout (/root/.git-credentials inert, no helper wired).

Folded those three into STATUS step 3 so the operator sees why the command is safe. The submodule
angle was an inference on my part, not a probe -- the Adversary actually tested it. Recorded in
JOURNAL.

Incidental (not a finding): cc-ci-secrets.git is public but SOPS-encrypted ciphertext.

STATUS/JOURNAL text only. No code. ## DONE stands; M1+M2 PASS stand; no gate reopens.
This commit is contained in:
autonomic-bot
2026-07-09 09:09:29 +00:00
parent 1dcb99911f
commit 3ec56d878e
3 changed files with 39 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
machine-docs/STATUS-redfix.md
View File

@ -108,6 +108,16 @@ action that actually revokes the exposure.
→ `f0372b8… HEAD`, rc=0, no credential. The sibling `cc-ci-secrets` submodule URL (`.git/config:15`)
already carries no userinfo, so this matches the existing pattern.
**Independently cold-verified by the Adversary (REVIEW-redfix.md wake #46, `3f27cc6`), which attempted to
refute it three ways and failed on all three** — so this step is safe to run on the node:
- **No push through `origin`.** The only `git push` in the deployed tree (`scripts/recipe-mirror-sync.sh:84-85`)
`remote add`s a `gitea` OAuth-token remote inside a *recipe* clone; it never touches `/etc/cc-ci`'s origin.
- **The `secrets` submodule survives the strip.** Its URL already carries no userinfo and
`cc-ci-secrets.git` is anonymously fetchable (`ls-remote` rc=0), so `submodule update` still works.
- **Nothing auto-pulls the checkout.** `/etc/cc-ci` is clone-once + local `nixos-rebuild switch`; the sweep
never `git pull`s it. (`/root/.git-credentials` exists but no `credential.helper` is wired at global or
system scope, so it is inert — the anonymous `ls-remote` results above are genuinely credential-free.)
**Rotation blast radius is small — no operational reason to delay.** `GITEA_PASSWORD` is consumed by exactly
one script, `scripts/bootstrap-drone-oauth.sh` (`git grep -ln GITEA_PASSWORD -- .` returns that script, `docs/
install.md`, and machine-docs prose; nothing else in the runner). In particular `scripts/recipe-mirror-sync.sh`