coulomb/the-custodian
5
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

security: establish native Forgejo receive-hook baseline
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Reject generated-only commits / generated-commit-guard (push) Successful in 7s
Details

Browse source
This commit is contained in:
codex 2026-10-12 18:15:56 +02:00
parent 355b6b9720
commit 6502bfe4d8
4 changed files with 933 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

14
docs/changes/CUST-WP-0080/observe_forge_hooks.py Normal file
View file

@ -0,0 +1,14 @@
import json,subprocess,re,datetime
shell='set -eu\nbase=/data/git/gitea-repositories\nprintf \'repository_directory_count\\t\'\nfind "$base" -mindepth 2 -maxdepth 2 -type d -name \'*.git\' | wc -l\nfor name in access-engine approval-engine audit-core gate-house glas-harness key-cape kings-guard maturity-engine net-kingdom ops-mason ops-warden policy-nexus railiance-forge railiance-platform repo-manager role-engine secrets-engine security-canon tenant-engine the-custodian user-engine zone-engine; do\n repo="$base/coulomb/$name.git"\n if ! test -d "$repo"; then printf \'missing\\t%s\\n\' "$name"; continue; fi\n printf \'repo\\t%s\\n\' "$name"\n git --git-dir="$repo" config --get core.hooksPath || test "$?" = 1\n if test -n "$(find "$repo/hooks" -maxdepth 2 -type l -print -quit)"; then exit 77; fi\nfind "$repo/hooks" -maxdepth 2 -type f ! -name \'*.sample\' -exec sha256sum {} \\;\ndone\n'
r=subprocess.run(["kubectl","-n","forgejo","exec","forgejo-gitea-7d94988c79-8k76l","-c","gitea","--","sh","-c",shell],capture_output=True,text=True,timeout=60)
if r.returncode: raise SystemExit("Read-only hook inventory failed; raw diagnostics suppressed.")
rows=[];current=None;count=None
for line in r.stdout.splitlines():
if line.startswith("repository_directory_count\t"): count=int(line.split("\t")[1])
elif line.startswith("repo\t"):
current={"repo":line.split("\t")[1],"hook_files":[],"core_hooks_path":"unset"};rows.append(current)
elif line.startswith("missing\t"): rows.append({"repo":line.split("\t")[1],"missing":True})
elif re.fullmatch(r"[0-9a-f]{64} /data/git/gitea-repositories/coulomb/[a-z0-9_.-]+/hooks/[a-zA-Z0-9_./-]+",line):
digest,path=line.split(" ",1);current["hook_files"].append({"relative_path":path.split("/hooks/",1)[1],"sha256":digest})
else: raise SystemExit("Unrecognized metadata suppressed; no inventory claim.")
print(json.dumps({"observed_at":datetime.datetime.now(datetime.timezone.utc).isoformat(),"host":"railiance01","image":"code.forgejo.org/forgejo/forgejo:11.0.3-rootless","pod":"forgejo-gitea-7d94988c79-8k76l","repository_root":"/data/git/gitea-repositories","repository_directory_count":count,"repositories":rows,"scope":"Filesystem hook metadata for 22 reviewed repos only; directory count includes unmanaged/archived/wiki possibilities, not an admitted production denominator. Hashes do not establish scanner behavior or branch protection. No repository content, credentials, logs, database or remote mutation."},indent=2))