coulomb/prj-forgejo-org-refactor
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ORGREF-WP-0002-T03: the backup token is the RPF-WP-0029 predecessor

Browse source 
Already invalidated at the provider (2026-09-15); remaining work is removing
the literal from two scripts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
This commit is contained in:
tegwick 2026-10-08 19:50:56 +02:00
parent fbad8c925d
commit 712f837b56
2 changed files with 24 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

29
inventory/history-exposure-2026-10-08.md
View file

@ -7,10 +7,10 @@ secret value, no commit author identity and no matched text.
## Result
283 findings in 25 repositories. After triage: **one real exposure**; everything
else is benign.
283 findings in 25 repositories. After triage: **one real exposure**, already
invalidated at the provider in September; everything else is benign.
### Real: hardcoded Nextcloud backup token (rotate)
### Real: hardcoded Nextcloud backup token (predecessor, cleanup remains)
| Repository | File | Since | In current HEAD |
| --- | --- | --- | --- |
@ -18,12 +18,23 @@ else is benign.
| railiance-cluster | `tools/cmd/railiance-backup` line 11 | same value; file last changed 2026-07-07 | yes |
`NC_TOKEN`, next to a Nextcloud URL, is the upload target for the backup tool. It
has been readable anonymously since February. Required, regardless of closing:
revoke and reissue it in Nextcloud, keep the new one in OpenBao only (this is
the same custody the CCR-2026-0004 offsite backup lane asks for: `NC_WEBDAV`
credentials in OpenBao), and remove the literal from both scripts. Removing it
from HEAD does not remove it from history or from clones; the revocation is the
fix. Routed to railiance-bootstrap and railiance-cluster (hub messages).
has been readable anonymously since February.
**Already handled at the provider (correction, same day).** By age and target this
is the predecessor credential of railiance-platform `RPF-WP-0029` (finished).
That plan removed the same literal from `tools/cmd/forgejo-backup` and moved
backups to a dedicated Backup account with an upload-only share. The governed
token lives in OpenBao at `platform/workloads/railiance/backup/offsite-lane`
(CCR-2026-0004; rotation: `warden rotate-guide railiance-backup-offsite-lane`).
The operator attested on 2026-09-15 that the old personal share was unshared.
Value identity was not compared (RPF-WP-0029 forbids recording fingerprints),
so the founder confirms in Nextcloud that no personal share remains on the
backup folder.
Remaining: **cleanup, not rotation.** Remove the literal from both
`railiance-backup` copies (read the governed lane, as `forgejo-backup` does) or
retire the script. Routed to railiance-bootstrap and railiance-cluster (hub
messages, with a correction to the first "revoke now" wording).
### Benign (no action)