Expose WP-80 delivery checkpoints and retain scanner source proof
This commit is contained in:
codex
parent
27737fcce0
commit
555514577f
92 changed files with 10801 additions and 1376 deletions
|
|
@ -0,0 +1,323 @@
|
|||
{
|
||||
"objective": "Finish what you found missing and finish CUST-WP-0080",
|
||||
"status": "active",
|
||||
"observed_at": "2026-10-18T11:47:21.781597+00:00",
|
||||
"full_scope_baseline": {
|
||||
"path": "docs/changes/netkingdom-target-2026-10-18/cust80-completion-r1/completion-audit.json",
|
||||
"sha256": "sha256:9bdee9a790db598956fe35d5954137bb4582c9f3810d2392f7ef3236c369b065",
|
||||
"all_requirements_retained": true
|
||||
},
|
||||
"normative_architecture": {
|
||||
"path": "docs/netkingdom-target-security-architecture.md",
|
||||
"sha256": "sha256:701c1e276df3d21925f6939821fb3953babfcb5bce8ff10fed582642f75ff484"
|
||||
},
|
||||
"acceptance_gates": [
|
||||
{
|
||||
"id": "TSA-01",
|
||||
"required_outcome": "Every inventoried privileged PEP authenticates its decision",
|
||||
"required_evidence": "PEP denominator; admitted signer/channel; forged, altered, wrong-key/pin, unsigned/downgrade, expired and rotation refusals. Start SECRETS-WP-0014.",
|
||||
"status": "incomplete",
|
||||
"completion_evidence": []
|
||||
},
|
||||
{
|
||||
"id": "TSA-02",
|
||||
"required_outcome": "Exact approval produces one bounded protected operation",
|
||||
"required_evidence": "SECRETS-WP-0013/RPF-WP-0035-T12 native effect; Approval T01/T05 issuer/tenant provenance; wrong actor/tenant/body, expiry, replay and unavailable refusal.",
|
||||
"status": "incomplete",
|
||||
"completion_evidence": []
|
||||
},
|
||||
{
|
||||
"id": "TSA-03",
|
||||
"required_outcome": "Crashes preserve uncertainty and cleanup",
|
||||
"required_evidence": "Actual ledger restart/concurrency, consumed-before-effect failure, target reconciliation, scoped cleanup and revocation evidence; no blind replay.",
|
||||
"status": "incomplete",
|
||||
"completion_evidence": []
|
||||
},
|
||||
{
|
||||
"id": "TSA-04",
|
||||
"required_outcome": "First reusable browser case is accepted",
|
||||
"required_evidence": "NK-WP-0048 and named Mason/Warden/KeyCape adapters; independent native structure, sign-in/denial, delivery, revocation and rollback.",
|
||||
"status": "incomplete",
|
||||
"completion_evidence": []
|
||||
},
|
||||
{
|
||||
"id": "TSA-05",
|
||||
"required_outcome": "Human and browser consumers can use the delivered identity",
|
||||
"required_evidence": "KEY-WP-0040/U08 real-factor recovery; User Engine journey; NK-WP-0050 and CUST-WP-0080-T05 human/agent Playwright acceptance.",
|
||||
"status": "incomplete",
|
||||
"completion_evidence": []
|
||||
},
|
||||
{
|
||||
"id": "TSA-06",
|
||||
"required_outcome": "Actual agent and runner authority is bounded",
|
||||
"required_evidence": "CUST-WP-0073/GLAS-WP-0012 admitted runtime read-denial/tool-effect proof; Forge/Platform per-job credential and repository-workflow abuse tests.",
|
||||
"status": "incomplete",
|
||||
"completion_evidence": []
|
||||
},
|
||||
{
|
||||
"id": "TSA-07",
|
||||
"required_outcome": "Credential lifecycle is inventoried and simplified",
|
||||
"required_evidence": "Current owner/consumer denominator, unknown/orphan findings, native-identity elimination candidates; sampled replacement/adoption/old-refusal and deletion semantics. G04/G09/G12.",
|
||||
"status": "incomplete",
|
||||
"completion_evidence": []
|
||||
},
|
||||
{
|
||||
"id": "TSA-08",
|
||||
"required_outcome": "Recovery is independent and measured",
|
||||
"required_evidence": "NK-WP-0049 plus platform/root owners; isolated recovery with ordinary issuer unavailable, restore/reconnect/audit continuity and measured RTO/RPO. G08/G11.",
|
||||
"status": "incomplete",
|
||||
"completion_evidence": []
|
||||
},
|
||||
{
|
||||
"id": "TSA-09",
|
||||
"required_outcome": "Security effects have independently reconciled evidence",
|
||||
"required_evidence": "Admitted source/class inventory, atomic outbox, receiver readback, lag/duplicate/boundary accounting and missing-class findings. Approval/Audit/Tenant/Secrets owners.",
|
||||
"status": "incomplete",
|
||||
"completion_evidence": []
|
||||
},
|
||||
{
|
||||
"id": "TSA-10",
|
||||
"required_outcome": "Source and delivery controls cover declared entry paths",
|
||||
"required_evidence": "FORGE-WP-0006/RMGR-WP-0021: denominator, SSH/HTTP/UI/new repo/import/mirror coverage, required checks/provenance, private synthetic finding through resolution.",
|
||||
"status": "incomplete",
|
||||
"completion_evidence": []
|
||||
},
|
||||
{
|
||||
"id": "TSA-11",
|
||||
"required_outcome": "Discovery remains accurate",
|
||||
"required_evidence": "All reviewed IDs exactly once, owner/index parity, usable source links, current limits/version aliases, drift checks and package-family disposition. Reuse/Repo Manager/provider owners.",
|
||||
"status": "incomplete",
|
||||
"completion_evidence": []
|
||||
},
|
||||
{
|
||||
"id": "TSA-12",
|
||||
"required_outcome": "Improvement operates without repeated manual polling",
|
||||
"required_evidence": "CUST-WP-0079/Activity accepted schedule, unassisted firing, checkpoint and changed-state notifications; adopted cadence runtime/receiver receipts; owner change and native remeasurement.",
|
||||
"status": "incomplete",
|
||||
"completion_evidence": []
|
||||
},
|
||||
{
|
||||
"id": "TSA-13",
|
||||
"required_outcome": "Shared adapters reduce per-consumer implementation",
|
||||
"required_evidence": "Producer-format cross-language fixtures, two real consumers, version compatibility, denied-path parity, upgrades and rollback; no second PDP.",
|
||||
"status": "incomplete",
|
||||
"completion_evidence": []
|
||||
},
|
||||
{
|
||||
"id": "TSA-14",
|
||||
"required_outcome": "Minimal profiles are independently reusable",
|
||||
"required_evidence": "Version/provider lock, dependency and optional-provider declaration, provider adapters, second clean installation, complete positive/negative journeys and upgrade/recovery instructions.",
|
||||
"status": "incomplete",
|
||||
"completion_evidence": []
|
||||
},
|
||||
{
|
||||
"id": "TSA-15",
|
||||
"required_outcome": "Optimization improves measured operations",
|
||||
"required_evidence": "Baseline and repeat measurements of onboarding time/touches, p50/p95 decision/effect latency, scanner throughput/failure, resources/headroom and owner effort with unchanged control coverage.",
|
||||
"status": "incomplete",
|
||||
"completion_evidence": []
|
||||
},
|
||||
{
|
||||
"id": "TSA-16",
|
||||
"required_outcome": "Governance and exceptions remain truthful",
|
||||
"required_evidence": "Existing SEC-DSM ledger and close-down controls reconciled to exact evidence; real authority for changes, explicit residual promotions, preserved deferrals and no invented owner assent.",
|
||||
"status": "incomplete",
|
||||
"completion_evidence": []
|
||||
}
|
||||
],
|
||||
"sec_dsm_requirements": {
|
||||
"path": "docs/evidence/2026-10-12-netkingdom-security/sec-dsm-requirement-ledger.json",
|
||||
"sha256": "sha256:ad81f7186ada04aa1cc410932fc8669d69dc2232f3c0be00657b17f3aa3a8184",
|
||||
"count": 116,
|
||||
"status_counts": {
|
||||
"unverified": 84,
|
||||
"incomplete": 12,
|
||||
"reference": 20
|
||||
},
|
||||
"closure_status_unchanged": true
|
||||
},
|
||||
"gap_ids": [
|
||||
"G01",
|
||||
"G02",
|
||||
"G03",
|
||||
"G04",
|
||||
"G05",
|
||||
"G06",
|
||||
"G07",
|
||||
"G08",
|
||||
"G09",
|
||||
"G10",
|
||||
"G11",
|
||||
"G12",
|
||||
"G13"
|
||||
],
|
||||
"separate_required_deliverables": [
|
||||
"G01-G13 current closure evidence or already applicable approved exceptions",
|
||||
"SEC-DSM requirement ledger reconciled with exact evidence",
|
||||
"T05 real human and agent Playwright acceptance and supported discovery",
|
||||
"Second real consumer and clean installation proves reuse",
|
||||
"Residual handoffs before workplan finish; no required work left only in prose"
|
||||
],
|
||||
"source_progress": {
|
||||
"packet": "docs/changes/netkingdom-target-2026-10-18/forgejo-postgres-source-r1",
|
||||
"producer_source_commit": "git:ca0cb75729a63c9288b7333382d0fa3eb1e8c9a3",
|
||||
"consumer_owner_commit": "git:308e83fcfbf9ec98dbe6b0286cbe8ec7be8899b3",
|
||||
"consumer_paths": 40,
|
||||
"patch_sha256": "sha256:feb1079399a43989742ae0a946c1ada50113d1821e6541f97f0b5592ee1fc20c",
|
||||
"postgreSQL_test_subtest_passes": 37,
|
||||
"database_schema_profiles": [
|
||||
"default",
|
||||
"explicit-public",
|
||||
"named"
|
||||
],
|
||||
"separate_client_crash_recovery": true,
|
||||
"actual_database_server_restart_recovery": true,
|
||||
"controlled_missing_lock_and_private_marker_counterexamples": true,
|
||||
"following_query_hook_context_panic_corrected": true,
|
||||
"selected_composed_passes_including_subtests": 94,
|
||||
"source_skips": 0,
|
||||
"release": {
|
||||
"frontend_and_static_backend": "passed",
|
||||
"release_version": "11.0.3+cust80.feb10793",
|
||||
"binary_sha256": "sha256:92efb26614d3fca22c400920d92c4cd022e32ab86c1f562f60699ab5f750cd28",
|
||||
"embedded_assets_exact": 2234,
|
||||
"actual_release_CLI_checks": 48,
|
||||
"exact_local_OCI_exports": 2,
|
||||
"manifest": "sha256:9d127b0a75d3d53b1598e7f380dce29f23f42c2e69056fdfc9a42122d98c41c7",
|
||||
"native_admission": false
|
||||
},
|
||||
"independent_owner_assent": false,
|
||||
"production_database": false,
|
||||
"native_gates_closed": 0
|
||||
},
|
||||
"current_work": "Finish the exact native scanner activation/recovery executor, resource/drift preflight and independent admission; obtain founder go for that new live revision, verify activation and ordinary queued source publication. Implement the selected current KeyCape checks across actual Forgejo ongoing HTTP/API/Git/SSH paths, including authoritative account/source/subject/application-tenant binding, current groups and exact resource/action policy. Finish actual current protected operation/inverse and effect/approval integration; private journal custody/retention; every-release-writer exclusion; complete release rebuild and independent/native acceptance. All sixteen gates, G01-G13 and 116 ledger entries remain in scope.",
|
||||
"workplan_finished": false,
|
||||
"goal_complete": false,
|
||||
"preceding_audit": {
|
||||
"path": "docs/changes/netkingdom-target-2026-10-18/cust80-completion-r6/completion-audit.json",
|
||||
"sha256": "sha256:0885c059f5a2a75b9592a3ead6981529b88356e0aa9e729369a66f79aa72fc94"
|
||||
},
|
||||
"issuer_source_progress": {
|
||||
"packet": "docs/changes/netkingdom-target-2026-10-18/keycape-token-status-r1",
|
||||
"base_revision": "git:d803e9282a47b49daf930fb905312fa5104c0ace",
|
||||
"scope": "proposed opt-in extension in the existing issuer",
|
||||
"source_delta_paths": 18,
|
||||
"complete_race_passes_including_subtests": 659,
|
||||
"existing_native_external_skips": 6,
|
||||
"new_token_status_passes_including_subtests": 43,
|
||||
"actual_built_server_process_checks": 26,
|
||||
"actual_process_restart": true,
|
||||
"actual_handler_HTTPS_PKCE_status_revocation": true,
|
||||
"controlled_revocation_guard_omission_failed_checks": 7,
|
||||
"independent_owner_assent": false,
|
||||
"native_admission": false,
|
||||
"gates_closed": 0,
|
||||
"owner_identifier_reconciliation": "existing exact historical reference restored using official consistency injection helper; new canonical records assigned by normal Repo Manager; no replacement existing UUID",
|
||||
"consumer_owner_commit": "git:67a0869c1ee40c9e00a60cb7c1d828734d5d3d32",
|
||||
"owner_primary_projection_verified": true,
|
||||
"owner_workplan": "KEY-WP-0042",
|
||||
"owner_workplan_status": "proposed",
|
||||
"owner_tasks": {
|
||||
"T01": "progress",
|
||||
"T02": "done",
|
||||
"T03": "todo"
|
||||
},
|
||||
"source_task_complete_only": true
|
||||
},
|
||||
"shared_client_source_progress": {
|
||||
"packet": "docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1",
|
||||
"issuer_commit": "git:08c083bae9ff35fbaf028c36d72a95b57d2541b7",
|
||||
"warden_commit": "git:08c098e64a9afd89e43f65436782ed2bb69cdfbd",
|
||||
"complete_issuer_race_passes_including_subtests": 724,
|
||||
"existing_native_external_skips": 6,
|
||||
"warden_canonical_unit_passes": 796,
|
||||
"warden_deselected": 4,
|
||||
"built_cross_owner_fixture_assertions": 45,
|
||||
"owner_processes": 2,
|
||||
"generated_go_consumer_processes": 4,
|
||||
"exact_source_delta_replay_paths": 23,
|
||||
"single_generated_producer_export_and_drift_refusal": true,
|
||||
"independent_owner_assent": false,
|
||||
"native_admission": false,
|
||||
"second_real_consumer": false,
|
||||
"native_gates_closed": 0,
|
||||
"both_owner_primary_projections_verified": true
|
||||
},
|
||||
"current_callback_source_progress": {
|
||||
"packet": "docs/changes/netkingdom-target-2026-10-18/forgejo-current-token-r1",
|
||||
"issuer_revision": "git:e2c5a947829568baf837543a6708fd0c3f6a863b",
|
||||
"apps_revision": "git:ab3cf5cdc56d085d040256e2e84633b0289ab0af",
|
||||
"consumer_source_postimages_exact": 49,
|
||||
"issuer_source_postimages_exact": 6,
|
||||
"latest_focused_results": 91,
|
||||
"final_composed_results": 116,
|
||||
"composed_skips": 0,
|
||||
"complete_issuer_race_results": 726,
|
||||
"existing_native_external_skips": 6,
|
||||
"actual_issuer_consumer_processes": 5,
|
||||
"original_purpose_and_issuer_failures_retained": true,
|
||||
"synthetic_MFA_and_PDP_admission": true,
|
||||
"independent_owner_assent": false,
|
||||
"complete_release_rebuild": false,
|
||||
"native_admission": false,
|
||||
"native_gates_closed": 0,
|
||||
"both_owner_primary_projections_verified": true
|
||||
},
|
||||
"ongoing_access_profile": {
|
||||
"selection": "Require current KeyCape checks on every ongoing API/Git/SSH operation for linked Forgejo accounts; retain separate local break-glass path",
|
||||
"selected_by": "user conversation response",
|
||||
"decision": "b96ef564-c713-4a48-9ab2-849958cec681",
|
||||
"implementation_status": "incomplete",
|
||||
"native_rollout_authority": false
|
||||
},
|
||||
"receive_scanner_source_progress": {
|
||||
"packet": "docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1",
|
||||
"source_commit": "git:ea65606c1298db782f721f9443bafeb03cdef138",
|
||||
"owner_primary_projection_verified": true,
|
||||
"source_delta_paths": 6,
|
||||
"distinct_passed_leaf_cases": 54,
|
||||
"skipped": 0,
|
||||
"exact_original_delta_objects": 141,
|
||||
"exact_original_delta_refs": 1,
|
||||
"exact_original_delta_seconds": 52.53,
|
||||
"unchanged_deadline_seconds": 90,
|
||||
"candidate_binary_sha256": "sha256:73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a",
|
||||
"installed_hook_inventory": 166,
|
||||
"conditional_source_fields_only": 2,
|
||||
"server_dry_runs_passed": true,
|
||||
"activation_executor_complete": false,
|
||||
"independent_owner_assent": false,
|
||||
"native_admission": false,
|
||||
"native_gates_closed": 0,
|
||||
"root_remote_publication_complete": false,
|
||||
"owner_workplan": "FORGE-WP-0010",
|
||||
"owner_tasks": {
|
||||
"T01": "done",
|
||||
"T02": "progress",
|
||||
"T03": "wait"
|
||||
}
|
||||
},
|
||||
"tracking_refinement": {
|
||||
"workplan": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md",
|
||||
"decision": "77f88913-e893-42c8-992d-2f67df0a13db",
|
||||
"original_6_bindings_and_statuses_preserved": true,
|
||||
"additional_delivery_checkpoints": 34,
|
||||
"delivery_status_counts": {
|
||||
"done_source_evidence": 7,
|
||||
"progress": 1,
|
||||
"todo": 26
|
||||
},
|
||||
"raw_task_counts": {
|
||||
"done": 9,
|
||||
"progress": 4,
|
||||
"todo": 27
|
||||
},
|
||||
"current_checkpoint": "CUST-WP-0080-T20",
|
||||
"next_checkpoints": [
|
||||
"CUST-WP-0080-T14",
|
||||
"CUST-WP-0080-T15"
|
||||
],
|
||||
"completed_source_records_do_not_close_native_gates": true,
|
||||
"coverage_validation": "docs/changes/netkingdom-target-2026-10-18/wp80-workplan-refinement-r1/validation.json"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,57 @@
|
|||
# Receive scanner: bounded small-input source correction
|
||||
|
||||
Published owner source: railiance-forge
|
||||
`ea65606c1298db782f721f9443bafeb03cdef138`, six files, ordinary hooks and primary
|
||||
projection verified. Existing unrelated WORK-RECORDS bytes/index were preserved.
|
||||
FORGE-WP-0010-T01 is done; T02 remains progress and T03 waits for native admission.
|
||||
Finished FORGE-WP-0006 and unpromoted FORGE-WP-0008 retain their original scopes.
|
||||
|
||||
The unchanged adapter reproduced the refused Custodian publication: after 90.06
|
||||
seconds, 94 of 141 introduced objects were scanned and the result was unverified.
|
||||
It starts Gitleaks once for every object. The existing Repo Manager profile
|
||||
provides the correction: batch up to 64 inputs of at most 4096 bytes; retain the
|
||||
original stdin fragment path for larger inputs. Scanner 8.30.1, default rules,
|
||||
object/ref coverage, all size/count limits and the 90-second deadline are unchanged.
|
||||
|
||||
The final production source scans all 141 objects and one ref in 52.53 seconds.
|
||||
The full suite passes 49 leaf cases; five additional boundary cases bring the
|
||||
distinct combined coverage to 54, with zero skips. It covers actual receive-pack
|
||||
quarantine, historical/merge/tag/ref content, suppression attempts and limits,
|
||||
binary inputs, the 4096-byte boundary, larger-input stdin behavior, strict
|
||||
diagnostic/report handling, receiver loss, reader termination and identity-checked
|
||||
cleanup. Separate actual helper processes refuse unavailable and ordinary-disk
|
||||
storage. Raw fixture inputs exist only in private namespace tmpfs or process memory.
|
||||
|
||||
The original repeated-character token fixture failed its reference check: the
|
||||
existing stdin scanner did not detect it. No directory parity claim is made for
|
||||
that attempt. The fixture now generates a high-entropy synthetic value. The failed attempt is
|
||||
retained. The first missing-storage harness accidentally retained bwrap's default
|
||||
tmpfs; a later file-over-directory mount was rejected by bwrap itself. Neither
|
||||
counts as storage-refusal proof. The corrected unavailable-root and ordinary-disk
|
||||
checks both return the adapter's fixed `volatile-storage-unavailable` refusal.
|
||||
Early read-only preflight failures and syntax/setup refinements also remain visible.
|
||||
|
||||
Read-only native inspection verifies the intended dual-stack node, Linux 6.8,
|
||||
UID 1000, actual tmpfs, unchanged installed binary/scanner hashes and 166 identical
|
||||
installed hook fragments. It corrects the assumed repository path to
|
||||
`/data/git/gitea-repositories`. The old Helm release predates intervening live
|
||||
changes, so it must not be replayed for this correction.
|
||||
|
||||
`native-preparation/` contains two proposed public Apps source files, the immutable
|
||||
new hook ConfigMap and a conditional Deployment patch. Only the existing startup
|
||||
guard command and hook ConfigMap reference change. Reused Forgejo patch helpers
|
||||
prove local forward/inverse restoration and exact Deployment/ConfigMap server dry
|
||||
runs. This is preparation, not an activation proposal ready for approval: the
|
||||
sealed activation/recovery executor, final drift/resource preflight, independent
|
||||
owner/package admission and founder go remain necessary. No native artifact,
|
||||
hook, Deployment, credential, policy, image or database changed.
|
||||
|
||||
Key evidence: `combined-tests.json`, `scan-r2.json`, `build-provenance.json`,
|
||||
`native-hook-inventory.json`, `native-preparation/preparation.json`,
|
||||
`publication-commit.json` and `projection.json`. Baseline reproduction is in
|
||||
`../receive-scanner-budget-r1/`. The binary stays outside Git. Source postimages
|
||||
and the exact patch are retained here; owner Git is authoritative.
|
||||
|
||||
CUST-WP-0080 remains 2/6 coordinator tasks done with 0/16 complete native target
|
||||
gates closed. G01–G13 and all 116 ledger entries remain required. Latest root
|
||||
evidence is still unpublished remotely because the old live scanner is unchanged.
|
||||
|
|
@ -0,0 +1,37 @@
|
|||
"""Apply six reviewed public source files; no live/control installation."""
|
||||
from pathlib import Path
|
||||
import hashlib
|
||||
import json
|
||||
import os
|
||||
import subprocess
|
||||
|
||||
HERE = Path(__file__).resolve().parent
|
||||
ROOT = Path('/home/worsch/railiance-forge')
|
||||
manifest=json.loads((HERE/'publication-inputs.json').read_text())
|
||||
def git(*args):
|
||||
return subprocess.check_output(['git','-C',str(ROOT),*args],stderr=subprocess.PIPE).decode().strip()
|
||||
assert git('rev-parse','HEAD')==manifest['base_revision']
|
||||
original={}
|
||||
for name in ['.custodian-brief.md','WORK-RECORDS.md']:
|
||||
original[name]={'bytes':(ROOT/name).read_bytes(), 'index':git('ls-files','--stage','--',name)}
|
||||
for row in manifest['files']:
|
||||
path=ROOT/row['path']; source=HERE/'owner-source'/row['path']
|
||||
assert hashlib.sha256(source.read_bytes()).hexdigest()==row['sha256']
|
||||
assert not path.is_symlink()
|
||||
assert (hashlib.sha256(path.read_bytes()).hexdigest() if path.exists() else None)==row['prior_sha256']
|
||||
receipt=HERE/'source-application.json'
|
||||
assert not receipt.exists()
|
||||
for row in manifest['files']:
|
||||
path=ROOT/row['path']; source=HERE/'owner-source'/row['path']
|
||||
temp=path.with_name(path.name+'.cust80-tmp')
|
||||
with temp.open('xb') as f:
|
||||
os.chmod(temp,0o644)
|
||||
f.write(source.read_bytes())
|
||||
f.flush(); os.fsync(f.fileno())
|
||||
os.replace(temp,path)
|
||||
for name, old in original.items():
|
||||
assert (ROOT/name).read_bytes()==old['bytes']
|
||||
assert git('ls-files','--stage','--',name)==old['index']
|
||||
receipt.write_text(json.dumps({'source_applied':True,'base_revision':manifest['base_revision'],
|
||||
'files':manifest['files'],'original_unrelated_state_preserved':True,'native_changed':False},indent=2)+'\n')
|
||||
print(json.dumps({'source_applied':True,'files':len(manifest['files']),'native_changed':False}))
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
{
|
||||
"owner": "railiance-forge",
|
||||
"base_revision": "git:b42206e52bce0e11f9615b4e774f80f9015a1ef7",
|
||||
"workspace": "/tmp/custodian-receive-scanner-batch-r1/source",
|
||||
"goal": "CUST-WP-0080 G07/TSA-10/TSA-15; source correction only",
|
||||
"native_authority": false
|
||||
}
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
/tmp/custodian-receive-scanner-batch-r1/candidate-hook: go1.26.7
|
||||
path railiance-forge/receive-secret-scan
|
||||
mod railiance-forge/receive-secret-scan (devel)
|
||||
build -buildmode=exe
|
||||
build -compiler=gc
|
||||
build -trimpath=true
|
||||
build DefaultGODEBUG=asynctimerchan=1,containermaxprocs=0,cryptocustomrand=1,decoratemappings=0,gotestjsonbuildtext=1,gotypesalias=0,httpcookiemaxnum=0,httpservecontentkeepheaders=1,multipathtcp=0,randseednop=0,rsa1024min=0,tls3des=1,tlsmlkem=0,tlssecpmlkem=0,tlssha1=1,updatemaxprocs=0,urlmaxqueryparams=0,urlstrictcolons=0,winreadlinkvolume=0,winsymlink=0,x509keypairleaf=0,x509negativeserial=1,x509rsacrt=0,x509sha256skid=0,x509usepolicies=0
|
||||
build CGO_ENABLED=0
|
||||
build GOARCH=amd64
|
||||
build GOOS=linux
|
||||
build GOAMD64=v1
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
{
|
||||
"compiler_version": "go1.26.7",
|
||||
"compiler_sha256": "182d1dc98119d61a6241590e1aaca180d771dbcb1133b9846684aee82d457362",
|
||||
"installed_module_ziphash": "h1:BbG1DRIqH1ZVMRnQg/4M6jtOJjMFUusUjI+kXRBWqE8=",
|
||||
"go_module_dependencies": [],
|
||||
"candidate_binary_sha256": "73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a",
|
||||
"scanner_version": "8.30.1",
|
||||
"scanner_sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509",
|
||||
"native_admission": false,
|
||||
"source_commit": "ea65606c1298db782f721f9443bafeb03cdef138"
|
||||
}
|
||||
|
|
@ -0,0 +1,95 @@
|
|||
{
|
||||
"returncode": 0,
|
||||
"seconds": 12.06,
|
||||
"argv": [
|
||||
"bwrap",
|
||||
"--unshare-net",
|
||||
"--unshare-pid",
|
||||
"--die-with-parent",
|
||||
"--new-session",
|
||||
"--ro-bind",
|
||||
"/usr",
|
||||
"/usr",
|
||||
"--ro-bind",
|
||||
"/lib",
|
||||
"/lib",
|
||||
"--ro-bind",
|
||||
"/lib64",
|
||||
"/lib64",
|
||||
"--symlink",
|
||||
"usr/bin",
|
||||
"/bin",
|
||||
"--proc",
|
||||
"/proc",
|
||||
"--dev",
|
||||
"/dev",
|
||||
"--tmpfs",
|
||||
"/dev/shm",
|
||||
"--tmpfs",
|
||||
"/tmp",
|
||||
"--bind",
|
||||
"/tmp/custodian-receive-scanner-batch-r1",
|
||||
"/work",
|
||||
"--ro-bind",
|
||||
"/tmp/custodian-receive-scanner-budget-r1/fixture.git",
|
||||
"/fixture",
|
||||
"--ro-bind",
|
||||
"/home/worsch/the-custodian/.git/objects",
|
||||
"/source-objects",
|
||||
"--ro-bind",
|
||||
"/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks",
|
||||
"/scanner",
|
||||
"--ro-bind",
|
||||
"/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
|
||||
"/toolchain",
|
||||
"--chdir",
|
||||
"/work/source/tools/receive-secret-scan",
|
||||
"--clearenv",
|
||||
"--setenv",
|
||||
"PATH",
|
||||
"/toolchain/bin:/usr/bin:/bin",
|
||||
"--setenv",
|
||||
"HOME",
|
||||
"/work/home",
|
||||
"--setenv",
|
||||
"GOTOOLCHAIN",
|
||||
"local",
|
||||
"--setenv",
|
||||
"GOPROXY",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOSUMDB",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOCACHE",
|
||||
"/work/gocache",
|
||||
"--setenv",
|
||||
"GOMAXPROCS",
|
||||
"2",
|
||||
"--setenv",
|
||||
"CGO_ENABLED",
|
||||
"0",
|
||||
"--setenv",
|
||||
"FORGE_TEST_GITLEAKS",
|
||||
"/scanner",
|
||||
"--",
|
||||
"go",
|
||||
"build",
|
||||
"-buildvcs=false",
|
||||
"-trimpath",
|
||||
"-o",
|
||||
"/work/candidate-hook",
|
||||
"."
|
||||
],
|
||||
"real_remote_ref_changed": false,
|
||||
"real_credentials": false,
|
||||
"native_acceptance": false,
|
||||
"source_sha256": {
|
||||
"batch.go": "24a98fc3a25c441f2c10f1c38efdeeb72851de7faeb8c1fabc02a8cd9f72f9f2",
|
||||
"batch_test.go": "eba7729797e3f559a6ea1622d5b6ec29700cf5396787b5ad666911e7f1be0b8a",
|
||||
"main.go": "25e41047bcf881a90bb9536583d6df72c73e868df0ee2fd3527de6d31740fbb7",
|
||||
"main_test.go": "306dfd8ff06ccb22cb5e7f38894725eb3900b81645d8b922a340e8ab239ffee5",
|
||||
"volatile.go": "d8cc0379d6f57743ab74f0318076b362b48de964631fa77f4d282b6993da8610"
|
||||
},
|
||||
"binary_sha256": "sha256:0af7a100c3ade1ab4a6755d6354a78f50f86301a149d3b035f6cc648a524d489"
|
||||
}
|
||||
|
|
@ -0,0 +1,95 @@
|
|||
{
|
||||
"returncode": 0,
|
||||
"seconds": 1.07,
|
||||
"argv": [
|
||||
"bwrap",
|
||||
"--unshare-net",
|
||||
"--unshare-pid",
|
||||
"--die-with-parent",
|
||||
"--new-session",
|
||||
"--ro-bind",
|
||||
"/usr",
|
||||
"/usr",
|
||||
"--ro-bind",
|
||||
"/lib",
|
||||
"/lib",
|
||||
"--ro-bind",
|
||||
"/lib64",
|
||||
"/lib64",
|
||||
"--symlink",
|
||||
"usr/bin",
|
||||
"/bin",
|
||||
"--proc",
|
||||
"/proc",
|
||||
"--dev",
|
||||
"/dev",
|
||||
"--tmpfs",
|
||||
"/dev/shm",
|
||||
"--tmpfs",
|
||||
"/tmp",
|
||||
"--bind",
|
||||
"/tmp/custodian-receive-scanner-batch-r1",
|
||||
"/work",
|
||||
"--ro-bind",
|
||||
"/tmp/custodian-receive-scanner-budget-r1/fixture.git",
|
||||
"/fixture",
|
||||
"--ro-bind",
|
||||
"/home/worsch/the-custodian/.git/objects",
|
||||
"/source-objects",
|
||||
"--ro-bind",
|
||||
"/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks",
|
||||
"/scanner",
|
||||
"--ro-bind",
|
||||
"/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
|
||||
"/toolchain",
|
||||
"--chdir",
|
||||
"/work/source/tools/receive-secret-scan",
|
||||
"--clearenv",
|
||||
"--setenv",
|
||||
"PATH",
|
||||
"/toolchain/bin:/usr/bin:/bin",
|
||||
"--setenv",
|
||||
"HOME",
|
||||
"/work/home",
|
||||
"--setenv",
|
||||
"GOTOOLCHAIN",
|
||||
"local",
|
||||
"--setenv",
|
||||
"GOPROXY",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOSUMDB",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOCACHE",
|
||||
"/work/gocache",
|
||||
"--setenv",
|
||||
"GOMAXPROCS",
|
||||
"2",
|
||||
"--setenv",
|
||||
"CGO_ENABLED",
|
||||
"0",
|
||||
"--setenv",
|
||||
"FORGE_TEST_GITLEAKS",
|
||||
"/scanner",
|
||||
"--",
|
||||
"go",
|
||||
"build",
|
||||
"-buildvcs=false",
|
||||
"-trimpath",
|
||||
"-o",
|
||||
"/work/candidate-hook",
|
||||
"."
|
||||
],
|
||||
"real_remote_ref_changed": false,
|
||||
"real_credentials": false,
|
||||
"native_acceptance": false,
|
||||
"source_sha256": {
|
||||
"batch.go": "1b3fd8d534686758d7489a5f3e0208acf6ed6304adac63ae95af3bcccccb98e8",
|
||||
"batch_test.go": "4edf51a3c38f3ad4f5484294fc32e5b5637f8b7caae556dff555c48ad28d87a1",
|
||||
"main.go": "25e41047bcf881a90bb9536583d6df72c73e868df0ee2fd3527de6d31740fbb7",
|
||||
"main_test.go": "306dfd8ff06ccb22cb5e7f38894725eb3900b81645d8b922a340e8ab239ffee5",
|
||||
"volatile.go": "d8cc0379d6f57743ab74f0318076b362b48de964631fa77f4d282b6993da8610"
|
||||
},
|
||||
"binary_sha256": "sha256:73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a"
|
||||
}
|
||||
|
|
@ -0,0 +1,64 @@
|
|||
{
|
||||
"full_suite": "test-r2.json",
|
||||
"additional_affected_checks": "test-r3.json",
|
||||
"distinct_passed_leaf_cases": 54,
|
||||
"distinct_passed_nodes": 59,
|
||||
"failed": 0,
|
||||
"skipped": 0,
|
||||
"leaf_cases": [
|
||||
"TestBatchAndLargerInputPushBoundaries/exact-limit-key",
|
||||
"TestBatchAndLargerInputPushBoundaries/larger-stdin-clean",
|
||||
"TestBatchAndLargerInputPushBoundaries/larger-stdin-key",
|
||||
"TestBatchAndLargerInputPushBoundaries/multiple-ref-name-detection",
|
||||
"TestBatchRefusesUnverifiedReportsAndDiagnostics",
|
||||
"TestCappedOutput",
|
||||
"TestGitEnvironmentDoesNotInheritConfigOrSecrets",
|
||||
"TestNativePushBoundaries/aggregate-byte-limit-refused",
|
||||
"TestNativePushBoundaries/annotated-tag-message",
|
||||
"TestNativePushBoundaries/clean-existing-and-new-branch-and-deletion",
|
||||
"TestNativePushBoundaries/commit-message",
|
||||
"TestNativePushBoundaries/external-gitlink-refused",
|
||||
"TestNativePushBoundaries/grafts-cannot-hide-introduced-history",
|
||||
"TestNativePushBoundaries/initial-repository-clean-and-secret/false",
|
||||
"TestNativePushBoundaries/initial-repository-clean-and-secret/true",
|
||||
"TestNativePushBoundaries/inline-and-config-suppression-refused",
|
||||
"TestNativePushBoundaries/merge-second-parent-history",
|
||||
"TestNativePushBoundaries/missing-scanner-and-deletion-refused",
|
||||
"TestNativePushBoundaries/multi-ref-all-refused",
|
||||
"TestNativePushBoundaries/new-branch-and-force-update",
|
||||
"TestNativePushBoundaries/object-count-limit-refused",
|
||||
"TestNativePushBoundaries/oversized-object-refused",
|
||||
"TestNativePushBoundaries/partial-config-include-refused",
|
||||
"TestNativePushBoundaries/partial-repository-refused",
|
||||
"TestNativePushBoundaries/ref-name-token",
|
||||
"TestNativePushBoundaries/replacement-objects-cannot-hide-secret",
|
||||
"TestNativePushBoundaries/secret-added-then-deleted",
|
||||
"TestNativePushBoundaries/secret-in-tip",
|
||||
"TestNativePushBoundaries/sha256-object-format",
|
||||
"TestNativePushBoundaries/tag-direct-to-blob",
|
||||
"TestNativePushBoundaries/wrong-executable-refused",
|
||||
"TestReceiverDeathCleansStorageAndStopsReader",
|
||||
"TestScannerFileAndTimeoutRefusal/expired-context",
|
||||
"TestScannerFileAndTimeoutRefusal/nonexecutable",
|
||||
"TestScannerFileAndTimeoutRefusal/scanner-process-failure",
|
||||
"TestScannerFileAndTimeoutRefusal/symlink",
|
||||
"TestScannerFileAndTimeoutRefusal/unknown-old-ref",
|
||||
"TestSmallInputParity/binary-private-key",
|
||||
"TestSmallInputParity/binary-token",
|
||||
"TestSmallInputParity/clean",
|
||||
"TestSmallInputParity/empty",
|
||||
"TestSmallInputParity/exact-limit",
|
||||
"TestSmallInputParity/exact-limit-private-key",
|
||||
"TestSmallInputParity/expired-context",
|
||||
"TestSmallInputParity/inline-suppression",
|
||||
"TestSmallInputParity/invalid-inputs",
|
||||
"TestSmallInputParity/private-key",
|
||||
"TestSmallInputParity/scanner-failure",
|
||||
"TestSmallInputParity/sixty-four-distinct-inputs",
|
||||
"TestSmallInputParity/token",
|
||||
"TestTreeRefusesMalformedAndExternalEntries",
|
||||
"TestUpdateInputRefusesAmbiguity",
|
||||
"TestVolatileIdentityRefusesReplacement",
|
||||
"TestVolatileStorageLifecycle"
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,95 @@
|
|||
{
|
||||
"returncode": 0,
|
||||
"seconds": 0.87,
|
||||
"argv": [
|
||||
"bwrap",
|
||||
"--unshare-net",
|
||||
"--unshare-pid",
|
||||
"--die-with-parent",
|
||||
"--new-session",
|
||||
"--ro-bind",
|
||||
"/usr",
|
||||
"/usr",
|
||||
"--ro-bind",
|
||||
"/lib",
|
||||
"/lib",
|
||||
"--ro-bind",
|
||||
"/lib64",
|
||||
"/lib64",
|
||||
"--symlink",
|
||||
"usr/bin",
|
||||
"/bin",
|
||||
"--proc",
|
||||
"/proc",
|
||||
"--dev",
|
||||
"/dev",
|
||||
"--tmpfs",
|
||||
"/tmp",
|
||||
"--bind",
|
||||
"/tmp/custodian-receive-scanner-batch-r1",
|
||||
"/work",
|
||||
"--ro-bind",
|
||||
"/tmp/custodian-receive-scanner-budget-r1/fixture.git",
|
||||
"/fixture",
|
||||
"--ro-bind",
|
||||
"/home/worsch/the-custodian/.git/objects",
|
||||
"/source-objects",
|
||||
"--ro-bind",
|
||||
"/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks",
|
||||
"/scanner",
|
||||
"--ro-bind",
|
||||
"/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
|
||||
"/toolchain",
|
||||
"--chdir",
|
||||
"/work/source/tools/receive-secret-scan",
|
||||
"--clearenv",
|
||||
"--tmpfs",
|
||||
"/dev/shm",
|
||||
"--setenv",
|
||||
"PATH",
|
||||
"/toolchain/bin:/usr/bin:/bin",
|
||||
"--setenv",
|
||||
"HOME",
|
||||
"/work/home",
|
||||
"--setenv",
|
||||
"GOTOOLCHAIN",
|
||||
"local",
|
||||
"--setenv",
|
||||
"GOPROXY",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOSUMDB",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOCACHE",
|
||||
"/work/gocache",
|
||||
"--setenv",
|
||||
"GOMAXPROCS",
|
||||
"2",
|
||||
"--setenv",
|
||||
"CGO_ENABLED",
|
||||
"0",
|
||||
"--setenv",
|
||||
"FORGE_TEST_GITLEAKS",
|
||||
"/scanner",
|
||||
"--",
|
||||
"go",
|
||||
"test",
|
||||
"-buildvcs=false",
|
||||
"-c",
|
||||
"-o",
|
||||
"/work/scanner.test",
|
||||
"."
|
||||
],
|
||||
"real_remote_ref_changed": false,
|
||||
"real_credentials": false,
|
||||
"native_acceptance": false,
|
||||
"source_sha256": {
|
||||
"batch.go": "1b3fd8d534686758d7489a5f3e0208acf6ed6304adac63ae95af3bcccccb98e8",
|
||||
"batch_test.go": "477762327353ed88526b8f79e563872c8ee80a4fd27c47c03f20db6cf20e4569",
|
||||
"main.go": "25e41047bcf881a90bb9536583d6df72c73e868df0ee2fd3527de6d31740fbb7",
|
||||
"main_test.go": "306dfd8ff06ccb22cb5e7f38894725eb3900b81645d8b922a340e8ab239ffee5",
|
||||
"volatile.go": "d8cc0379d6f57743ab74f0318076b362b48de964631fa77f4d282b6993da8610"
|
||||
},
|
||||
"binary_sha256": "sha256:73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a"
|
||||
}
|
||||
|
|
@ -0,0 +1,106 @@
|
|||
{
|
||||
"repo_slug": "railiance-forge",
|
||||
"repo_path": "/home/worsch/railiance-forge",
|
||||
"source_revision": "ea65606c1298db782f721f9443bafeb03cdef138",
|
||||
"source_revision_reason": null,
|
||||
"issues": [
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-35",
|
||||
"message": "Repo Manager warning: .repo-classification.yaml: category is project but slug is not prj-*; not every category:project is a prj- repo",
|
||||
"file_path": ".repo-classification.yaml",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-35",
|
||||
"message": "Repo Manager warning: workplans/: repository uses more than one workplan prefix: ['FORGE-WP', 'RAILIANCE-WP', 'RFORGE-WP']",
|
||||
"file_path": "workplans/",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-33",
|
||||
"message": "WORK-RECORDS.md is missing or stale \u2014 regenerate via fix-consistency (CUST-WP-0061-T04 generated work-record index)",
|
||||
"file_path": "WORK-RECORDS.md",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-06",
|
||||
"message": "Authoritative workplan 04d8ebb9\u2026 is absent from this projection",
|
||||
"file_path": "workplans/FORGE-WP-0010-receive-scanner-budget.md",
|
||||
"db_id": "04d8ebb9-e9fe-58d8-bdc8-2aa985098c7a",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-28",
|
||||
"message": "4 unread inbox message(s) older than 3 day(s): the-custodian:23172cb2, the-custodian:338888ac, the-custodian:51e9eace, the-custodian:89854bab",
|
||||
"file_path": "",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-28",
|
||||
"message": "4 unread message(s) lack thread_id for supersession tracking: the-custodian:23172cb2, the-custodian:338888ac, the-custodian:51e9eace, the-custodian:89854bab",
|
||||
"file_path": "",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-26",
|
||||
"message": "Workplan id 'RFORGE-WP-0002' uses prefix 'RFORGE-WP' but repo canonical prefix is 'FORGE-WP' \u2014 new plans must conform",
|
||||
"file_path": "workplans/RFORGE-WP-0002-forge-resource-economics-evidence.md",
|
||||
"db_id": "",
|
||||
"file_value": "RFORGE-WP-0002",
|
||||
"db_value": "FORGE-WP",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-26",
|
||||
"message": "Workplan id 'RAILIANCE-WP-0001' uses prefix 'RAILIANCE-WP' but repo canonical prefix is 'FORGE-WP' \u2014 new plans must conform",
|
||||
"file_path": "workplans/archived/260605-RAILIANCE-WP-0001-statehub-bootstrap.md",
|
||||
"db_id": "",
|
||||
"file_value": "RAILIANCE-WP-0001",
|
||||
"db_value": "FORGE-WP",
|
||||
"fixable": false
|
||||
}
|
||||
],
|
||||
"fixes_applied": [
|
||||
"bindings: synced 11/12",
|
||||
"C-17 cleared: pushed 1 backlogged commit(s)",
|
||||
"C-33 fixed: regenerated WORK-RECORDS.md",
|
||||
"C-06 fixed: created workstream 04d8ebb9\u2026 for FORGE-WP-0010, wrote ID to FORGE-WP-0010-receive-scanner-budget.md",
|
||||
" + task FORGE-WP-0010-T01 \u2192 c61c0392\u2026",
|
||||
" + task FORGE-WP-0010-T02 \u2192 b49d34ef\u2026",
|
||||
" + task FORGE-WP-0010-T03 \u2192 863c91e4\u2026",
|
||||
"brief: .custodian-brief.md updated",
|
||||
"push: pushed"
|
||||
],
|
||||
"summary": {
|
||||
"fail": 0,
|
||||
"automation_error": 0,
|
||||
"warn": 8,
|
||||
"info": 0
|
||||
},
|
||||
"result": "warn"
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
WARN: git commit failed for writeback: Generated-only commits rejected: staged
|
||||
|
|
@ -0,0 +1,38 @@
|
|||
{
|
||||
"schema": "repo-manager.identifier-assignment.v1",
|
||||
"ok": true,
|
||||
"executed": true,
|
||||
"repo": "source",
|
||||
"namespace": "helixforge",
|
||||
"assignments": [
|
||||
{
|
||||
"kind": "workplan",
|
||||
"record_id": "FORGE-WP-0010",
|
||||
"uuid": "04d8ebb9-e9fe-58d8-bdc8-2aa985098c7a",
|
||||
"path": "workplans/FORGE-WP-0010-receive-scanner-budget.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "FORGE-WP-0010-T01",
|
||||
"uuid": "c61c0392-6c0a-5a36-bbd1-4ee6aeb2afea",
|
||||
"path": "workplans/FORGE-WP-0010-receive-scanner-budget.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "FORGE-WP-0010-T02",
|
||||
"uuid": "b49d34ef-e6e5-5674-b523-ebcf80e0dcca",
|
||||
"path": "workplans/FORGE-WP-0010-receive-scanner-budget.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "FORGE-WP-0010-T03",
|
||||
"uuid": "863c91e4-7c25-575f-b8b6-f98d0074ce5a",
|
||||
"path": "workplans/FORGE-WP-0010-receive-scanner-budget.md"
|
||||
}
|
||||
],
|
||||
"historical_invalid_identifiers": [],
|
||||
"historical_identity_collisions": [],
|
||||
"files_changed": [
|
||||
"workplans/FORGE-WP-0010-receive-scanner-budget.md"
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,78 @@
|
|||
"""Read only known public scanner paths; suppress raw cluster errors."""
|
||||
from pathlib import Path
|
||||
import argparse
|
||||
import json
|
||||
import subprocess
|
||||
|
||||
HERE = Path(__file__).resolve().parent
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument('--attempt', required=True)
|
||||
args = parser.parse_args()
|
||||
assert args.attempt.isalnum()
|
||||
remote = r'''
|
||||
import json, subprocess
|
||||
def call(args, stage='metadata'):
|
||||
p = subprocess.run(args, capture_output=True, text=True, timeout=30)
|
||||
if p.returncode:
|
||||
print(json.dumps({'error':'metadata-command-refused', 'stage':stage}))
|
||||
raise SystemExit(2)
|
||||
return p.stdout
|
||||
items=json.loads(call(['kubectl','get','nodes','-o','json']))['items']
|
||||
nodes=[a['address'] for n in items for a in n['status']['addresses'] if a['type']=='InternalIP']
|
||||
if len(items)!=1 or '92.205.62.239' not in nodes:
|
||||
print(json.dumps({'error':'target-node-mismatch', 'node_count':len(items), 'internal_ips':nodes})); raise SystemExit(2)
|
||||
pods=call(['kubectl','-n','forgejo','get','pods','-o','custom-columns=NAME:.metadata.name,UID:.metadata.uid,PHASE:.status.phase','--no-headers'])
|
||||
running=[line.split() for line in pods.splitlines() if line.startswith('forgejo-gitea-') and line.split()[-1]=='Running']
|
||||
if len(running)!=1:
|
||||
raise RuntimeError('ambiguous-forgejo-pod')
|
||||
pod,uid,_=running[0]
|
||||
paths=[
|
||||
'/data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan',
|
||||
'/data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks',
|
||||
'/opt/forge-secret-template/hooks/pre-receive.d/10-custodian-secret-scan',
|
||||
'/data/git/repositories/coulomb/the-custodian.git/hooks/pre-receive.d/10-custodian-secret-scan',
|
||||
]
|
||||
script='set -eu\nid -u\nuname -r\nstat -f -c %t /dev/shm\nstat -c "%a:%u:%g:%F" /dev/shm\n'
|
||||
for path in paths:
|
||||
script+='if test -f '+path+' && test ! -L '+path+'; then\nstat -c "%a:%u:%g:%F" '+path+'\nsha256sum '+path+'\nelse\necho unavailable\nfi\n'
|
||||
script+="""
|
||||
for base in /data/git/repositories /data/git/gitea-repositories /data/gitea/repositories; do
|
||||
if test -d "$base"; then printf 'root=%s\\n' "$base"; fi
|
||||
for path in "$base"/*/*.git/hooks/pre-receive.d/10-custodian-secret-scan; do
|
||||
if test -f "$path" && test ! -L "$path"; then
|
||||
printf 'hook=%s\\n' "$path"
|
||||
stat -c "%a:%u:%g:%F" "$path"
|
||||
sha256sum "$path"
|
||||
fi
|
||||
done
|
||||
done
|
||||
"""
|
||||
output=call(['kubectl','-n','forgejo','exec',pod,'--','sh','-c',script], stage='public-file-metadata')
|
||||
current=call(['kubectl','-n','forgejo','get','pod',pod,'-o','custom-columns=UID:.metadata.uid','--no-headers']).strip()
|
||||
if current!=uid:
|
||||
raise RuntimeError('pod-identity-changed')
|
||||
print(json.dumps({'node_ip':'92.205.62.239', 'pod':pod, 'pod_uid':uid, 'read_only':True, 'public_scanner_metadata':output.splitlines()}))
|
||||
'''
|
||||
compile(remote, '<read-only-preflight>', 'exec')
|
||||
result = subprocess.run(['ssh', '-o', 'BatchMode=yes', 'railiance01', 'python3', '-'],
|
||||
input=remote, text=True, capture_output=True, timeout=150)
|
||||
receipt = {'returncode': result.returncode, 'read_only': True, 'real_credentials_retrieved': False}
|
||||
if result.returncode == 0:
|
||||
receipt['result'] = json.loads(result.stdout)
|
||||
else:
|
||||
receipt['error'] = 'read-only-metadata-refused; raw output suppressed'
|
||||
try:
|
||||
detail=json.loads(result.stdout)
|
||||
if detail.get('error') in {'metadata-command-refused', 'target-node-mismatch'}:
|
||||
receipt['detail']=detail
|
||||
except ValueError:
|
||||
pass
|
||||
path=HERE/('native-preflight-'+args.attempt+'.json')
|
||||
with path.open('x') as f:
|
||||
f.write(json.dumps(receipt, indent=2)+'\n')
|
||||
summary={k:receipt[k] for k in ['returncode','read_only','error','detail'] if k in receipt}
|
||||
if 'result' in receipt:
|
||||
summary.update({k:receipt['result'][k] for k in ['node_ip','pod','pod_uid']})
|
||||
summary['installed_hooks']=sum(line.startswith('hook=') for line in receipt['result']['public_scanner_metadata'])
|
||||
print(json.dumps(summary))
|
||||
raise SystemExit(result.returncode)
|
||||
|
|
@ -0,0 +1,836 @@
|
|||
{
|
||||
"pod": "forgejo-gitea-7474684b6-lnr9w",
|
||||
"pod_uid": "d4728052-b8df-4574-8a3e-74490a04472d",
|
||||
"hooks": [
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/access-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/activity-core.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/adaptive-pricing.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/agentic-resources.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/approval-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/arc-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/artifact-store.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/assembly-economics.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/audit-core.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/autonomy-canon.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/binect-chrome.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/binect-js.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/binky-control.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/can-you-assist.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/canned-prompts.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/citation-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/citation-evidence.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/citation-work.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/clay-borg.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/commerce-canon.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/config-atlas.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/content-explorer.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/coordination-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/core-hub.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/coulomb-loop.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/coulomb-research.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/coulomb-social.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/decision-canon.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/direkt-vermittlung-de.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/disaster-control.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/doc-store-pg.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/domain-tree.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/email-connect.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/emergent-security.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/evidence-anchor.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/evidence-binder.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/evidence-source.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/executor-sandbox.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/facetted-interfaces.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/feature-control.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/fin-hub.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/fluid-core.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/fluid-substack.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/fluid-telegram.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/fluid-x.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/forgejo-actions-probe.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/freedom-intelligence.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/frontend-patterns.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/gate-house.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/glas-harness.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/ground-game.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/guide-board.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/hall-of-helix.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/helix-forge.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/hub-core.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/human-resources.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/ihp-railiance-probe.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/inbound-library.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/info-tech-canon.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/informed-decision.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/infospace-bench.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/intelligence-radar.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/inter-hub-haskell.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/interface-canon.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/issue-core.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/kaizen-agentic.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/key-cape.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/kings-guard.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/kontextual-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/llm-connect.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/mail-address-semantics.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/marki-docx.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/markitect-filter.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/markitect-quarkdown.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/markitect-tool.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/maturity-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/net-kingdom.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/nudge-space.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/open-cmis-tck.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/open-reuse.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/ops-bridge.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/ops-hub.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/ops-mason.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/ops-warden.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/phase-memory.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/plenty-gobble.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/policy-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/polycode-sim.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/pqrst-practice.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/pr-hall-of-helix.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/prj-canon-federation.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/prj-forgejo-org-refactor.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/prj-helixforge-factory.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/prj-state-hub-retirement.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/prj-unattended-progress-company.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/python-snake.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/qonto-assistant.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/rail-knative.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/rail-kubernetes.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/railiance-apps.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/railiance-bootstrap.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/railiance-clock.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/railiance-cluster.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/railiance-enablement.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/railiance-fabric.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/railiance-forge.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/railiance-hosts.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/railiance-infra.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/railiance-master.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/railiance-platform.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/railiance-telemetry.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/ralph-workplan.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/rapp-canned-prompts.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/rapp-core-hub.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/rapp-forgejo.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/rapp-issue-core.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/rapp-openbao.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/rapp-playwright.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/rapp-policy-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/rapp-postgres.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/rapp-qonto.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/rapp-sbom-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/rapp-secrets-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/rapp-telemetry.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/rapp-tenant-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/rapp-user-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/reef-railiance.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/reef-storage.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/rein-aharness.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/rein-openweights.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/repo-manager.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/repo-scoping.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/repo-seed.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/resource-control.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/reuse-surface.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/risk-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/role-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/runbook-tutorials.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/sand-boxer.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/sbom-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/secrets-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/security-canon.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/shard-wiki.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/snuggles-inventor.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/soul-frame.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/state-hub.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/target-revenue.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/tegwick-control.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/tele-mcp.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/telegram-edge.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/tenant-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/test-driver.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/testdrive-jsui.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/the-custodian.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/timeline-svg.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/tmux-amq.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/user-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/vantage-point.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/vergabe-teilnahme.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/web-fetcher.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/whitehat-security.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/whynot-control.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/whynot-design.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/wise-validator.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/xperience-grader.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
},
|
||||
{
|
||||
"path": "/data/git/gitea-repositories/coulomb/zone-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"mode_owner": "775:1000:1000:regular file",
|
||||
"sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
{
|
||||
"returncode": 1,
|
||||
"read_only": true,
|
||||
"real_credentials_retrieved": false,
|
||||
"error": "read-only-metadata-refused; raw output suppressed"
|
||||
}
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
{
|
||||
"returncode": 1,
|
||||
"read_only": true,
|
||||
"real_credentials_retrieved": false,
|
||||
"error": "read-only-metadata-refused; raw output suppressed"
|
||||
}
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
{
|
||||
"returncode": 2,
|
||||
"read_only": true,
|
||||
"real_credentials_retrieved": false,
|
||||
"error": "read-only-metadata-refused; raw output suppressed",
|
||||
"detail": {
|
||||
"error": "target-node-mismatch"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
{
|
||||
"returncode": 0,
|
||||
"read_only": true,
|
||||
"real_credentials_retrieved": false,
|
||||
"result": {
|
||||
"node_ip": "92.205.62.239",
|
||||
"pod": "forgejo-gitea-7474684b6-lnr9w",
|
||||
"pod_uid": "d4728052-b8df-4574-8a3e-74490a04472d",
|
||||
"read_only": true,
|
||||
"public_scanner_metadata": [
|
||||
"1000",
|
||||
"6.8.0-136-generic",
|
||||
"1021994",
|
||||
"1777:0:0:directory",
|
||||
"755:1000:1000:regular file",
|
||||
"57a0642b625105440fe146fceb4d244fd2dd08a75beb316831675643e6cc27ec /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan",
|
||||
"755:1000:1000:regular file",
|
||||
"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509 /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks",
|
||||
"555:0:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /opt/forge-secret-template/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"unavailable"
|
||||
]
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
{
|
||||
"returncode": 0,
|
||||
"read_only": true,
|
||||
"real_credentials_retrieved": false,
|
||||
"result": {
|
||||
"node_ip": "92.205.62.239",
|
||||
"pod": "forgejo-gitea-7474684b6-lnr9w",
|
||||
"pod_uid": "d4728052-b8df-4574-8a3e-74490a04472d",
|
||||
"read_only": true,
|
||||
"public_scanner_metadata": [
|
||||
"1000",
|
||||
"6.8.0-136-generic",
|
||||
"1021994",
|
||||
"1777:0:0:directory",
|
||||
"755:1000:1000:regular file",
|
||||
"57a0642b625105440fe146fceb4d244fd2dd08a75beb316831675643e6cc27ec /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan",
|
||||
"755:1000:1000:regular file",
|
||||
"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509 /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks",
|
||||
"555:0:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /opt/forge-secret-template/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"unavailable"
|
||||
]
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
{
|
||||
"returncode": 1,
|
||||
"read_only": true,
|
||||
"real_credentials_retrieved": false,
|
||||
"error": "read-only-metadata-refused; raw output suppressed"
|
||||
}
|
||||
|
|
@ -0,0 +1,523 @@
|
|||
{
|
||||
"returncode": 0,
|
||||
"read_only": true,
|
||||
"real_credentials_retrieved": false,
|
||||
"result": {
|
||||
"node_ip": "92.205.62.239",
|
||||
"pod": "forgejo-gitea-7474684b6-lnr9w",
|
||||
"pod_uid": "d4728052-b8df-4574-8a3e-74490a04472d",
|
||||
"read_only": true,
|
||||
"public_scanner_metadata": [
|
||||
"1000",
|
||||
"6.8.0-136-generic",
|
||||
"1021994",
|
||||
"1777:0:0:directory",
|
||||
"755:1000:1000:regular file",
|
||||
"57a0642b625105440fe146fceb4d244fd2dd08a75beb316831675643e6cc27ec /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan",
|
||||
"755:1000:1000:regular file",
|
||||
"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509 /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks",
|
||||
"555:0:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /opt/forge-secret-template/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"unavailable",
|
||||
"root=/data/git/gitea-repositories",
|
||||
"hook=/data/git/gitea-repositories/coulomb/access-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/access-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/activity-core.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/activity-core.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/adaptive-pricing.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/adaptive-pricing.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/agentic-resources.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/agentic-resources.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/approval-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/approval-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/arc-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/arc-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/artifact-store.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/artifact-store.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/assembly-economics.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/assembly-economics.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/audit-core.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/audit-core.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/autonomy-canon.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/autonomy-canon.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/binect-chrome.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/binect-chrome.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/binect-js.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/binect-js.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/binky-control.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/binky-control.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/can-you-assist.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/can-you-assist.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/canned-prompts.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/canned-prompts.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/citation-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/citation-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/citation-evidence.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/citation-evidence.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/citation-work.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/citation-work.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/clay-borg.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/clay-borg.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/commerce-canon.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/commerce-canon.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/config-atlas.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/config-atlas.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/content-explorer.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/content-explorer.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/coordination-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/coordination-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/core-hub.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/core-hub.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/coulomb-loop.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/coulomb-loop.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/coulomb-research.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/coulomb-research.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/coulomb-social.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/coulomb-social.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/decision-canon.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/decision-canon.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/direkt-vermittlung-de.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/direkt-vermittlung-de.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/disaster-control.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/disaster-control.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/doc-store-pg.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/doc-store-pg.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/domain-tree.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/domain-tree.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/email-connect.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/email-connect.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/emergent-security.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/emergent-security.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/evidence-anchor.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/evidence-anchor.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/evidence-binder.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/evidence-binder.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/evidence-source.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/evidence-source.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/executor-sandbox.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/executor-sandbox.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/facetted-interfaces.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/facetted-interfaces.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/feature-control.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/feature-control.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/fin-hub.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/fin-hub.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/fluid-core.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/fluid-core.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/fluid-substack.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/fluid-substack.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/fluid-telegram.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/fluid-telegram.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/fluid-x.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/fluid-x.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/forgejo-actions-probe.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/forgejo-actions-probe.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/freedom-intelligence.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/freedom-intelligence.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/frontend-patterns.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/frontend-patterns.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/gate-house.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/gate-house.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/glas-harness.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/glas-harness.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/ground-game.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/ground-game.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/guide-board.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/guide-board.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/hall-of-helix.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/hall-of-helix.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/helix-forge.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/helix-forge.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/hub-core.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/hub-core.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/human-resources.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/human-resources.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/ihp-railiance-probe.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/ihp-railiance-probe.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/inbound-library.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/inbound-library.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/info-tech-canon.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/info-tech-canon.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/informed-decision.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/informed-decision.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/infospace-bench.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/infospace-bench.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/intelligence-radar.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/intelligence-radar.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/inter-hub-haskell.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/inter-hub-haskell.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/interface-canon.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/interface-canon.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/issue-core.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/issue-core.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/kaizen-agentic.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/kaizen-agentic.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/key-cape.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/key-cape.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/kings-guard.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/kings-guard.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/kontextual-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/kontextual-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/llm-connect.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/llm-connect.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/mail-address-semantics.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/mail-address-semantics.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/marki-docx.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/marki-docx.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/markitect-filter.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/markitect-filter.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/markitect-quarkdown.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/markitect-quarkdown.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/markitect-tool.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/markitect-tool.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/maturity-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/maturity-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/net-kingdom.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/net-kingdom.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/nudge-space.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/nudge-space.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/open-cmis-tck.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/open-cmis-tck.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/open-reuse.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/open-reuse.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/ops-bridge.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/ops-bridge.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/ops-hub.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/ops-hub.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/ops-mason.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/ops-mason.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/ops-warden.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/ops-warden.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/phase-memory.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/phase-memory.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/plenty-gobble.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/plenty-gobble.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/policy-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/policy-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/polycode-sim.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/polycode-sim.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/pqrst-practice.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/pqrst-practice.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/pr-hall-of-helix.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/pr-hall-of-helix.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/prj-canon-federation.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/prj-canon-federation.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/prj-forgejo-org-refactor.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/prj-forgejo-org-refactor.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/prj-helixforge-factory.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/prj-helixforge-factory.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/prj-state-hub-retirement.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/prj-state-hub-retirement.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/prj-unattended-progress-company.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/prj-unattended-progress-company.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/python-snake.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/python-snake.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/qonto-assistant.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/qonto-assistant.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/rail-knative.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rail-knative.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/rail-kubernetes.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rail-kubernetes.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/railiance-apps.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/railiance-apps.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/railiance-bootstrap.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/railiance-bootstrap.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/railiance-clock.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/railiance-clock.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/railiance-cluster.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/railiance-cluster.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/railiance-enablement.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/railiance-enablement.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/railiance-fabric.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/railiance-fabric.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/railiance-forge.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/railiance-forge.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/railiance-hosts.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/railiance-hosts.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/railiance-infra.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/railiance-infra.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/railiance-master.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/railiance-master.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/railiance-platform.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/railiance-platform.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/railiance-telemetry.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/railiance-telemetry.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/ralph-workplan.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/ralph-workplan.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/rapp-canned-prompts.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rapp-canned-prompts.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/rapp-core-hub.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rapp-core-hub.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/rapp-forgejo.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rapp-forgejo.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/rapp-issue-core.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rapp-issue-core.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/rapp-openbao.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rapp-openbao.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/rapp-playwright.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rapp-playwright.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/rapp-policy-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rapp-policy-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/rapp-postgres.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rapp-postgres.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/rapp-qonto.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rapp-qonto.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/rapp-sbom-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rapp-sbom-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/rapp-secrets-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rapp-secrets-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/rapp-telemetry.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rapp-telemetry.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/rapp-tenant-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rapp-tenant-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/rapp-user-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rapp-user-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/reef-railiance.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/reef-railiance.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/reef-storage.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/reef-storage.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/rein-aharness.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rein-aharness.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/rein-openweights.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/rein-openweights.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/repo-manager.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/repo-manager.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/repo-scoping.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/repo-scoping.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/repo-seed.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/repo-seed.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/resource-control.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/resource-control.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/reuse-surface.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/reuse-surface.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/risk-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/risk-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/role-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/role-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/runbook-tutorials.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/runbook-tutorials.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/sand-boxer.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/sand-boxer.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/sbom-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/sbom-nexus.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/secrets-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/secrets-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/security-canon.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/security-canon.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/shard-wiki.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/shard-wiki.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/snuggles-inventor.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/snuggles-inventor.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/soul-frame.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/soul-frame.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/state-hub.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/state-hub.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/target-revenue.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/target-revenue.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/tegwick-control.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/tegwick-control.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/tele-mcp.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/tele-mcp.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/telegram-edge.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/telegram-edge.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/tenant-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/tenant-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/test-driver.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/test-driver.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/testdrive-jsui.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/testdrive-jsui.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/the-custodian.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/the-custodian.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/timeline-svg.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/timeline-svg.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/tmux-amq.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/tmux-amq.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/user-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/user-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/vantage-point.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/vantage-point.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/vergabe-teilnahme.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/vergabe-teilnahme.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/web-fetcher.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/web-fetcher.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/whitehat-security.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/whitehat-security.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/whynot-control.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/whynot-control.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/whynot-design.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/whynot-design.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/wise-validator.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/wise-validator.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/xperience-grader.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/xperience-grader.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"hook=/data/git/gitea-repositories/coulomb/zone-engine.git/hooks/pre-receive.d/10-custodian-secret-scan",
|
||||
"775:1000:1000:regular file",
|
||||
"b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b /data/git/gitea-repositories/coulomb/zone-engine.git/hooks/pre-receive.d/10-custodian-secret-scan"
|
||||
]
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,138 @@
|
|||
# Non-secret Forgejo Helm values (gitea-charts/gitea chart + Forgejo image).
|
||||
# Layer helm/forgejo-secrets.sops.yaml for database password and admin credentials.
|
||||
# Recreate avoids leveldb queue lock fights on the shared RWO PVC during upgrades.
|
||||
strategy:
|
||||
type: Recreate
|
||||
|
||||
service:
|
||||
http:
|
||||
type: ClusterIP
|
||||
|
||||
image:
|
||||
registry: code.forgejo.org
|
||||
repository: forgejo/forgejo
|
||||
tag: "11.0.3"
|
||||
rootless: true
|
||||
|
||||
persistence:
|
||||
enabled: true
|
||||
size: 10Gi
|
||||
|
||||
postgresql:
|
||||
enabled: false
|
||||
|
||||
postgresql-ha:
|
||||
enabled: false
|
||||
|
||||
redis-cluster:
|
||||
enabled: false
|
||||
|
||||
valkey-cluster:
|
||||
enabled: false
|
||||
|
||||
# File subPath keeps Git from copying ConfigMap projection symlinks.
|
||||
extraVolumes:
|
||||
- name: secret-scan-template
|
||||
configMap:
|
||||
name: forgejo-secret-template-832f6dc6b809
|
||||
defaultMode: 365
|
||||
extraContainerVolumeMounts:
|
||||
- &id001
|
||||
name: secret-scan-template
|
||||
mountPath: /opt/forge-secret-template/hooks/pre-receive.d/10-custodian-secret-scan
|
||||
subPath: hook
|
||||
readOnly: true
|
||||
extraInitVolumeMounts:
|
||||
- *id001
|
||||
|
||||
# Verify admitted scanner custody after Kubernetes fsGroup volume processing.
|
||||
# Only the existing security subtree is mounted; no credentials are needed.
|
||||
preExtraInitContainers:
|
||||
- name: verify-secret-scanner
|
||||
image: code.forgejo.org/forgejo/forgejo@sha256:691657c7e64af7730a2e885e6d022cf16ae60724931c5392bd61838afadcaeba
|
||||
imagePullPolicy: IfNotPresent
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- "#!/bin/sh\nset +vx\nset -eu\ntest \"$(id -u)\" = 1000\ntest -d /data && test ! -L /data\ntest -d /data/security\
|
||||
\ && test ! -L /data/security\ntest -d /data/security/receive-secret-scan && test ! -L /data/security/receive-secret-scan\n\
|
||||
test -d /data/security/receive-secret-scan/20261018-73ee04078786 && test ! -L /data/security/receive-secret-scan/20261018-73ee04078786\n\
|
||||
test -f /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan && test ! -L /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan\n\
|
||||
test \"$(stat -c %u /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan)\" = 1000\n\
|
||||
test \"$(sha256sum /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan | cut -d \"\
|
||||
\ \" -f 1)\" = 73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a\ncase \"$(stat -c %a /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan)\"\
|
||||
\ in 755|775) ;; *) exit 21;; esac\ntest -f /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks\
|
||||
\ && test ! -L /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks\ntest \"$(stat -c %u /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks)\"\
|
||||
\ = 1000\ntest \"$(sha256sum /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks | cut -d \" \"\
|
||||
\ -f 1)\" = 88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\ncase \"$(stat -c %a /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks)\"\
|
||||
\ in 755|775) ;; *) exit 21;; esac\nif [ \"${1:-check}\" = apply ]; then\n chmod 755 /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan\n\
|
||||
\ test \"$(stat -c %a /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan)\" = 755\n\
|
||||
\ chmod 755 /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks\n test \"$(stat -c %a /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks)\"\
|
||||
\ = 755\nfi\n"
|
||||
- sh
|
||||
- apply
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 32Mi
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 64Mi
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /data/security
|
||||
subPath: security
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
|
||||
gitea:
|
||||
admin:
|
||||
username: forgejo_admin
|
||||
email: admin@coulomb.social
|
||||
passwordMode: initialOnlyRequireReset
|
||||
# Mailer password from OpenBao via ExternalSecret forgejo-mailer (not Helm/SOPS).
|
||||
additionalConfigFromEnvs:
|
||||
- name: GITEA__GIT_0X2E_CONFIG__INIT_0X2E_TEMPLATEDIR
|
||||
value: /opt/forge-secret-template
|
||||
- name: GITEA__mailer__PASSWD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: forgejo-mailer
|
||||
key: MAILER_PASSWD
|
||||
config:
|
||||
database:
|
||||
DB_TYPE: postgres
|
||||
HOST: forgejo-db-rw.databases.svc.cluster.local:5432
|
||||
NAME: forgejo
|
||||
USER: forgejo
|
||||
server:
|
||||
DOMAIN: forgejo.coulomb.social
|
||||
SSH_DOMAIN: forgejo.coulomb.social
|
||||
SSH_PORT: 22
|
||||
SSH_LISTEN_PORT: 2222
|
||||
DISABLE_SSH: false
|
||||
service:
|
||||
DISABLE_REGISTRATION: true
|
||||
security:
|
||||
INSTALL_LOCK: true
|
||||
session:
|
||||
COOKIE_SECURE: true
|
||||
mailer:
|
||||
ENABLED: true
|
||||
FROM: forgejo@coulomb.social
|
||||
# IONOS submission port 587 uses STARTTLS, not implicit TLS (smtps).
|
||||
PROTOCOL: smtp+starttls
|
||||
SMTP_ADDR: smtp.ionos.de
|
||||
SMTP_PORT: 587
|
||||
USER: forgejo@coulomb.social
|
||||
actions:
|
||||
ENABLED: true
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: forgejo-secret-template-832f6dc6b809
|
||||
namespace: forgejo
|
||||
labels:
|
||||
app.kubernetes.io/part-of: forgejo
|
||||
custodian.coulomb.social/workplan: FORGE-WP-0010
|
||||
immutable: true
|
||||
data:
|
||||
hook: '#!/bin/sh
|
||||
|
||||
set +vx
|
||||
|
||||
set -eu
|
||||
|
||||
exec /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan
|
||||
--scanner /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks
|
||||
|
||||
'
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
{
|
||||
"apiVersion": "v1",
|
||||
"kind": "ConfigMap",
|
||||
"metadata": {
|
||||
"name": "forgejo-secret-template-832f6dc6b809",
|
||||
"namespace": "forgejo",
|
||||
"labels": {
|
||||
"app.kubernetes.io/part-of": "forgejo",
|
||||
"custodian.coulomb.social/workplan": "FORGE-WP-0010"
|
||||
}
|
||||
},
|
||||
"immutable": true,
|
||||
"data": {
|
||||
"hook": "#!/bin/sh\nset +vx\nset -eu\nexec /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan --scanner /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks\n"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,44 @@
|
|||
[
|
||||
{
|
||||
"op": "test",
|
||||
"path": "/metadata/uid",
|
||||
"value": "e8eff0aa-64bb-4b44-9a80-a66612986355"
|
||||
},
|
||||
{
|
||||
"op": "test",
|
||||
"path": "/metadata/resourceVersion",
|
||||
"value": "75293954"
|
||||
},
|
||||
{
|
||||
"op": "test",
|
||||
"path": "/spec/template/spec/initContainers/0/command",
|
||||
"value": [
|
||||
"sh",
|
||||
"-c",
|
||||
"#!/bin/sh\nset +vx\nset -eu\ntest \"$(id -u)\" = 1000\ntest -d /data && test ! -L /data\ntest -d /data/security && test ! -L /data/security\ntest -d /data/security/receive-secret-scan && test ! -L /data/security/receive-secret-scan\ntest -d /data/security/receive-secret-scan/20261012-57a0642b6251 && test ! -L /data/security/receive-secret-scan/20261012-57a0642b6251\ntest -f /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan && test ! -L /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan\ntest \"$(stat -c %u /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan)\" = 1000\ntest \"$(sha256sum /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan | cut -d \" \" -f 1)\" = 57a0642b625105440fe146fceb4d244fd2dd08a75beb316831675643e6cc27ec\ncase \"$(stat -c %a /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan)\" in 755|775) ;; *) exit 21;; esac\ntest -f /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks && test ! -L /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks\ntest \"$(stat -c %u /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks)\" = 1000\ntest \"$(sha256sum /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks | cut -d \" \" -f 1)\" = 88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\ncase \"$(stat -c %a /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks)\" in 755|775) ;; *) exit 21;; esac\nif [ \"${1:-check}\" = apply ]; then\n chmod 755 /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan\n test \"$(stat -c %a /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan)\" = 755\n chmod 755 /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks\n test \"$(stat -c %a /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks)\" = 755\nfi\n",
|
||||
"sh",
|
||||
"apply"
|
||||
]
|
||||
},
|
||||
{
|
||||
"op": "test",
|
||||
"path": "/spec/template/spec/volumes/5/configMap/name",
|
||||
"value": "forgejo-secret-template-b1d7cf8cd13f"
|
||||
},
|
||||
{
|
||||
"op": "replace",
|
||||
"path": "/spec/template/spec/initContainers/0/command",
|
||||
"value": [
|
||||
"sh",
|
||||
"-c",
|
||||
"#!/bin/sh\nset +vx\nset -eu\ntest \"$(id -u)\" = 1000\ntest -d /data && test ! -L /data\ntest -d /data/security && test ! -L /data/security\ntest -d /data/security/receive-secret-scan && test ! -L /data/security/receive-secret-scan\ntest -d /data/security/receive-secret-scan/20261018-73ee04078786 && test ! -L /data/security/receive-secret-scan/20261018-73ee04078786\ntest -f /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan && test ! -L /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan\ntest \"$(stat -c %u /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan)\" = 1000\ntest \"$(sha256sum /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan | cut -d \" \" -f 1)\" = 73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a\ncase \"$(stat -c %a /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan)\" in 755|775) ;; *) exit 21;; esac\ntest -f /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks && test ! -L /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks\ntest \"$(stat -c %u /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks)\" = 1000\ntest \"$(sha256sum /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks | cut -d \" \" -f 1)\" = 88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\ncase \"$(stat -c %a /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks)\" in 755|775) ;; *) exit 21;; esac\nif [ \"${1:-check}\" = apply ]; then\n chmod 755 /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan\n test \"$(stat -c %a /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan)\" = 755\n chmod 755 /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks\n test \"$(stat -c %a /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks)\" = 755\nfi\n",
|
||||
"sh",
|
||||
"apply"
|
||||
]
|
||||
},
|
||||
{
|
||||
"op": "replace",
|
||||
"path": "/spec/template/spec/volumes/5/configMap/name",
|
||||
"value": "forgejo-secret-template-832f6dc6b809"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
#!/bin/sh
|
||||
set +vx
|
||||
set -eu
|
||||
exec /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan --scanner /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
#!/bin/sh
|
||||
set +vx
|
||||
set -eu
|
||||
exec /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan --scanner /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks
|
||||
|
|
@ -0,0 +1,40 @@
|
|||
{
|
||||
"proposal_id": "FORGE10-RECEIVE-BATCH-20261018",
|
||||
"revision": "preparation-1",
|
||||
"source_commit": "ea65606c1298db782f721f9443bafeb03cdef138",
|
||||
"candidate_binary_sha256": "73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a",
|
||||
"new_directory": "/data/security/receive-secret-scan/20261018-73ee04078786",
|
||||
"old_directory": "/data/security/receive-secret-scan/20261012-57a0642b6251",
|
||||
"old_binary_sha256": "57a0642b625105440fe146fceb4d244fd2dd08a75beb316831675643e6cc27ec",
|
||||
"old_configmap": "forgejo-secret-template-b1d7cf8cd13f",
|
||||
"new_configmap": "forgejo-secret-template-832f6dc6b809",
|
||||
"old_hook_sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b",
|
||||
"new_hook_sha256": "832f6dc6b809de4dad401b283a77eb1372b9d29f62b893010f1cecd0af5d01de",
|
||||
"deployment_uid": "e8eff0aa-64bb-4b44-9a80-a66612986355",
|
||||
"generation": 14,
|
||||
"original_template_sha256": "6fc7c79797790dc30871ec523714012b68907b51e8b2d23db22fd1783462ed36",
|
||||
"proposed_template_sha256": "d308fa8a64612ef506a7c027cf80123ccfae47d75c9d32b9ef504e92f8ca0ca0",
|
||||
"source_fields_only_verified": true,
|
||||
"conditional_forward_and_inverse_verified": true,
|
||||
"deployment_server_dry_run_verified": true,
|
||||
"configmap_server_dry_run_verified": true,
|
||||
"native_changed": false,
|
||||
"approval_requested": false,
|
||||
"remaining": [
|
||||
"Pinned activation/recovery executor, drift/refusal checks and resource preflight",
|
||||
"Independent owner/package admission and exact founder go",
|
||||
"Native exact-binary smoke, 166-hook rollout and ordinary publication proof"
|
||||
],
|
||||
"support_hashes": {
|
||||
"activate_forge_template.py": "ef2b38f655d5520d69dcd69cdb4997eaad4b50773f32c1d798d16331b204c789",
|
||||
"verify_receive_native.py": "c9120122c6f6f0b7c41fe4fa975e5a2a340e776885d852b861b8c13b7664adcd",
|
||||
"activate_receive_hooks.py": "9b01ee383e16463981112226e19156b0de59af2d03dd71b9403e144e280a9fb3"
|
||||
},
|
||||
"apps_preimage_hashes": {
|
||||
"helm/forgejo-values.yaml": "sha256:cf87a3dccd666bf8870619755afac4af64fc0bee77b0f0ea54718d6384b70d4f",
|
||||
"manifests/forgejo-secret-scan-template.yaml": "sha256:8fad71aff5a25d8e31289072b9c06c6ec74ac74fedafc54dde7177bfe187c96a"
|
||||
},
|
||||
"cost_estimate_eur": 0,
|
||||
"cost_note": "No additional infrastructure or paid service; human effort unpriced.",
|
||||
"risk_note": "One existing Forgejo Recreate rollout and exact installed-hook copies; availability impact and partial rollout require guarded rollback. No credential, policy, image or database change."
|
||||
}
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,130 @@
|
|||
# Forge receive-path secret detection
|
||||
|
||||
FORGE-WP-0006 implements the forge-owned part of RMGR-WP-0021-T03 and
|
||||
Custodian CUST-WP-0080 G07. The local Repo Manager scanner remains separate.
|
||||
The source adapter is not evidence of installed server enforcement.
|
||||
|
||||
## Boundary and ownership
|
||||
|
||||
The forge-owned, standalone Linux adapter composes with Forgejo's generated
|
||||
pre-receive dispatcher. It uses pinned Gitleaks 8.30.1 Linux amd64
|
||||
(SHA256 `88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509`).
|
||||
It requires `/usr/bin/git`, `/proc`, a private writable tmpfs at `/dev/shm`,
|
||||
and Linux pidfd support (5.3+ on amd64/arm64) but no Python runtime, issuer credential,
|
||||
network access, source checkout, or repository-controlled workflow. The current
|
||||
Forgejo 11.0.3 image has no Python interpreter; this keeps the runtime change to
|
||||
two reviewed executables and a hook fragment, subject to native admission.
|
||||
|
||||
The forge owns tool admission, hook installation and recovery. Repo Manager
|
||||
coordinates repository-control coverage; enablement owns reusable CI templates;
|
||||
source repositories own their workflows. Credential classification and
|
||||
revocation remain with existing incident/custody owners.
|
||||
|
||||
Do not overwrite generated `hooks/pre-receive` or `pre-receive.d/gitea`, or enable
|
||||
arbitrary user Git-hook editing. A reviewed additional executable in the existing
|
||||
`pre-receive.d/` dispatcher is the proposed integration. Server writers, frontend
|
||||
merge/edit/import paths, SSH and HTTP pushes, hook resynchronization, pod restart
|
||||
and new repository creation all need separate native acceptance. No admission
|
||||
or production coverage is inferred from disposable bare-repository tests.
|
||||
|
||||
## What is checked
|
||||
|
||||
Input is the exact `old-object new-object ref-name` batch from receive-pack.
|
||||
Malformed, duplicate, oversized, inconsistent or unsupported updates refuse.
|
||||
All updated ref names are scanned without echoing them. Ref exclusions are frozen
|
||||
from the pre-push snapshot; the traversal scans complete introduced reachable
|
||||
objects across every new tip and every parent, including annotated tags and
|
||||
direct object tags. A secret added and removed before the tip is still examined.
|
||||
|
||||
Blob data, raw commit/tag contents and tree names are scanned. Symlink contents
|
||||
are read as Git blobs; their filesystem targets are never followed. Changed trees
|
||||
containing external gitlinks refuse because the referenced repository is not
|
||||
covered. Git replacement objects and grafts cannot hide history. Partial/shallow
|
||||
repositories, missing objects and unverified traversal refuse. Receive-pack's
|
||||
quarantine object locations are preserved only for Git reads; the adapter never
|
||||
updates refs or copies objects into the primary store.
|
||||
|
||||
The scanner executable is opened without following a final symlink, checked for
|
||||
ownership/mode/regular-file shape and exact SHA256, and executed through its open
|
||||
file descriptor. Scanner config and ignore files are private temporary files;
|
||||
repository configuration, inline allow comments and ambient scanner settings do
|
||||
not disable detection. Child diagnostics/findings are discarded. Output contains
|
||||
only a fixed status/reason, counts, version and, for an object detection, its ID.
|
||||
Privately review the identified object; never paste its contents into an issue,
|
||||
State Hub, CI logs or chat. Standard Git output may independently display ref
|
||||
names; the adapter does not make Git's transport diagnostics a secret-safe log.
|
||||
|
||||
Exit 0 is `clean` in this declared scope; exit 1 is `blocked`; exit 2 is
|
||||
`unverified`. Both nonzero statuses must refuse the complete push. There is no
|
||||
implicit baseline/ignore or override switch. A false-positive exception needs a
|
||||
separate reviewed mechanism with exact scope, approval and expiry.
|
||||
|
||||
## Bounds and remaining coverage
|
||||
|
||||
Current bounds: 256 updates, 10,000 existing refs, 2,000 introduced objects,
|
||||
8 MiB per object, 64 MiB total, 512 KiB update input and 90 seconds for the check.
|
||||
Scanner calls also use the scanner's 15-second timeout. Object sizes and total
|
||||
bytes are checked before scanning payloads. Limits reject rather
|
||||
than skip. Large imports need an admitted path; do not disable the gate to pass
|
||||
an unreviewed import. Git/scanner versions and limits require native load testing.
|
||||
|
||||
FORGE-WP-0010 corrects per-small-input scanner startup overhead without changing
|
||||
these limits. It reuses Repo Manager's bounded profile: at most 64 inputs of at
|
||||
most 4096 bytes per directory invocation. Larger inputs retain the existing stdin
|
||||
reader and fragment behavior. Raw inputs use 0700 private tmpfs directories and
|
||||
0600 files with safe object/ref identifiers; no source path controls a filename.
|
||||
Missing or nonvolatile storage refuses instead of falling back to ordinary disk.
|
||||
|
||||
A separately supervised child pins its receiver with pidfd, acknowledges readiness
|
||||
before payload writes, and cleans up on pipe EOF. A 180-second backstop terminates
|
||||
the exact stalled receiver before cleanup. Git/scanner children die when their
|
||||
creating receiver thread dies; it is pinned to its OS thread during each child.
|
||||
Normal cleanup and failed cleanup are checked. Directory identity replacement
|
||||
refuses deletion. This is not protection against a hostile same-UID host process.
|
||||
|
||||
Directory scans use the same pinned scanner/default config and explicit empty
|
||||
ignore file. Bounded reports contain only known safe payload identifiers. Missing,
|
||||
malformed, oversized or inconsistent reports, unknown diagnostics and scanner or
|
||||
watchdog failures refuse. Only the exact pinned scanner's positive-finding summary
|
||||
is accepted as a warning. The original stdin route is otherwise unchanged.
|
||||
|
||||
The adapter does not rescan objects already reachable before the push, scan
|
||||
unreachable extra pack objects, LFS payloads, other repositories, runtime logs,
|
||||
artifacts or credentials outside Git. It is not an authorization boundary against
|
||||
a forge administrator or hostile same-UID process. Default scanner rules remain
|
||||
heuristic. Historical discovery and finding-to-response are independent work;
|
||||
removing a source value or rejecting a push does not revoke an exposed credential.
|
||||
CUST-WP-0073-T05's founder-deferred rotation is unchanged.
|
||||
|
||||
The 165 observed on-disk repository directories are a discovery count, not an
|
||||
admitted production-software denominator. The 22 reviewed repositories provide a
|
||||
named rollout starting scope; the owner must reconcile all production repositories,
|
||||
wikis, archives, mirrors and new-repository lifecycle before claiming DSM coverage.
|
||||
|
||||
## Build and disposable acceptance
|
||||
|
||||
Use an admitted Go toolchain. The original deployed revision used Go 1.26.9,
|
||||
verified against the SHA256 from go.dev release metadata. The FORGE-WP-0010
|
||||
source candidate is separately tested with installed Go 1.26.7; its new source,
|
||||
compiler and exact executable still require native admission. No third-party Go
|
||||
modules are required. Keep binaries and logs outside the repository:
|
||||
|
||||
```sh
|
||||
cd tools/receive-secret-scan
|
||||
FORGE_TEST_GITLEAKS=/reviewed/gitleaks go test -count=1 -v ./...
|
||||
CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -buildvcs=false -o /tmp/receive-secret-scan .
|
||||
```
|
||||
|
||||
The root `make test-secret-detection` target requires `FORGE_TEST_GITLEAKS`
|
||||
and runs this module; set `GO` to the admitted compiler path where needed.
|
||||
|
||||
Tests use disposable Git servers, actual receive-pack quarantine and generated
|
||||
keys. Scanner-dependent tests explicitly skip without `FORGE_TEST_GITLEAKS`;
|
||||
skips are not acceptance. Native activation additionally needs exact original
|
||||
hook hashes, tool provenance, dry-run/diff, abort owner, rollback and value-free
|
||||
receipts under the accepted build-mode change rule.
|
||||
|
||||
References: [Git receive-pack and quarantine](https://git-scm.com/docs/git-receive-pack),
|
||||
[Git object traversal](https://git-scm.com/docs/git-rev-list),
|
||||
[Forgejo 11.0.3 generated hooks](https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/modules/repository/hooks.go),
|
||||
[Gitleaks release](https://github.com/gitleaks/gitleaks/releases/tag/v8.30.1).
|
||||
|
|
@ -0,0 +1,192 @@
|
|||
package main
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"crypto/sha256"
|
||||
"encoding/hex"
|
||||
"errors"
|
||||
"io"
|
||||
"os"
|
||||
"os/exec"
|
||||
"path/filepath"
|
||||
"regexp"
|
||||
"strings"
|
||||
"syscall"
|
||||
)
|
||||
|
||||
// Same bounded small-input profile as Repo Manager's staged adapter. Above
|
||||
// PIPE_BUF, keep the original stdin reader/fragment path byte-for-byte.
|
||||
const directoryInputBytes = 4096
|
||||
const directoryBatchInputs = 64
|
||||
const maxReportBytes = 1024 * 1024
|
||||
|
||||
type scanInput struct {
|
||||
name string
|
||||
content []byte
|
||||
}
|
||||
|
||||
func verifyScannerFD(f *os.File) error {
|
||||
st, err := f.Stat()
|
||||
if err != nil {
|
||||
return errors.New("scanner-file-refused")
|
||||
}
|
||||
native, ok := st.Sys().(*syscall.Stat_t)
|
||||
if !ok || !st.Mode().IsRegular() || st.Mode().Perm()&022 != 0 || st.Mode().Perm()&0111 == 0 || st.Size() > 64*1024*1024 || (native.Uid != 0 && native.Uid != uint32(os.Getuid())) {
|
||||
return errors.New("scanner-file-refused")
|
||||
}
|
||||
if _, err = f.Seek(0, 0); err != nil {
|
||||
return errors.New("scanner-file-refused")
|
||||
}
|
||||
hash := sha256.New()
|
||||
if _, err = io.Copy(hash, f); err != nil || hex.EncodeToString(hash.Sum(nil)) != scannerHash {
|
||||
return errors.New("scanner-digest-mismatch")
|
||||
}
|
||||
if _, err = f.Seek(0, 0); err != nil {
|
||||
return errors.New("scanner-file-refused")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// Trusted child mode establishes resource limits before exec of the exact
|
||||
// independently pinned scanner descriptor. It accepts no repository commands.
|
||||
func batchScannerProcess(args []string) int {
|
||||
if len(args) != 2 {
|
||||
return 127
|
||||
}
|
||||
if _, err := volatileIdentity(args[1]); err != nil {
|
||||
return 127
|
||||
}
|
||||
f := os.NewFile(3, "pinned-scanner")
|
||||
if f == nil || verifyScannerFD(f) != nil {
|
||||
return 127
|
||||
}
|
||||
defer f.Close()
|
||||
for resource, limit := range map[int]uint64{syscall.RLIMIT_FSIZE: maxReportBytes, syscall.RLIMIT_CPU: 20, syscall.RLIMIT_AS: 8 * 1024 * 1024 * 1024} {
|
||||
if syscall.Setrlimit(resource, &syscall.Rlimit{Cur: limit, Max: limit}) != nil {
|
||||
return 127
|
||||
}
|
||||
}
|
||||
if os.Chdir(args[1]) != nil {
|
||||
return 127
|
||||
}
|
||||
argv := []string{"gitleaks", "dir", "--config", filepath.Join(args[0], "scanner.toml"), "--gitleaks-ignore-path", filepath.Join(args[0], "ignore"), "--ignore-gitleaks-allow", "--redact=100", "--no-banner", "--no-color", "--log-level", "warn", "--exit-code", "20", "--timeout", "15", "--report-format", "template", "--report-template", filepath.Join(args[0], "template"), "--report-path", filepath.Join(args[0], "report.paths"), "--max-target-megabytes", "0", "payload"}
|
||||
if syscall.Exec("/proc/self/fd/3", argv, []string{"PATH=/usr/bin:/bin", "HOME=" + args[1], "TMPDIR=" + args[1], "LANG=C"}) != nil {
|
||||
return 127
|
||||
}
|
||||
return 127
|
||||
}
|
||||
|
||||
var safeInputName = regexp.MustCompile(`^(?:[0-9a-f]{40}|[0-9a-f]{64}|ref-[0-9]{1,3})$`)
|
||||
var leakSummary = regexp.MustCompile(`^[0-9]{1,2}:[0-9]{2}(?:AM|PM) WRN leaks found: [1-9][0-9]*\n$`)
|
||||
|
||||
func validateBatchDiagnostics(code int, diagnostics []byte) error {
|
||||
if code != 0 && code != 20 || len(diagnostics) > 0 && !(code == 20 && leakSummary.Match(diagnostics)) {
|
||||
return errors.New("scanner-failed")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func batchFindings(code int, raw []byte, known map[string]string) (map[string]bool, error) {
|
||||
findings := map[string]bool{}
|
||||
if len(raw) > 0 {
|
||||
if !bytes.HasSuffix(raw, []byte("\n")) {
|
||||
return nil, errors.New("scanner-report-refused")
|
||||
}
|
||||
for _, line := range strings.Split(string(raw[:len(raw)-1]), "\n") {
|
||||
name, ok := known[line]
|
||||
if !ok {
|
||||
return nil, errors.New("scanner-report-refused")
|
||||
}
|
||||
findings[name] = true
|
||||
}
|
||||
}
|
||||
if (code != 0 && code != 20) || (len(findings) > 0) != (code == 20) {
|
||||
return nil, errors.New("scanner-report-refused")
|
||||
}
|
||||
return findings, nil
|
||||
}
|
||||
|
||||
func scanSmall(ctx context.Context, scanner *os.File, config string, storage *volatileStorage, inputs []scanInput) (blocked string, err error) {
|
||||
if len(inputs) == 0 || len(inputs) > directoryBatchInputs || !storage.live() {
|
||||
return "", errors.New("cleanup-watchdog-unavailable")
|
||||
}
|
||||
id, e := volatileIdentity(storage.path)
|
||||
if e != nil || id != storage.id {
|
||||
return "", errors.New("volatile-storage-identity-changed")
|
||||
}
|
||||
payload := filepath.Join(storage.path, "payload")
|
||||
if os.Mkdir(payload, 0700) != nil {
|
||||
return "", errors.New("volatile-storage-unavailable")
|
||||
}
|
||||
defer func() {
|
||||
if os.RemoveAll(payload) != nil && err == nil {
|
||||
err = errors.New("volatile-storage-cleanup-failed")
|
||||
}
|
||||
}()
|
||||
known := map[string]string{}
|
||||
for _, item := range inputs {
|
||||
if !safeInputName.MatchString(item.name) || len(item.content) > directoryInputBytes || known["payload/"+item.name] != "" {
|
||||
return "", errors.New("invalid-scan-batch")
|
||||
}
|
||||
known["payload/"+item.name] = item.name
|
||||
file, e := os.OpenFile(filepath.Join(payload, item.name), os.O_WRONLY|os.O_CREATE|os.O_EXCL|syscall.O_NOFOLLOW, 0600)
|
||||
if e != nil {
|
||||
return "", errors.New("volatile-storage-write-failed")
|
||||
}
|
||||
_, e = file.Write(item.content)
|
||||
closed := file.Close()
|
||||
if e != nil || closed != nil {
|
||||
return "", errors.New("volatile-storage-write-failed")
|
||||
}
|
||||
}
|
||||
if os.WriteFile(filepath.Join(config, "template"), []byte("{{range .}}{{.File}}\n{{end}}"), 0600) != nil {
|
||||
return "", errors.New("scanner-config-unavailable")
|
||||
}
|
||||
report := filepath.Join(config, "report.paths")
|
||||
if e = os.Remove(report); e != nil && !os.IsNotExist(e) {
|
||||
return "", errors.New("scanner-report-refused")
|
||||
}
|
||||
cmd := exec.CommandContext(ctx, "/proc/self/exe", "--batch-scanner", config, storage.path)
|
||||
cmd.ExtraFiles = []*os.File{scanner}
|
||||
cmd.Env = []string{"PATH=/usr/bin:/bin", "LANG=C"}
|
||||
diagnostics := &cappedBuffer{limit: maxReportBytes}
|
||||
cmd.Stdout = io.Discard
|
||||
cmd.Stderr = diagnostics
|
||||
runErr := runChild(cmd)
|
||||
if ctx.Err() != nil {
|
||||
return "", errors.New("scan-deadline-exceeded")
|
||||
}
|
||||
code := 0
|
||||
var exit *exec.ExitError
|
||||
if runErr != nil {
|
||||
if !errors.As(runErr, &exit) {
|
||||
return "", errors.New("scanner-failed")
|
||||
}
|
||||
code = exit.ExitCode()
|
||||
}
|
||||
if e = validateBatchDiagnostics(code, diagnostics.Bytes()); e != nil {
|
||||
return "", e
|
||||
}
|
||||
st, e := os.Lstat(report)
|
||||
if e != nil || !st.Mode().IsRegular() || st.Size() > maxReportBytes {
|
||||
return "", errors.New("scanner-report-refused")
|
||||
}
|
||||
raw, e := os.ReadFile(report)
|
||||
if e != nil {
|
||||
return "", errors.New("scanner-report-refused")
|
||||
}
|
||||
findings, e := batchFindings(code, raw, known)
|
||||
if e != nil {
|
||||
return "", e
|
||||
}
|
||||
if !storage.live() {
|
||||
return "", errors.New("scanner-report-refused")
|
||||
}
|
||||
for _, item := range inputs {
|
||||
if findings[item.name] {
|
||||
return item.name, nil
|
||||
}
|
||||
}
|
||||
return "", nil
|
||||
}
|
||||
|
|
@ -0,0 +1,323 @@
|
|||
package main
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"bytes"
|
||||
"context"
|
||||
"crypto/rand"
|
||||
"encoding/hex"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"os"
|
||||
"os/exec"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
func TestMain(m *testing.M) {
|
||||
if code, handled := internalProcess(os.Args[1:]); handled {
|
||||
os.Exit(code)
|
||||
}
|
||||
if len(os.Args) == 2 && os.Args[1] == "--test-storage-refusal" {
|
||||
storage, err := newVolatileStorage()
|
||||
if err == nil {
|
||||
storage.close()
|
||||
os.Exit(3)
|
||||
}
|
||||
json.NewEncoder(os.Stdout).Encode(map[string]string{"status": "unverified", "reason": err.Error()})
|
||||
os.Exit(0)
|
||||
}
|
||||
if len(os.Args) == 2 && os.Args[1] == "--test-storage-parent" {
|
||||
storage, err := newVolatileStorage()
|
||||
if err != nil {
|
||||
os.Exit(3)
|
||||
}
|
||||
if os.WriteFile(filepath.Join(storage.path, "input"), []byte("synthetic private test input"), 0600) != nil {
|
||||
os.Exit(3)
|
||||
}
|
||||
json.NewEncoder(os.Stdout).Encode(map[string]any{"path": storage.path, "watchdog": storage.command.Process.Pid})
|
||||
child := exec.Command("/proc/self/exe", "--test-storage-reader", storage.path)
|
||||
child.Stdout = os.Stdout
|
||||
if runChild(child) != nil {
|
||||
os.Exit(4)
|
||||
}
|
||||
os.Exit(0)
|
||||
}
|
||||
if len(os.Args) == 3 && os.Args[1] == "--test-storage-reader" {
|
||||
f, err := os.Open(filepath.Join(os.Args[2], "input"))
|
||||
if err != nil {
|
||||
os.Exit(3)
|
||||
}
|
||||
defer f.Close()
|
||||
fmt.Fprintln(os.Stdout, os.Getpid())
|
||||
time.Sleep(time.Minute)
|
||||
os.Exit(0)
|
||||
}
|
||||
os.Exit(m.Run())
|
||||
}
|
||||
|
||||
func TestVolatileStorageLifecycle(t *testing.T) {
|
||||
storage, err := newVolatileStorage()
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !storage.live() {
|
||||
t.Fatal("watchdog did not remain live")
|
||||
}
|
||||
if err = os.WriteFile(filepath.Join(storage.path, "input"), []byte("synthetic input"), 0600); err != nil {
|
||||
t.Fatal("cannot write private fixture")
|
||||
}
|
||||
if err = storage.close(); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if _, err = os.Lstat(storage.path); !os.IsNotExist(err) {
|
||||
t.Fatal("private storage retained")
|
||||
}
|
||||
}
|
||||
|
||||
func TestVolatileIdentityRefusesReplacement(t *testing.T) {
|
||||
storage, err := newVolatileStorage()
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
// Keep the original inode alive so a new directory cannot reuse it.
|
||||
original := storage.path + "-original"
|
||||
if os.Rename(storage.path, original) != nil || os.Mkdir(storage.path, 0700) != nil {
|
||||
t.Fatal("cannot prepare replacement")
|
||||
}
|
||||
defer os.RemoveAll(original)
|
||||
defer os.RemoveAll(storage.path)
|
||||
if err = storage.close(); err == nil {
|
||||
t.Fatal("replacement directory accepted")
|
||||
}
|
||||
if _, err = os.Stat(storage.path); err != nil {
|
||||
t.Fatal("replacement directory was removed")
|
||||
}
|
||||
}
|
||||
|
||||
func TestReceiverDeathCleansStorageAndStopsReader(t *testing.T) {
|
||||
cmd := exec.Command("/proc/self/exe", "--test-storage-parent")
|
||||
pipe, err := cmd.StdoutPipe()
|
||||
if err != nil || cmd.Start() != nil {
|
||||
t.Fatal("cannot start disposable parent")
|
||||
}
|
||||
defer cmd.Process.Kill()
|
||||
reader := bufio.NewReader(pipe)
|
||||
line, err := reader.ReadBytes('\n')
|
||||
var receipt struct {
|
||||
Path string
|
||||
Watchdog int
|
||||
}
|
||||
if err != nil || json.Unmarshal(line, &receipt) != nil || receipt.Path == "" {
|
||||
t.Fatal("disposable parent did not prepare storage")
|
||||
}
|
||||
var childPID int
|
||||
if _, err = fmt.Fscanln(reader, &childPID); err != nil || childPID < 2 {
|
||||
t.Fatal("disposable reader did not open input")
|
||||
}
|
||||
if cmd.Process.Kill() != nil {
|
||||
t.Fatal("cannot kill disposable parent")
|
||||
}
|
||||
cmd.Wait()
|
||||
deadline := time.Now().Add(5 * time.Second)
|
||||
for time.Now().Before(deadline) {
|
||||
_, pathErr := os.Lstat(receipt.Path)
|
||||
stat, procErr := os.ReadFile(fmt.Sprintf("/proc/%d/stat", childPID))
|
||||
terminal := os.IsNotExist(procErr)
|
||||
if procErr == nil {
|
||||
// Zombies are terminal; the private PID namespace reaps them.
|
||||
fields := strings.Fields(string(stat)[strings.LastIndex(string(stat), ")")+1:])
|
||||
terminal = len(fields) > 0 && fields[0] == "Z"
|
||||
}
|
||||
if os.IsNotExist(pathErr) && terminal {
|
||||
return
|
||||
}
|
||||
time.Sleep(10 * time.Millisecond)
|
||||
}
|
||||
t.Fatal("receiver loss retained private input or live reader")
|
||||
}
|
||||
|
||||
func TestSmallInputParity(t *testing.T) {
|
||||
scanner := os.Getenv("FORGE_TEST_GITLEAKS")
|
||||
if scanner == "" {
|
||||
t.Skip("requires explicitly admitted disposable Gitleaks binary")
|
||||
}
|
||||
f, err := pinScanner(scanner)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
defer f.Close()
|
||||
storage, err := newVolatileStorage()
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
defer func() {
|
||||
if err := storage.close(); err != nil {
|
||||
t.Error(err)
|
||||
}
|
||||
}()
|
||||
config := t.TempDir()
|
||||
write(t, filepath.Join(config, "scanner.toml"), []byte("[extend]\nuseDefault = true\n"))
|
||||
write(t, filepath.Join(config, "ignore"), nil)
|
||||
privateKey := key(t)
|
||||
var random [32]byte
|
||||
if _, err := rand.Read(random[:]); err != nil {
|
||||
t.Fatal("cannot generate synthetic token")
|
||||
}
|
||||
canary := []byte("glpat-" + hex.EncodeToString(random[:]))
|
||||
for _, tc := range []struct {
|
||||
name string
|
||||
input []byte
|
||||
want bool
|
||||
}{
|
||||
{"empty", nil, false},
|
||||
{"clean", []byte("reviewed clean input\n"), false},
|
||||
{"exact-limit", bytes.Repeat([]byte("x"), directoryInputBytes), false},
|
||||
{"private-key", privateKey, true},
|
||||
{"exact-limit-private-key", append(bytes.Repeat([]byte("\n"), directoryInputBytes-len(privateKey)), privateKey...), true},
|
||||
{"binary-private-key", append([]byte{0, 1, 0}, privateKey...), true},
|
||||
{"token", canary, true},
|
||||
{"binary-token", append([]byte{0, 0}, canary...), true},
|
||||
{"inline-suppression", append([]byte("# gitleaks:allow\n"), privateKey...), true},
|
||||
} {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
stdin, e := scan(context.Background(), f, config, tc.input)
|
||||
if e != nil || stdin != tc.want {
|
||||
t.Fatal("stdin reference outcome differs", e)
|
||||
}
|
||||
name := strings.Repeat("a", 40)
|
||||
blocked, e := scanSmall(context.Background(), f, config, storage, []scanInput{{name, tc.input}})
|
||||
if e != nil || (blocked != "") != stdin || blocked != "" && blocked != name {
|
||||
t.Fatal("directory and original stdin detection differ", e)
|
||||
}
|
||||
})
|
||||
}
|
||||
t.Run("sixty-four-distinct-inputs", func(t *testing.T) {
|
||||
var inputs []scanInput
|
||||
for i := 0; i < directoryBatchInputs; i++ {
|
||||
inputs = append(inputs, scanInput{fmt.Sprintf("%040x", i), []byte("clean")})
|
||||
}
|
||||
inputs[63].content = privateKey
|
||||
blocked, e := scanSmall(context.Background(), f, config, storage, inputs)
|
||||
if e != nil || blocked != inputs[63].name {
|
||||
t.Fatal("last batch input was not detected", e)
|
||||
}
|
||||
})
|
||||
t.Run("expired-context", func(t *testing.T) {
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
cancel()
|
||||
_, e := scanSmall(ctx, f, config, storage, []scanInput{{strings.Repeat("b", 40), []byte("clean")}})
|
||||
if e == nil || e.Error() != "scan-deadline-exceeded" {
|
||||
t.Fatal("expired scan did not fail closed")
|
||||
}
|
||||
})
|
||||
t.Run("invalid-inputs", func(t *testing.T) {
|
||||
name := strings.Repeat("c", 40)
|
||||
for _, inputs := range [][]scanInput{
|
||||
{{"../escape", []byte("clean")}},
|
||||
{{name, bytes.Repeat([]byte("x"), directoryInputBytes+1)}},
|
||||
{{name, []byte("clean")}, {name, []byte("clean")}},
|
||||
} {
|
||||
if _, e := scanSmall(context.Background(), f, config, storage, inputs); e == nil {
|
||||
t.Fatal("invalid batch input accepted")
|
||||
}
|
||||
if _, e := os.Lstat(filepath.Join(storage.path, "payload")); !os.IsNotExist(e) {
|
||||
t.Fatal("invalid batch left input files")
|
||||
}
|
||||
}
|
||||
})
|
||||
t.Run("scanner-failure", func(t *testing.T) {
|
||||
write(t, filepath.Join(config, "scanner.toml"), []byte("invalid = ["))
|
||||
if _, e := scanSmall(context.Background(), f, config, storage, []scanInput{{strings.Repeat("d", 40), []byte("clean")}}); e == nil {
|
||||
t.Fatal("scanner failure accepted")
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
func TestBatchAndLargerInputPushBoundaries(t *testing.T) {
|
||||
adapter, scanner := binary(t)
|
||||
for _, tc := range []struct {
|
||||
name string
|
||||
size int
|
||||
secret bool
|
||||
}{
|
||||
{"exact-limit-key", directoryInputBytes, true},
|
||||
{"larger-stdin-key", directoryInputBytes + 1, true},
|
||||
{"larger-stdin-clean", 70 * 1024, false},
|
||||
} {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
f := setup(t, adapter, scanner)
|
||||
content := []byte("reviewed clean input\n")
|
||||
want := 0
|
||||
if tc.secret {
|
||||
content = key(t)
|
||||
want = 1
|
||||
}
|
||||
content = append(content, bytes.Repeat([]byte("\n"), tc.size-len(content))...)
|
||||
f.commit(t, "input.bin", content, "disposable boundary fixture")
|
||||
f.push(t, want, "HEAD:refs/heads/main")
|
||||
})
|
||||
}
|
||||
t.Run("multiple-ref-name-detection", func(t *testing.T) {
|
||||
f := setup(t, adapter, scanner)
|
||||
var random [32]byte
|
||||
if _, err := rand.Read(random[:]); err != nil {
|
||||
t.Fatal("fixture generation failed")
|
||||
}
|
||||
out := f.push(t, 1, "HEAD:refs/heads/clean-new", "HEAD:refs/heads/glpat-"+hex.EncodeToString(random[:]))
|
||||
if !bytes.Contains(out, []byte(`"reason":"ref-name-detection"`)) {
|
||||
t.Fatal("multi-ref name was not scanned")
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
func TestBatchRefusesUnverifiedReportsAndDiagnostics(t *testing.T) {
|
||||
known := map[string]string{"payload/ref-0": "ref-0"}
|
||||
for _, tc := range []struct {
|
||||
code int
|
||||
raw string
|
||||
}{
|
||||
{0, "payload/ref-0\n"}, {20, ""}, {0, "\n"},
|
||||
{20, "payload/ref-0"}, {20, "payload/ref-0\n\n"},
|
||||
{20, "payload/ref-unknown\n"}, {20, "../payload/ref-0\n"},
|
||||
{20, "payload/ref-0\r\n"}, {2, ""},
|
||||
} {
|
||||
if _, err := batchFindings(tc.code, []byte(tc.raw), known); err == nil {
|
||||
t.Fatal("unverified report accepted")
|
||||
}
|
||||
}
|
||||
for _, tc := range []struct {
|
||||
code int
|
||||
raw string
|
||||
}{
|
||||
{0, ""}, {20, "payload/ref-0\n"}, {20, "payload/ref-0\npayload/ref-0\n"},
|
||||
} {
|
||||
if _, err := batchFindings(tc.code, []byte(tc.raw), known); err != nil {
|
||||
t.Fatal("valid report refused")
|
||||
}
|
||||
}
|
||||
for _, tc := range []struct {
|
||||
code int
|
||||
text string
|
||||
}{
|
||||
{0, "12:03PM WRN incomplete scan\n"}, {20, "12:03PM WRN incomplete scan\n"},
|
||||
{20, "12:03PM WRN leaks found: 1\n12:03PM WRN incomplete scan\n"},
|
||||
{0, "12:03PM WRN leaks found: 1\n"}, {2, ""},
|
||||
} {
|
||||
if validateBatchDiagnostics(tc.code, []byte(tc.text)) == nil {
|
||||
t.Fatal("unverified diagnostic accepted")
|
||||
}
|
||||
}
|
||||
for _, tc := range []struct {
|
||||
code int
|
||||
text string
|
||||
}{
|
||||
{0, ""}, {20, ""}, {20, "12:03PM WRN leaks found: 1\n"},
|
||||
} {
|
||||
if validateBatchDiagnostics(tc.code, []byte(tc.text)) != nil {
|
||||
t.Fatal("valid diagnostic refused")
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,481 @@
|
|||
// receive-secret-scan is a content-silent, Linux pre-receive control adapter.
|
||||
// It never changes refs, runs repository programs, or retrieves credentials.
|
||||
package main
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"flag"
|
||||
"fmt"
|
||||
"io"
|
||||
"os"
|
||||
"os/exec"
|
||||
"path/filepath"
|
||||
"regexp"
|
||||
"sort"
|
||||
"strconv"
|
||||
"strings"
|
||||
"syscall"
|
||||
"time"
|
||||
)
|
||||
|
||||
const scannerHash = "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509"
|
||||
const scannerVersion = "8.30.1"
|
||||
const maxInput = 512 * 1024
|
||||
const maxObject = 8 * 1024 * 1024
|
||||
const maxTotal = 64 * 1024 * 1024
|
||||
const maxObjects = 2000
|
||||
const maxRefs = 10000
|
||||
|
||||
var oidPattern = regexp.MustCompile(`^(?:[0-9a-f]{40}|[0-9a-f]{64})$`)
|
||||
var errLimit = errors.New("output-limit")
|
||||
|
||||
type result struct {
|
||||
Status string `json:"status"`
|
||||
Scope string `json:"scope"`
|
||||
Reason string `json:"reason,omitempty"`
|
||||
Scanned int `json:"scanned_objects"`
|
||||
ScannedRefs int `json:"scanned_refs"`
|
||||
BlockedID string `json:"blocked_object_id,omitempty"`
|
||||
Version string `json:"scanner_version"`
|
||||
}
|
||||
type update struct{ Old, New, Ref string }
|
||||
type cappedBuffer struct {
|
||||
bytes.Buffer
|
||||
limit int
|
||||
}
|
||||
|
||||
func (b *cappedBuffer) Write(p []byte) (int, error) {
|
||||
if len(p) > b.limit-b.Len() {
|
||||
return 0, errLimit
|
||||
}
|
||||
return b.Buffer.Write(p)
|
||||
}
|
||||
func zero(s string) bool { return strings.Trim(s, "0") == "" }
|
||||
func parseUpdates(raw []byte) ([]update, error) {
|
||||
if len(raw) == 0 || len(raw) > maxInput || raw[len(raw)-1] != '\n' {
|
||||
return nil, errors.New("invalid-update-input")
|
||||
}
|
||||
lines := strings.Split(string(raw[:len(raw)-1]), "\n")
|
||||
if len(lines) > 256 {
|
||||
return nil, errors.New("update-limit")
|
||||
}
|
||||
seen := map[string]bool{}
|
||||
var out []update
|
||||
for _, line := range lines {
|
||||
fields := strings.Split(line, " ")
|
||||
if len(fields) != 3 || !oidPattern.MatchString(fields[0]) || !oidPattern.MatchString(fields[1]) || len(fields[0]) != len(fields[1]) || len(fields[2]) > 1024 || !strings.HasPrefix(fields[2], "refs/") || strings.ContainsAny(fields[2], "\x00\r\n\t") || seen[fields[2]] || zero(fields[0]) && zero(fields[1]) {
|
||||
return nil, errors.New("invalid-update-input")
|
||||
}
|
||||
seen[fields[2]] = true
|
||||
out = append(out, update{fields[0], fields[1], fields[2]})
|
||||
}
|
||||
return out, nil
|
||||
}
|
||||
|
||||
// Only receive-pack object-location variables cross into Git. Scanner processes
|
||||
// get none. Never inherit arbitrary GIT_CONFIG_* or credential/provider settings.
|
||||
func gitEnvironment() []string {
|
||||
env := []string{"PATH=/usr/local/bin:/usr/bin:/bin", "HOME=/nonexistent", "LANG=C", "GIT_CONFIG_NOSYSTEM=1", "GIT_CONFIG_GLOBAL=/dev/null", "GIT_NO_REPLACE_OBJECTS=1", "GIT_GRAFT_FILE=/dev/null", "GIT_NO_LAZY_FETCH=1", "GIT_TERMINAL_PROMPT=0", "GIT_ASKPASS=/bin/false", "GIT_SSH_COMMAND=/bin/false"}
|
||||
for _, key := range []string{"GIT_DIR", "GIT_COMMON_DIR", "GIT_OBJECT_DIRECTORY", "GIT_ALTERNATE_OBJECT_DIRECTORIES", "GIT_QUARANTINE_PATH"} {
|
||||
if val, ok := os.LookupEnv(key); ok {
|
||||
env = append(env, key+"="+val)
|
||||
}
|
||||
}
|
||||
return env
|
||||
}
|
||||
func git(ctx context.Context, input []byte, limit int, args ...string) ([]byte, error) {
|
||||
cmd := exec.CommandContext(ctx, "/usr/bin/git", args...)
|
||||
cmd.Env = gitEnvironment()
|
||||
cmd.Stdin = bytes.NewReader(input)
|
||||
b := &cappedBuffer{limit: limit}
|
||||
cmd.Stdout = b
|
||||
cmd.Stderr = io.Discard
|
||||
if runChild(cmd) != nil {
|
||||
return nil, errors.New("git-" + args[0] + "-failed")
|
||||
}
|
||||
return b.Bytes(), nil
|
||||
}
|
||||
func refs(ctx context.Context) ([]byte, map[string]string, error) {
|
||||
raw, err := git(ctx, nil, 2*1024*1024, "for-each-ref", "--format=%(objectname) %(refname)")
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
found := map[string]string{}
|
||||
for _, line := range strings.Split(strings.TrimSuffix(string(raw), "\n"), "\n") {
|
||||
if line == "" {
|
||||
continue
|
||||
}
|
||||
parts := strings.Split(line, " ")
|
||||
if len(parts) != 2 || !oidPattern.MatchString(parts[0]) || !strings.HasPrefix(parts[1], "refs/") {
|
||||
return nil, nil, errors.New("invalid-ref-snapshot")
|
||||
}
|
||||
found[parts[1]] = parts[0]
|
||||
}
|
||||
if len(found) > maxRefs {
|
||||
return nil, nil, errors.New("ref-limit")
|
||||
}
|
||||
return raw, found, nil
|
||||
}
|
||||
func pinScanner(path string) (*os.File, error) {
|
||||
fd, err := syscall.Open(path, syscall.O_RDONLY|syscall.O_NOFOLLOW|syscall.O_NONBLOCK, 0)
|
||||
if err != nil {
|
||||
return nil, errors.New("scanner-file-refused")
|
||||
}
|
||||
f := os.NewFile(uintptr(fd), path)
|
||||
ok := false
|
||||
defer func() {
|
||||
if !ok {
|
||||
f.Close()
|
||||
}
|
||||
}()
|
||||
if err = verifyScannerFD(f); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
ok = true
|
||||
return f, nil
|
||||
}
|
||||
func scan(ctx context.Context, f *os.File, dir string, content []byte) (bool, error) {
|
||||
cmd := exec.CommandContext(ctx, "/proc/self/fd/3", "stdin", "--config", filepath.Join(dir, "scanner.toml"), "--gitleaks-ignore-path", filepath.Join(dir, "ignore"), "--ignore-gitleaks-allow", "--redact=100", "--no-banner", "--no-color", "--log-level", "fatal", "--exit-code", "20", "--timeout", "15")
|
||||
cmd.ExtraFiles = []*os.File{f}
|
||||
cmd.Dir = dir
|
||||
cmd.Env = []string{"PATH=/usr/bin:/bin", "HOME=" + dir, "TMPDIR=" + dir, "LANG=C"}
|
||||
cmd.Stdin = bytes.NewReader(content)
|
||||
cmd.Stdout = io.Discard
|
||||
cmd.Stderr = io.Discard
|
||||
err := runChild(cmd)
|
||||
if ctx.Err() != nil {
|
||||
return false, errors.New("scan-deadline-exceeded")
|
||||
}
|
||||
if err == nil {
|
||||
return false, nil
|
||||
}
|
||||
var exit *exec.ExitError
|
||||
if errors.As(err, &exit) && exit.ExitCode() == 20 {
|
||||
return true, nil
|
||||
}
|
||||
return false, errors.New("scanner-failed")
|
||||
}
|
||||
|
||||
// Tree object names are covered too. Gitlinks refer to an external repository,
|
||||
// so this version refuses them rather than claiming transitive coverage.
|
||||
func treeContent(raw []byte, oidBytes int) ([]byte, error) {
|
||||
var names []byte
|
||||
for len(raw) > 0 {
|
||||
space := bytes.IndexByte(raw, ' ')
|
||||
nul := bytes.IndexByte(raw, 0)
|
||||
if space <= 0 || nul <= space || len(raw) < nul+1+oidBytes {
|
||||
return nil, errors.New("invalid-tree")
|
||||
}
|
||||
mode := string(raw[:space])
|
||||
if mode == "160000" {
|
||||
return nil, errors.New("external-gitlink-unverified")
|
||||
}
|
||||
if mode != "100644" && mode != "100755" && mode != "120000" && mode != "40000" {
|
||||
return nil, errors.New("unsupported-tree-entry")
|
||||
}
|
||||
names = append(names, raw[space+1:nul]...)
|
||||
names = append(names, '\n')
|
||||
raw = raw[nul+1+oidBytes:]
|
||||
}
|
||||
return names, nil
|
||||
}
|
||||
func check(ctx context.Context, updates []update, binary string) (out result) {
|
||||
out = result{Status: "unverified", Scope: "introduced-reachable-git-objects-and-updated-ref-names", Version: scannerVersion}
|
||||
fail := func(err error) result { out.Reason = err.Error(); return out }
|
||||
scanner, err := pinScanner(binary)
|
||||
if err != nil {
|
||||
return fail(err)
|
||||
}
|
||||
defer scanner.Close()
|
||||
format, err := git(ctx, nil, 128, "rev-parse", "--show-object-format")
|
||||
if err != nil {
|
||||
return fail(err)
|
||||
}
|
||||
width := 40
|
||||
if string(format) == "sha256\n" {
|
||||
width = 64
|
||||
} else if string(format) != "sha1\n" {
|
||||
return fail(errors.New("unsupported-object-format"))
|
||||
}
|
||||
shallow, err := git(ctx, nil, 128, "rev-parse", "--is-shallow-repository")
|
||||
if err != nil {
|
||||
return fail(err)
|
||||
}
|
||||
if string(shallow) != "false\n" {
|
||||
return fail(errors.New("shallow-repository-unverified"))
|
||||
}
|
||||
// Partial repositories may perform network retrieval while reading objects.
|
||||
config, err := git(ctx, nil, 1024*1024, "config", "--local", "--includes", "--name-only", "--list")
|
||||
if err != nil {
|
||||
return fail(err)
|
||||
}
|
||||
for _, key := range strings.Split(strings.ToLower(string(config)), "\n") {
|
||||
if key == "extensions.partialclone" || strings.HasSuffix(key, ".promisor") {
|
||||
return fail(errors.New("partial-repository-unverified"))
|
||||
}
|
||||
}
|
||||
snapshot, existing, err := refs(ctx)
|
||||
if err != nil {
|
||||
return fail(err)
|
||||
}
|
||||
tips := map[string]bool{}
|
||||
for _, u := range updates {
|
||||
if len(u.Old) != width {
|
||||
return fail(errors.New("object-format-mismatch"))
|
||||
}
|
||||
if _, err = git(ctx, nil, 128, "check-ref-format", u.Ref); err != nil {
|
||||
return fail(errors.New("invalid-ref-name"))
|
||||
}
|
||||
current, exists := existing[u.Ref]
|
||||
if zero(u.Old) && exists || !zero(u.Old) && current != u.Old {
|
||||
return fail(errors.New("old-ref-mismatch"))
|
||||
}
|
||||
if !zero(u.New) {
|
||||
tips[u.New] = true
|
||||
}
|
||||
}
|
||||
// Freeze exclusions from the pre-push snapshot, never a mutable --all read.
|
||||
// Scan all introduced reachable objects, not just a tip diff or first parent.
|
||||
var revisions strings.Builder
|
||||
for tip := range tips {
|
||||
revisions.WriteString(tip + "\n")
|
||||
}
|
||||
objects := map[string]bool{}
|
||||
if len(tips) > 0 {
|
||||
excluded := map[string]bool{}
|
||||
for _, oid := range existing {
|
||||
excluded[oid] = true
|
||||
}
|
||||
for oid := range excluded {
|
||||
revisions.WriteString("^" + oid + "\n")
|
||||
}
|
||||
raw, e := git(ctx, []byte(revisions.String()), (maxObjects+1)*(width+1), "rev-list", "--objects", "--no-object-names", "--stdin")
|
||||
if e != nil {
|
||||
return fail(e)
|
||||
}
|
||||
for _, oid := range strings.Fields(string(raw)) {
|
||||
if !oidPattern.MatchString(oid) || len(oid) != width {
|
||||
return fail(errors.New("invalid-object-list"))
|
||||
}
|
||||
objects[oid] = true
|
||||
}
|
||||
}
|
||||
if len(objects) > maxObjects {
|
||||
return fail(errors.New("object-limit"))
|
||||
}
|
||||
ids := make([]string, 0, len(objects))
|
||||
for oid := range objects {
|
||||
ids = append(ids, oid)
|
||||
}
|
||||
sort.Strings(ids)
|
||||
var metadata []byte
|
||||
if len(ids) > 0 {
|
||||
metadata, err = git(ctx, []byte(strings.Join(ids, "\n")+"\n"), (maxObjects+1)*100, "cat-file", "--batch-check=%(objectname) %(objecttype) %(objectsize)")
|
||||
if err != nil {
|
||||
return fail(err)
|
||||
}
|
||||
}
|
||||
lines := strings.Split(strings.TrimSuffix(string(metadata), "\n"), "\n")
|
||||
if len(ids) == 0 {
|
||||
lines = nil
|
||||
}
|
||||
if len(lines) != len(ids) {
|
||||
return fail(errors.New("incomplete-object-metadata"))
|
||||
}
|
||||
// Reject oversized batches before reading/scanning any object payload.
|
||||
type objectInfo struct {
|
||||
kind string
|
||||
size int64
|
||||
}
|
||||
var objectMetadata []objectInfo
|
||||
total := int64(0)
|
||||
for i, line := range lines {
|
||||
parts := strings.Split(line, " ")
|
||||
if len(parts) != 3 || parts[0] != ids[i] {
|
||||
return fail(errors.New("invalid-object-metadata"))
|
||||
}
|
||||
kind := parts[1]
|
||||
if kind != "blob" && kind != "commit" && kind != "tag" && kind != "tree" {
|
||||
return fail(errors.New("unsupported-object-type"))
|
||||
}
|
||||
size, e := strconv.ParseInt(parts[2], 10, 64)
|
||||
if e != nil || size < 0 || size > maxObject || total+size > maxTotal {
|
||||
return fail(errors.New("object-byte-limit"))
|
||||
}
|
||||
total += size
|
||||
objectMetadata = append(objectMetadata, objectInfo{kind, size})
|
||||
}
|
||||
dir, err := os.MkdirTemp("", "forge-secret-scan-")
|
||||
if err != nil {
|
||||
return fail(errors.New("temporary-directory-unavailable"))
|
||||
}
|
||||
defer os.RemoveAll(dir)
|
||||
var storage *volatileStorage
|
||||
defer func() {
|
||||
if storage != nil {
|
||||
if e := storage.close(); e != nil {
|
||||
out.Status = "unverified"
|
||||
out.Reason = e.Error()
|
||||
}
|
||||
}
|
||||
}()
|
||||
getStorage := func() error {
|
||||
if storage == nil {
|
||||
var e error
|
||||
storage, e = newVolatileStorage()
|
||||
return e
|
||||
}
|
||||
if !storage.live() {
|
||||
return errors.New("cleanup-watchdog-unavailable")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
if os.WriteFile(filepath.Join(dir, "scanner.toml"), []byte("[extend]\nuseDefault = true\n"), 0600) != nil || os.WriteFile(filepath.Join(dir, "ignore"), nil, 0600) != nil {
|
||||
return fail(errors.New("scanner-config-unavailable"))
|
||||
}
|
||||
// Ref names can themselves contain recognized tokens. Never echo them.
|
||||
for start := 0; start < len(updates); start += directoryBatchInputs {
|
||||
end := start + directoryBatchInputs
|
||||
if end > len(updates) {
|
||||
end = len(updates)
|
||||
}
|
||||
if end-start == 1 {
|
||||
blocked, e := scan(ctx, scanner, dir, []byte(updates[start].Ref))
|
||||
if e != nil {
|
||||
return fail(e)
|
||||
}
|
||||
out.ScannedRefs++
|
||||
if blocked {
|
||||
out.Status = "blocked"
|
||||
out.Reason = "ref-name-detection"
|
||||
return out
|
||||
}
|
||||
continue
|
||||
}
|
||||
if e := getStorage(); e != nil {
|
||||
return fail(e)
|
||||
}
|
||||
var batch []scanInput
|
||||
for i := start; i < end; i++ {
|
||||
batch = append(batch, scanInput{fmt.Sprintf("ref-%d", i), []byte(updates[i].Ref)})
|
||||
}
|
||||
blocked, e := scanSmall(ctx, scanner, dir, storage, batch)
|
||||
if e != nil {
|
||||
return fail(e)
|
||||
}
|
||||
out.ScannedRefs += len(batch)
|
||||
if blocked != "" {
|
||||
out.Status = "blocked"
|
||||
out.Reason = "ref-name-detection"
|
||||
return out
|
||||
}
|
||||
}
|
||||
var pending []scanInput
|
||||
flush := func() error {
|
||||
if len(pending) == 0 {
|
||||
return nil
|
||||
}
|
||||
if e := getStorage(); e != nil {
|
||||
return e
|
||||
}
|
||||
blocked, e := scanSmall(ctx, scanner, dir, storage, pending)
|
||||
if e != nil {
|
||||
return e
|
||||
}
|
||||
out.Scanned += len(pending)
|
||||
pending = nil
|
||||
if blocked != "" {
|
||||
out.Status = "blocked"
|
||||
out.BlockedID = blocked
|
||||
}
|
||||
return nil
|
||||
}
|
||||
for i, info := range objectMetadata {
|
||||
kind, size := info.kind, info.size
|
||||
raw, e := git(ctx, nil, int(size)+1, "cat-file", kind, ids[i])
|
||||
if e != nil {
|
||||
return fail(e)
|
||||
}
|
||||
if int64(len(raw)) != size {
|
||||
return fail(errors.New("object-size-mismatch"))
|
||||
}
|
||||
if kind == "tree" {
|
||||
raw, e = treeContent(raw, width/2)
|
||||
if e != nil {
|
||||
return fail(e)
|
||||
}
|
||||
}
|
||||
if len(raw) <= directoryInputBytes {
|
||||
pending = append(pending, scanInput{ids[i], raw})
|
||||
if len(pending) == directoryBatchInputs {
|
||||
if e = flush(); e != nil {
|
||||
return fail(e)
|
||||
}
|
||||
if out.Status == "blocked" {
|
||||
return out
|
||||
}
|
||||
}
|
||||
continue
|
||||
}
|
||||
blocked, e := scan(ctx, scanner, dir, raw)
|
||||
if e != nil {
|
||||
return fail(e)
|
||||
}
|
||||
out.Scanned++
|
||||
if blocked {
|
||||
out.Status = "blocked"
|
||||
out.BlockedID = ids[i]
|
||||
return out
|
||||
}
|
||||
}
|
||||
if err = flush(); err != nil {
|
||||
return fail(err)
|
||||
}
|
||||
if out.Status == "blocked" {
|
||||
return out
|
||||
}
|
||||
after, _, err := refs(ctx)
|
||||
if err != nil {
|
||||
return fail(err)
|
||||
}
|
||||
if !bytes.Equal(snapshot, after) {
|
||||
return fail(errors.New("refs-changed-during-scan"))
|
||||
}
|
||||
out.Status = "clean"
|
||||
return out
|
||||
}
|
||||
func main() {
|
||||
if code, handled := internalProcess(os.Args[1:]); handled {
|
||||
os.Exit(code)
|
||||
}
|
||||
flags := flag.NewFlagSet("receive-secret-scan", flag.ContinueOnError)
|
||||
flags.SetOutput(io.Discard)
|
||||
binary := flags.String("scanner", "", "reviewed Gitleaks executable")
|
||||
out := result{Status: "unverified", Scope: "introduced-reachable-git-objects-and-updated-ref-names", Version: scannerVersion, Reason: "invalid-invocation"}
|
||||
if flags.Parse(os.Args[1:]) == nil && *binary != "" && flags.NArg() == 0 {
|
||||
raw, err := io.ReadAll(io.LimitReader(os.Stdin, maxInput+1))
|
||||
if err == nil {
|
||||
updates, e := parseUpdates(raw)
|
||||
if e != nil {
|
||||
out.Reason = e.Error()
|
||||
} else {
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 90*time.Second)
|
||||
out = check(ctx, updates, *binary)
|
||||
cancel()
|
||||
}
|
||||
}
|
||||
}
|
||||
// Only fixed reason codes, counts and an object ID may reach the caller.
|
||||
encoded, _ := json.Marshal(out)
|
||||
fmt.Println(string(encoded))
|
||||
if out.Status == "clean" {
|
||||
return
|
||||
}
|
||||
if out.Status == "blocked" {
|
||||
os.Exit(1)
|
||||
}
|
||||
os.Exit(2)
|
||||
}
|
||||
|
|
@ -0,0 +1,268 @@
|
|||
// Linux volatile input custody; no raw input is written to ordinary disk.
|
||||
package main
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"os"
|
||||
"os/exec"
|
||||
"path/filepath"
|
||||
"runtime"
|
||||
"strconv"
|
||||
"strings"
|
||||
"syscall"
|
||||
"time"
|
||||
)
|
||||
|
||||
type storageIdentity struct {
|
||||
dev uint64
|
||||
ino uint64
|
||||
uid uint32
|
||||
}
|
||||
|
||||
func volatileIdentity(path string) (storageIdentity, error) {
|
||||
var id storageIdentity
|
||||
if filepath.Dir(path) != "/dev/shm" || !strings.HasPrefix(filepath.Base(path), "forge-receive-scan-") {
|
||||
return id, errors.New("volatile-storage-refused")
|
||||
}
|
||||
fd, err := syscall.Open(path, syscall.O_RDONLY|syscall.O_DIRECTORY|syscall.O_NOFOLLOW|syscall.O_CLOEXEC, 0)
|
||||
if err != nil {
|
||||
return id, errors.New("volatile-storage-unavailable")
|
||||
}
|
||||
defer syscall.Close(fd)
|
||||
var st syscall.Stat_t
|
||||
var fs syscall.Statfs_t
|
||||
if syscall.Fstat(fd, &st) != nil || syscall.Fstatfs(fd, &fs) != nil || fs.Type != 0x01021994 || st.Mode&07777 != 0700 || st.Uid != uint32(os.Getuid()) {
|
||||
return id, errors.New("volatile-storage-refused")
|
||||
}
|
||||
return storageIdentity{uint64(st.Dev), st.Ino, st.Uid}, nil
|
||||
}
|
||||
|
||||
func removeVolatile(path string, expected storageIdentity) error {
|
||||
if _, err := os.Lstat(path); os.IsNotExist(err) {
|
||||
return nil
|
||||
}
|
||||
id, err := volatileIdentity(path)
|
||||
if err != nil || id != expected {
|
||||
return errors.New("volatile-storage-identity-changed")
|
||||
}
|
||||
if os.RemoveAll(path) != nil {
|
||||
return errors.New("volatile-storage-cleanup-failed")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// Pin the exact parent using Linux pidfd, not a reusable numeric process ID.
|
||||
func parentDescriptor(parent int) (*os.File, error) {
|
||||
if runtime.GOARCH != "amd64" && runtime.GOARCH != "arm64" {
|
||||
return nil, errors.New("cleanup-platform-unsupported")
|
||||
}
|
||||
if parent <= 1 || os.Getppid() != parent {
|
||||
return nil, errors.New("cleanup-parent-refused")
|
||||
}
|
||||
fd, _, errno := syscall.Syscall(434, uintptr(parent), 0, 0) // pidfd_open, Linux 5.3+
|
||||
if errno != 0 {
|
||||
return nil, errors.New("cleanup-parent-unavailable")
|
||||
}
|
||||
f := os.NewFile(fd, "parent-pidfd")
|
||||
if os.Getppid() != parent || fd >= 1024 {
|
||||
f.Close()
|
||||
return nil, errors.New("cleanup-parent-refused")
|
||||
}
|
||||
return f, nil
|
||||
}
|
||||
|
||||
func waitParent(f *os.File, duration time.Duration) bool {
|
||||
fd := int(f.Fd())
|
||||
var deadline time.Time
|
||||
if duration >= 0 {
|
||||
deadline = time.Now().Add(duration)
|
||||
}
|
||||
for {
|
||||
// select may mutate both arguments, including when interrupted.
|
||||
var set syscall.FdSet
|
||||
set.Bits[fd/64] |= 1 << uint(fd%64)
|
||||
var timeout *syscall.Timeval
|
||||
if duration >= 0 {
|
||||
remaining := time.Until(deadline)
|
||||
if remaining < 0 {
|
||||
remaining = 0
|
||||
}
|
||||
value := syscall.NsecToTimeval(remaining.Nanoseconds())
|
||||
timeout = &value
|
||||
}
|
||||
n, err := syscall.Select(fd+1, &set, nil, nil, timeout)
|
||||
if err == syscall.EINTR {
|
||||
continue
|
||||
}
|
||||
return err == nil && n > 0
|
||||
}
|
||||
}
|
||||
|
||||
func signalParent(f *os.File, signal syscall.Signal) {
|
||||
_, _, _ = syscall.Syscall6(424, f.Fd(), uintptr(signal), 0, 0, 0, 0) // pidfd_send_signal
|
||||
}
|
||||
|
||||
func cleanupProcess(args []string) int {
|
||||
if len(args) != 5 {
|
||||
return 4
|
||||
}
|
||||
dev, e1 := strconv.ParseUint(args[1], 10, 64)
|
||||
ino, e2 := strconv.ParseUint(args[2], 10, 64)
|
||||
uid, e3 := strconv.ParseUint(args[3], 10, 32)
|
||||
parent, e4 := strconv.Atoi(args[4])
|
||||
if e1 != nil || e2 != nil || e3 != nil || e4 != nil {
|
||||
return 4
|
||||
}
|
||||
expected := storageIdentity{dev, ino, uint32(uid)}
|
||||
id, err := volatileIdentity(args[0])
|
||||
if err != nil || id != expected {
|
||||
return 3
|
||||
}
|
||||
process, err := parentDescriptor(parent)
|
||||
if err != nil {
|
||||
return 4
|
||||
}
|
||||
defer process.Close()
|
||||
if _, err = os.Stdout.Write([]byte("R")); err != nil {
|
||||
return 4
|
||||
}
|
||||
eof := make(chan bool, 1)
|
||||
go func() { var b [1]byte; n, e := os.Stdin.Read(b[:]); eof <- n == 0 && e == io.EOF }()
|
||||
select {
|
||||
case ok := <-eof:
|
||||
if !ok {
|
||||
return 4
|
||||
}
|
||||
case <-time.After(180 * time.Second):
|
||||
signalParent(process, syscall.SIGTERM)
|
||||
if !waitParent(process, 5*time.Second) {
|
||||
signalParent(process, syscall.SIGKILL)
|
||||
if !waitParent(process, -1) {
|
||||
return 4
|
||||
}
|
||||
}
|
||||
}
|
||||
if removeVolatile(args[0], expected) != nil {
|
||||
return 3
|
||||
}
|
||||
return 0
|
||||
}
|
||||
|
||||
type volatileStorage struct {
|
||||
path string
|
||||
id storageIdentity
|
||||
pipe io.WriteCloser
|
||||
command *exec.Cmd
|
||||
done chan error
|
||||
}
|
||||
|
||||
func newVolatileStorage() (*volatileStorage, error) {
|
||||
root, err := syscall.Open("/dev/shm", syscall.O_RDONLY|syscall.O_DIRECTORY|syscall.O_NOFOLLOW|syscall.O_CLOEXEC, 0)
|
||||
if err != nil {
|
||||
return nil, errors.New("volatile-storage-unavailable")
|
||||
}
|
||||
var fs syscall.Statfs_t
|
||||
err = syscall.Fstatfs(root, &fs)
|
||||
syscall.Close(root)
|
||||
if err != nil || fs.Type != 0x01021994 {
|
||||
return nil, errors.New("volatile-storage-unavailable")
|
||||
}
|
||||
path, err := os.MkdirTemp("/dev/shm", "forge-receive-scan-")
|
||||
if err != nil {
|
||||
return nil, errors.New("volatile-storage-unavailable")
|
||||
}
|
||||
id, err := volatileIdentity(path)
|
||||
if err != nil {
|
||||
os.RemoveAll(path)
|
||||
return nil, err
|
||||
}
|
||||
cmd := exec.Command("/proc/self/exe", "--cleanup-storage", path, fmt.Sprint(id.dev), fmt.Sprint(id.ino), fmt.Sprint(id.uid), strconv.Itoa(os.Getpid()))
|
||||
cmd.Env = []string{"PATH=/usr/bin:/bin", "LANG=C"}
|
||||
cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
|
||||
writer, err := cmd.StdinPipe()
|
||||
if err != nil {
|
||||
removeVolatile(path, id)
|
||||
return nil, errors.New("cleanup-watchdog-unavailable")
|
||||
}
|
||||
reader, err := cmd.StdoutPipe()
|
||||
if err != nil {
|
||||
writer.Close()
|
||||
removeVolatile(path, id)
|
||||
return nil, errors.New("cleanup-watchdog-unavailable")
|
||||
}
|
||||
if err = cmd.Start(); err != nil {
|
||||
writer.Close()
|
||||
reader.Close()
|
||||
removeVolatile(path, id)
|
||||
return nil, errors.New("cleanup-watchdog-unavailable")
|
||||
}
|
||||
v := &volatileStorage{path, id, writer, cmd, make(chan error, 1)}
|
||||
go func() { v.done <- cmd.Wait() }()
|
||||
ready := make(chan bool, 1)
|
||||
go func() {
|
||||
var b [1]byte
|
||||
_, e := io.ReadFull(reader, b[:])
|
||||
reader.Close()
|
||||
ready <- e == nil && b[0] == 'R'
|
||||
}()
|
||||
select {
|
||||
case ok := <-ready:
|
||||
if ok && v.live() {
|
||||
return v, nil
|
||||
}
|
||||
case <-time.After(5 * time.Second):
|
||||
}
|
||||
v.close()
|
||||
return nil, errors.New("cleanup-watchdog-unavailable")
|
||||
}
|
||||
|
||||
func (v *volatileStorage) live() bool {
|
||||
select {
|
||||
case err := <-v.done:
|
||||
v.done <- err
|
||||
return false
|
||||
default:
|
||||
return true
|
||||
}
|
||||
}
|
||||
|
||||
func (v *volatileStorage) close() error {
|
||||
err := removeVolatile(v.path, v.id)
|
||||
v.pipe.Close()
|
||||
select {
|
||||
case outcome := <-v.done:
|
||||
if outcome != nil && err == nil {
|
||||
err = errors.New("cleanup-watchdog-failed")
|
||||
}
|
||||
case <-time.After(5 * time.Second):
|
||||
v.command.Process.Kill()
|
||||
<-v.done
|
||||
if err == nil {
|
||||
err = errors.New("cleanup-watchdog-failed")
|
||||
}
|
||||
}
|
||||
return err
|
||||
}
|
||||
|
||||
// Source-reading/writing children cannot survive loss of their exact parent.
|
||||
func runChild(cmd *exec.Cmd) error {
|
||||
runtime.LockOSThread()
|
||||
defer runtime.UnlockOSThread()
|
||||
cmd.SysProcAttr = &syscall.SysProcAttr{Pdeathsig: syscall.SIGKILL}
|
||||
return cmd.Run()
|
||||
}
|
||||
|
||||
func internalProcess(args []string) (int, bool) {
|
||||
if len(args) == 0 {
|
||||
return 0, false
|
||||
}
|
||||
switch args[0] {
|
||||
case "--cleanup-storage":
|
||||
return cleanupProcess(args[1:]), true
|
||||
case "--batch-scanner":
|
||||
return batchScannerProcess(args[1:]), true
|
||||
}
|
||||
return 0, false
|
||||
}
|
||||
|
|
@ -0,0 +1,90 @@
|
|||
---
|
||||
id: FORGE-WP-0010
|
||||
type: workplan
|
||||
title: "Complete bounded receive scans without per-small-input startup overhead"
|
||||
domain: financials
|
||||
repo: railiance-forge
|
||||
status: proposed
|
||||
owner: codex
|
||||
topic_slug: railiance-forge
|
||||
created: "2026-10-18"
|
||||
updated: "2026-10-18"
|
||||
flavor: implementation
|
||||
depends_on: []
|
||||
state_hub_workstream_id: "04d8ebb9-e9fe-58d8-bdc8-2aa985098c7a"
|
||||
---
|
||||
|
||||
CUST-WP-0080 discovered an availability defect in the already enforced receive
|
||||
control: the normal 141-object public Custodian source delta exhausts the
|
||||
unchanged 90-second budget, with no secret finding. The unmodified owner source
|
||||
reproduces the refusal in an isolated bare repository. This is a new correction,
|
||||
not reopening finished FORGE-WP-0006 or promoting FORGE-WP-0008 residual coverage.
|
||||
|
||||
Reuse the existing Repo Manager small-input profile: at most 64 inputs of at most
|
||||
4096 bytes per directory scan, identical pinned Gitleaks/default rules and strict
|
||||
report/diagnostic validation. Larger inputs retain the original stdin fragment
|
||||
path. Preserve every traversal/ref/object/byte/time bound, no override or new
|
||||
runtime service. Raw batch inputs require checked private tmpfs, independent
|
||||
parent-bound cleanup and child termination on receiver loss. Source preparation
|
||||
does not grant native installation, package/owner acceptance or production proof.
|
||||
|
||||
## Reproduce and implement the bounded adapter correction
|
||||
|
||||
```task
|
||||
id: FORGE-WP-0010-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "c61c0392-6c0a-5a36-bbd1-4ee6aeb2afea"
|
||||
```
|
||||
|
||||
Retain the exact original failure and source delta. Implement the existing
|
||||
small-input batching contract in the Linux receive adapter. Verify synthetic
|
||||
positive/negative parity, real receive-pack quarantine, all prior boundaries,
|
||||
limits, expired context, diagnostic/report refusal, normal cleanup, receiver
|
||||
death and changed storage identity. Complete the exact original clean delta
|
||||
within the same deadline. Failures remain evidence; source proof closes no
|
||||
native acceptance gate. Independent package/owner review remains under T02.
|
||||
|
||||
Source result: the exact previously refused 141-object/one-ref delta completes
|
||||
in 52.53 seconds with all objects counted, under the unchanged 90-second budget.
|
||||
The complete suite passes 49 leaf cases with zero skips; five additional boundary
|
||||
cases bring the combined distinct leaf coverage to 54. These include 4096-byte
|
||||
and larger-input detection, multi-ref-name detection, normal and receiver-loss
|
||||
cleanup, scanner/report/diagnostic failures and changed directory identity.
|
||||
Unavailable and ordinary-disk storage fail closed in separate actual helper
|
||||
processes. The original low-entropy canary failure and misconfigured storage
|
||||
fixture/setup failures are retained rather than counted as successful tests.
|
||||
Source/proof: Custodian `docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/`.
|
||||
|
||||
## Prepare and approve the immutable native revision
|
||||
|
||||
```task
|
||||
id: FORGE-WP-0010-T02
|
||||
status: progress
|
||||
priority: high
|
||||
state_hub_task_id: "b49d34ef-e6e5-5674-b523-ebcf80e0dcca"
|
||||
```
|
||||
|
||||
Obtain independent source/package review. Pin exact source/build tool provenance, executable digest, startup-guard and
|
||||
hook composition. Capture read-only current state, no-op checks and exact
|
||||
before/after/rollback. Retain permissions, scanner digest, hook ordering and
|
||||
fail-closed behavior. Obtain the founder's explicit go for this live change
|
||||
under the existing environment rule; previous activation is not approval for
|
||||
this different executable. Preserve the original revision and every refinement
|
||||
in the current supervised-action record.
|
||||
|
||||
## Verify admitted native behavior and ordinary publication
|
||||
|
||||
```task
|
||||
id: FORGE-WP-0010-T03
|
||||
status: wait
|
||||
priority: high
|
||||
state_hub_task_id: "863c91e4-7c25-575f-b8b6-f98d0074ce5a"
|
||||
```
|
||||
|
||||
Waiting on T02: exact executable/startup admission and founder-authorized native
|
||||
activation. Verify actual hook clean/refusal/unavailable/cleanup behavior and
|
||||
the legitimate ordinary source publication without splitting or seeding refs.
|
||||
Reconcile owner task/source status and independent evidence. Existing remaining
|
||||
coverage, private incident response and target-wide acceptance retain their
|
||||
original owners; no residual implementation is inferred.
|
||||
|
|
@ -0,0 +1,139 @@
|
|||
"""Prepare public source and conditional patch; only read/server dry-run remotely.
|
||||
|
||||
Reuse the existing Forgejo template patch simulator, metadata transport and
|
||||
server-dry-run helper. Never replay historical Helm release values.
|
||||
"""
|
||||
from pathlib import Path
|
||||
import copy
|
||||
import hashlib
|
||||
import importlib.util
|
||||
import json
|
||||
import re
|
||||
|
||||
import yaml
|
||||
|
||||
HERE=Path(__file__).resolve().parent
|
||||
REPO=HERE.parents[3]
|
||||
OLD=REPO/'docs/changes/CUST-WP-0080'
|
||||
OLD_DIRECTORY='/data/security/receive-secret-scan/20261012-57a0642b6251'
|
||||
OLD_HASH='57a0642b625105440fe146fceb4d244fd2dd08a75beb316831675643e6cc27ec'
|
||||
OLD_CM='forgejo-secret-template-b1d7cf8cd13f'
|
||||
|
||||
def sha(raw):
|
||||
return hashlib.sha256(raw).hexdigest()
|
||||
|
||||
def support():
|
||||
spec=importlib.util.spec_from_file_location('existing_forge_template',OLD/'activate_forge_template.py')
|
||||
module=importlib.util.module_from_spec(spec)
|
||||
spec.loader.exec_module(module)
|
||||
return module
|
||||
|
||||
def replacement_patch(deployment, old_command, new_command, old_cm, new_cm):
|
||||
spec=deployment['spec']['template']['spec']
|
||||
guards=[i for i,c in enumerate(spec['initContainers']) if c['name']=='verify-secret-scanner']
|
||||
volumes=[i for i,v in enumerate(spec['volumes']) if v['name']=='secret-scan-template']
|
||||
if len(guards)!=1 or len(volumes)!=1:
|
||||
raise ValueError('missing-or-ambiguous-existing-control')
|
||||
command_path='/spec/template/spec/initContainers/'+str(guards[0])+'/command'
|
||||
volume_path='/spec/template/spec/volumes/'+str(volumes[0])+'/configMap/name'
|
||||
if spec['initContainers'][guards[0]]['command']!=old_command or spec['volumes'][volumes[0]]['configMap']['name']!=old_cm:
|
||||
raise ValueError('existing-control-drift')
|
||||
return [
|
||||
{'op':'test','path':'/metadata/uid','value':deployment['metadata']['uid']},
|
||||
{'op':'test','path':'/metadata/resourceVersion','value':deployment['metadata']['resourceVersion']},
|
||||
{'op':'test','path':command_path,'value':old_command},
|
||||
{'op':'test','path':volume_path,'value':old_cm},
|
||||
{'op':'replace','path':command_path,'value':new_command},
|
||||
{'op':'replace','path':volume_path,'value':new_cm},
|
||||
]
|
||||
|
||||
def main():
|
||||
t=support()
|
||||
manifest=json.loads((HERE/'publication-inputs.json').read_text())
|
||||
commit=json.loads((HERE/'publication-commit.json').read_text())['commit']
|
||||
assert commit=='ea65606c1298db782f721f9443bafeb03cdef138'
|
||||
source=Path('/home/worsch/railiance-forge')
|
||||
for row in manifest['files']:
|
||||
assert sha((source/row['path']).read_bytes())==row['sha256']
|
||||
binary=Path('/tmp/custodian-receive-scanner-batch-r1/candidate-hook')
|
||||
binary_hash=sha(binary.read_bytes())
|
||||
assert binary_hash=='73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a'
|
||||
new_directory='/data/security/receive-secret-scan/20261018-'+binary_hash[:12]
|
||||
apps=Path('/home/worsch/railiance-apps')
|
||||
values_text=(apps/'helm/forgejo-values.yaml').read_text()
|
||||
cm_text=(apps/'manifests/forgejo-secret-scan-template.yaml').read_text()
|
||||
original_values=yaml.safe_load(values_text)
|
||||
original_cm=yaml.safe_load(cm_text)
|
||||
assert original_cm['metadata']['name']==OLD_CM and original_cm['immutable'] is True
|
||||
old_hook=original_cm['data']['hook']
|
||||
assert sha(old_hook.encode())=='b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b'
|
||||
new_hook=old_hook.replace(OLD_DIRECTORY,new_directory)
|
||||
hook_hash=sha(new_hook.encode())
|
||||
new_cm='forgejo-secret-template-'+hook_hash[:12]
|
||||
new_values_text=values_text.replace(OLD_DIRECTORY,new_directory).replace(OLD_HASH,binary_hash).replace(OLD_CM,new_cm)
|
||||
new_cm_text=cm_text.replace(OLD_DIRECTORY,new_directory).replace(OLD_CM,new_cm).replace('FORGE-WP-0006','FORGE-WP-0010')
|
||||
new_values=yaml.safe_load(new_values_text)
|
||||
new_configmap=yaml.safe_load(new_cm_text)
|
||||
assert new_configmap['data']['hook']==new_hook
|
||||
assert len(original_values['preExtraInitContainers'])==len(new_values['preExtraInitContainers'])==1
|
||||
old_command=original_values['preExtraInitContainers'][0]['command']
|
||||
new_command=new_values['preExtraInitContainers'][0]['command']
|
||||
# Prove the source changes only the existing guard command and CM name.
|
||||
expected=copy.deepcopy(original_values)
|
||||
expected['preExtraInitContainers'][0]['command']=new_command
|
||||
expected['extraVolumes'][0]['configMap']['name']=new_cm
|
||||
assert expected==new_values
|
||||
config_expected=copy.deepcopy(original_cm)
|
||||
config_expected['metadata']['name']=new_cm
|
||||
config_expected['metadata']['labels']['custodian.coulomb.social/workplan']='FORGE-WP-0010'
|
||||
config_expected['data']['hook']=new_hook
|
||||
assert config_expected==new_configmap
|
||||
nodes=json.loads(t.native.command(['get','nodes','-o','json']))['items']
|
||||
assert len(nodes)==1 and any(a['type']=='InternalIP' and a['address']=='92.205.62.239' for a in nodes[0]['status']['addresses'])
|
||||
d=t.deployment()
|
||||
assert d['metadata']['uid']=='e8eff0aa-64bb-4b44-9a80-a66612986355'
|
||||
assert d['spec']['replicas']==1 and d['spec']['strategy']['type']=='Recreate'
|
||||
before=t.digest(d['spec']['template'])
|
||||
forward=replacement_patch(d,old_command,new_command,OLD_CM,new_cm)
|
||||
simulated=t.apply_locally(d,forward)
|
||||
# Rollback reads fresh metadata, verifies exact new fields, restores the two
|
||||
# original fields. This simulation changes no image, environment or mounts.
|
||||
reverse=replacement_patch(simulated,new_command,old_command,new_cm,OLD_CM)
|
||||
restored=t.apply_locally(simulated,reverse)
|
||||
assert restored==d
|
||||
dry=t.patch_remote(forward,dry_run=True)
|
||||
assert t.digest(dry['spec']['template'])==t.digest(simulated['spec']['template'])
|
||||
dry_cm=json.loads(t.native.command(['apply','--server-side','--dry-run=server','-f','-','-o','json'],payload=json.dumps(new_configmap).encode()))
|
||||
assert dry_cm['immutable'] is True and dry_cm['data']['hook']==new_hook
|
||||
proposal=HERE/'native-preparation'
|
||||
proposal.mkdir(exist_ok=False)
|
||||
for path,text in [('helm/forgejo-values.yaml',new_values_text),('manifests/forgejo-secret-scan-template.yaml',new_cm_text)]:
|
||||
output=proposal/'apps-source'/path
|
||||
output.parent.mkdir(parents=True,exist_ok=True); output.write_text(text)
|
||||
(proposal/'deployment-forward.json').write_text(json.dumps(forward,indent=2)+'\n')
|
||||
(proposal/'configmap.json').write_text(json.dumps(new_configmap,indent=2)+'\n')
|
||||
(proposal/'old-hook').write_text(old_hook)
|
||||
(proposal/'new-hook').write_text(new_hook)
|
||||
result={
|
||||
'proposal_id':'FORGE10-RECEIVE-BATCH-20261018','revision':'preparation-1',
|
||||
'source_commit':commit,'candidate_binary_sha256':binary_hash,'new_directory':new_directory,
|
||||
'old_directory':OLD_DIRECTORY,'old_binary_sha256':OLD_HASH,
|
||||
'old_configmap':OLD_CM,'new_configmap':new_cm,'old_hook_sha256':sha(old_hook.encode()),'new_hook_sha256':hook_hash,
|
||||
'deployment_uid':d['metadata']['uid'],'generation':d['metadata']['generation'],
|
||||
'original_template_sha256':before,'proposed_template_sha256':t.digest(simulated['spec']['template']),
|
||||
'source_fields_only_verified':True,'conditional_forward_and_inverse_verified':True,
|
||||
'deployment_server_dry_run_verified':True,'configmap_server_dry_run_verified':True,
|
||||
'native_changed':False,'approval_requested':False,
|
||||
'remaining':['Pinned activation/recovery executor, drift/refusal checks and resource preflight',
|
||||
'Independent owner/package admission and exact founder go',
|
||||
'Native exact-binary smoke, 166-hook rollout and ordinary publication proof'],
|
||||
'support_hashes':{name:sha((OLD/name).read_bytes()) for name in ['activate_forge_template.py','verify_receive_native.py','activate_receive_hooks.py']},
|
||||
'apps_preimage_hashes':{path:'sha256:'+sha((apps/path).read_bytes()) for path in ['helm/forgejo-values.yaml','manifests/forgejo-secret-scan-template.yaml']},
|
||||
'cost_estimate_eur':0,'cost_note':'No additional infrastructure or paid service; human effort unpriced.',
|
||||
'risk_note':'One existing Forgejo Recreate rollout and exact installed-hook copies; availability impact and partial rollout require guarded rollback. No credential, policy, image or database change.'
|
||||
}
|
||||
(proposal/'preparation.json').write_text(json.dumps(result,indent=2)+'\n')
|
||||
print(json.dumps({k:result[k] for k in ['proposal_id','candidate_binary_sha256','new_configmap','conditional_forward_and_inverse_verified','deployment_server_dry_run_verified','configmap_server_dry_run_verified','native_changed','approval_requested']}))
|
||||
|
||||
if __name__=='__main__':
|
||||
main()
|
||||
|
|
@ -0,0 +1,100 @@
|
|||
{
|
||||
"ok": true,
|
||||
"status": "applied",
|
||||
"repo_slug": "railiance-forge",
|
||||
"commit": "ea65606c1298db782f721f9443bafeb03cdef138",
|
||||
"requests": 2,
|
||||
"elapsed_ms": 1419.5,
|
||||
"git": {
|
||||
"upstream": "origin/main",
|
||||
"behind": 0,
|
||||
"ahead": 0
|
||||
},
|
||||
"identifiers": {
|
||||
"schema": "repo-manager.identifier-assignment.v1",
|
||||
"ok": true,
|
||||
"executed": true,
|
||||
"repo": "railiance-forge",
|
||||
"namespace": "helixforge",
|
||||
"assignments": [],
|
||||
"historical_invalid_identifiers": [],
|
||||
"historical_identity_collisions": [],
|
||||
"files_changed": []
|
||||
},
|
||||
"receipt": {
|
||||
"schema": "state-hub.repository-projection-reconcile.v1",
|
||||
"instance_role": "primary",
|
||||
"instance_label": "railiance01",
|
||||
"expected_commit": "ea65606c1298db782f721f9443bafeb03cdef138",
|
||||
"derived_commit": "ea65606c1298db782f721f9443bafeb03cdef138",
|
||||
"outcome": {
|
||||
"schema": "state-hub.projection-reset.v1",
|
||||
"repo_slug": "railiance-forge",
|
||||
"commit": "ea65606c1298db782f721f9443bafeb03cdef138",
|
||||
"status": "applied",
|
||||
"counts": {
|
||||
"created": 0,
|
||||
"updated": 12,
|
||||
"retired": 0,
|
||||
"refused": 0,
|
||||
"released": 0,
|
||||
"created_tasks": 0,
|
||||
"updated_tasks": 11,
|
||||
"cancelled_tasks": 0,
|
||||
"created_edges": 0,
|
||||
"removed_edges": 0,
|
||||
"unresolved_edges": 0,
|
||||
"external_edges": 1
|
||||
},
|
||||
"created": [],
|
||||
"updated": [
|
||||
"FORGE-WP-0001",
|
||||
"FORGE-WP-0002",
|
||||
"FORGE-WP-0003",
|
||||
"FORGE-WP-0004",
|
||||
"FORGE-WP-0005",
|
||||
"FORGE-WP-0006",
|
||||
"FORGE-WP-0007",
|
||||
"FORGE-WP-0008",
|
||||
"FORGE-WP-0009",
|
||||
"FORGE-WP-0010",
|
||||
"RAILIANCE-WP-0001",
|
||||
"RFORGE-WP-0002"
|
||||
],
|
||||
"retired": [],
|
||||
"released": [],
|
||||
"created_tasks": [],
|
||||
"updated_tasks": [
|
||||
"FORGE-WP-0008-T01",
|
||||
"FORGE-WP-0008-T02",
|
||||
"FORGE-WP-0008-T03",
|
||||
"FORGE-WP-0008-T04",
|
||||
"FORGE-WP-0008-T05",
|
||||
"FORGE-WP-0008-T06",
|
||||
"FORGE-WP-0009-T01",
|
||||
"FORGE-WP-0009-T02",
|
||||
"FORGE-WP-0010-T01",
|
||||
"FORGE-WP-0010-T02",
|
||||
"FORGE-WP-0010-T03"
|
||||
],
|
||||
"cancelled_tasks": [],
|
||||
"created_edges": [],
|
||||
"removed_edges": [],
|
||||
"unresolved_edges": [],
|
||||
"external_edges": [
|
||||
{
|
||||
"workplan": "FORGE-WP-0008",
|
||||
"from": "FORGE-WP-0008",
|
||||
"target": "FORGE-WP-0006",
|
||||
"relationship_type": "blocks",
|
||||
"from_workplan_id": "5334ba5c-a1a6-5579-b482-12e3e968b2b5",
|
||||
"from_task_id": null,
|
||||
"to_workplan_id": "69458fdc-d727-5391-b88b-d03da0afe24e",
|
||||
"to_task_id": null
|
||||
}
|
||||
],
|
||||
"refused": [],
|
||||
"notes": []
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
{
|
||||
"exit_code": 0,
|
||||
"commit": "ea65606c1298db782f721f9443bafeb03cdef138",
|
||||
"base": "b42206e52bce0e11f9615b4e774f80f9015a1ef7",
|
||||
"files": [
|
||||
{
|
||||
"path": "tools/receive-secret-scan/main.go",
|
||||
"sha256": "25e41047bcf881a90bb9536583d6df72c73e868df0ee2fd3527de6d31740fbb7",
|
||||
"prior_sha256": "5eee28fbe830ebec7abbdfc93275c34d126f92d1b144df93e72aec0dfb821bc6"
|
||||
},
|
||||
{
|
||||
"path": "tools/receive-secret-scan/batch.go",
|
||||
"sha256": "1b3fd8d534686758d7489a5f3e0208acf6ed6304adac63ae95af3bcccccb98e8",
|
||||
"prior_sha256": null
|
||||
},
|
||||
{
|
||||
"path": "tools/receive-secret-scan/volatile.go",
|
||||
"sha256": "d8cc0379d6f57743ab74f0318076b362b48de964631fa77f4d282b6993da8610",
|
||||
"prior_sha256": null
|
||||
},
|
||||
{
|
||||
"path": "tools/receive-secret-scan/batch_test.go",
|
||||
"sha256": "477762327353ed88526b8f79e563872c8ee80a4fd27c47c03f20db6cf20e4569",
|
||||
"prior_sha256": null
|
||||
},
|
||||
{
|
||||
"path": "docs/receive-secret-detection.md",
|
||||
"sha256": "70293d48e783f76a804b154789f24a926d287cd356c83fc3a83739e4b6a70a78",
|
||||
"prior_sha256": "50dd97e80f437de04232f977cd362d8bade89c33a3fc270164e74de7e3d65478"
|
||||
},
|
||||
{
|
||||
"path": "workplans/FORGE-WP-0010-receive-scanner-budget.md",
|
||||
"sha256": "02b23a4e8dfc13607086c83eec8fe0905339b4478b6cf49ec2989ff0066ad551",
|
||||
"prior_sha256": null
|
||||
}
|
||||
],
|
||||
"stdout": "[main ea65606] Batch small receive inputs within the unchanged scan budget\n 6 files changed, 995 insertions(+), 22 deletions(-)\n create mode 100644 tools/receive-secret-scan/batch.go\n create mode 100644 tools/receive-secret-scan/batch_test.go\n create mode 100644 tools/receive-secret-scan/volatile.go\n create mode 100644 workplans/FORGE-WP-0010-receive-scanner-budget.md\n",
|
||||
"stderr": "{\"blocked_blob_ids\": [], \"scanned_blobs\": 6, \"scanner_sha256\": \"88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\", \"scanner_version\": \"8.30.1\", \"scope\": \"changed-staged-blobs\", \"status\": \"clean\"}\n"
|
||||
}
|
||||
|
|
@ -0,0 +1,38 @@
|
|||
{
|
||||
"owner": "railiance-forge",
|
||||
"base_revision": "b42206e52bce0e11f9615b4e774f80f9015a1ef7",
|
||||
"message": "Batch small receive inputs within the unchanged scan budget",
|
||||
"files": [
|
||||
{
|
||||
"path": "tools/receive-secret-scan/main.go",
|
||||
"sha256": "25e41047bcf881a90bb9536583d6df72c73e868df0ee2fd3527de6d31740fbb7",
|
||||
"prior_sha256": "5eee28fbe830ebec7abbdfc93275c34d126f92d1b144df93e72aec0dfb821bc6"
|
||||
},
|
||||
{
|
||||
"path": "tools/receive-secret-scan/batch.go",
|
||||
"sha256": "1b3fd8d534686758d7489a5f3e0208acf6ed6304adac63ae95af3bcccccb98e8",
|
||||
"prior_sha256": null
|
||||
},
|
||||
{
|
||||
"path": "tools/receive-secret-scan/volatile.go",
|
||||
"sha256": "d8cc0379d6f57743ab74f0318076b362b48de964631fa77f4d282b6993da8610",
|
||||
"prior_sha256": null
|
||||
},
|
||||
{
|
||||
"path": "tools/receive-secret-scan/batch_test.go",
|
||||
"sha256": "477762327353ed88526b8f79e563872c8ee80a4fd27c47c03f20db6cf20e4569",
|
||||
"prior_sha256": null
|
||||
},
|
||||
{
|
||||
"path": "docs/receive-secret-detection.md",
|
||||
"sha256": "70293d48e783f76a804b154789f24a926d287cd356c83fc3a83739e4b6a70a78",
|
||||
"prior_sha256": "50dd97e80f437de04232f977cd362d8bade89c33a3fc270164e74de7e3d65478"
|
||||
},
|
||||
{
|
||||
"path": "workplans/FORGE-WP-0010-receive-scanner-budget.md",
|
||||
"sha256": "02b23a4e8dfc13607086c83eec8fe0905339b4478b6cf49ec2989ff0066ad551",
|
||||
"prior_sha256": null
|
||||
}
|
||||
],
|
||||
"native_authority": false
|
||||
}
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
"""Apply reviewed source and use the ordinary owner publication workflow."""
|
||||
from pathlib import Path
|
||||
import subprocess
|
||||
import sys
|
||||
|
||||
HERE=Path(__file__).resolve().parent
|
||||
REPO=HERE.parents[3]
|
||||
for argv in [
|
||||
[sys.executable,str(HERE/'apply_owner.py')],
|
||||
[sys.executable,str(REPO/'docs/changes/netkingdom-target-2026-10-17/native-source-publication-r2/publish_owner.py'),str(HERE/'publication-inputs.json'),'commit'],
|
||||
[sys.executable,str(REPO/'docs/changes/netkingdom-target-2026-10-17/native-source-publication-r2/publish_owner.py'),str(HERE/'publication-inputs.json'),'sync'],
|
||||
]:
|
||||
subprocess.run(argv,check=True,timeout=600)
|
||||
|
|
@ -0,0 +1,81 @@
|
|||
"""Offline candidate checks; private PID namespace, tmpfs inputs, no remote writes."""
|
||||
from pathlib import Path
|
||||
import argparse
|
||||
import hashlib
|
||||
import json
|
||||
import re
|
||||
import subprocess
|
||||
import time
|
||||
|
||||
HERE = Path(__file__).resolve().parent
|
||||
WORK = Path('/tmp/custodian-receive-scanner-batch-r1')
|
||||
ORIGINAL = Path('/tmp/custodian-receive-scanner-budget-r1')
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument('phase', choices=['build', 'test', 'scan', 'compiletests', 'storage'])
|
||||
parser.add_argument('--attempt', required=True)
|
||||
parser.add_argument('--run', default='.')
|
||||
parser.add_argument('--storage', choices=['private', 'ordinary', 'unavailable'], default='private')
|
||||
parser.add_argument('--revision', help='Optional exact new commit for the same disposable old-ref fixture')
|
||||
args = parser.parse_args()
|
||||
if not args.attempt.isalnum():
|
||||
raise SystemExit('invalid receipt suffix')
|
||||
if args.revision and not re.fullmatch('[0-9a-f]{40}',args.revision):
|
||||
raise SystemExit('invalid source revision')
|
||||
stem = HERE / (args.phase + '-' + args.attempt)
|
||||
assert not stem.with_suffix('.json').exists()
|
||||
argv = ['bwrap', '--unshare-net', '--unshare-pid', '--die-with-parent', '--new-session']
|
||||
for path in ['/usr', '/lib', '/lib64']:
|
||||
argv += ['--ro-bind', path, path]
|
||||
argv += ['--symlink', 'usr/bin', '/bin', '--proc', '/proc', '--dev', '/dev',
|
||||
'--tmpfs', '/tmp', '--bind', str(WORK), '/work',
|
||||
'--ro-bind', str(ORIGINAL / 'fixture.git'), '/fixture',
|
||||
'--ro-bind', '/home/worsch/the-custodian/.git/objects', '/source-objects',
|
||||
'--ro-bind', '/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks', '/scanner',
|
||||
'--ro-bind', '/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64', '/toolchain',
|
||||
'--chdir', '/fixture' if args.phase == 'scan' else '/work/source/tools/receive-secret-scan', '--clearenv']
|
||||
if args.storage == 'private':
|
||||
argv += ['--tmpfs', '/dev/shm']
|
||||
elif args.storage == 'ordinary':
|
||||
ordinary = WORK / 'ordinary-storage'
|
||||
ordinary.mkdir(exist_ok=True)
|
||||
argv += ['--ro-bind', str(ordinary), '/dev/shm']
|
||||
elif args.storage == 'unavailable':
|
||||
# Hide bwrap's default /dev/shm as well; the test helper needs only stdio.
|
||||
argv += ['--tmpfs', '/dev']
|
||||
env = {'PATH': '/toolchain/bin:/usr/bin:/bin', 'HOME': '/work/home', 'GOTOOLCHAIN': 'local',
|
||||
'GOPROXY': 'off', 'GOSUMDB': 'off', 'GOCACHE': '/work/gocache', 'GOMAXPROCS': '2',
|
||||
'CGO_ENABLED': '0', 'FORGE_TEST_GITLEAKS': '/scanner'}
|
||||
if args.phase == 'scan':
|
||||
env['GIT_DIR'] = '/fixture'
|
||||
for key, value in env.items():
|
||||
argv += ['--setenv', key, value]
|
||||
command = {
|
||||
'build': ['go', 'build', '-buildvcs=false', '-trimpath', '-o', '/work/candidate-hook', '.'],
|
||||
'test': ['go', 'test', '-buildvcs=false', '-count=1', '-timeout', '8m', '-v', '-run', args.run, '.'],
|
||||
'scan': ['/work/candidate-hook', '--scanner', '/scanner'],
|
||||
'compiletests': ['go', 'test', '-buildvcs=false', '-c', '-o', '/work/scanner.test', '.'],
|
||||
'storage': ['/work/scanner.test', '--test-storage-refusal'],
|
||||
}[args.phase]
|
||||
argv += ['--', *command]
|
||||
start = time.monotonic()
|
||||
scan_input=(ORIGINAL / 'input.txt').read_bytes()
|
||||
if args.revision:
|
||||
old, _, ref=scan_input.decode().strip().split(' ')
|
||||
scan_input=(old+' '+args.revision+' '+ref+'\n').encode()
|
||||
with stem.with_suffix('.txt').open('xb') as output:
|
||||
result = subprocess.run(argv, input=scan_input if args.phase == 'scan' else None,
|
||||
stdout=output, stderr=subprocess.STDOUT, timeout=540)
|
||||
receipt = {'returncode': result.returncode, 'seconds': round(time.monotonic() - start, 2),
|
||||
'argv': argv, 'real_remote_ref_changed': False, 'real_credentials': False,
|
||||
'native_acceptance': False,
|
||||
'source_sha256': {p.name: hashlib.sha256(p.read_bytes()).hexdigest()
|
||||
for p in sorted((WORK / 'source/tools/receive-secret-scan').glob('*.go'))}}
|
||||
binary = WORK / 'candidate-hook'
|
||||
if binary.exists():
|
||||
receipt['binary_sha256'] = 'sha256:' + hashlib.sha256(binary.read_bytes()).hexdigest()
|
||||
if args.phase == 'scan':
|
||||
receipt['adapter_result'] = json.loads(stem.with_suffix('.txt').read_text())
|
||||
receipt['exact_update']=scan_input.decode().strip()
|
||||
stem.with_suffix('.json').write_text(json.dumps(receipt, indent=2) + '\n')
|
||||
print(json.dumps({k: receipt[k] for k in ['returncode', 'seconds', 'adapter_result'] if k in receipt}))
|
||||
raise SystemExit(result.returncode)
|
||||
|
|
@ -0,0 +1,99 @@
|
|||
{
|
||||
"returncode": 0,
|
||||
"seconds": 58.33,
|
||||
"argv": [
|
||||
"bwrap",
|
||||
"--unshare-net",
|
||||
"--unshare-pid",
|
||||
"--die-with-parent",
|
||||
"--new-session",
|
||||
"--ro-bind",
|
||||
"/usr",
|
||||
"/usr",
|
||||
"--ro-bind",
|
||||
"/lib",
|
||||
"/lib",
|
||||
"--ro-bind",
|
||||
"/lib64",
|
||||
"/lib64",
|
||||
"--symlink",
|
||||
"usr/bin",
|
||||
"/bin",
|
||||
"--proc",
|
||||
"/proc",
|
||||
"--dev",
|
||||
"/dev",
|
||||
"--tmpfs",
|
||||
"/tmp",
|
||||
"--bind",
|
||||
"/tmp/custodian-receive-scanner-batch-r1",
|
||||
"/work",
|
||||
"--ro-bind",
|
||||
"/tmp/custodian-receive-scanner-budget-r1/fixture.git",
|
||||
"/fixture",
|
||||
"--ro-bind",
|
||||
"/home/worsch/the-custodian/.git/objects",
|
||||
"/source-objects",
|
||||
"--ro-bind",
|
||||
"/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks",
|
||||
"/scanner",
|
||||
"--ro-bind",
|
||||
"/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
|
||||
"/toolchain",
|
||||
"--chdir",
|
||||
"/fixture",
|
||||
"--clearenv",
|
||||
"--setenv",
|
||||
"PATH",
|
||||
"/toolchain/bin:/usr/bin:/bin",
|
||||
"--setenv",
|
||||
"HOME",
|
||||
"/work/home",
|
||||
"--setenv",
|
||||
"GOTOOLCHAIN",
|
||||
"local",
|
||||
"--setenv",
|
||||
"GOPROXY",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOSUMDB",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOCACHE",
|
||||
"/work/gocache",
|
||||
"--setenv",
|
||||
"GOMAXPROCS",
|
||||
"2",
|
||||
"--setenv",
|
||||
"CGO_ENABLED",
|
||||
"0",
|
||||
"--setenv",
|
||||
"FORGE_TEST_GITLEAKS",
|
||||
"/scanner",
|
||||
"--setenv",
|
||||
"GIT_DIR",
|
||||
"/fixture",
|
||||
"--",
|
||||
"/work/candidate-hook",
|
||||
"--scanner",
|
||||
"/scanner"
|
||||
],
|
||||
"real_remote_ref_changed": false,
|
||||
"real_credentials": false,
|
||||
"native_acceptance": false,
|
||||
"source_sha256": {
|
||||
"batch.go": "1b3fd8d534686758d7489a5f3e0208acf6ed6304adac63ae95af3bcccccb98e8",
|
||||
"batch_test.go": "627cb93b43dcf4d154cfee0ea30bb4c94d3f8c39332b6e80cb4f8256950b1ead",
|
||||
"main.go": "25e41047bcf881a90bb9536583d6df72c73e868df0ee2fd3527de6d31740fbb7",
|
||||
"main_test.go": "306dfd8ff06ccb22cb5e7f38894725eb3900b81645d8b922a340e8ab239ffee5",
|
||||
"volatile.go": "d8cc0379d6f57743ab74f0318076b362b48de964631fa77f4d282b6993da8610"
|
||||
},
|
||||
"binary_sha256": "sha256:73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a",
|
||||
"adapter_result": {
|
||||
"status": "clean",
|
||||
"scope": "introduced-reachable-git-objects-and-updated-ref-names",
|
||||
"scanned_objects": 141,
|
||||
"scanned_refs": 1,
|
||||
"scanner_version": "8.30.1"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
{"status":"clean","scope":"introduced-reachable-git-objects-and-updated-ref-names","scanned_objects":141,"scanned_refs":1,"scanner_version":"8.30.1"}
|
||||
|
|
@ -0,0 +1,103 @@
|
|||
{
|
||||
"returncode": 2,
|
||||
"seconds": 45.36,
|
||||
"argv": [
|
||||
"bwrap",
|
||||
"--unshare-net",
|
||||
"--unshare-pid",
|
||||
"--die-with-parent",
|
||||
"--new-session",
|
||||
"--ro-bind",
|
||||
"/usr",
|
||||
"/usr",
|
||||
"--ro-bind",
|
||||
"/lib",
|
||||
"/lib",
|
||||
"--ro-bind",
|
||||
"/lib64",
|
||||
"/lib64",
|
||||
"--symlink",
|
||||
"usr/bin",
|
||||
"/bin",
|
||||
"--proc",
|
||||
"/proc",
|
||||
"--dev",
|
||||
"/dev",
|
||||
"--tmpfs",
|
||||
"/tmp",
|
||||
"--bind",
|
||||
"/tmp/custodian-receive-scanner-batch-r1",
|
||||
"/work",
|
||||
"--ro-bind",
|
||||
"/tmp/custodian-receive-scanner-budget-r1/fixture.git",
|
||||
"/fixture",
|
||||
"--ro-bind",
|
||||
"/home/worsch/the-custodian/.git/objects",
|
||||
"/source-objects",
|
||||
"--ro-bind",
|
||||
"/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks",
|
||||
"/scanner",
|
||||
"--ro-bind",
|
||||
"/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
|
||||
"/toolchain",
|
||||
"--chdir",
|
||||
"/fixture",
|
||||
"--clearenv",
|
||||
"--ro-bind",
|
||||
"/tmp/custodian-receive-scanner-batch-r1/ordinary-storage",
|
||||
"/dev/shm",
|
||||
"--setenv",
|
||||
"PATH",
|
||||
"/toolchain/bin:/usr/bin:/bin",
|
||||
"--setenv",
|
||||
"HOME",
|
||||
"/work/home",
|
||||
"--setenv",
|
||||
"GOTOOLCHAIN",
|
||||
"local",
|
||||
"--setenv",
|
||||
"GOPROXY",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOSUMDB",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOCACHE",
|
||||
"/work/gocache",
|
||||
"--setenv",
|
||||
"GOMAXPROCS",
|
||||
"2",
|
||||
"--setenv",
|
||||
"CGO_ENABLED",
|
||||
"0",
|
||||
"--setenv",
|
||||
"FORGE_TEST_GITLEAKS",
|
||||
"/scanner",
|
||||
"--setenv",
|
||||
"GIT_DIR",
|
||||
"/fixture",
|
||||
"--",
|
||||
"/work/candidate-hook",
|
||||
"--scanner",
|
||||
"/scanner"
|
||||
],
|
||||
"real_remote_ref_changed": false,
|
||||
"real_credentials": false,
|
||||
"native_acceptance": false,
|
||||
"source_sha256": {
|
||||
"batch.go": "1b3fd8d534686758d7489a5f3e0208acf6ed6304adac63ae95af3bcccccb98e8",
|
||||
"batch_test.go": "627cb93b43dcf4d154cfee0ea30bb4c94d3f8c39332b6e80cb4f8256950b1ead",
|
||||
"main.go": "25e41047bcf881a90bb9536583d6df72c73e868df0ee2fd3527de6d31740fbb7",
|
||||
"main_test.go": "306dfd8ff06ccb22cb5e7f38894725eb3900b81645d8b922a340e8ab239ffee5",
|
||||
"volatile.go": "d8cc0379d6f57743ab74f0318076b362b48de964631fa77f4d282b6993da8610"
|
||||
},
|
||||
"binary_sha256": "sha256:73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a",
|
||||
"adapter_result": {
|
||||
"status": "unverified",
|
||||
"scope": "introduced-reachable-git-objects-and-updated-ref-names",
|
||||
"reason": "volatile-storage-unavailable",
|
||||
"scanned_objects": 36,
|
||||
"scanned_refs": 1,
|
||||
"scanner_version": "8.30.1"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
{"status":"unverified","scope":"introduced-reachable-git-objects-and-updated-ref-names","reason":"volatile-storage-unavailable","scanned_objects":36,"scanned_refs":1,"scanner_version":"8.30.1"}
|
||||
|
|
@ -0,0 +1,101 @@
|
|||
{
|
||||
"returncode": 0,
|
||||
"seconds": 53.38,
|
||||
"argv": [
|
||||
"bwrap",
|
||||
"--unshare-net",
|
||||
"--unshare-pid",
|
||||
"--die-with-parent",
|
||||
"--new-session",
|
||||
"--ro-bind",
|
||||
"/usr",
|
||||
"/usr",
|
||||
"--ro-bind",
|
||||
"/lib",
|
||||
"/lib",
|
||||
"--ro-bind",
|
||||
"/lib64",
|
||||
"/lib64",
|
||||
"--symlink",
|
||||
"usr/bin",
|
||||
"/bin",
|
||||
"--proc",
|
||||
"/proc",
|
||||
"--dev",
|
||||
"/dev",
|
||||
"--tmpfs",
|
||||
"/dev/shm",
|
||||
"--tmpfs",
|
||||
"/tmp",
|
||||
"--bind",
|
||||
"/tmp/custodian-receive-scanner-batch-r1",
|
||||
"/work",
|
||||
"--ro-bind",
|
||||
"/tmp/custodian-receive-scanner-budget-r1/fixture.git",
|
||||
"/fixture",
|
||||
"--ro-bind",
|
||||
"/home/worsch/the-custodian/.git/objects",
|
||||
"/source-objects",
|
||||
"--ro-bind",
|
||||
"/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks",
|
||||
"/scanner",
|
||||
"--ro-bind",
|
||||
"/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
|
||||
"/toolchain",
|
||||
"--chdir",
|
||||
"/fixture",
|
||||
"--clearenv",
|
||||
"--setenv",
|
||||
"PATH",
|
||||
"/toolchain/bin:/usr/bin:/bin",
|
||||
"--setenv",
|
||||
"HOME",
|
||||
"/work/home",
|
||||
"--setenv",
|
||||
"GOTOOLCHAIN",
|
||||
"local",
|
||||
"--setenv",
|
||||
"GOPROXY",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOSUMDB",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOCACHE",
|
||||
"/work/gocache",
|
||||
"--setenv",
|
||||
"GOMAXPROCS",
|
||||
"2",
|
||||
"--setenv",
|
||||
"CGO_ENABLED",
|
||||
"0",
|
||||
"--setenv",
|
||||
"FORGE_TEST_GITLEAKS",
|
||||
"/scanner",
|
||||
"--setenv",
|
||||
"GIT_DIR",
|
||||
"/fixture",
|
||||
"--",
|
||||
"/work/candidate-hook",
|
||||
"--scanner",
|
||||
"/scanner"
|
||||
],
|
||||
"real_remote_ref_changed": false,
|
||||
"real_credentials": false,
|
||||
"native_acceptance": false,
|
||||
"source_sha256": {
|
||||
"batch.go": "24a98fc3a25c441f2c10f1c38efdeeb72851de7faeb8c1fabc02a8cd9f72f9f2",
|
||||
"batch_test.go": "eba7729797e3f559a6ea1622d5b6ec29700cf5396787b5ad666911e7f1be0b8a",
|
||||
"main.go": "25e41047bcf881a90bb9536583d6df72c73e868df0ee2fd3527de6d31740fbb7",
|
||||
"main_test.go": "306dfd8ff06ccb22cb5e7f38894725eb3900b81645d8b922a340e8ab239ffee5",
|
||||
"volatile.go": "d8cc0379d6f57743ab74f0318076b362b48de964631fa77f4d282b6993da8610"
|
||||
},
|
||||
"binary_sha256": "sha256:0af7a100c3ade1ab4a6755d6354a78f50f86301a149d3b035f6cc648a524d489",
|
||||
"adapter_result": {
|
||||
"status": "clean",
|
||||
"scope": "introduced-reachable-git-objects-and-updated-ref-names",
|
||||
"scanned_objects": 141,
|
||||
"scanned_refs": 1,
|
||||
"scanner_version": "8.30.1"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
{"status":"clean","scope":"introduced-reachable-git-objects-and-updated-ref-names","scanned_objects":141,"scanned_refs":1,"scanner_version":"8.30.1"}
|
||||
|
|
@ -0,0 +1,101 @@
|
|||
{
|
||||
"returncode": 0,
|
||||
"seconds": 52.53,
|
||||
"argv": [
|
||||
"bwrap",
|
||||
"--unshare-net",
|
||||
"--unshare-pid",
|
||||
"--die-with-parent",
|
||||
"--new-session",
|
||||
"--ro-bind",
|
||||
"/usr",
|
||||
"/usr",
|
||||
"--ro-bind",
|
||||
"/lib",
|
||||
"/lib",
|
||||
"--ro-bind",
|
||||
"/lib64",
|
||||
"/lib64",
|
||||
"--symlink",
|
||||
"usr/bin",
|
||||
"/bin",
|
||||
"--proc",
|
||||
"/proc",
|
||||
"--dev",
|
||||
"/dev",
|
||||
"--tmpfs",
|
||||
"/dev/shm",
|
||||
"--tmpfs",
|
||||
"/tmp",
|
||||
"--bind",
|
||||
"/tmp/custodian-receive-scanner-batch-r1",
|
||||
"/work",
|
||||
"--ro-bind",
|
||||
"/tmp/custodian-receive-scanner-budget-r1/fixture.git",
|
||||
"/fixture",
|
||||
"--ro-bind",
|
||||
"/home/worsch/the-custodian/.git/objects",
|
||||
"/source-objects",
|
||||
"--ro-bind",
|
||||
"/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks",
|
||||
"/scanner",
|
||||
"--ro-bind",
|
||||
"/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
|
||||
"/toolchain",
|
||||
"--chdir",
|
||||
"/fixture",
|
||||
"--clearenv",
|
||||
"--setenv",
|
||||
"PATH",
|
||||
"/toolchain/bin:/usr/bin:/bin",
|
||||
"--setenv",
|
||||
"HOME",
|
||||
"/work/home",
|
||||
"--setenv",
|
||||
"GOTOOLCHAIN",
|
||||
"local",
|
||||
"--setenv",
|
||||
"GOPROXY",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOSUMDB",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOCACHE",
|
||||
"/work/gocache",
|
||||
"--setenv",
|
||||
"GOMAXPROCS",
|
||||
"2",
|
||||
"--setenv",
|
||||
"CGO_ENABLED",
|
||||
"0",
|
||||
"--setenv",
|
||||
"FORGE_TEST_GITLEAKS",
|
||||
"/scanner",
|
||||
"--setenv",
|
||||
"GIT_DIR",
|
||||
"/fixture",
|
||||
"--",
|
||||
"/work/candidate-hook",
|
||||
"--scanner",
|
||||
"/scanner"
|
||||
],
|
||||
"real_remote_ref_changed": false,
|
||||
"real_credentials": false,
|
||||
"native_acceptance": false,
|
||||
"source_sha256": {
|
||||
"batch.go": "1b3fd8d534686758d7489a5f3e0208acf6ed6304adac63ae95af3bcccccb98e8",
|
||||
"batch_test.go": "4edf51a3c38f3ad4f5484294fc32e5b5637f8b7caae556dff555c48ad28d87a1",
|
||||
"main.go": "25e41047bcf881a90bb9536583d6df72c73e868df0ee2fd3527de6d31740fbb7",
|
||||
"main_test.go": "306dfd8ff06ccb22cb5e7f38894725eb3900b81645d8b922a340e8ab239ffee5",
|
||||
"volatile.go": "d8cc0379d6f57743ab74f0318076b362b48de964631fa77f4d282b6993da8610"
|
||||
},
|
||||
"binary_sha256": "sha256:73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a",
|
||||
"adapter_result": {
|
||||
"status": "clean",
|
||||
"scope": "introduced-reachable-git-objects-and-updated-ref-names",
|
||||
"scanned_objects": 141,
|
||||
"scanned_refs": 1,
|
||||
"scanner_version": "8.30.1"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
{"status":"clean","scope":"introduced-reachable-git-objects-and-updated-ref-names","scanned_objects":141,"scanned_refs":1,"scanner_version":"8.30.1"}
|
||||
|
|
@ -0,0 +1,38 @@
|
|||
{
|
||||
"source_applied": true,
|
||||
"base_revision": "b42206e52bce0e11f9615b4e774f80f9015a1ef7",
|
||||
"files": [
|
||||
{
|
||||
"path": "tools/receive-secret-scan/main.go",
|
||||
"sha256": "25e41047bcf881a90bb9536583d6df72c73e868df0ee2fd3527de6d31740fbb7",
|
||||
"prior_sha256": "5eee28fbe830ebec7abbdfc93275c34d126f92d1b144df93e72aec0dfb821bc6"
|
||||
},
|
||||
{
|
||||
"path": "tools/receive-secret-scan/batch.go",
|
||||
"sha256": "1b3fd8d534686758d7489a5f3e0208acf6ed6304adac63ae95af3bcccccb98e8",
|
||||
"prior_sha256": null
|
||||
},
|
||||
{
|
||||
"path": "tools/receive-secret-scan/volatile.go",
|
||||
"sha256": "d8cc0379d6f57743ab74f0318076b362b48de964631fa77f4d282b6993da8610",
|
||||
"prior_sha256": null
|
||||
},
|
||||
{
|
||||
"path": "tools/receive-secret-scan/batch_test.go",
|
||||
"sha256": "477762327353ed88526b8f79e563872c8ee80a4fd27c47c03f20db6cf20e4569",
|
||||
"prior_sha256": null
|
||||
},
|
||||
{
|
||||
"path": "docs/receive-secret-detection.md",
|
||||
"sha256": "70293d48e783f76a804b154789f24a926d287cd356c83fc3a83739e4b6a70a78",
|
||||
"prior_sha256": "50dd97e80f437de04232f977cd362d8bade89c33a3fc270164e74de7e3d65478"
|
||||
},
|
||||
{
|
||||
"path": "workplans/FORGE-WP-0010-receive-scanner-budget.md",
|
||||
"sha256": "02b23a4e8dfc13607086c83eec8fe0905339b4478b6cf49ec2989ff0066ad551",
|
||||
"prior_sha256": null
|
||||
}
|
||||
],
|
||||
"original_unrelated_state_preserved": true,
|
||||
"native_changed": false
|
||||
}
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
{
|
||||
"attempt": "scan-missing",
|
||||
"expected": "unverified",
|
||||
"observed": "clean",
|
||||
"classification": "negative fixture did not remove tmpfs: bwrap --dev supplies /dev/shm",
|
||||
"accepted_as_missing_storage_proof": false,
|
||||
"retained": true,
|
||||
"actual_ordinary_storage_refusal": "scan-ordinary.json"
|
||||
}
|
||||
|
|
@ -0,0 +1,91 @@
|
|||
{
|
||||
"returncode": 0,
|
||||
"seconds": 0.03,
|
||||
"argv": [
|
||||
"bwrap",
|
||||
"--unshare-net",
|
||||
"--unshare-pid",
|
||||
"--die-with-parent",
|
||||
"--new-session",
|
||||
"--ro-bind",
|
||||
"/usr",
|
||||
"/usr",
|
||||
"--ro-bind",
|
||||
"/lib",
|
||||
"/lib",
|
||||
"--ro-bind",
|
||||
"/lib64",
|
||||
"/lib64",
|
||||
"--symlink",
|
||||
"usr/bin",
|
||||
"/bin",
|
||||
"--proc",
|
||||
"/proc",
|
||||
"--dev",
|
||||
"/dev",
|
||||
"--tmpfs",
|
||||
"/tmp",
|
||||
"--bind",
|
||||
"/tmp/custodian-receive-scanner-batch-r1",
|
||||
"/work",
|
||||
"--ro-bind",
|
||||
"/tmp/custodian-receive-scanner-budget-r1/fixture.git",
|
||||
"/fixture",
|
||||
"--ro-bind",
|
||||
"/home/worsch/the-custodian/.git/objects",
|
||||
"/source-objects",
|
||||
"--ro-bind",
|
||||
"/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks",
|
||||
"/scanner",
|
||||
"--ro-bind",
|
||||
"/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
|
||||
"/toolchain",
|
||||
"--chdir",
|
||||
"/work/source/tools/receive-secret-scan",
|
||||
"--clearenv",
|
||||
"--ro-bind",
|
||||
"/tmp/custodian-receive-scanner-batch-r1/ordinary-storage",
|
||||
"/dev/shm",
|
||||
"--setenv",
|
||||
"PATH",
|
||||
"/toolchain/bin:/usr/bin:/bin",
|
||||
"--setenv",
|
||||
"HOME",
|
||||
"/work/home",
|
||||
"--setenv",
|
||||
"GOTOOLCHAIN",
|
||||
"local",
|
||||
"--setenv",
|
||||
"GOPROXY",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOSUMDB",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOCACHE",
|
||||
"/work/gocache",
|
||||
"--setenv",
|
||||
"GOMAXPROCS",
|
||||
"2",
|
||||
"--setenv",
|
||||
"CGO_ENABLED",
|
||||
"0",
|
||||
"--setenv",
|
||||
"FORGE_TEST_GITLEAKS",
|
||||
"/scanner",
|
||||
"--",
|
||||
"/work/scanner.test",
|
||||
"--test-storage-refusal"
|
||||
],
|
||||
"real_remote_ref_changed": false,
|
||||
"real_credentials": false,
|
||||
"native_acceptance": false,
|
||||
"source_sha256": {
|
||||
"batch.go": "1b3fd8d534686758d7489a5f3e0208acf6ed6304adac63ae95af3bcccccb98e8",
|
||||
"batch_test.go": "477762327353ed88526b8f79e563872c8ee80a4fd27c47c03f20db6cf20e4569",
|
||||
"main.go": "25e41047bcf881a90bb9536583d6df72c73e868df0ee2fd3527de6d31740fbb7",
|
||||
"main_test.go": "306dfd8ff06ccb22cb5e7f38894725eb3900b81645d8b922a340e8ab239ffee5",
|
||||
"volatile.go": "d8cc0379d6f57743ab74f0318076b362b48de964631fa77f4d282b6993da8610"
|
||||
},
|
||||
"binary_sha256": "sha256:73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a"
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
{"reason":"volatile-storage-unavailable","status":"unverified"}
|
||||
|
|
@ -0,0 +1,91 @@
|
|||
{
|
||||
"returncode": 1,
|
||||
"seconds": 0.02,
|
||||
"argv": [
|
||||
"bwrap",
|
||||
"--unshare-net",
|
||||
"--unshare-pid",
|
||||
"--die-with-parent",
|
||||
"--new-session",
|
||||
"--ro-bind",
|
||||
"/usr",
|
||||
"/usr",
|
||||
"--ro-bind",
|
||||
"/lib",
|
||||
"/lib",
|
||||
"--ro-bind",
|
||||
"/lib64",
|
||||
"/lib64",
|
||||
"--symlink",
|
||||
"usr/bin",
|
||||
"/bin",
|
||||
"--proc",
|
||||
"/proc",
|
||||
"--dev",
|
||||
"/dev",
|
||||
"--tmpfs",
|
||||
"/tmp",
|
||||
"--bind",
|
||||
"/tmp/custodian-receive-scanner-batch-r1",
|
||||
"/work",
|
||||
"--ro-bind",
|
||||
"/tmp/custodian-receive-scanner-budget-r1/fixture.git",
|
||||
"/fixture",
|
||||
"--ro-bind",
|
||||
"/home/worsch/the-custodian/.git/objects",
|
||||
"/source-objects",
|
||||
"--ro-bind",
|
||||
"/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks",
|
||||
"/scanner",
|
||||
"--ro-bind",
|
||||
"/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
|
||||
"/toolchain",
|
||||
"--chdir",
|
||||
"/work/source/tools/receive-secret-scan",
|
||||
"--clearenv",
|
||||
"--ro-bind",
|
||||
"/usr/bin/true",
|
||||
"/dev/shm",
|
||||
"--setenv",
|
||||
"PATH",
|
||||
"/toolchain/bin:/usr/bin:/bin",
|
||||
"--setenv",
|
||||
"HOME",
|
||||
"/work/home",
|
||||
"--setenv",
|
||||
"GOTOOLCHAIN",
|
||||
"local",
|
||||
"--setenv",
|
||||
"GOPROXY",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOSUMDB",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOCACHE",
|
||||
"/work/gocache",
|
||||
"--setenv",
|
||||
"GOMAXPROCS",
|
||||
"2",
|
||||
"--setenv",
|
||||
"CGO_ENABLED",
|
||||
"0",
|
||||
"--setenv",
|
||||
"FORGE_TEST_GITLEAKS",
|
||||
"/scanner",
|
||||
"--",
|
||||
"/work/scanner.test",
|
||||
"--test-storage-refusal"
|
||||
],
|
||||
"real_remote_ref_changed": false,
|
||||
"real_credentials": false,
|
||||
"native_acceptance": false,
|
||||
"source_sha256": {
|
||||
"batch.go": "1b3fd8d534686758d7489a5f3e0208acf6ed6304adac63ae95af3bcccccb98e8",
|
||||
"batch_test.go": "477762327353ed88526b8f79e563872c8ee80a4fd27c47c03f20db6cf20e4569",
|
||||
"main.go": "25e41047bcf881a90bb9536583d6df72c73e868df0ee2fd3527de6d31740fbb7",
|
||||
"main_test.go": "306dfd8ff06ccb22cb5e7f38894725eb3900b81645d8b922a340e8ab239ffee5",
|
||||
"volatile.go": "d8cc0379d6f57743ab74f0318076b362b48de964631fa77f4d282b6993da8610"
|
||||
},
|
||||
"binary_sha256": "sha256:73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a"
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
bwrap: Can't create file at /dev/shm: Is a directory
|
||||
|
|
@ -0,0 +1,90 @@
|
|||
{
|
||||
"returncode": 0,
|
||||
"seconds": 0.03,
|
||||
"argv": [
|
||||
"bwrap",
|
||||
"--unshare-net",
|
||||
"--unshare-pid",
|
||||
"--die-with-parent",
|
||||
"--new-session",
|
||||
"--ro-bind",
|
||||
"/usr",
|
||||
"/usr",
|
||||
"--ro-bind",
|
||||
"/lib",
|
||||
"/lib",
|
||||
"--ro-bind",
|
||||
"/lib64",
|
||||
"/lib64",
|
||||
"--symlink",
|
||||
"usr/bin",
|
||||
"/bin",
|
||||
"--proc",
|
||||
"/proc",
|
||||
"--dev",
|
||||
"/dev",
|
||||
"--tmpfs",
|
||||
"/tmp",
|
||||
"--bind",
|
||||
"/tmp/custodian-receive-scanner-batch-r1",
|
||||
"/work",
|
||||
"--ro-bind",
|
||||
"/tmp/custodian-receive-scanner-budget-r1/fixture.git",
|
||||
"/fixture",
|
||||
"--ro-bind",
|
||||
"/home/worsch/the-custodian/.git/objects",
|
||||
"/source-objects",
|
||||
"--ro-bind",
|
||||
"/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks",
|
||||
"/scanner",
|
||||
"--ro-bind",
|
||||
"/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
|
||||
"/toolchain",
|
||||
"--chdir",
|
||||
"/work/source/tools/receive-secret-scan",
|
||||
"--clearenv",
|
||||
"--tmpfs",
|
||||
"/dev",
|
||||
"--setenv",
|
||||
"PATH",
|
||||
"/toolchain/bin:/usr/bin:/bin",
|
||||
"--setenv",
|
||||
"HOME",
|
||||
"/work/home",
|
||||
"--setenv",
|
||||
"GOTOOLCHAIN",
|
||||
"local",
|
||||
"--setenv",
|
||||
"GOPROXY",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOSUMDB",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOCACHE",
|
||||
"/work/gocache",
|
||||
"--setenv",
|
||||
"GOMAXPROCS",
|
||||
"2",
|
||||
"--setenv",
|
||||
"CGO_ENABLED",
|
||||
"0",
|
||||
"--setenv",
|
||||
"FORGE_TEST_GITLEAKS",
|
||||
"/scanner",
|
||||
"--",
|
||||
"/work/scanner.test",
|
||||
"--test-storage-refusal"
|
||||
],
|
||||
"real_remote_ref_changed": false,
|
||||
"real_credentials": false,
|
||||
"native_acceptance": false,
|
||||
"source_sha256": {
|
||||
"batch.go": "1b3fd8d534686758d7489a5f3e0208acf6ed6304adac63ae95af3bcccccb98e8",
|
||||
"batch_test.go": "477762327353ed88526b8f79e563872c8ee80a4fd27c47c03f20db6cf20e4569",
|
||||
"main.go": "25e41047bcf881a90bb9536583d6df72c73e868df0ee2fd3527de6d31740fbb7",
|
||||
"main_test.go": "306dfd8ff06ccb22cb5e7f38894725eb3900b81645d8b922a340e8ab239ffee5",
|
||||
"volatile.go": "d8cc0379d6f57743ab74f0318076b362b48de964631fa77f4d282b6993da8610"
|
||||
},
|
||||
"binary_sha256": "sha256:73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a"
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
{"reason":"volatile-storage-unavailable","status":"unverified"}
|
||||
|
|
@ -0,0 +1,98 @@
|
|||
{
|
||||
"returncode": 1,
|
||||
"seconds": 39.45,
|
||||
"argv": [
|
||||
"bwrap",
|
||||
"--unshare-net",
|
||||
"--unshare-pid",
|
||||
"--die-with-parent",
|
||||
"--new-session",
|
||||
"--ro-bind",
|
||||
"/usr",
|
||||
"/usr",
|
||||
"--ro-bind",
|
||||
"/lib",
|
||||
"/lib",
|
||||
"--ro-bind",
|
||||
"/lib64",
|
||||
"/lib64",
|
||||
"--symlink",
|
||||
"usr/bin",
|
||||
"/bin",
|
||||
"--proc",
|
||||
"/proc",
|
||||
"--dev",
|
||||
"/dev",
|
||||
"--tmpfs",
|
||||
"/dev/shm",
|
||||
"--tmpfs",
|
||||
"/tmp",
|
||||
"--bind",
|
||||
"/tmp/custodian-receive-scanner-batch-r1",
|
||||
"/work",
|
||||
"--ro-bind",
|
||||
"/tmp/custodian-receive-scanner-budget-r1/fixture.git",
|
||||
"/fixture",
|
||||
"--ro-bind",
|
||||
"/home/worsch/the-custodian/.git/objects",
|
||||
"/source-objects",
|
||||
"--ro-bind",
|
||||
"/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks",
|
||||
"/scanner",
|
||||
"--ro-bind",
|
||||
"/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
|
||||
"/toolchain",
|
||||
"--chdir",
|
||||
"/work/source/tools/receive-secret-scan",
|
||||
"--clearenv",
|
||||
"--setenv",
|
||||
"PATH",
|
||||
"/toolchain/bin:/usr/bin:/bin",
|
||||
"--setenv",
|
||||
"HOME",
|
||||
"/work/home",
|
||||
"--setenv",
|
||||
"GOTOOLCHAIN",
|
||||
"local",
|
||||
"--setenv",
|
||||
"GOPROXY",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOSUMDB",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOCACHE",
|
||||
"/work/gocache",
|
||||
"--setenv",
|
||||
"GOMAXPROCS",
|
||||
"2",
|
||||
"--setenv",
|
||||
"CGO_ENABLED",
|
||||
"0",
|
||||
"--setenv",
|
||||
"FORGE_TEST_GITLEAKS",
|
||||
"/scanner",
|
||||
"--",
|
||||
"go",
|
||||
"test",
|
||||
"-buildvcs=false",
|
||||
"-count=1",
|
||||
"-timeout",
|
||||
"8m",
|
||||
"-v",
|
||||
"-run",
|
||||
"TestVolatile|TestReceiverDeath|TestSmallInputParity|TestUpdate|TestTree|TestGitEnvironment|TestCapped",
|
||||
"."
|
||||
],
|
||||
"real_remote_ref_changed": false,
|
||||
"real_credentials": false,
|
||||
"native_acceptance": false,
|
||||
"source_sha256": {
|
||||
"batch.go": "24a98fc3a25c441f2c10f1c38efdeeb72851de7faeb8c1fabc02a8cd9f72f9f2",
|
||||
"batch_test.go": "eba7729797e3f559a6ea1622d5b6ec29700cf5396787b5ad666911e7f1be0b8a",
|
||||
"main.go": "25e41047bcf881a90bb9536583d6df72c73e868df0ee2fd3527de6d31740fbb7",
|
||||
"main_test.go": "306dfd8ff06ccb22cb5e7f38894725eb3900b81645d8b922a340e8ab239ffee5",
|
||||
"volatile.go": "d8cc0379d6f57743ab74f0318076b362b48de964631fa77f4d282b6993da8610"
|
||||
},
|
||||
"binary_sha256": "sha256:0af7a100c3ade1ab4a6755d6354a78f50f86301a149d3b035f6cc648a524d489"
|
||||
}
|
||||
|
|
@ -0,0 +1,41 @@
|
|||
=== RUN TestVolatileStorageLifecycle
|
||||
--- PASS: TestVolatileStorageLifecycle (0.01s)
|
||||
=== RUN TestVolatileIdentityRefusesReplacement
|
||||
--- PASS: TestVolatileIdentityRefusesReplacement (0.01s)
|
||||
=== RUN TestReceiverDeathCleansStorageAndStopsReader
|
||||
--- PASS: TestReceiverDeathCleansStorageAndStopsReader (0.03s)
|
||||
=== RUN TestSmallInputParity
|
||||
=== RUN TestSmallInputParity/empty
|
||||
=== RUN TestSmallInputParity/clean
|
||||
=== RUN TestSmallInputParity/exact-limit
|
||||
=== RUN TestSmallInputParity/private-key
|
||||
=== RUN TestSmallInputParity/binary-private-key
|
||||
=== RUN TestSmallInputParity/token
|
||||
batch_test.go:172: stdin reference outcome differs <nil>
|
||||
=== RUN TestSmallInputParity/binary-token
|
||||
batch_test.go:172: stdin reference outcome differs <nil>
|
||||
=== RUN TestSmallInputParity/inline-suppression
|
||||
=== RUN TestSmallInputParity/sixty-four-distinct-inputs
|
||||
=== RUN TestSmallInputParity/expired-context
|
||||
--- FAIL: TestSmallInputParity (15.13s)
|
||||
--- PASS: TestSmallInputParity/empty (1.82s)
|
||||
--- PASS: TestSmallInputParity/clean (1.90s)
|
||||
--- PASS: TestSmallInputParity/exact-limit (1.97s)
|
||||
--- PASS: TestSmallInputParity/private-key (1.90s)
|
||||
--- PASS: TestSmallInputParity/binary-private-key (1.95s)
|
||||
--- FAIL: TestSmallInputParity/token (1.21s)
|
||||
--- FAIL: TestSmallInputParity/binary-token (1.21s)
|
||||
--- PASS: TestSmallInputParity/inline-suppression (2.08s)
|
||||
--- PASS: TestSmallInputParity/sixty-four-distinct-inputs (1.07s)
|
||||
--- PASS: TestSmallInputParity/expired-context (0.00s)
|
||||
=== RUN TestUpdateInputRefusesAmbiguity
|
||||
--- PASS: TestUpdateInputRefusesAmbiguity (0.00s)
|
||||
=== RUN TestTreeRefusesMalformedAndExternalEntries
|
||||
--- PASS: TestTreeRefusesMalformedAndExternalEntries (0.00s)
|
||||
=== RUN TestGitEnvironmentDoesNotInheritConfigOrSecrets
|
||||
--- PASS: TestGitEnvironmentDoesNotInheritConfigOrSecrets (0.00s)
|
||||
=== RUN TestCappedOutput
|
||||
--- PASS: TestCappedOutput (0.00s)
|
||||
FAIL
|
||||
FAIL railiance-forge/receive-secret-scan 15.178s
|
||||
FAIL
|
||||
|
|
@ -0,0 +1,98 @@
|
|||
{
|
||||
"returncode": 0,
|
||||
"seconds": 64.23,
|
||||
"argv": [
|
||||
"bwrap",
|
||||
"--unshare-net",
|
||||
"--unshare-pid",
|
||||
"--die-with-parent",
|
||||
"--new-session",
|
||||
"--ro-bind",
|
||||
"/usr",
|
||||
"/usr",
|
||||
"--ro-bind",
|
||||
"/lib",
|
||||
"/lib",
|
||||
"--ro-bind",
|
||||
"/lib64",
|
||||
"/lib64",
|
||||
"--symlink",
|
||||
"usr/bin",
|
||||
"/bin",
|
||||
"--proc",
|
||||
"/proc",
|
||||
"--dev",
|
||||
"/dev",
|
||||
"--tmpfs",
|
||||
"/dev/shm",
|
||||
"--tmpfs",
|
||||
"/tmp",
|
||||
"--bind",
|
||||
"/tmp/custodian-receive-scanner-batch-r1",
|
||||
"/work",
|
||||
"--ro-bind",
|
||||
"/tmp/custodian-receive-scanner-budget-r1/fixture.git",
|
||||
"/fixture",
|
||||
"--ro-bind",
|
||||
"/home/worsch/the-custodian/.git/objects",
|
||||
"/source-objects",
|
||||
"--ro-bind",
|
||||
"/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks",
|
||||
"/scanner",
|
||||
"--ro-bind",
|
||||
"/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
|
||||
"/toolchain",
|
||||
"--chdir",
|
||||
"/work/source/tools/receive-secret-scan",
|
||||
"--clearenv",
|
||||
"--setenv",
|
||||
"PATH",
|
||||
"/toolchain/bin:/usr/bin:/bin",
|
||||
"--setenv",
|
||||
"HOME",
|
||||
"/work/home",
|
||||
"--setenv",
|
||||
"GOTOOLCHAIN",
|
||||
"local",
|
||||
"--setenv",
|
||||
"GOPROXY",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOSUMDB",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOCACHE",
|
||||
"/work/gocache",
|
||||
"--setenv",
|
||||
"GOMAXPROCS",
|
||||
"2",
|
||||
"--setenv",
|
||||
"CGO_ENABLED",
|
||||
"0",
|
||||
"--setenv",
|
||||
"FORGE_TEST_GITLEAKS",
|
||||
"/scanner",
|
||||
"--",
|
||||
"go",
|
||||
"test",
|
||||
"-buildvcs=false",
|
||||
"-count=1",
|
||||
"-timeout",
|
||||
"8m",
|
||||
"-v",
|
||||
"-run",
|
||||
".",
|
||||
"."
|
||||
],
|
||||
"real_remote_ref_changed": false,
|
||||
"real_credentials": false,
|
||||
"native_acceptance": false,
|
||||
"source_sha256": {
|
||||
"batch.go": "1b3fd8d534686758d7489a5f3e0208acf6ed6304adac63ae95af3bcccccb98e8",
|
||||
"batch_test.go": "4edf51a3c38f3ad4f5484294fc32e5b5637f8b7caae556dff555c48ad28d87a1",
|
||||
"main.go": "25e41047bcf881a90bb9536583d6df72c73e868df0ee2fd3527de6d31740fbb7",
|
||||
"main_test.go": "306dfd8ff06ccb22cb5e7f38894725eb3900b81645d8b922a340e8ab239ffee5",
|
||||
"volatile.go": "d8cc0379d6f57743ab74f0318076b362b48de964631fa77f4d282b6993da8610"
|
||||
},
|
||||
"binary_sha256": "sha256:73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a"
|
||||
}
|
||||
|
|
@ -0,0 +1,108 @@
|
|||
=== RUN TestVolatileStorageLifecycle
|
||||
--- PASS: TestVolatileStorageLifecycle (0.01s)
|
||||
=== RUN TestVolatileIdentityRefusesReplacement
|
||||
--- PASS: TestVolatileIdentityRefusesReplacement (0.01s)
|
||||
=== RUN TestReceiverDeathCleansStorageAndStopsReader
|
||||
--- PASS: TestReceiverDeathCleansStorageAndStopsReader (0.02s)
|
||||
=== RUN TestSmallInputParity
|
||||
=== RUN TestSmallInputParity/empty
|
||||
=== RUN TestSmallInputParity/clean
|
||||
=== RUN TestSmallInputParity/exact-limit
|
||||
=== RUN TestSmallInputParity/private-key
|
||||
=== RUN TestSmallInputParity/binary-private-key
|
||||
=== RUN TestSmallInputParity/token
|
||||
=== RUN TestSmallInputParity/binary-token
|
||||
=== RUN TestSmallInputParity/inline-suppression
|
||||
=== RUN TestSmallInputParity/sixty-four-distinct-inputs
|
||||
=== RUN TestSmallInputParity/expired-context
|
||||
=== RUN TestSmallInputParity/invalid-inputs
|
||||
=== RUN TestSmallInputParity/scanner-failure
|
||||
--- PASS: TestSmallInputParity (12.66s)
|
||||
--- PASS: TestSmallInputParity/empty (1.39s)
|
||||
--- PASS: TestSmallInputParity/clean (1.36s)
|
||||
--- PASS: TestSmallInputParity/exact-limit (1.49s)
|
||||
--- PASS: TestSmallInputParity/private-key (1.43s)
|
||||
--- PASS: TestSmallInputParity/binary-private-key (1.44s)
|
||||
--- PASS: TestSmallInputParity/token (1.33s)
|
||||
--- PASS: TestSmallInputParity/binary-token (1.37s)
|
||||
--- PASS: TestSmallInputParity/inline-suppression (1.43s)
|
||||
--- PASS: TestSmallInputParity/sixty-four-distinct-inputs (0.89s)
|
||||
--- PASS: TestSmallInputParity/expired-context (0.00s)
|
||||
--- PASS: TestSmallInputParity/invalid-inputs (0.00s)
|
||||
--- PASS: TestSmallInputParity/scanner-failure (0.50s)
|
||||
=== RUN TestBatchRefusesUnverifiedReportsAndDiagnostics
|
||||
--- PASS: TestBatchRefusesUnverifiedReportsAndDiagnostics (0.00s)
|
||||
=== RUN TestUpdateInputRefusesAmbiguity
|
||||
--- PASS: TestUpdateInputRefusesAmbiguity (0.00s)
|
||||
=== RUN TestTreeRefusesMalformedAndExternalEntries
|
||||
--- PASS: TestTreeRefusesMalformedAndExternalEntries (0.00s)
|
||||
=== RUN TestGitEnvironmentDoesNotInheritConfigOrSecrets
|
||||
--- PASS: TestGitEnvironmentDoesNotInheritConfigOrSecrets (0.00s)
|
||||
=== RUN TestCappedOutput
|
||||
--- PASS: TestCappedOutput (0.00s)
|
||||
=== RUN TestNativePushBoundaries
|
||||
=== RUN TestNativePushBoundaries/clean-existing-and-new-branch-and-deletion
|
||||
=== RUN TestNativePushBoundaries/initial-repository-clean-and-secret
|
||||
=== RUN TestNativePushBoundaries/initial-repository-clean-and-secret/false
|
||||
=== RUN TestNativePushBoundaries/initial-repository-clean-and-secret/true
|
||||
=== RUN TestNativePushBoundaries/sha256-object-format
|
||||
=== RUN TestNativePushBoundaries/secret-in-tip
|
||||
=== RUN TestNativePushBoundaries/secret-added-then-deleted
|
||||
=== RUN TestNativePushBoundaries/new-branch-and-force-update
|
||||
=== RUN TestNativePushBoundaries/merge-second-parent-history
|
||||
=== RUN TestNativePushBoundaries/commit-message
|
||||
=== RUN TestNativePushBoundaries/annotated-tag-message
|
||||
=== RUN TestNativePushBoundaries/tag-direct-to-blob
|
||||
=== RUN TestNativePushBoundaries/multi-ref-all-refused
|
||||
=== RUN TestNativePushBoundaries/missing-scanner-and-deletion-refused
|
||||
=== RUN TestNativePushBoundaries/wrong-executable-refused
|
||||
=== RUN TestNativePushBoundaries/inline-and-config-suppression-refused
|
||||
=== RUN TestNativePushBoundaries/replacement-objects-cannot-hide-secret
|
||||
=== RUN TestNativePushBoundaries/grafts-cannot-hide-introduced-history
|
||||
=== RUN TestNativePushBoundaries/ref-name-token
|
||||
=== RUN TestNativePushBoundaries/partial-config-include-refused
|
||||
=== RUN TestNativePushBoundaries/object-count-limit-refused
|
||||
=== RUN TestNativePushBoundaries/external-gitlink-refused
|
||||
=== RUN TestNativePushBoundaries/partial-repository-refused
|
||||
=== RUN TestNativePushBoundaries/aggregate-byte-limit-refused
|
||||
=== RUN TestNativePushBoundaries/oversized-object-refused
|
||||
--- PASS: TestNativePushBoundaries (48.86s)
|
||||
--- PASS: TestNativePushBoundaries/clean-existing-and-new-branch-and-deletion (3.65s)
|
||||
--- PASS: TestNativePushBoundaries/initial-repository-clean-and-secret (4.73s)
|
||||
--- PASS: TestNativePushBoundaries/initial-repository-clean-and-secret/false (2.06s)
|
||||
--- PASS: TestNativePushBoundaries/initial-repository-clean-and-secret/true (2.66s)
|
||||
--- PASS: TestNativePushBoundaries/sha256-object-format (4.16s)
|
||||
--- PASS: TestNativePushBoundaries/secret-in-tip (2.12s)
|
||||
--- PASS: TestNativePushBoundaries/secret-added-then-deleted (1.93s)
|
||||
--- PASS: TestNativePushBoundaries/new-branch-and-force-update (4.81s)
|
||||
--- PASS: TestNativePushBoundaries/merge-second-parent-history (2.53s)
|
||||
--- PASS: TestNativePushBoundaries/commit-message (2.06s)
|
||||
--- PASS: TestNativePushBoundaries/annotated-tag-message (2.07s)
|
||||
--- PASS: TestNativePushBoundaries/tag-direct-to-blob (1.85s)
|
||||
--- PASS: TestNativePushBoundaries/multi-ref-all-refused (1.91s)
|
||||
--- PASS: TestNativePushBoundaries/missing-scanner-and-deletion-refused (0.11s)
|
||||
--- PASS: TestNativePushBoundaries/wrong-executable-refused (0.10s)
|
||||
--- PASS: TestNativePushBoundaries/inline-and-config-suppression-refused (1.79s)
|
||||
--- PASS: TestNativePushBoundaries/replacement-objects-cannot-hide-secret (1.95s)
|
||||
--- PASS: TestNativePushBoundaries/grafts-cannot-hide-introduced-history (2.35s)
|
||||
--- PASS: TestNativePushBoundaries/ref-name-token (1.17s)
|
||||
--- PASS: TestNativePushBoundaries/partial-config-include-refused (0.16s)
|
||||
--- PASS: TestNativePushBoundaries/object-count-limit-refused (1.10s)
|
||||
--- PASS: TestNativePushBoundaries/external-gitlink-refused (1.58s)
|
||||
--- PASS: TestNativePushBoundaries/partial-repository-refused (0.17s)
|
||||
--- PASS: TestNativePushBoundaries/aggregate-byte-limit-refused (5.22s)
|
||||
--- PASS: TestNativePushBoundaries/oversized-object-refused (0.64s)
|
||||
=== RUN TestScannerFileAndTimeoutRefusal
|
||||
=== RUN TestScannerFileAndTimeoutRefusal/nonexecutable
|
||||
=== RUN TestScannerFileAndTimeoutRefusal/symlink
|
||||
=== RUN TestScannerFileAndTimeoutRefusal/expired-context
|
||||
=== RUN TestScannerFileAndTimeoutRefusal/scanner-process-failure
|
||||
=== RUN TestScannerFileAndTimeoutRefusal/unknown-old-ref
|
||||
--- PASS: TestScannerFileAndTimeoutRefusal (1.67s)
|
||||
--- PASS: TestScannerFileAndTimeoutRefusal/nonexecutable (0.06s)
|
||||
--- PASS: TestScannerFileAndTimeoutRefusal/symlink (0.00s)
|
||||
--- PASS: TestScannerFileAndTimeoutRefusal/expired-context (0.04s)
|
||||
--- PASS: TestScannerFileAndTimeoutRefusal/scanner-process-failure (0.84s)
|
||||
--- PASS: TestScannerFileAndTimeoutRefusal/unknown-old-ref (0.05s)
|
||||
PASS
|
||||
ok railiance-forge/receive-secret-scan 63.236s
|
||||
|
|
@ -0,0 +1,98 @@
|
|||
{
|
||||
"returncode": 0,
|
||||
"seconds": 29.92,
|
||||
"argv": [
|
||||
"bwrap",
|
||||
"--unshare-net",
|
||||
"--unshare-pid",
|
||||
"--die-with-parent",
|
||||
"--new-session",
|
||||
"--ro-bind",
|
||||
"/usr",
|
||||
"/usr",
|
||||
"--ro-bind",
|
||||
"/lib",
|
||||
"/lib",
|
||||
"--ro-bind",
|
||||
"/lib64",
|
||||
"/lib64",
|
||||
"--symlink",
|
||||
"usr/bin",
|
||||
"/bin",
|
||||
"--proc",
|
||||
"/proc",
|
||||
"--dev",
|
||||
"/dev",
|
||||
"--tmpfs",
|
||||
"/tmp",
|
||||
"--bind",
|
||||
"/tmp/custodian-receive-scanner-batch-r1",
|
||||
"/work",
|
||||
"--ro-bind",
|
||||
"/tmp/custodian-receive-scanner-budget-r1/fixture.git",
|
||||
"/fixture",
|
||||
"--ro-bind",
|
||||
"/home/worsch/the-custodian/.git/objects",
|
||||
"/source-objects",
|
||||
"--ro-bind",
|
||||
"/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks",
|
||||
"/scanner",
|
||||
"--ro-bind",
|
||||
"/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
|
||||
"/toolchain",
|
||||
"--chdir",
|
||||
"/work/source/tools/receive-secret-scan",
|
||||
"--clearenv",
|
||||
"--tmpfs",
|
||||
"/dev/shm",
|
||||
"--setenv",
|
||||
"PATH",
|
||||
"/toolchain/bin:/usr/bin:/bin",
|
||||
"--setenv",
|
||||
"HOME",
|
||||
"/work/home",
|
||||
"--setenv",
|
||||
"GOTOOLCHAIN",
|
||||
"local",
|
||||
"--setenv",
|
||||
"GOPROXY",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOSUMDB",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOCACHE",
|
||||
"/work/gocache",
|
||||
"--setenv",
|
||||
"GOMAXPROCS",
|
||||
"2",
|
||||
"--setenv",
|
||||
"CGO_ENABLED",
|
||||
"0",
|
||||
"--setenv",
|
||||
"FORGE_TEST_GITLEAKS",
|
||||
"/scanner",
|
||||
"--",
|
||||
"go",
|
||||
"test",
|
||||
"-buildvcs=false",
|
||||
"-count=1",
|
||||
"-timeout",
|
||||
"8m",
|
||||
"-v",
|
||||
"-run",
|
||||
"TestSmallInputParity|TestBatchAndLargerInputPushBoundaries",
|
||||
"."
|
||||
],
|
||||
"real_remote_ref_changed": false,
|
||||
"real_credentials": false,
|
||||
"native_acceptance": false,
|
||||
"source_sha256": {
|
||||
"batch.go": "1b3fd8d534686758d7489a5f3e0208acf6ed6304adac63ae95af3bcccccb98e8",
|
||||
"batch_test.go": "627cb93b43dcf4d154cfee0ea30bb4c94d3f8c39332b6e80cb4f8256950b1ead",
|
||||
"main.go": "25e41047bcf881a90bb9536583d6df72c73e868df0ee2fd3527de6d31740fbb7",
|
||||
"main_test.go": "306dfd8ff06ccb22cb5e7f38894725eb3900b81645d8b922a340e8ab239ffee5",
|
||||
"volatile.go": "d8cc0379d6f57743ab74f0318076b362b48de964631fa77f4d282b6993da8610"
|
||||
},
|
||||
"binary_sha256": "sha256:73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a"
|
||||
}
|
||||
|
|
@ -0,0 +1,40 @@
|
|||
=== RUN TestSmallInputParity
|
||||
=== RUN TestSmallInputParity/empty
|
||||
=== RUN TestSmallInputParity/clean
|
||||
=== RUN TestSmallInputParity/exact-limit
|
||||
=== RUN TestSmallInputParity/private-key
|
||||
=== RUN TestSmallInputParity/exact-limit-private-key
|
||||
=== RUN TestSmallInputParity/binary-private-key
|
||||
=== RUN TestSmallInputParity/token
|
||||
=== RUN TestSmallInputParity/binary-token
|
||||
=== RUN TestSmallInputParity/inline-suppression
|
||||
=== RUN TestSmallInputParity/sixty-four-distinct-inputs
|
||||
=== RUN TestSmallInputParity/expired-context
|
||||
=== RUN TestSmallInputParity/invalid-inputs
|
||||
=== RUN TestSmallInputParity/scanner-failure
|
||||
--- PASS: TestSmallInputParity (15.80s)
|
||||
--- PASS: TestSmallInputParity/empty (1.49s)
|
||||
--- PASS: TestSmallInputParity/clean (1.43s)
|
||||
--- PASS: TestSmallInputParity/exact-limit (1.41s)
|
||||
--- PASS: TestSmallInputParity/private-key (1.40s)
|
||||
--- PASS: TestSmallInputParity/exact-limit-private-key (1.33s)
|
||||
--- PASS: TestSmallInputParity/binary-private-key (1.44s)
|
||||
--- PASS: TestSmallInputParity/token (1.75s)
|
||||
--- PASS: TestSmallInputParity/binary-token (1.85s)
|
||||
--- PASS: TestSmallInputParity/inline-suppression (1.95s)
|
||||
--- PASS: TestSmallInputParity/sixty-four-distinct-inputs (0.89s)
|
||||
--- PASS: TestSmallInputParity/expired-context (0.00s)
|
||||
--- PASS: TestSmallInputParity/invalid-inputs (0.00s)
|
||||
--- PASS: TestSmallInputParity/scanner-failure (0.82s)
|
||||
=== RUN TestBatchAndLargerInputPushBoundaries
|
||||
=== RUN TestBatchAndLargerInputPushBoundaries/exact-limit-key
|
||||
=== RUN TestBatchAndLargerInputPushBoundaries/larger-stdin-key
|
||||
=== RUN TestBatchAndLargerInputPushBoundaries/larger-stdin-clean
|
||||
=== RUN TestBatchAndLargerInputPushBoundaries/multiple-ref-name-detection
|
||||
--- PASS: TestBatchAndLargerInputPushBoundaries (13.27s)
|
||||
--- PASS: TestBatchAndLargerInputPushBoundaries/exact-limit-key (2.16s)
|
||||
--- PASS: TestBatchAndLargerInputPushBoundaries/larger-stdin-key (2.90s)
|
||||
--- PASS: TestBatchAndLargerInputPushBoundaries/larger-stdin-clean (5.46s)
|
||||
--- PASS: TestBatchAndLargerInputPushBoundaries/multiple-ref-name-detection (2.31s)
|
||||
PASS
|
||||
ok railiance-forge/receive-secret-scan 29.076s
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
# Receive-scanner availability reproduction
|
||||
|
||||
Custodian source checkpoint `27737fcc` introduces 141 Git objects (one commit,
|
||||
45 trees, 95 blobs; 2,068,946 bytes). Two exact normal remote publications returned
|
||||
`unverified/scanner-failed`, after 128 and 118 objects respectively. The local
|
||||
commit hook passed. The real remote ref remains `7c682d9`; no refusal was bypassed.
|
||||
|
||||
The unchanged current Forge receive adapter source `b42206e5`, compiled locally
|
||||
with the pinned Gitleaks binary, reproduces the failure on that exact public delta
|
||||
in a disposable bare repository: 90.06 seconds, 94 objects, unverified. The source
|
||||
uses one scanner process per object under a 90-second total context. Git object
|
||||
storage is mounted read-only; network/PID/HOME are isolated and no credential or
|
||||
real remote ref changes. This is source/environment reproduction, not a native
|
||||
replacement artifact admission.
|
||||
|
||||
The existing Repo Manager staged scanner already batches inputs up to 4096 bytes
|
||||
and keeps larger stdin fragment behavior. Reuse that bounded profile and its
|
||||
private volatile-storage/parent-loss cleanup semantics for the receive adapter.
|
||||
All reachable object types and updated ref names, fixed scanner digest/rules,
|
||||
byte/count limits and fail-closed outcomes remain required. Native hook/runtime
|
||||
custody and any activation require their existing owner/founder change authority.
|
||||
|
||||
The sealed-memfd symlink primitive did **not** establish traversal parity:
|
||||
Gitleaks returned zero with warnings and missed the text/NUL-prefixed canaries.
|
||||
That approach is rejected. Regular files inside a private namespace tmpfs detect
|
||||
both canaries. This narrow primitive success does not prove complete batching,
|
||||
process-loss cleanup, whole-control parity, workload cost or native admission.
|
||||
The full correction is still implementation work; no scanner configuration or
|
||||
canonical Forge source was changed here.
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
{
|
||||
"source_owner": "railiance-forge",
|
||||
"source_revision": "git:b42206e52bce0e11f9615b4e774f80f9015a1ef7",
|
||||
"scanner_sha256": "sha256:88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509",
|
||||
"target_commit": "git:27737fcce0c22192578dbd46d1268e5e12cf5615",
|
||||
"baseline_commit": "git:7c682d9c66f8aaeb2bebe88aa31069fea482338c",
|
||||
"introduced_objects": 141,
|
||||
"bytes": 2068946,
|
||||
"real_remote_ref_changed": false,
|
||||
"real_credentials": false,
|
||||
"native_acceptance": false
|
||||
}
|
||||
|
|
@ -0,0 +1,133 @@
|
|||
{
|
||||
"native_publication_attempts": [
|
||||
{
|
||||
"status": "unverified",
|
||||
"reason": "scanner-failed",
|
||||
"scanned_objects": 128,
|
||||
"scanned_refs": 1,
|
||||
"receipt": "../cust80-current-callback-publication-r1/projection.json"
|
||||
},
|
||||
{
|
||||
"status": "unverified",
|
||||
"reason": "scanner-failed",
|
||||
"scanned_objects": 118,
|
||||
"scanned_refs": 1,
|
||||
"receipt": "../cust80-current-callback-publication-r2/projection.json"
|
||||
}
|
||||
],
|
||||
"exact_public_delta": {
|
||||
"introduced_objects": 141,
|
||||
"commit_objects": 1,
|
||||
"trees": 45,
|
||||
"blobs": 95,
|
||||
"bytes": 2068946
|
||||
},
|
||||
"actual_owner_adapter_local_reproduction": {
|
||||
"returncode": 2,
|
||||
"seconds": 90.06,
|
||||
"argv": [
|
||||
"bwrap",
|
||||
"--unshare-net",
|
||||
"--unshare-pid",
|
||||
"--die-with-parent",
|
||||
"--new-session",
|
||||
"--ro-bind",
|
||||
"/usr",
|
||||
"/usr",
|
||||
"--ro-bind",
|
||||
"/lib",
|
||||
"/lib",
|
||||
"--ro-bind",
|
||||
"/lib64",
|
||||
"/lib64",
|
||||
"--symlink",
|
||||
"usr/bin",
|
||||
"/bin",
|
||||
"--proc",
|
||||
"/proc",
|
||||
"--dev",
|
||||
"/dev",
|
||||
"--tmpfs",
|
||||
"/tmp",
|
||||
"--bind",
|
||||
"/tmp/custodian-receive-scanner-budget-r1",
|
||||
"/work",
|
||||
"--ro-bind",
|
||||
"/home/worsch/the-custodian/.git/objects",
|
||||
"/source-objects",
|
||||
"--ro-bind",
|
||||
"/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks",
|
||||
"/scanner",
|
||||
"--ro-bind",
|
||||
"/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
|
||||
"/toolchain",
|
||||
"--chdir",
|
||||
"/work/fixture.git",
|
||||
"--clearenv",
|
||||
"--setenv",
|
||||
"PATH",
|
||||
"/toolchain/bin:/usr/bin:/bin",
|
||||
"--setenv",
|
||||
"HOME",
|
||||
"/work/home",
|
||||
"--setenv",
|
||||
"GOTOOLCHAIN",
|
||||
"local",
|
||||
"--setenv",
|
||||
"GOPROXY",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOSUMDB",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOCACHE",
|
||||
"/work/gocache",
|
||||
"--setenv",
|
||||
"GOMAXPROCS",
|
||||
"2",
|
||||
"--setenv",
|
||||
"CGO_ENABLED",
|
||||
"0",
|
||||
"--setenv",
|
||||
"GIT_DIR",
|
||||
"/work/fixture.git",
|
||||
"--",
|
||||
"/work/original-hook",
|
||||
"--scanner",
|
||||
"/scanner"
|
||||
],
|
||||
"binary_sha256": "sha256:f37c64ae6ed089515fcd83581be6313986efc5a9e5a548008554213c4469a058",
|
||||
"target": "disposable bare Git refs; read-only exact public object delta",
|
||||
"real_remote_ref_changed": false,
|
||||
"real_credentials": false,
|
||||
"native_acceptance": false,
|
||||
"adapter_result": {
|
||||
"status": "unverified",
|
||||
"scope": "introduced-reachable-git-objects-and-updated-ref-names",
|
||||
"reason": "scanner-failed",
|
||||
"scanned_objects": 94,
|
||||
"scanned_refs": 1,
|
||||
"scanner_version": "8.30.1"
|
||||
}
|
||||
},
|
||||
"batch_primitive_trials": {
|
||||
"sealed_memfd_symlinks": {
|
||||
"status": "refused",
|
||||
"scanner_exit": 0,
|
||||
"warnings_present": true,
|
||||
"canaries_not_reported": true,
|
||||
"parity_established": false
|
||||
},
|
||||
"private_namespace_tmpfs_regular_files": {
|
||||
"status": "primitive_passed",
|
||||
"scanner_exit": 20,
|
||||
"text_and_NUL_prefixed_canaries_detected": true,
|
||||
"raw_input_persisted_to_host_filesystem": false,
|
||||
"full_control_adapter_parity": false
|
||||
}
|
||||
},
|
||||
"source_or_native_scanner_configuration_changed": false,
|
||||
"native_change_approved": false,
|
||||
"root_checkpoint_remote_publication": "pending; both exact normal attempts refused",
|
||||
"next_source_work": "Reuse bounded <=4096-byte batching and private volatile workspace/parent-loss cleanup semantics from existing Repo Manager adapter; preserve large-object stdin, all Git object/ref scope, fixed producer digest/rules and 90-second fail-closed budget. Implement and test before requesting any native action."
|
||||
}
|
||||
|
|
@ -0,0 +1,84 @@
|
|||
{
|
||||
"returncode": 0,
|
||||
"seconds": 11.0,
|
||||
"argv": [
|
||||
"bwrap",
|
||||
"--unshare-net",
|
||||
"--unshare-pid",
|
||||
"--die-with-parent",
|
||||
"--new-session",
|
||||
"--ro-bind",
|
||||
"/usr",
|
||||
"/usr",
|
||||
"--ro-bind",
|
||||
"/lib",
|
||||
"/lib",
|
||||
"--ro-bind",
|
||||
"/lib64",
|
||||
"/lib64",
|
||||
"--symlink",
|
||||
"usr/bin",
|
||||
"/bin",
|
||||
"--proc",
|
||||
"/proc",
|
||||
"--dev",
|
||||
"/dev",
|
||||
"--tmpfs",
|
||||
"/tmp",
|
||||
"--bind",
|
||||
"/tmp/custodian-receive-scanner-budget-r1",
|
||||
"/work",
|
||||
"--ro-bind",
|
||||
"/home/worsch/the-custodian/.git/objects",
|
||||
"/source-objects",
|
||||
"--ro-bind",
|
||||
"/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks",
|
||||
"/scanner",
|
||||
"--ro-bind",
|
||||
"/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
|
||||
"/toolchain",
|
||||
"--chdir",
|
||||
"/work/source/tools/receive-secret-scan",
|
||||
"--clearenv",
|
||||
"--setenv",
|
||||
"PATH",
|
||||
"/toolchain/bin:/usr/bin:/bin",
|
||||
"--setenv",
|
||||
"HOME",
|
||||
"/work/home",
|
||||
"--setenv",
|
||||
"GOTOOLCHAIN",
|
||||
"local",
|
||||
"--setenv",
|
||||
"GOPROXY",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOSUMDB",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOCACHE",
|
||||
"/work/gocache",
|
||||
"--setenv",
|
||||
"GOMAXPROCS",
|
||||
"2",
|
||||
"--setenv",
|
||||
"CGO_ENABLED",
|
||||
"0",
|
||||
"--setenv",
|
||||
"GIT_DIR",
|
||||
"/work/fixture.git",
|
||||
"--",
|
||||
"go",
|
||||
"build",
|
||||
"-buildvcs=false",
|
||||
"-trimpath",
|
||||
"-o",
|
||||
"/work/original-hook",
|
||||
"."
|
||||
],
|
||||
"binary_sha256": "sha256:f37c64ae6ed089515fcd83581be6313986efc5a9e5a548008554213c4469a058",
|
||||
"target": "disposable bare Git refs; read-only exact public object delta",
|
||||
"real_remote_ref_changed": false,
|
||||
"real_credentials": false,
|
||||
"native_acceptance": false
|
||||
}
|
||||
|
|
@ -0,0 +1,88 @@
|
|||
{
|
||||
"returncode": 2,
|
||||
"seconds": 90.06,
|
||||
"argv": [
|
||||
"bwrap",
|
||||
"--unshare-net",
|
||||
"--unshare-pid",
|
||||
"--die-with-parent",
|
||||
"--new-session",
|
||||
"--ro-bind",
|
||||
"/usr",
|
||||
"/usr",
|
||||
"--ro-bind",
|
||||
"/lib",
|
||||
"/lib",
|
||||
"--ro-bind",
|
||||
"/lib64",
|
||||
"/lib64",
|
||||
"--symlink",
|
||||
"usr/bin",
|
||||
"/bin",
|
||||
"--proc",
|
||||
"/proc",
|
||||
"--dev",
|
||||
"/dev",
|
||||
"--tmpfs",
|
||||
"/tmp",
|
||||
"--bind",
|
||||
"/tmp/custodian-receive-scanner-budget-r1",
|
||||
"/work",
|
||||
"--ro-bind",
|
||||
"/home/worsch/the-custodian/.git/objects",
|
||||
"/source-objects",
|
||||
"--ro-bind",
|
||||
"/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks",
|
||||
"/scanner",
|
||||
"--ro-bind",
|
||||
"/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
|
||||
"/toolchain",
|
||||
"--chdir",
|
||||
"/work/fixture.git",
|
||||
"--clearenv",
|
||||
"--setenv",
|
||||
"PATH",
|
||||
"/toolchain/bin:/usr/bin:/bin",
|
||||
"--setenv",
|
||||
"HOME",
|
||||
"/work/home",
|
||||
"--setenv",
|
||||
"GOTOOLCHAIN",
|
||||
"local",
|
||||
"--setenv",
|
||||
"GOPROXY",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOSUMDB",
|
||||
"off",
|
||||
"--setenv",
|
||||
"GOCACHE",
|
||||
"/work/gocache",
|
||||
"--setenv",
|
||||
"GOMAXPROCS",
|
||||
"2",
|
||||
"--setenv",
|
||||
"CGO_ENABLED",
|
||||
"0",
|
||||
"--setenv",
|
||||
"GIT_DIR",
|
||||
"/work/fixture.git",
|
||||
"--",
|
||||
"/work/original-hook",
|
||||
"--scanner",
|
||||
"/scanner"
|
||||
],
|
||||
"binary_sha256": "sha256:f37c64ae6ed089515fcd83581be6313986efc5a9e5a548008554213c4469a058",
|
||||
"target": "disposable bare Git refs; read-only exact public object delta",
|
||||
"real_remote_ref_changed": false,
|
||||
"real_credentials": false,
|
||||
"native_acceptance": false,
|
||||
"adapter_result": {
|
||||
"status": "unverified",
|
||||
"scope": "introduced-reachable-git-objects-and-updated-ref-names",
|
||||
"reason": "scanner-failed",
|
||||
"scanned_objects": 94,
|
||||
"scanned_refs": 1,
|
||||
"scanner_version": "8.30.1"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
{"status":"unverified","scope":"introduced-reachable-git-objects-and-updated-ref-names","reason":"scanner-failed","scanned_objects":94,"scanned_refs":1,"scanner_version":"8.30.1"}
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
import fcntl
|
||||
import hashlib
|
||||
import json
|
||||
import os
|
||||
from pathlib import Path
|
||||
import subprocess
|
||||
import tempfile
|
||||
|
||||
assert hashlib.sha256(Path('/scanner').read_bytes()).hexdigest() == '88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509'
|
||||
with tempfile.TemporaryDirectory() as area:
|
||||
root=Path(area); inputs=root/'inputs'; inputs.mkdir()
|
||||
(root/'scanner.toml').write_text('[extend]\nuseDefault = true\n')
|
||||
(root/'ignore').write_text('')
|
||||
(root/'template').write_text('{{ range . }}{{ .File }}\n{{ end }}')
|
||||
token=b'ghp_'+b'A1b2C3d4E5f6G7h8I9j0K1l2M3n4O5p6Q7r8'
|
||||
descriptors=[]
|
||||
for i,raw in enumerate([b'clean public source\n', b'github_token = '+token+b'\n',b'\x00github_token = '+token+b'\n']):
|
||||
fd=os.memfd_create('forge-source-input',os.MFD_CLOEXEC|os.MFD_ALLOW_SEALING)
|
||||
os.fchmod(fd,0o600);os.write(fd,raw);os.lseek(fd,0,0)
|
||||
fcntl.fcntl(fd,fcntl.F_ADD_SEALS,fcntl.F_SEAL_SEAL|fcntl.F_SEAL_SHRINK|fcntl.F_SEAL_GROW|fcntl.F_SEAL_WRITE)
|
||||
os.symlink('/proc/self/fd/'+str(fd),inputs/str(i));descriptors.append(fd)
|
||||
command=['/scanner','dir','--follow-symlinks','--config',str(root/'scanner.toml'),'--gitleaks-ignore-path',str(root/'ignore'),'--ignore-gitleaks-allow','--redact=100','--no-banner','--no-color','--log-level','warn','--exit-code','20','--timeout','15','--report-format','template','--report-template',str(root/'template'),'--report-path',str(root/'paths'),'--max-target-megabytes','0',str(inputs)]
|
||||
result=subprocess.run(command,pass_fds=tuple(descriptors),stdout=subprocess.PIPE,stderr=subprocess.PIPE,env={'PATH':'/usr/bin:/bin','HOME':str(root),'LANG':'C'},cwd=root,timeout=20)
|
||||
found=(root/'paths').read_text().splitlines() if (root/'paths').exists() else []
|
||||
assert token not in result.stdout and token not in result.stderr
|
||||
print(json.dumps({'observed_exit':result.returncode,'reported_indexes':[Path(x).name for x in found],'diagnostic_bytes':len(result.stderr)}))
|
||||
assert result.returncode==20 and any(Path(x).name=='1' for x in found) and any(Path(x).name=='2' for x in found), 'memfd traversal/parity not established'
|
||||
for fd in descriptors:os.close(fd)
|
||||
print(json.dumps({'returncode':result.returncode,'reported_input_indexes':[Path(x).name for x in found],'sealed_memory_inputs':True,'text_and_NUL_prefixed_canaries_detected':True,'raw_input_written_to_filesystem':False}))
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
import fcntl
|
||||
import hashlib
|
||||
import json
|
||||
import os
|
||||
from pathlib import Path
|
||||
import subprocess
|
||||
import tempfile
|
||||
|
||||
assert hashlib.sha256(Path('/scanner').read_bytes()).hexdigest() == '88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509'
|
||||
with tempfile.TemporaryDirectory() as area:
|
||||
root=Path(area); inputs=root/'inputs'; inputs.mkdir()
|
||||
(root/'scanner.toml').write_text('[extend]\nuseDefault = true\n')
|
||||
(root/'ignore').write_text('')
|
||||
(root/'template').write_text('{{ range . }}{{ .File }}\n{{ end }}')
|
||||
token=b'ghp_'+b'A1b2C3d4E5f6G7h8I9j0K1l2M3n4O5p6Q7r8'
|
||||
descriptors=[]
|
||||
for i,raw in enumerate([b'clean public source\n', b'github_token = '+token+b'\n',b'\x00github_token = '+token+b'\n']):
|
||||
fd=os.memfd_create('forge-source-input',os.MFD_CLOEXEC|os.MFD_ALLOW_SEALING)
|
||||
os.fchmod(fd,0o600);os.write(fd,raw);os.lseek(fd,0,0)
|
||||
fcntl.fcntl(fd,fcntl.F_ADD_SEALS,fcntl.F_SEAL_SEAL|fcntl.F_SEAL_SHRINK|fcntl.F_SEAL_GROW|fcntl.F_SEAL_WRITE)
|
||||
(inputs/str(i)).write_bytes(raw); (inputs/str(i)).chmod(0o600); descriptors.append(fd)
|
||||
command=['/scanner','dir','--follow-symlinks','--config',str(root/'scanner.toml'),'--gitleaks-ignore-path',str(root/'ignore'),'--ignore-gitleaks-allow','--redact=100','--no-banner','--no-color','--log-level','warn','--exit-code','20','--timeout','15','--report-format','template','--report-template',str(root/'template'),'--report-path',str(root/'paths'),'--max-target-megabytes','0',str(inputs)]
|
||||
result=subprocess.run(command,pass_fds=tuple(descriptors),stdout=subprocess.PIPE,stderr=subprocess.PIPE,env={'PATH':'/usr/bin:/bin','HOME':str(root),'LANG':'C'},cwd=root,timeout=20)
|
||||
found=(root/'paths').read_text().splitlines() if (root/'paths').exists() else []
|
||||
assert token not in result.stdout and token not in result.stderr
|
||||
print(json.dumps({'observed_exit':result.returncode,'reported_indexes':[Path(x).name for x in found],'diagnostic_bytes':len(result.stderr)}))
|
||||
assert result.returncode==20 and any(Path(x).name=='1' for x in found) and any(Path(x).name=='2' for x in found), 'memfd traversal/parity not established'
|
||||
for fd in descriptors:os.close(fd)
|
||||
print(json.dumps({'returncode':result.returncode,'reported_input_indexes':[Path(x).name for x in found],'namespace_private_tmpfs_inputs':True,'text_and_NUL_prefixed_canaries_detected':True,'raw_input_persisted_to_host_filesystem':False}))
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
"""Exercise the unchanged actual receive adapter on the exact public source delta."""
|
||||
from pathlib import Path
|
||||
import argparse
|
||||
import hashlib
|
||||
import json
|
||||
import subprocess
|
||||
import time
|
||||
|
||||
HERE=Path(__file__).resolve().parent
|
||||
WORK=Path('/tmp/custodian-receive-scanner-budget-r1')
|
||||
parser=argparse.ArgumentParser();parser.add_argument('phase',choices=['build','scan']);args=parser.parse_args()
|
||||
argv=['bwrap','--unshare-net','--unshare-pid','--die-with-parent','--new-session']
|
||||
for p in ['/usr','/lib','/lib64']:argv+=['--ro-bind',p,p]
|
||||
argv+=['--symlink','usr/bin','/bin','--proc','/proc','--dev','/dev','--tmpfs','/tmp',
|
||||
'--bind',str(WORK),'/work','--ro-bind','/home/worsch/the-custodian/.git/objects','/source-objects',
|
||||
'--ro-bind','/home/worsch/.local/lib/repo-manager/gitleaks/8.30.1/gitleaks','/scanner',
|
||||
'--ro-bind','/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64','/toolchain',
|
||||
'--chdir','/work/source/tools/receive-secret-scan' if args.phase=='build' else '/work/fixture.git','--clearenv']
|
||||
for key,value in {'PATH':'/toolchain/bin:/usr/bin:/bin','HOME':'/work/home','GOTOOLCHAIN':'local','GOPROXY':'off','GOSUMDB':'off','GOCACHE':'/work/gocache','GOMAXPROCS':'2','CGO_ENABLED':'0','GIT_DIR':'/work/fixture.git'}.items():argv+=['--setenv',key,value]
|
||||
command=['go','build','-buildvcs=false','-trimpath','-o','/work/original-hook','.'] if args.phase=='build' else ['/work/original-hook','--scanner','/scanner']
|
||||
argv+=['--',*command];stem=HERE/('original-'+args.phase);assert not stem.with_suffix('.json').exists()
|
||||
start=time.monotonic()
|
||||
with stem.with_suffix('.txt').open('xb') as output:
|
||||
r=subprocess.run(argv,input=None if args.phase=='build' else (WORK/'input.txt').read_bytes(),stdout=output,stderr=subprocess.STDOUT,timeout=150)
|
||||
receipt={'returncode':r.returncode,'seconds':round(time.monotonic()-start,2),'argv':argv,
|
||||
'binary_sha256':'sha256:'+hashlib.sha256((WORK/'original-hook').read_bytes()).hexdigest() if (WORK/'original-hook').exists() else None,
|
||||
'target':'disposable bare Git refs; read-only exact public object delta','real_remote_ref_changed':False,'real_credentials':False,'native_acceptance':False}
|
||||
if args.phase=='scan':
|
||||
receipt['adapter_result']=json.loads(stem.with_suffix('.txt').read_text())
|
||||
stem.with_suffix('.json').write_text(json.dumps(receipt,indent=2)+'\n')
|
||||
print(json.dumps({k:receipt[k] for k in ['returncode','seconds','adapter_result'] if k in receipt}));raise SystemExit(r.returncode)
|
||||
|
|
@ -0,0 +1,42 @@
|
|||
# WP-80 progress visibility and task refinement
|
||||
|
||||
The user requested smaller tasks and a transparent account of delivered work.
|
||||
The active workplan now starts with source/integration/native progress, Now/Next,
|
||||
publication limits and an explicit update rule. All six original task blocks,
|
||||
statuses and UUIDs are preserved. The complete former 1,467-line file is retained
|
||||
byte-for-byte in `workplan-before-refinement.txt`; the current file is much shorter.
|
||||
|
||||
T07-T40 are 34 Custodian evidence checkpoints linked to existing owner work:
|
||||
seven completed source reviews, one native preparation in progress, 26 pending.
|
||||
Each pending checkpoint names its owner and completion test. This exposes existing
|
||||
delivered work and the actual remaining integration, build, runtime, lifecycle,
|
||||
recovery, audit and consumer acceptance. It creates no replacement owner backlog.
|
||||
|
||||
All 16 target gates and G01-G13 have explicit checkpoint mappings; all 116 original
|
||||
ledger entries remain unchanged. No complete native gate is closed. The source
|
||||
review counts are not an overall completion percentage. Active delivery work is
|
||||
limited to two checkpoints, with one clear current item and a short next sequence.
|
||||
|
||||
The gap register now reflects accepted MFA preview/help corrections, delivered
|
||||
sandbox and signing/verification source, actual current-token/Forgejo/database
|
||||
proof and the new scanner source correction. Remaining native acceptance stays
|
||||
explicit. The detailed implementation history links to the current workplan.
|
||||
|
||||
Normal Repo Manager assigned exactly 34 new canonical task bindings and changed
|
||||
no old binding. Its actual workplan parser verifies 40 tasks, unique bindings,
|
||||
9 done / 4 progress / 27 todo across both umbrella and delivery records, all local
|
||||
links, and an acyclic internal dependency graph. The delivery subset is 7 done /
|
||||
1 progress / 26 todo. Source and native scopes remain distinct.
|
||||
|
||||
The first ordinary consistency run completed with zero failures/automation errors,
|
||||
but publication was refused and C-17 skipped task writes because commits remain
|
||||
unpushed. API readback still has the original six tasks. The new source records
|
||||
await the normal projection after scanner correction; no API task creation bypass
|
||||
is used. Existing source/CLI failure receipts are retained. The eight preexisting
|
||||
worktree/index states remain preserved.
|
||||
|
||||
Decision: `77f88913-e893-42c8-992d-2f67df0a13db`, a Codex planning/reporting
|
||||
decision implementing the user's request. It grants no runtime authority, owner
|
||||
assent, residual promotion or changed security requirement. Evidence is in
|
||||
`identifier-assignment.json`, `refinement-scope.json`, `validation.json`,
|
||||
`consistency.json` and the projection readback receipt.
|
||||
|
|
@ -0,0 +1,849 @@
|
|||
{
|
||||
"repo_slug": "the-custodian",
|
||||
"repo_path": "/home/worsch/the-custodian",
|
||||
"source_revision": null,
|
||||
"source_revision_reason": "dirty_workplans",
|
||||
"issues": [
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-35",
|
||||
"message": "Repo Manager warning: workplans/: repository uses more than one workplan prefix: ['CUST-WP', 'THE-WP']",
|
||||
"file_path": "workplans/",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-35",
|
||||
"message": "Repo Manager contradictory: workplans/ADHOC-2026-08-25-retired.md: workplan id 'CUST-WP-ADHOC-2026-08-25-RETIRED' is not accepted by the canon kind registry",
|
||||
"file_path": "workplans/ADHOC-2026-08-25-retired.md",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-33",
|
||||
"message": "WORK-RECORDS.md is missing or stale \u2014 regenerate via fix-consistency (CUST-WP-0061-T04 generated work-record index)",
|
||||
"file_path": "WORK-RECORDS.md",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-05",
|
||||
"message": "Title drift in 'cust-wp-0010': file='Domain and Repository Goals' db='Workplan Lifecycle Documentation' (file wins)",
|
||||
"file_path": "workplans/CUST-WP-0010b-domain-and-repo-goals.md",
|
||||
"db_id": "def8455a-9de4-4891-a15a-5b09ca98ab1e",
|
||||
"file_value": "Domain and Repository Goals",
|
||||
"db_value": "Workplan Lifecycle Documentation",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Workplan dependency target 'STATE-WP-0092' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0072-fleet-flavor-and-depends-on-backfill.md",
|
||||
"db_id": "",
|
||||
"file_value": "STATE-WP-0092",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-40",
|
||||
"message": "blocker satisfied, task still wait: 'CUST-WP-0073-T05' in workplan 'CUST-WP-0073' \u2014 decision 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa is resolved",
|
||||
"file_path": "workplans/CUST-WP-0073-agent-credential-separation.md#CUST-WP-0073-T05",
|
||||
"db_id": "",
|
||||
"file_value": "1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-39",
|
||||
"message": "Human wait task 'CUST-WP-0079-T06' in workplan 'CUST-WP-0079' has needs_human: true without decision_id \u2014 unrouted human gate",
|
||||
"file_path": "workplans/CUST-WP-0079-deterministic-security-flow.md#CUST-WP-0079-T06",
|
||||
"db_id": "",
|
||||
"file_value": "needs_human: true",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-22",
|
||||
"message": "Task description drift 'CUST-WP-0080-T01': file content differs from DB (file wins)",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T01",
|
||||
"db_id": "c770f7e1-25eb-53ec-9a37-1f7794077ff8",
|
||||
"file_value": "Completed the SecurityCanon SEC-DSM and existing-owner architecture review. Delivered [security blueprint](../docs/netki",
|
||||
"db_value": "Read SecurityCanon SEC-DSM 1.0, accepted NetKingdom layer model and case contracts,\nowner declarations, source implement",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-22",
|
||||
"message": "Task description drift 'CUST-WP-0080-T02': file content differs from DB (file wins)",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T02",
|
||||
"db_id": "5973026f-8ca9-5882-99fe-65a54bc250ac",
|
||||
"file_value": "Completed trust-boundary, owner, lifecycle and dependency inspection. Delivered the [gap analysis](../docs/netkingdom-se",
|
||||
"db_value": "Blueprint inspection table records trust boundaries, circular dependency removal,\nidentity-first credential selection, e",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-22",
|
||||
"message": "Task description drift 'CUST-WP-0080-T03': file content differs from DB (file wins)",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T03",
|
||||
"db_id": "87637402-02f1-57c1-8fbc-4141598af8e3",
|
||||
"file_value": "Coordination umbrella. Drive remaining source/lifecycle closure through the existing owners and specific checkpoints, es",
|
||||
"db_value": "Start with the reproduced DN-subject validation defect in existing KEY-WP-0040.\nReconcile G04/G07/G08/G10/G12/G13 agains",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-22",
|
||||
"message": "Task description drift 'CUST-WP-0080-T04': file content differs from DB (file wins)",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T04",
|
||||
"db_id": "82378b0f-7004-5c2f-9683-b356a1227576",
|
||||
"file_value": "Final acceptance audit. Reconcile every TSA-01-TSA-16 gate, G01-G13 and all 116 individual requirements with exact curre",
|
||||
"db_value": "Verify G01\u2013G13 against current source/runtime receipts and the individual SEC-DSM\nrequirement ledger. Existing owner int",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-22",
|
||||
"message": "Task description drift 'CUST-WP-0080-T05': file content differs from DB (file wins)",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T05",
|
||||
"db_id": "ed8b909a-23bf-5e5f-b600-e477fbae136b",
|
||||
"file_value": "Coordination umbrella for T25/T26 and supported consumer/discovery evidence. Retain incoming request `1b279bad-a159-43da",
|
||||
"db_value": "User-requested addition on 2026-10-13. Accountable coordinating owner:\n**the-custodian / custodian-codex**. Accept incom",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-22",
|
||||
"message": "Task description drift 'CUST-WP-0080-T06': file content differs from DB (file wins)",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T06",
|
||||
"db_id": "6aca534c-5c7a-556f-b6b6-406433670c29",
|
||||
"file_value": "Coordination umbrella for the full target and owner sequencing. Preserve independently owned security meaning, identity,",
|
||||
"db_value": "Founder implementation request, 2026-10-16. Document the optimized target and\ncoordinate GPT-6.1-Sol medium agents again",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Derived task 'CUST-WP-0080-T07' is absent from this projection",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T07",
|
||||
"db_id": "bb236dea-30f7-5437-b01c-f14d2509e061",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Derived task 'CUST-WP-0080-T08' is absent from this projection",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T08",
|
||||
"db_id": "18b885fe-503f-5ebc-b390-808f71316264",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Derived task 'CUST-WP-0080-T09' is absent from this projection",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T09",
|
||||
"db_id": "a1f2dbe0-13d4-57a2-a2b5-c0137cd48410",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Derived task 'CUST-WP-0080-T10' is absent from this projection",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T10",
|
||||
"db_id": "1f3c78af-5686-58ea-9133-8afc2df36b8f",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Derived task 'CUST-WP-0080-T11' is absent from this projection",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T11",
|
||||
"db_id": "bffd4e10-2cf0-5835-a8d0-ae1763ca3873",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Derived task 'CUST-WP-0080-T12' is absent from this projection",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T12",
|
||||
"db_id": "bb09e414-6d79-5dcd-b8e6-b73a046a4dda",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Derived task 'CUST-WP-0080-T13' is absent from this projection",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T13",
|
||||
"db_id": "793e78f0-7782-5e48-bdc0-b65127b32ecb",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Task dependency target 'CUST-WP-0080-T09' of task 'CUST-WP-0080-T14' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T14",
|
||||
"db_id": "",
|
||||
"file_value": "CUST-WP-0080-T09",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Derived task 'CUST-WP-0080-T14' is absent from this projection",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T14",
|
||||
"db_id": "7ecbd622-03a8-5b49-9621-8d21d7d15890",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Task dependency target 'CUST-WP-0080-T14' of task 'CUST-WP-0080-T15' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T15",
|
||||
"db_id": "",
|
||||
"file_value": "CUST-WP-0080-T14",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Derived task 'CUST-WP-0080-T15' is absent from this projection",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T15",
|
||||
"db_id": "434d9c78-7789-5b78-8d9d-d87b0638b469",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Task dependency target 'CUST-WP-0080-T07' of task 'CUST-WP-0080-T16' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T16",
|
||||
"db_id": "",
|
||||
"file_value": "CUST-WP-0080-T07",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Task dependency target 'CUST-WP-0080-T08' of task 'CUST-WP-0080-T16' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T16",
|
||||
"db_id": "",
|
||||
"file_value": "CUST-WP-0080-T08",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Task dependency target 'CUST-WP-0080-T09' of task 'CUST-WP-0080-T16' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T16",
|
||||
"db_id": "",
|
||||
"file_value": "CUST-WP-0080-T09",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Derived task 'CUST-WP-0080-T16' is absent from this projection",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T16",
|
||||
"db_id": "e6183073-cc8e-5c6f-8fbd-db50bb1a466c",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Task dependency target 'CUST-WP-0080-T16' of task 'CUST-WP-0080-T17' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T17",
|
||||
"db_id": "",
|
||||
"file_value": "CUST-WP-0080-T16",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Derived task 'CUST-WP-0080-T17' is absent from this projection",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T17",
|
||||
"db_id": "4de46468-7ae2-59e3-be2b-1a32506153a5",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Task dependency target 'CUST-WP-0080-T10' of task 'CUST-WP-0080-T18' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T18",
|
||||
"db_id": "",
|
||||
"file_value": "CUST-WP-0080-T10",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Task dependency target 'CUST-WP-0080-T16' of task 'CUST-WP-0080-T18' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T18",
|
||||
"db_id": "",
|
||||
"file_value": "CUST-WP-0080-T16",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Derived task 'CUST-WP-0080-T18' is absent from this projection",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T18",
|
||||
"db_id": "fd796e9c-dd70-5c65-a6fe-eafe3911bc8f",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Task dependency target 'CUST-WP-0080-T14' of task 'CUST-WP-0080-T19' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T19",
|
||||
"db_id": "",
|
||||
"file_value": "CUST-WP-0080-T14",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Task dependency target 'CUST-WP-0080-T15' of task 'CUST-WP-0080-T19' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T19",
|
||||
"db_id": "",
|
||||
"file_value": "CUST-WP-0080-T15",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Task dependency target 'CUST-WP-0080-T16' of task 'CUST-WP-0080-T19' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T19",
|
||||
"db_id": "",
|
||||
"file_value": "CUST-WP-0080-T16",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Task dependency target 'CUST-WP-0080-T17' of task 'CUST-WP-0080-T19' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T19",
|
||||
"db_id": "",
|
||||
"file_value": "CUST-WP-0080-T17",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Task dependency target 'CUST-WP-0080-T18' of task 'CUST-WP-0080-T19' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T19",
|
||||
"db_id": "",
|
||||
"file_value": "CUST-WP-0080-T18",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Derived task 'CUST-WP-0080-T19' is absent from this projection",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T19",
|
||||
"db_id": "4ffd2e33-d887-5686-bad1-7f32a56191a8",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Task dependency target 'CUST-WP-0080-T11' of task 'CUST-WP-0080-T20' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T20",
|
||||
"db_id": "",
|
||||
"file_value": "CUST-WP-0080-T11",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Derived task 'CUST-WP-0080-T20' is absent from this projection",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T20",
|
||||
"db_id": "0d9df435-b9a2-5b89-833d-799785c969a9",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Task dependency target 'CUST-WP-0080-T07' of task 'CUST-WP-0080-T21' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T21",
|
||||
"db_id": "",
|
||||
"file_value": "CUST-WP-0080-T07",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Derived task 'CUST-WP-0080-T21' is absent from this projection",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T21",
|
||||
"db_id": "fa11a2a4-4dbd-5dfb-ad29-bc7a99cc6258",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Task dependency target 'CUST-WP-0080-T21' of task 'CUST-WP-0080-T22' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T22",
|
||||
"db_id": "",
|
||||
"file_value": "CUST-WP-0080-T21",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Task dependency target 'CUST-WP-0080-T16' of task 'CUST-WP-0080-T22' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T22",
|
||||
"db_id": "",
|
||||
"file_value": "CUST-WP-0080-T16",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Task dependency target 'CUST-WP-0080-T17' of task 'CUST-WP-0080-T22' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T22",
|
||||
"db_id": "",
|
||||
"file_value": "CUST-WP-0080-T17",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Task dependency target 'CUST-WP-0080-T18' of task 'CUST-WP-0080-T22' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T22",
|
||||
"db_id": "",
|
||||
"file_value": "CUST-WP-0080-T18",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Derived task 'CUST-WP-0080-T22' is absent from this projection",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T22",
|
||||
"db_id": "88588db8-8c6e-5d15-a85b-2c068f4e8a2a",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Task dependency target 'CUST-WP-0080-T19' of task 'CUST-WP-0080-T23' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T23",
|
||||
"db_id": "",
|
||||
"file_value": "CUST-WP-0080-T19",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Derived task 'CUST-WP-0080-T23' is absent from this projection",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T23",
|
||||
"db_id": "266e228b-7754-5323-b0c6-37f860592d90",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Derived task 'CUST-WP-0080-T24' is absent from this projection",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T24",
|
||||
"db_id": "a4f06ce0-69a5-5cbb-9d78-6c5b89ba9853",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Derived task 'CUST-WP-0080-T25' is absent from this projection",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T25",
|
||||
"db_id": "3be1c76d-a5f3-5dea-9777-349dc97e836e",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Derived task 'CUST-WP-0080-T26' is absent from this projection",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T26",
|
||||
"db_id": "0491b6b4-a238-58ef-bf3a-505749e5655c",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Task dependency target 'CUST-WP-0080-T13' of task 'CUST-WP-0080-T27' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T27",
|
||||
"db_id": "",
|
||||
"file_value": "CUST-WP-0080-T13",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Derived task 'CUST-WP-0080-T27' is absent from this projection",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T27",
|
||||
"db_id": "19540d29-c4df-5f1a-acf7-127965c9a396",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Derived task 'CUST-WP-0080-T28' is absent from this projection",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T28",
|
||||
"db_id": "5ac99f55-0dde-5d1c-b88c-b85f34469abc",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Derived task 'CUST-WP-0080-T29' is absent from this projection",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T29",
|
||||
"db_id": "3ec89fb2-fe97-50f5-a3c9-88b731b0d2ec",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Task dependency target 'CUST-WP-0080-T29' of task 'CUST-WP-0080-T30' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T30",
|
||||
"db_id": "",
|
||||
"file_value": "CUST-WP-0080-T29",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Derived task 'CUST-WP-0080-T30' is absent from this projection",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T30",
|
||||
"db_id": "457400ad-6c44-5160-a77a-63c6ad5acabc",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Task dependency target 'CUST-WP-0080-T29' of task 'CUST-WP-0080-T31' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T31",
|
||||
"db_id": "",
|
||||
"file_value": "CUST-WP-0080-T29",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Derived task 'CUST-WP-0080-T31' is absent from this projection",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T31",
|
||||
"db_id": "cbf32375-279a-5bf3-b867-06333a1ff2ca",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Task dependency target 'CUST-WP-0080-T22' of task 'CUST-WP-0080-T32' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T32",
|
||||
"db_id": "",
|
||||
"file_value": "CUST-WP-0080-T22",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Derived task 'CUST-WP-0080-T32' is absent from this projection",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T32",
|
||||
"db_id": "5a0cb7f7-1cd8-50ba-8af2-a2b13ed34a18",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Task dependency target 'CUST-WP-0080-T12' of task 'CUST-WP-0080-T33' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T33",
|
||||
"db_id": "",
|
||||
"file_value": "CUST-WP-0080-T12",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Derived task 'CUST-WP-0080-T33' is absent from this projection",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T33",
|
||||
"db_id": "4547ac4c-8893-54fe-ae6e-362682bb7920",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Derived task 'CUST-WP-0080-T34' is absent from this projection",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T34",
|
||||
"db_id": "393b9fcc-323b-5182-92c6-44530fce7efb",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Task dependency target 'CUST-WP-0080-T23' of task 'CUST-WP-0080-T35' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T35",
|
||||
"db_id": "",
|
||||
"file_value": "CUST-WP-0080-T23",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Derived task 'CUST-WP-0080-T35' is absent from this projection",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T35",
|
||||
"db_id": "db274192-07d6-5be7-9c1e-d63c5a9fb57f",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Task dependency target 'CUST-WP-0080-T23' of task 'CUST-WP-0080-T36' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T36",
|
||||
"db_id": "",
|
||||
"file_value": "CUST-WP-0080-T23",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Derived task 'CUST-WP-0080-T36' is absent from this projection",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T36",
|
||||
"db_id": "586232a1-57b0-5e04-a61b-fb687bcc8999",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Derived task 'CUST-WP-0080-T37' is absent from this projection",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T37",
|
||||
"db_id": "d533ca34-a691-5f8e-8cc2-5f408b679538",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Derived task 'CUST-WP-0080-T38' is absent from this projection",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T38",
|
||||
"db_id": "2350a829-bd8c-5c3b-9f39-07bfa1c3f228",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Task dependency target 'CUST-WP-0080-T20' of task 'CUST-WP-0080-T39' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T39",
|
||||
"db_id": "",
|
||||
"file_value": "CUST-WP-0080-T20",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Task dependency target 'CUST-WP-0080-T28' of task 'CUST-WP-0080-T39' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T39",
|
||||
"db_id": "",
|
||||
"file_value": "CUST-WP-0080-T28",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Derived task 'CUST-WP-0080-T39' is absent from this projection",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T39",
|
||||
"db_id": "da6ae9a3-9107-5ca7-adb2-c9d85b3c529c",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-20",
|
||||
"message": "Task dependency target 'CUST-WP-0080-T39' of task 'CUST-WP-0080-T40' is not linked to State Hub",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T40",
|
||||
"db_id": "",
|
||||
"file_value": "CUST-WP-0080-T39",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-11",
|
||||
"message": "Derived task 'CUST-WP-0080-T40' is absent from this projection",
|
||||
"file_path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md#CUST-WP-0080-T40",
|
||||
"db_id": "8e71f6f0-9fc3-509b-8f1b-768f7d9cbd0e",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": true
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Closed DB workstream 'cust-wp-0010b' (id=416ff571\u2026, status=finished) has no backing workplan file",
|
||||
"file_path": "",
|
||||
"db_id": "416ff571-18cf-5cb2-9c8b-836f68a301b3",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'interactive-the-custodian@retired-20260828' (id=370c2481\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "370c2481-6806-41eb-a917-f8874f03184f",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'adhoc-2026-05-02@retired-20260827' (id=3f54ce9c\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "3f54ce9c-1f95-42de-894f-0f81a52ba2e8",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "INFO",
|
||||
"check_id": "C-08",
|
||||
"message": "Retired DB workstream 'the-custodian-adhoc-2026-07-02@retired-20260827' (id=5c53733b\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
|
||||
"file_path": "",
|
||||
"db_id": "5c53733b-c077-4a93-be66-9c3af8f9b6fd",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-26",
|
||||
"message": "Workplan id 'THE-WP-0001' uses prefix 'THE-WP' but repo canonical prefix is 'CUST-WP' \u2014 new plans must conform",
|
||||
"file_path": "workplans/THE-WP-0001-federation-interface.md",
|
||||
"db_id": "",
|
||||
"file_value": "THE-WP-0001",
|
||||
"db_value": "CUST-WP",
|
||||
"fixable": false
|
||||
},
|
||||
{
|
||||
"severity": "WARN",
|
||||
"check_id": "C-17",
|
||||
"message": "Repo 'the-custodian' has 1 unpushed commit(s) and push failed (remote: {\"status\":\"unverified\",\"scope\":\"introduced-reachable-git-objects-and-updated-ref-names\",\"reason\":\"scanner-failed\",\"scanned_objects\":138,\"scanned_refs\":1,\"scanner_version\":\"8.30.1\"} \nTo forgejo-remote:coulomb/the-custodian.git\n ! [remote rejected] main -> main (pre-receive hook declined)\nerror: failed to push some refs to 'forgejo-remote:coulomb/the-custodian.git') \u2014 skipping writes to prevent runaway divergence",
|
||||
"file_path": "",
|
||||
"db_id": "",
|
||||
"file_value": "",
|
||||
"db_value": "",
|
||||
"fixable": false
|
||||
}
|
||||
],
|
||||
"fixes_applied": [
|
||||
"bindings: synced 89/89",
|
||||
"C-17: all write operations skipped \u2014 unpushed commits, push failed"
|
||||
],
|
||||
"summary": {
|
||||
"fail": 0,
|
||||
"automation_error": 0,
|
||||
"warn": 79,
|
||||
"info": 4
|
||||
},
|
||||
"result": "warn"
|
||||
}
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
{
|
||||
"workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52",
|
||||
"id": "77f88913-e893-42c8-992d-2f67df0a13db",
|
||||
"topic_id": null,
|
||||
"title": "Expose WP-80 progress as bounded delivery evidence checkpoints",
|
||||
"description": "At the user's explicit request, preserve all six existing task UUIDs/statuses and the entire 16-gate/G01-G13/116-requirement scope; add 34 specific Custodian evidence checkpoints linked to existing owner work. Seven dated source reviews are complete, one native preparation is in progress and 26 remain todo. Separate source/integration/build/native/consumer stages, show Now/Next and retain the complete previous history. This is planning and reporting, not runtime approval or conformance. Owner implementation files stay authoritative; no duplicate implementation backlog or new service.",
|
||||
"decision_type": "made",
|
||||
"status": "resolved",
|
||||
"rationale": "The previous 2/6 umbrella count hid real delivered work and concrete remaining acceptance. The user asked for smaller tasks and more transparency. This decomposition records existing evidence without changing any native gate status, prior authority, owner assent, residual promotion or deferral.",
|
||||
"decided_by": "codex",
|
||||
"decided_at": "2026-10-18T11:46:35.463476Z",
|
||||
"deadline": null,
|
||||
"escalation_note": null,
|
||||
"superseded_by": null,
|
||||
"created_at": "2026-10-18T11:46:36.597563Z",
|
||||
"updated_at": "2026-10-18T11:46:36.597563Z",
|
||||
"workstream_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52"
|
||||
}
|
||||
|
|
@ -0,0 +1,40 @@
|
|||
{
|
||||
"file_task_count": 40,
|
||||
"hub_task_count": 6,
|
||||
"normal_sync_completed": true,
|
||||
"projection_complete": false,
|
||||
"reason": "C-17 all task writes skipped after normal source publication failed",
|
||||
"all_6_existing_bindings_statuses_preserved": true,
|
||||
"hub_rows": [
|
||||
{
|
||||
"id": "c770f7e1-25eb-53ec-9a37-1f7794077ff8",
|
||||
"title": "Review canon and map actual architecture",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"id": "5973026f-8ca9-5882-99fe-65a54bc250ac",
|
||||
"title": "Inspect and optimize the blueprint before planning closure",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"id": "87637402-02f1-57c1-8fbc-4141598af8e3",
|
||||
"title": "Close source defects and reconcile uncovered lifecycle gaps",
|
||||
"status": "progress"
|
||||
},
|
||||
{
|
||||
"id": "82378b0f-7004-5c2f-9683-b356a1227576",
|
||||
"title": "Verify native closure against every requirement",
|
||||
"status": "todo"
|
||||
},
|
||||
{
|
||||
"id": "ed8b909a-23bf-5e5f-b600-e477fbae136b",
|
||||
"title": "Coordinate self-service Playwright identity delivery",
|
||||
"status": "progress"
|
||||
},
|
||||
{
|
||||
"id": "6aca534c-5c7a-556f-b6b6-406433670c29",
|
||||
"title": "Establish the target architecture and drive the restructuring",
|
||||
"status": "progress"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,224 @@
|
|||
{
|
||||
"schema": "repo-manager.identifier-assignment.v1",
|
||||
"ok": true,
|
||||
"executed": true,
|
||||
"repo": "the-custodian",
|
||||
"namespace": "helixforge",
|
||||
"assignments": [
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "CUST-WP-0080-T07",
|
||||
"uuid": "bb236dea-30f7-5437-b01c-f14d2509e061",
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "CUST-WP-0080-T08",
|
||||
"uuid": "18b885fe-503f-5ebc-b390-808f71316264",
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "CUST-WP-0080-T09",
|
||||
"uuid": "a1f2dbe0-13d4-57a2-a2b5-c0137cd48410",
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "CUST-WP-0080-T10",
|
||||
"uuid": "1f3c78af-5686-58ea-9133-8afc2df36b8f",
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "CUST-WP-0080-T11",
|
||||
"uuid": "bffd4e10-2cf0-5835-a8d0-ae1763ca3873",
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "CUST-WP-0080-T12",
|
||||
"uuid": "bb09e414-6d79-5dcd-b8e6-b73a046a4dda",
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "CUST-WP-0080-T13",
|
||||
"uuid": "793e78f0-7782-5e48-bdc0-b65127b32ecb",
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "CUST-WP-0080-T14",
|
||||
"uuid": "7ecbd622-03a8-5b49-9621-8d21d7d15890",
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "CUST-WP-0080-T15",
|
||||
"uuid": "434d9c78-7789-5b78-8d9d-d87b0638b469",
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "CUST-WP-0080-T16",
|
||||
"uuid": "e6183073-cc8e-5c6f-8fbd-db50bb1a466c",
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "CUST-WP-0080-T17",
|
||||
"uuid": "4de46468-7ae2-59e3-be2b-1a32506153a5",
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "CUST-WP-0080-T18",
|
||||
"uuid": "fd796e9c-dd70-5c65-a6fe-eafe3911bc8f",
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "CUST-WP-0080-T19",
|
||||
"uuid": "4ffd2e33-d887-5686-bad1-7f32a56191a8",
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "CUST-WP-0080-T20",
|
||||
"uuid": "0d9df435-b9a2-5b89-833d-799785c969a9",
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "CUST-WP-0080-T21",
|
||||
"uuid": "fa11a2a4-4dbd-5dfb-ad29-bc7a99cc6258",
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "CUST-WP-0080-T22",
|
||||
"uuid": "88588db8-8c6e-5d15-a85b-2c068f4e8a2a",
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "CUST-WP-0080-T23",
|
||||
"uuid": "266e228b-7754-5323-b0c6-37f860592d90",
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "CUST-WP-0080-T24",
|
||||
"uuid": "a4f06ce0-69a5-5cbb-9d78-6c5b89ba9853",
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "CUST-WP-0080-T25",
|
||||
"uuid": "3be1c76d-a5f3-5dea-9777-349dc97e836e",
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "CUST-WP-0080-T26",
|
||||
"uuid": "0491b6b4-a238-58ef-bf3a-505749e5655c",
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "CUST-WP-0080-T27",
|
||||
"uuid": "19540d29-c4df-5f1a-acf7-127965c9a396",
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "CUST-WP-0080-T28",
|
||||
"uuid": "5ac99f55-0dde-5d1c-b88c-b85f34469abc",
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "CUST-WP-0080-T29",
|
||||
"uuid": "3ec89fb2-fe97-50f5-a3c9-88b731b0d2ec",
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "CUST-WP-0080-T30",
|
||||
"uuid": "457400ad-6c44-5160-a77a-63c6ad5acabc",
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "CUST-WP-0080-T31",
|
||||
"uuid": "cbf32375-279a-5bf3-b867-06333a1ff2ca",
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "CUST-WP-0080-T32",
|
||||
"uuid": "5a0cb7f7-1cd8-50ba-8af2-a2b13ed34a18",
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "CUST-WP-0080-T33",
|
||||
"uuid": "4547ac4c-8893-54fe-ae6e-362682bb7920",
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "CUST-WP-0080-T34",
|
||||
"uuid": "393b9fcc-323b-5182-92c6-44530fce7efb",
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "CUST-WP-0080-T35",
|
||||
"uuid": "db274192-07d6-5be7-9c1e-d63c5a9fb57f",
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "CUST-WP-0080-T36",
|
||||
"uuid": "586232a1-57b0-5e04-a61b-fb687bcc8999",
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "CUST-WP-0080-T37",
|
||||
"uuid": "d533ca34-a691-5f8e-8cc2-5f408b679538",
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "CUST-WP-0080-T38",
|
||||
"uuid": "2350a829-bd8c-5c3b-9f39-07bfa1c3f228",
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "CUST-WP-0080-T39",
|
||||
"uuid": "da6ae9a3-9107-5ca7-adb2-c9d85b3c529c",
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
},
|
||||
{
|
||||
"kind": "task",
|
||||
"record_id": "CUST-WP-0080-T40",
|
||||
"uuid": "8e71f6f0-9fc3-509b-8f1b-768f7d9cbd0e",
|
||||
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
}
|
||||
],
|
||||
"historical_invalid_identifiers": [
|
||||
{
|
||||
"kind": "workplan",
|
||||
"id": "CUST-WP-ADHOC-2026-08-25-RETIRED",
|
||||
"source": "workplans/ADHOC-2026-08-25-retired.md"
|
||||
}
|
||||
],
|
||||
"historical_identity_collisions": [],
|
||||
"files_changed": [
|
||||
"workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md"
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,104 @@
|
|||
{
|
||||
"reason": "Founder requested transparent progress and smaller workplan tasks",
|
||||
"original_workplan_sha256": "sha256:1aae7ecaf6f3f7e16113c896b5a746f303f5a6e7d6441b3f23ba5d8c2d060299",
|
||||
"original_task_bindings_and_statuses_preserved": true,
|
||||
"original_coordinator_tasks": 6,
|
||||
"new_delivery_checkpoints": 34,
|
||||
"completed_source_evidence_checkpoints": [
|
||||
7,
|
||||
8,
|
||||
9,
|
||||
10,
|
||||
11,
|
||||
12,
|
||||
13
|
||||
],
|
||||
"current_delivery_checkpoint": "CUST-WP-0080-T20",
|
||||
"next_delivery_checkpoints": [
|
||||
"CUST-WP-0080-T14",
|
||||
"CUST-WP-0080-T15"
|
||||
],
|
||||
"acceptance_coverage": {
|
||||
"TSA-01": [
|
||||
7,
|
||||
21
|
||||
],
|
||||
"TSA-02": [
|
||||
7,
|
||||
16,
|
||||
22
|
||||
],
|
||||
"TSA-03": [
|
||||
8,
|
||||
10,
|
||||
17,
|
||||
18,
|
||||
22
|
||||
],
|
||||
"TSA-04": [
|
||||
9,
|
||||
10,
|
||||
14,
|
||||
15,
|
||||
16,
|
||||
17,
|
||||
18,
|
||||
19,
|
||||
23
|
||||
],
|
||||
"TSA-05": [
|
||||
24,
|
||||
25,
|
||||
26
|
||||
],
|
||||
"TSA-06": [
|
||||
13,
|
||||
27,
|
||||
28
|
||||
],
|
||||
"TSA-07": [
|
||||
29,
|
||||
30
|
||||
],
|
||||
"TSA-08": [
|
||||
31
|
||||
],
|
||||
"TSA-09": [
|
||||
32
|
||||
],
|
||||
"TSA-10": [
|
||||
11,
|
||||
20,
|
||||
28,
|
||||
39,
|
||||
40
|
||||
],
|
||||
"TSA-11": [
|
||||
12,
|
||||
33
|
||||
],
|
||||
"TSA-12": [
|
||||
34
|
||||
],
|
||||
"TSA-13": [
|
||||
7,
|
||||
8,
|
||||
9,
|
||||
35
|
||||
],
|
||||
"TSA-14": [
|
||||
36
|
||||
],
|
||||
"TSA-15": [
|
||||
37
|
||||
],
|
||||
"TSA-16": [
|
||||
4,
|
||||
38
|
||||
]
|
||||
},
|
||||
"native_gates_closed": 0,
|
||||
"all_13_gaps_and_116_requirements_retained": true,
|
||||
"scope_or_runtime_authority_changed": false,
|
||||
"new_task_binding_assignment": "Official Repo Manager helper; not hand-assigned"
|
||||
}
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
{
|
||||
"all_original_8_worktree_and_index_states_preserved": true
|
||||
}
|
||||
|
|
@ -0,0 +1,44 @@
|
|||
{
|
||||
"files": [
|
||||
{
|
||||
"path": ".custodian-brief.md",
|
||||
"sha256": "sha256:74e3f825b14c6fe5a0f8cf511e2b85d9010f56109ea5bee700b360766b3dd453",
|
||||
"index": "100644 6aad3a5788fad3abd60c0f1270f160062dc0168b 0\t.custodian-brief.md"
|
||||
},
|
||||
{
|
||||
"path": "WORK-RECORDS.md",
|
||||
"sha256": "sha256:b8dc1ac2245e7aa59b13af1f62b0ca21b6c5704cafdb5a4de7a81b2d5595265b",
|
||||
"index": "100644 d535e0f2dcc3d454e041a8f1b547b5dea4493380 0\tWORK-RECORDS.md"
|
||||
},
|
||||
{
|
||||
"path": "docs/assessments/netkingdom-2026-10-14/hosted-before-federated.json",
|
||||
"sha256": "sha256:baecc157233131d17c73e84cd997db922d36ad235cbaa91f4938852220a824a2",
|
||||
"index": "100644 bbe2969551797f8c0c7c33e1009f1b293a631113 0\tdocs/assessments/netkingdom-2026-10-14/hosted-before-federated.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/assessments/netkingdom-2026-10-14/hub-private-source-pending.json",
|
||||
"sha256": "sha256:92916fa2fcabbe3f4b7c4b89ddbd6dc6cb079ffd6f06cf66b2c6e6d6ff5fabde",
|
||||
"index": "100644 af6b3430909c8cbf8190c53cd541da651291151a 0\tdocs/assessments/netkingdom-2026-10-14/hub-private-source-pending.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/assessments/netkingdom-2026-10-14/owner-access-gate.json",
|
||||
"sha256": "sha256:059d36b607383c1458dd2909e9adc5ec8be42af7c41412b4ce2d244d20d093df",
|
||||
"index": "100644 514edc14eb0a48736594bdd1bde2348e3d55e365 0\tdocs/assessments/netkingdom-2026-10-14/owner-access-gate.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/assessments/netkingdom-2026-10-14/publication-preflight.json",
|
||||
"sha256": "sha256:4b041890abae585ca78536fa12bb9668392f21b7c2c21f5f581e2eed516a1164",
|
||||
"index": "100644 ee5730a4c683ee71240a4086e34a448cad92d88d 0\tdocs/assessments/netkingdom-2026-10-14/publication-preflight.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/assessments/netkingdom-2026-10-14/published-source-verification.json",
|
||||
"sha256": "sha256:f0095fc7a8089443f27ad50e358247705a6a5ce83c85f4d57b402b116741e7c0",
|
||||
"index": "100644 83cdeb35d0ccd0b3a2472f8aa95767437566cbd9 0\tdocs/assessments/netkingdom-2026-10-14/published-source-verification.json"
|
||||
},
|
||||
{
|
||||
"path": "docs/assessments/netkingdom-2026-10-14/scoped-access-handoff.json",
|
||||
"sha256": "sha256:29c43c9909bb8a94ebdc74312a545b66bcc73de1a355158bf247cf8fc405f16b",
|
||||
"index": "100644 44097c5ea5ab08a0834ab1bd1d42fe4528bbb2c2 0\tdocs/assessments/netkingdom-2026-10-14/scoped-access-handoff.json"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
{
|
||||
"parser": "repo_manager.parse.workplan.parse_workplan_file",
|
||||
"task_count": 40,
|
||||
"status_counts": {
|
||||
"done": 9,
|
||||
"progress": 4,
|
||||
"todo": 27
|
||||
},
|
||||
"delivery_status_counts": {
|
||||
"done": 7,
|
||||
"todo": 26,
|
||||
"progress": 1
|
||||
},
|
||||
"all_6_original_bindings_and_statuses_preserved": true,
|
||||
"unique_40_canonical_bindings": true,
|
||||
"all_16_gates_and_13_gaps_mapped": true,
|
||||
"all_local_links_resolve": true,
|
||||
"internal_dependencies_acyclic": true,
|
||||
"all_116_requirements_retained": true,
|
||||
"workplan_sha256": "sha256:fdc639c90091157541cfaccef5dc653936d5869c1d4a2344fefbcd48575a13d9",
|
||||
"unchanged_ledger_sha256": "sha256:ad81f7186ada04aa1cc410932fc8669d69dc2232f3c0be00657b17f3aa3a8184",
|
||||
"requirements_count": 116,
|
||||
"native_gates_closed": 0,
|
||||
"hub_projection_complete": false,
|
||||
"hub_task_count": 6
|
||||
}
|
||||
File diff suppressed because it is too large
Load diff
Loading…
Add table
Add a link
Reference in a new issue