recipe-maintainers/cc-ci
0
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(redfix): B-redfix-8 reproduction quoted a brittle blob total (3099); the invariant is password=2 / token=0

Browse Source 
Adversary (a22c384) confirmed both findings but counted 3061 blobs vs my 3099. Root-caused:
(a) later commits add blobs (host now 3104); (b) --batch-all-objects counts 49 unreachable
objects rev-list omits (reachable-only = 3026); (c) 'git clone /local/path' hardlinks the whole
object store, so local clones inherit unreachable objects while remote clones do not -- hence
the Adversary's lower, and for a mirror question more apt, number.

All four scans agree on password=2 and token=0. STATUS now asserts those invariants and a
'wc -l > 100' sanity floor instead of an exact total, so the documented repro cannot misfire.

Operator-scope, no gate impact, no VETO; DONE stands.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018XE43k4DaeMXHMK51wBUu2
This commit is contained in:
autonomic-bot
2026-07-09 11:03:53 +00:00
parent a22c384eeb
commit ab4be1b419
2 changed files with 41 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
machine-docs/STATUS-redfix.md
View File

@ -69,8 +69,8 @@ and the redaction commit `e99e2b3` are clean. Redaction cannot unpublish it —
history and in every clone.
**CORRECTED (wake #58, 2026-07-09):** an earlier version of this entry said "**only** the historical commit
`14c7dee` serves it." That **understated the exposure**. An exhaustive scan of all **3099** blobs in the
object db (`git cat-file --batch-all-objects`, literal-value match) finds the password in **two distinct
`14c7dee` serves it." That **understated the exposure**. An exhaustive scan of every blob in the object db
(`git cat-file --batch-all-objects`, literal-value match) finds the password in **two distinct
blobs**, carried by **two published commits** — both ancestors of `origin/main`, so both are mirror-served:
| commit | blob | `machine-docs/BACKLOG-redfix.md` size |
@ -98,15 +98,25 @@ leak, not an error page.
`0 hits`:
git cat-file --batch-all-objects --batch-check='%(objecttype) %(objectname)' \
| grep '^blob ' | cut -d' ' -f2 > /tmp/blobs # → 3099 lines; assert >100 before trusting
| grep '^blob ' | cut -d' ' -f2 > /tmp/blobs # assert wc -l > 100 before trusting
# then literal-match each blob against a chmod-600 sentinel; positive control MUST return 2
**Positive control is mandatory.** Any scan of this repo that reports **0** password-bearing blobs is a
**broken probe**, not a clean repo — the correct answer is **2**.
**Do not assert an exact total blob count** — it is host- and time-dependent, and is *not* the invariant.
Observed legitimately: **3099** (Builder wake-#58 scan), **3104** (same host, after that wake's commits),
**3026** (reachable-only), **3061** (Adversary's cold clone, wake #58). Three sources of drift: (a) new
commits add blobs; (b) `--batch-all-objects` counts **unreachable** objects (49 here) that `git rev-list`
omits; (c) `git clone /local/path` **hardlinks the whole object store**, so a local clone inherits those
unreachable objects while a clone from the *remote* receives only reachable ones. All four scans agree on
the only figures that matter.
**Positive control is mandatory.** The durable invariants, stable across every scan scope above:
**password ⇒ exactly 2 blobs; token ⇒ exactly 0.** Any scan of this repo that reports **0** password-bearing
blobs is a **broken probe**, not a clean repo.
**The `oauth2` token (the second exposed credential) does NOT appear in git history.** Same exhaustive scan,
same run, literal match against the live token (`sha256[:16]=9c44a1aea2ecb389`, extracted root-only to a
`chmod 600` file, then `shred`-removed): **0 of 3099 blobs.** The 271 history blobs matching the string
`chmod 600` file, then `shred`-removed): **0 blobs** — independently reproduced by the Adversary at wake #58
against its own cold clone. The 271 history blobs matching the string
`oauth2:` are `scripts/recipe-mirror-sync.sh:39`'s `https://oauth2:${TOKEN}@…` **variable interpolation**
plus machine-docs **prose citing the sha16 sentinel** — no literal value. So the token's exposure is
**filesystem-only** (A-redfix-1: world-readable `.git/config` copies); it is **not** on the public mirror.