security: establish native Forgejo receive-hook baseline
This commit is contained in:
codex
parent
355b6b9720
commit
6502bfe4d8
4 changed files with 933 additions and 0 deletions
14
docs/changes/CUST-WP-0080/observe_forge_hooks.py
Normal file
14
docs/changes/CUST-WP-0080/observe_forge_hooks.py
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
import json,subprocess,re,datetime
|
||||
shell='set -eu\nbase=/data/git/gitea-repositories\nprintf \'repository_directory_count\\t\'\nfind "$base" -mindepth 2 -maxdepth 2 -type d -name \'*.git\' | wc -l\nfor name in access-engine approval-engine audit-core gate-house glas-harness key-cape kings-guard maturity-engine net-kingdom ops-mason ops-warden policy-nexus railiance-forge railiance-platform repo-manager role-engine secrets-engine security-canon tenant-engine the-custodian user-engine zone-engine; do\n repo="$base/coulomb/$name.git"\n if ! test -d "$repo"; then printf \'missing\\t%s\\n\' "$name"; continue; fi\n printf \'repo\\t%s\\n\' "$name"\n git --git-dir="$repo" config --get core.hooksPath || test "$?" = 1\n if test -n "$(find "$repo/hooks" -maxdepth 2 -type l -print -quit)"; then exit 77; fi\nfind "$repo/hooks" -maxdepth 2 -type f ! -name \'*.sample\' -exec sha256sum {} \\;\ndone\n'
|
||||
r=subprocess.run(["kubectl","-n","forgejo","exec","forgejo-gitea-7d94988c79-8k76l","-c","gitea","--","sh","-c",shell],capture_output=True,text=True,timeout=60)
|
||||
if r.returncode: raise SystemExit("Read-only hook inventory failed; raw diagnostics suppressed.")
|
||||
rows=[];current=None;count=None
|
||||
for line in r.stdout.splitlines():
|
||||
if line.startswith("repository_directory_count\t"): count=int(line.split("\t")[1])
|
||||
elif line.startswith("repo\t"):
|
||||
current={"repo":line.split("\t")[1],"hook_files":[],"core_hooks_path":"unset"};rows.append(current)
|
||||
elif line.startswith("missing\t"): rows.append({"repo":line.split("\t")[1],"missing":True})
|
||||
elif re.fullmatch(r"[0-9a-f]{64} /data/git/gitea-repositories/coulomb/[a-z0-9_.-]+/hooks/[a-zA-Z0-9_./-]+",line):
|
||||
digest,path=line.split(" ",1);current["hook_files"].append({"relative_path":path.split("/hooks/",1)[1],"sha256":digest})
|
||||
else: raise SystemExit("Unrecognized metadata suppressed; no inventory claim.")
|
||||
print(json.dumps({"observed_at":datetime.datetime.now(datetime.timezone.utc).isoformat(),"host":"railiance01","image":"code.forgejo.org/forgejo/forgejo:11.0.3-rootless","pod":"forgejo-gitea-7d94988c79-8k76l","repository_root":"/data/git/gitea-repositories","repository_directory_count":count,"repositories":rows,"scope":"Filesystem hook metadata for 22 reviewed repos only; directory count includes unmanaged/archived/wiki possibilities, not an admitted production denominator. Hashes do not establish scanner behavior or branch protection. No repository content, credentials, logs, database or remote mutation."},indent=2))
|
||||
|
|
@ -0,0 +1,901 @@
|
|||
{
|
||||
"observed_at": "2026-10-12T15:53:14.407749+00:00",
|
||||
"host": "railiance01",
|
||||
"image": "code.forgejo.org/forgejo/forgejo:11.0.3-rootless",
|
||||
"pod": "forgejo-gitea-7d94988c79-8k76l",
|
||||
"repository_root": "/data/git/gitea-repositories",
|
||||
"repository_directory_count": 165,
|
||||
"repositories": [
|
||||
{
|
||||
"repo": "access-engine",
|
||||
"hook_files": [
|
||||
{
|
||||
"relative_path": "proc-receive.d/gitea",
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive.d/gitea",
|
||||
"sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "proc-receive",
|
||||
"sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
|
||||
},
|
||||
{
|
||||
"relative_path": "update",
|
||||
"sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
|
||||
},
|
||||
{
|
||||
"relative_path": "update.d/gitea",
|
||||
"sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive.d/gitea",
|
||||
"sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
|
||||
}
|
||||
],
|
||||
"core_hooks_path": "unset"
|
||||
},
|
||||
{
|
||||
"repo": "approval-engine",
|
||||
"hook_files": [
|
||||
{
|
||||
"relative_path": "proc-receive.d/gitea",
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive.d/gitea",
|
||||
"sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "proc-receive",
|
||||
"sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
|
||||
},
|
||||
{
|
||||
"relative_path": "update",
|
||||
"sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
|
||||
},
|
||||
{
|
||||
"relative_path": "update.d/gitea",
|
||||
"sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive.d/gitea",
|
||||
"sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
|
||||
}
|
||||
],
|
||||
"core_hooks_path": "unset"
|
||||
},
|
||||
{
|
||||
"repo": "audit-core",
|
||||
"hook_files": [
|
||||
{
|
||||
"relative_path": "proc-receive.d/gitea",
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive.d/gitea",
|
||||
"sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "proc-receive",
|
||||
"sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
|
||||
},
|
||||
{
|
||||
"relative_path": "update",
|
||||
"sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
|
||||
},
|
||||
{
|
||||
"relative_path": "update.d/gitea",
|
||||
"sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive.d/gitea",
|
||||
"sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
|
||||
}
|
||||
],
|
||||
"core_hooks_path": "unset"
|
||||
},
|
||||
{
|
||||
"repo": "gate-house",
|
||||
"hook_files": [
|
||||
{
|
||||
"relative_path": "proc-receive.d/gitea",
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive.d/gitea",
|
||||
"sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "proc-receive",
|
||||
"sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
|
||||
},
|
||||
{
|
||||
"relative_path": "update",
|
||||
"sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
|
||||
},
|
||||
{
|
||||
"relative_path": "update.d/gitea",
|
||||
"sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive.d/gitea",
|
||||
"sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
|
||||
}
|
||||
],
|
||||
"core_hooks_path": "unset"
|
||||
},
|
||||
{
|
||||
"repo": "glas-harness",
|
||||
"hook_files": [
|
||||
{
|
||||
"relative_path": "proc-receive.d/gitea",
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive.d/gitea",
|
||||
"sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "proc-receive",
|
||||
"sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
|
||||
},
|
||||
{
|
||||
"relative_path": "update",
|
||||
"sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
|
||||
},
|
||||
{
|
||||
"relative_path": "update.d/gitea",
|
||||
"sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive.d/gitea",
|
||||
"sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
|
||||
}
|
||||
],
|
||||
"core_hooks_path": "unset"
|
||||
},
|
||||
{
|
||||
"repo": "key-cape",
|
||||
"hook_files": [
|
||||
{
|
||||
"relative_path": "proc-receive.d/gitea",
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive.d/gitea",
|
||||
"sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "proc-receive",
|
||||
"sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
|
||||
},
|
||||
{
|
||||
"relative_path": "update",
|
||||
"sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
|
||||
},
|
||||
{
|
||||
"relative_path": "update.d/gitea",
|
||||
"sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive.d/gitea",
|
||||
"sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
|
||||
}
|
||||
],
|
||||
"core_hooks_path": "unset"
|
||||
},
|
||||
{
|
||||
"repo": "kings-guard",
|
||||
"hook_files": [
|
||||
{
|
||||
"relative_path": "proc-receive.d/gitea",
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive.d/gitea",
|
||||
"sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "proc-receive",
|
||||
"sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
|
||||
},
|
||||
{
|
||||
"relative_path": "update",
|
||||
"sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
|
||||
},
|
||||
{
|
||||
"relative_path": "update.d/gitea",
|
||||
"sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive.d/gitea",
|
||||
"sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
|
||||
}
|
||||
],
|
||||
"core_hooks_path": "unset"
|
||||
},
|
||||
{
|
||||
"repo": "maturity-engine",
|
||||
"hook_files": [
|
||||
{
|
||||
"relative_path": "proc-receive.d/gitea",
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive.d/gitea",
|
||||
"sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "proc-receive",
|
||||
"sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
|
||||
},
|
||||
{
|
||||
"relative_path": "update",
|
||||
"sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
|
||||
},
|
||||
{
|
||||
"relative_path": "update.d/gitea",
|
||||
"sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive.d/gitea",
|
||||
"sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
|
||||
}
|
||||
],
|
||||
"core_hooks_path": "unset"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"hook_files": [
|
||||
{
|
||||
"relative_path": "proc-receive.d/gitea",
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive.d/gitea",
|
||||
"sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "proc-receive",
|
||||
"sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
|
||||
},
|
||||
{
|
||||
"relative_path": "update",
|
||||
"sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
|
||||
},
|
||||
{
|
||||
"relative_path": "update.d/gitea",
|
||||
"sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive.d/gitea",
|
||||
"sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
|
||||
}
|
||||
],
|
||||
"core_hooks_path": "unset"
|
||||
},
|
||||
{
|
||||
"repo": "ops-mason",
|
||||
"hook_files": [
|
||||
{
|
||||
"relative_path": "proc-receive.d/gitea",
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive.d/gitea",
|
||||
"sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "proc-receive",
|
||||
"sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
|
||||
},
|
||||
{
|
||||
"relative_path": "update",
|
||||
"sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
|
||||
},
|
||||
{
|
||||
"relative_path": "update.d/gitea",
|
||||
"sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive.d/gitea",
|
||||
"sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
|
||||
}
|
||||
],
|
||||
"core_hooks_path": "unset"
|
||||
},
|
||||
{
|
||||
"repo": "ops-warden",
|
||||
"hook_files": [
|
||||
{
|
||||
"relative_path": "proc-receive.d/gitea",
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive.d/gitea",
|
||||
"sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "proc-receive",
|
||||
"sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
|
||||
},
|
||||
{
|
||||
"relative_path": "update",
|
||||
"sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
|
||||
},
|
||||
{
|
||||
"relative_path": "update.d/gitea",
|
||||
"sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive.d/gitea",
|
||||
"sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
|
||||
}
|
||||
],
|
||||
"core_hooks_path": "unset"
|
||||
},
|
||||
{
|
||||
"repo": "policy-nexus",
|
||||
"hook_files": [
|
||||
{
|
||||
"relative_path": "proc-receive.d/gitea",
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive.d/gitea",
|
||||
"sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "proc-receive",
|
||||
"sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
|
||||
},
|
||||
{
|
||||
"relative_path": "update",
|
||||
"sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
|
||||
},
|
||||
{
|
||||
"relative_path": "update.d/gitea",
|
||||
"sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive.d/gitea",
|
||||
"sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
|
||||
}
|
||||
],
|
||||
"core_hooks_path": "unset"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-forge",
|
||||
"hook_files": [
|
||||
{
|
||||
"relative_path": "proc-receive.d/gitea",
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive.d/gitea",
|
||||
"sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "proc-receive",
|
||||
"sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
|
||||
},
|
||||
{
|
||||
"relative_path": "update",
|
||||
"sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
|
||||
},
|
||||
{
|
||||
"relative_path": "update.d/gitea",
|
||||
"sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive.d/gitea",
|
||||
"sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
|
||||
}
|
||||
],
|
||||
"core_hooks_path": "unset"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"hook_files": [
|
||||
{
|
||||
"relative_path": "proc-receive.d/gitea",
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive.d/gitea",
|
||||
"sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "proc-receive",
|
||||
"sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
|
||||
},
|
||||
{
|
||||
"relative_path": "update",
|
||||
"sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
|
||||
},
|
||||
{
|
||||
"relative_path": "update.d/gitea",
|
||||
"sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive.d/gitea",
|
||||
"sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
|
||||
}
|
||||
],
|
||||
"core_hooks_path": "unset"
|
||||
},
|
||||
{
|
||||
"repo": "repo-manager",
|
||||
"hook_files": [
|
||||
{
|
||||
"relative_path": "proc-receive.d/gitea",
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive.d/gitea",
|
||||
"sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "proc-receive",
|
||||
"sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
|
||||
},
|
||||
{
|
||||
"relative_path": "update",
|
||||
"sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
|
||||
},
|
||||
{
|
||||
"relative_path": "update.d/gitea",
|
||||
"sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive.d/gitea",
|
||||
"sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
|
||||
}
|
||||
],
|
||||
"core_hooks_path": "unset"
|
||||
},
|
||||
{
|
||||
"repo": "role-engine",
|
||||
"hook_files": [
|
||||
{
|
||||
"relative_path": "proc-receive.d/gitea",
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive.d/gitea",
|
||||
"sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "proc-receive",
|
||||
"sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
|
||||
},
|
||||
{
|
||||
"relative_path": "update",
|
||||
"sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
|
||||
},
|
||||
{
|
||||
"relative_path": "update.d/gitea",
|
||||
"sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive.d/gitea",
|
||||
"sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
|
||||
}
|
||||
],
|
||||
"core_hooks_path": "unset"
|
||||
},
|
||||
{
|
||||
"repo": "secrets-engine",
|
||||
"hook_files": [
|
||||
{
|
||||
"relative_path": "proc-receive.d/gitea",
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive.d/gitea",
|
||||
"sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "proc-receive",
|
||||
"sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
|
||||
},
|
||||
{
|
||||
"relative_path": "update",
|
||||
"sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
|
||||
},
|
||||
{
|
||||
"relative_path": "update.d/gitea",
|
||||
"sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive.d/gitea",
|
||||
"sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
|
||||
}
|
||||
],
|
||||
"core_hooks_path": "unset"
|
||||
},
|
||||
{
|
||||
"repo": "security-canon",
|
||||
"hook_files": [
|
||||
{
|
||||
"relative_path": "proc-receive.d/gitea",
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive.d/gitea",
|
||||
"sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "proc-receive",
|
||||
"sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
|
||||
},
|
||||
{
|
||||
"relative_path": "update",
|
||||
"sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
|
||||
},
|
||||
{
|
||||
"relative_path": "update.d/gitea",
|
||||
"sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive.d/gitea",
|
||||
"sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
|
||||
}
|
||||
],
|
||||
"core_hooks_path": "unset"
|
||||
},
|
||||
{
|
||||
"repo": "tenant-engine",
|
||||
"hook_files": [
|
||||
{
|
||||
"relative_path": "proc-receive.d/gitea",
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive.d/gitea",
|
||||
"sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "proc-receive",
|
||||
"sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
|
||||
},
|
||||
{
|
||||
"relative_path": "update",
|
||||
"sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
|
||||
},
|
||||
{
|
||||
"relative_path": "update.d/gitea",
|
||||
"sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive.d/gitea",
|
||||
"sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
|
||||
}
|
||||
],
|
||||
"core_hooks_path": "unset"
|
||||
},
|
||||
{
|
||||
"repo": "the-custodian",
|
||||
"hook_files": [
|
||||
{
|
||||
"relative_path": "proc-receive.d/gitea",
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive.d/gitea",
|
||||
"sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "proc-receive",
|
||||
"sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
|
||||
},
|
||||
{
|
||||
"relative_path": "update",
|
||||
"sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
|
||||
},
|
||||
{
|
||||
"relative_path": "update.d/gitea",
|
||||
"sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive.d/gitea",
|
||||
"sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
|
||||
}
|
||||
],
|
||||
"core_hooks_path": "unset"
|
||||
},
|
||||
{
|
||||
"repo": "user-engine",
|
||||
"hook_files": [
|
||||
{
|
||||
"relative_path": "proc-receive.d/gitea",
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive.d/gitea",
|
||||
"sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "proc-receive",
|
||||
"sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
|
||||
},
|
||||
{
|
||||
"relative_path": "update",
|
||||
"sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
|
||||
},
|
||||
{
|
||||
"relative_path": "update.d/gitea",
|
||||
"sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive.d/gitea",
|
||||
"sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
|
||||
}
|
||||
],
|
||||
"core_hooks_path": "unset"
|
||||
},
|
||||
{
|
||||
"repo": "zone-engine",
|
||||
"hook_files": [
|
||||
{
|
||||
"relative_path": "proc-receive.d/gitea",
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive.d/gitea",
|
||||
"sha256": "a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "proc-receive",
|
||||
"sha256": "ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748"
|
||||
},
|
||||
{
|
||||
"relative_path": "update",
|
||||
"sha256": "a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6"
|
||||
},
|
||||
{
|
||||
"relative_path": "update.d/gitea",
|
||||
"sha256": "d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f"
|
||||
},
|
||||
{
|
||||
"relative_path": "post-receive",
|
||||
"sha256": "38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef"
|
||||
},
|
||||
{
|
||||
"relative_path": "pre-receive.d/gitea",
|
||||
"sha256": "2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc"
|
||||
}
|
||||
],
|
||||
"core_hooks_path": "unset"
|
||||
}
|
||||
],
|
||||
"scope": "Filesystem hook metadata for 22 reviewed repos only; directory count includes unmanaged/archived/wiki possibilities, not an admitted production denominator. Hashes do not establish scanner behavior or branch protection. No repository content, credentials, logs, database or remote mutation.",
|
||||
"template_comparison": {
|
||||
"source_url": "https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/modules/repository/hooks.go",
|
||||
"source_sha256": "c7d149a66c2e1170e50b6f6bd9fd1c96cbfab68dfed3e664d503bfb05e4e1348",
|
||||
"matches_by_sha256": {
|
||||
"38f2197d49b27f315e3487664802e56bc888d4afaec9e30b3bcc6bd461554aef": {
|
||||
"template_index": 2,
|
||||
"shell": "bash",
|
||||
"executable": null,
|
||||
"config_path": null,
|
||||
"quoted": true
|
||||
},
|
||||
"a53caf562b0cdd47b08d20c27c63059ba41cd410c3264a61cda1a531f1810ae6": {
|
||||
"template_index": 1,
|
||||
"shell": "bash",
|
||||
"executable": null,
|
||||
"config_path": null,
|
||||
"quoted": true
|
||||
},
|
||||
"2572c08b2aa9ec9db475f03e6ed43bf64d18f64f9a2364c5341ad277e31149fc": {
|
||||
"template_index": 3,
|
||||
"shell": "bash",
|
||||
"executable": "/usr/local/bin/gitea",
|
||||
"config_path": "/data/gitea/conf/app.ini",
|
||||
"quoted": false
|
||||
},
|
||||
"d32f9f382dc1511c93e9e2ce61a60c068ac83a933376368b474faad1399be79f": {
|
||||
"template_index": 4,
|
||||
"shell": "bash",
|
||||
"executable": "/usr/local/bin/gitea",
|
||||
"config_path": "/data/gitea/conf/app.ini",
|
||||
"quoted": false
|
||||
},
|
||||
"a3a87fd152133783f14859bfa738eb3fcc38d3090147ad8df81724ed62fa97a5": {
|
||||
"template_index": 5,
|
||||
"shell": "bash",
|
||||
"executable": "/usr/local/bin/gitea",
|
||||
"config_path": "/data/gitea/conf/app.ini",
|
||||
"quoted": false
|
||||
},
|
||||
"ca4eb127414b2c85164b9366a3311218ed7b5a2f6cac93c2d654da97e1ba4748": {
|
||||
"template_index": 6,
|
||||
"shell": "bash",
|
||||
"executable": "/usr/local/bin/gitea",
|
||||
"config_path": "/data/gitea/conf/app.ini",
|
||||
"quoted": false
|
||||
},
|
||||
"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855": {
|
||||
"template": "empty proc-receive.d/gitea"
|
||||
}
|
||||
},
|
||||
"result": "All seven unique hook hashes match upstream generated templates for bash, /usr/local/bin/gitea and /data/gitea/conf/app.ini; 22 hook directories contain only the eight observed standard files, with no symlinks at the inspected depth. No custom scanner hook is installed at this boundary. Forge internal policies and Actions/branch-protection checks were not assessed."
|
||||
},
|
||||
"observer_sha256": "db2bdb37794a427a9b9543ecb9a3b35d5310c77417e6edb6da726ad87992237d",
|
||||
"next_action": "Define admitted production repository inventory and owner-controlled introduced-history prevention, preserving Forgejo hooks. Verify SSH/HTTP/merge paths and CI authority separately; do not enable arbitrary user Git-hook editing or replace the generated dispatchers."
|
||||
}
|
||||
|
|
@ -103,6 +103,14 @@ acceptance remain open. [Activation receipt](evidence/2026-10-12-netkingdom-secu
|
|||
All four DSM-DETECT requirements now have incomplete assessments rather than
|
||||
unverified placeholders. [Receipt and exact hook inventory](evidence/2026-10-12-netkingdom-security/secret-detection.json).
|
||||
|
||||
G07 server baseline: the 22 reviewed repositories on railiance01 have only
|
||||
upstream-generated receive hooks, verified by matching all observed hashes to
|
||||
[Forgejo v11.0.3 templates](https://codeberg.org/forgejo/forgejo/src/tag/v11.0.3/modules/repository/hooks.go).
|
||||
No custom scanner hook is installed at that boundary. The 165 repository
|
||||
directories are a discovery count, not a reviewed production denominator.
|
||||
Actions/branch-protection and actual push refusal are still unverified.
|
||||
[Read-only inventory](evidence/2026-10-12-netkingdom-security/forge-secret-detection-baseline.json).
|
||||
|
||||
## SEC DSM requirement coverage
|
||||
|
||||
Each numbered requirement in these families is in scope for assessment. The
|
||||
|
|
|
|||
|
|
@ -163,6 +163,16 @@ exact proposal, backups and rollback: `docs/changes/CUST-WP-0080/`. Independent
|
|||
forge/CI enforcement, other clones/history and detection-to-response remain open.
|
||||
No DSM requirement or whole G07 closure is inferred from this local acceptance.
|
||||
|
||||
2026-10-12 G07 forge baseline: read-only observation confirmed railiance01 and
|
||||
Forgejo 11.0.3. Its repository storage has 165 repository directories (not yet an
|
||||
admitted production denominator). All 22 reviewed repositories exist and their
|
||||
receive-hook files exactly match the seven distinct hashes generated by upstream
|
||||
v11.0.3 templates, with no extra hook files/symlinks at the inspected depth.
|
||||
No custom scanner hook is installed there. Branch-protection/Actions coverage,
|
||||
internal policies and actual push rejection remain unverified. Metadata and
|
||||
upstream comparison: `forge-secret-detection-baseline.json`. No server mutation,
|
||||
credential read, repository-content scan or synthetic push was performed.
|
||||
|
||||
## Verify native closure against every requirement
|
||||
|
||||
```task
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue