recipe-maintainers/cc-ci
0
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

review(redfix): CONFIRM Builder's "still LIVE not merely served" strengthening (27d6a5a) — independently re-derived from artifacts, secret never materialized: live GITEA_PASSWORD from .testenv is verbatim in the public 14c7dee blob (True), sha256[:16] == committed 3fcea78925015fc9, and the documented operator re-check one-liner runs verbatim and prints that digest. Real distinction (reachable != live; "unrotated" had been true-by-repetition) and it's the basis of the HIGH rating. Verdict strength up, verdict unchanged: DONE stands, no VETO, B-redfix-8 OPEN on operator rotation. Loop stopping.
Some checks failed
continuous-integration/drone/push Build is failing
Details

Browse Source
This commit is contained in:
autonomic-bot
2026-07-09 02:37:02 +00:00
parent 5cd796ed2a
commit de126b302f
1 changed files with 19 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
machine-docs/REVIEW-redfix.md
View File

@ -1020,3 +1020,22 @@ VETO cleared, both inboxes empty, no gate claimed. **DONE stands. No VETO.** The
**B-redfix-8 — a live, world-readable, push-capable `autonomic-bot` Gitea credential at `14c7dee` (re-probed
HTTP 200 this wake, still unrotated)** — is HIGH, urgent, and closable only by operator rotation. Adversary
loop stopping: nothing remains that is mine to advance.
### Re-test @2026-07-09T02:36Z — Builder's "still LIVE" strengthening (27d6a5a) INDEPENDENTLY CONFIRMED
The Builder drew a distinction my own probes had glossed: public *reachability* (HTTP 200) and the served
value being the *current live credential* are two claims, and until now only reachability was ever measured —
"unrotated" was carried by repetition. Correct catch, and it is the whole basis of the HIGH rating, so I
re-derived it myself from the artifacts (not from 27d6a5a's message), without materializing the secret:
- `GITEA_PASSWORD` from `/srv/cc-ci/.testenv` (the value the harness authenticates with **today**) is present
**verbatim** in the public `14c7dee` blob → `True`.
- `sha256(live password)[:16]` = **`3fcea78925015fc9`**, matching the Builder's committed digest exactly.
- The documented operator re-check one-liner runs verbatim (no SyntaxError) and prints `3fcea78925015fc9`.
So the bytes the open internet serves ARE the password in live use — the exposure is not inert. The digest
commitment is a good move: it lets the operator confirm rotation later (any other digest ⇒ rotated ⇒ inert)
without either loop reprinting the secret. Confirmed reproducible.
**Nothing changes in the verdict**, only its evidentiary strength: B-redfix-8 is now proven live, not merely
reachable. M1+M2 PASS, `## DONE`, no VETO. B-redfix-8 stays OPEN, HIGH, operator-rotation-only. Loop stopping.