security: record introduced-history scanner proof and native admission gates
This commit is contained in:
codex
parent
e5ebbdba5b
commit
78081dabf2
7 changed files with 259 additions and 11 deletions
|
|
@ -0,0 +1,146 @@
|
|||
{
|
||||
"assessed_at": "2026-10-12T16:39:28.319476+00:00",
|
||||
"scope": "Forge-owned source adapter and disposable actual Git receive-pack protocol; no production installation or whole DSM/G07 closure",
|
||||
"owner_workplan": "FORGE-WP-0006",
|
||||
"coordinator": "RMGR-WP-0021-T03 / CUST-WP-0080-T03",
|
||||
"source_manifest": [
|
||||
{
|
||||
"path": "/home/worsch/railiance-forge/Makefile",
|
||||
"sha256": "03e690bf8c6c6375aa9f099eaa2789ceb42153d9942dbded86dd405fc2e1754e",
|
||||
"prior_sha256": "6a9cea7fd0b5991da3d5a081245f4e0f7def50a3c4e92037cd68369be55c3356"
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/railiance-forge/tools/receive-secret-scan/go.mod",
|
||||
"sha256": "0dc9f91da4769328bb72c1ea73dfa6ac9dd3db72f3840a2cef3874c8d69dca3f",
|
||||
"prior_sha256": null
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/railiance-forge/tools/receive-secret-scan/main.go",
|
||||
"sha256": "5eee28fbe830ebec7abbdfc93275c34d126f92d1b144df93e72aec0dfb821bc6",
|
||||
"prior_sha256": null
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/railiance-forge/tools/receive-secret-scan/main_test.go",
|
||||
"sha256": "306dfd8ff06ccb22cb5e7f38894725eb3900b81645d8b922a340e8ab239ffee5",
|
||||
"prior_sha256": null
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/railiance-forge/docs/receive-secret-detection.md",
|
||||
"sha256": "50dd97e80f437de04232f977cd362d8bade89c33a3fc270164e74de7e3d65478",
|
||||
"prior_sha256": null
|
||||
},
|
||||
{
|
||||
"path": "/home/worsch/railiance-forge/workplans/FORGE-WP-0006-independent-secret-detection.md",
|
||||
"sha256": "9747930fafdfc7779bb839d004911e9b4e35f92ccc4e2bdb8c7e2860023f39e5",
|
||||
"prior_sha256": null
|
||||
}
|
||||
],
|
||||
"source_install_manifest_sha256": "8f011d82310704f8624f50a7bb452a61376bfdce809e60a03d07aca581b2f376",
|
||||
"source_install_authorization": "Exact guarded sibling-source installer approved through filesystem permission flow; no server mutation or expanded credential authority.",
|
||||
"toolchain": {
|
||||
"version": "go1.26.9",
|
||||
"source": "https://go.dev/dl/go1.26.9.linux-amd64.tar.gz",
|
||||
"sha256": "42d158b4d8f7b61ac0a830567c940a86098fb7aac52e467a5ebec03ef5cc2f8d",
|
||||
"verification": "Compared official go.dev release JSON SHA256; no detached signature claim."
|
||||
},
|
||||
"scanner": {
|
||||
"version": "8.30.1",
|
||||
"sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509",
|
||||
"admission_ref": "secret-hook-activation-record.json"
|
||||
},
|
||||
"candidate_binary": {
|
||||
"sha256": "57a0642b625105440fe146fceb4d244fd2dd08a75beb316831675643e6cc27ec",
|
||||
"build": "CGO_ENABLED=0 GOTOOLCHAIN=local GOOS=linux GOARCH=amd64 go1.26.9 build -trimpath -buildvcs=false",
|
||||
"format": "statically linked Linux amd64 ELF",
|
||||
"native_deployment_admitted": false,
|
||||
"note": "Protocol tests compile the same source without trimpath; this release candidate still requires exact-binary native admission."
|
||||
},
|
||||
"tests": {
|
||||
"leaf_cases": [
|
||||
"TestUpdateInputRefusesAmbiguity",
|
||||
"TestTreeRefusesMalformedAndExternalEntries",
|
||||
"TestGitEnvironmentDoesNotInheritConfigOrSecrets",
|
||||
"TestCappedOutput",
|
||||
"TestNativePushBoundaries/clean-existing-and-new-branch-and-deletion",
|
||||
"TestNativePushBoundaries/initial-repository-clean-and-secret/false",
|
||||
"TestNativePushBoundaries/initial-repository-clean-and-secret/true",
|
||||
"TestNativePushBoundaries/sha256-object-format",
|
||||
"TestNativePushBoundaries/secret-in-tip",
|
||||
"TestNativePushBoundaries/secret-added-then-deleted",
|
||||
"TestNativePushBoundaries/new-branch-and-force-update",
|
||||
"TestNativePushBoundaries/merge-second-parent-history",
|
||||
"TestNativePushBoundaries/commit-message",
|
||||
"TestNativePushBoundaries/annotated-tag-message",
|
||||
"TestNativePushBoundaries/tag-direct-to-blob",
|
||||
"TestNativePushBoundaries/multi-ref-all-refused",
|
||||
"TestNativePushBoundaries/missing-scanner-and-deletion-refused",
|
||||
"TestNativePushBoundaries/wrong-executable-refused",
|
||||
"TestNativePushBoundaries/inline-and-config-suppression-refused",
|
||||
"TestNativePushBoundaries/replacement-objects-cannot-hide-secret",
|
||||
"TestNativePushBoundaries/grafts-cannot-hide-introduced-history",
|
||||
"TestNativePushBoundaries/ref-name-token",
|
||||
"TestNativePushBoundaries/partial-config-include-refused",
|
||||
"TestNativePushBoundaries/object-count-limit-refused",
|
||||
"TestNativePushBoundaries/external-gitlink-refused",
|
||||
"TestNativePushBoundaries/partial-repository-refused",
|
||||
"TestNativePushBoundaries/aggregate-byte-limit-refused",
|
||||
"TestNativePushBoundaries/oversized-object-refused",
|
||||
"TestScannerFileAndTimeoutRefusal/nonexecutable",
|
||||
"TestScannerFileAndTimeoutRefusal/symlink",
|
||||
"TestScannerFileAndTimeoutRefusal/expired-context",
|
||||
"TestScannerFileAndTimeoutRefusal/scanner-process-failure",
|
||||
"TestScannerFileAndTimeoutRefusal/unknown-old-ref"
|
||||
],
|
||||
"passed_leaf_cases": 33,
|
||||
"passing_test_nodes": 36,
|
||||
"skipped": 0,
|
||||
"failed": 0,
|
||||
"actual_owner_make_target": "make test-secret-detection passed in 54.403s with explicit pinned scanner and Go1.26.9",
|
||||
"existing_owner_python_suite": "1 passed",
|
||||
"logs": [
|
||||
"receive-secret-tests.txt",
|
||||
"receive-secret-owner-tests.txt"
|
||||
]
|
||||
},
|
||||
"retained_failed_attempts": [
|
||||
{
|
||||
"log_sha256": "c3edba915bbdc35c2558d0c076fc9b08c823c5a197720d2259046f1ade54d076",
|
||||
"outcome": "Test binary build failed because invalid parent /tmp/.git prevented Go VCS stamping; disposable build made explicit with -buildvcs=false."
|
||||
},
|
||||
{
|
||||
"log_sha256": "d6cf7c3643ca6a0babeab0b478368a908d66e26a7d87fa3cbe8f48ad7c873800",
|
||||
"outcome": "Unsupported --no-use-bitmap-index caused unverified refusals. Removed unsupported option and required each negative push test to assert blocked versus unverified; unrelated failures are not successful detection proof."
|
||||
}
|
||||
],
|
||||
"refinement": "Preflight all object sizes and aggregate bytes before scanner payload work; aggregate-limit test requires zero scanned objects.",
|
||||
"remaining": [
|
||||
"Admit production repository denominator, including archives/mirrors/wikis/new repositories.",
|
||||
"Review exact tool/adapter custody, resource limits, dispatch composition, abort owner and rollback.",
|
||||
"Verify exact artifact in deployed image and installed SSH/HTTP/frontend merge/edit/import paths.",
|
||||
"Verify hook regeneration/restarts/new-repository lifecycle.",
|
||||
"Independently verify CI writers/required checks and private detection-to-response.",
|
||||
"Historical reachable objects, unreachable extra pack objects, LFS, artifacts, runtime/log detection remain separate coverage."
|
||||
],
|
||||
"no_live_forge_mutation": true,
|
||||
"no_live_credential_handling": true,
|
||||
"owner_source_commit": "6d5c9e2",
|
||||
"owner_identifier_commit": "d805b00",
|
||||
"coordinator_handoff_commit": "847786e",
|
||||
"owner_workplan_id": "69458fdc-d727-5391-b88b-d03da0afe24e",
|
||||
"owner_task_readback": [
|
||||
{
|
||||
"id": "cd81bc07-e3b9-55f4-bafd-e78d271497ee",
|
||||
"status": "done"
|
||||
},
|
||||
{
|
||||
"id": "210e7935-944a-5720-b356-18b48a68aa5e",
|
||||
"status": "todo"
|
||||
},
|
||||
{
|
||||
"id": "e65f9093-f615-5af9-a2c0-21e17ff35dcf",
|
||||
"status": "todo"
|
||||
}
|
||||
],
|
||||
"post_sync_workplan_sha256": "8ef5c82456fa6b6cae95f7b7c7c8731a2affa57626d3242000693fea995c5440",
|
||||
"sync_note": "Required forge consistency sync indexed new workplan/tasks. Generated-only working-memory auto-commit was refused by existing guard; source task identifiers committed separately. Generated brief/index changes remain local."
|
||||
}
|
||||
|
|
@ -0,0 +1,2 @@
|
|||
cd tools/receive-secret-scan && go test -count=1 ./...
|
||||
ok railiance-forge/receive-secret-scan 54.403s
|
||||
|
|
@ -0,0 +1,74 @@
|
|||
=== RUN TestUpdateInputRefusesAmbiguity
|
||||
--- PASS: TestUpdateInputRefusesAmbiguity (0.00s)
|
||||
=== RUN TestTreeRefusesMalformedAndExternalEntries
|
||||
--- PASS: TestTreeRefusesMalformedAndExternalEntries (0.00s)
|
||||
=== RUN TestGitEnvironmentDoesNotInheritConfigOrSecrets
|
||||
--- PASS: TestGitEnvironmentDoesNotInheritConfigOrSecrets (0.00s)
|
||||
=== RUN TestCappedOutput
|
||||
--- PASS: TestCappedOutput (0.00s)
|
||||
=== RUN TestNativePushBoundaries
|
||||
=== RUN TestNativePushBoundaries/clean-existing-and-new-branch-and-deletion
|
||||
=== RUN TestNativePushBoundaries/initial-repository-clean-and-secret
|
||||
=== RUN TestNativePushBoundaries/initial-repository-clean-and-secret/false
|
||||
=== RUN TestNativePushBoundaries/initial-repository-clean-and-secret/true
|
||||
=== RUN TestNativePushBoundaries/sha256-object-format
|
||||
=== RUN TestNativePushBoundaries/secret-in-tip
|
||||
=== RUN TestNativePushBoundaries/secret-added-then-deleted
|
||||
=== RUN TestNativePushBoundaries/new-branch-and-force-update
|
||||
=== RUN TestNativePushBoundaries/merge-second-parent-history
|
||||
=== RUN TestNativePushBoundaries/commit-message
|
||||
=== RUN TestNativePushBoundaries/annotated-tag-message
|
||||
=== RUN TestNativePushBoundaries/tag-direct-to-blob
|
||||
=== RUN TestNativePushBoundaries/multi-ref-all-refused
|
||||
=== RUN TestNativePushBoundaries/missing-scanner-and-deletion-refused
|
||||
=== RUN TestNativePushBoundaries/wrong-executable-refused
|
||||
=== RUN TestNativePushBoundaries/inline-and-config-suppression-refused
|
||||
=== RUN TestNativePushBoundaries/replacement-objects-cannot-hide-secret
|
||||
=== RUN TestNativePushBoundaries/grafts-cannot-hide-introduced-history
|
||||
=== RUN TestNativePushBoundaries/ref-name-token
|
||||
=== RUN TestNativePushBoundaries/partial-config-include-refused
|
||||
=== RUN TestNativePushBoundaries/object-count-limit-refused
|
||||
=== RUN TestNativePushBoundaries/external-gitlink-refused
|
||||
=== RUN TestNativePushBoundaries/partial-repository-refused
|
||||
=== RUN TestNativePushBoundaries/aggregate-byte-limit-refused
|
||||
=== RUN TestNativePushBoundaries/oversized-object-refused
|
||||
--- PASS: TestNativePushBoundaries (112.32s)
|
||||
--- PASS: TestNativePushBoundaries/clean-existing-and-new-branch-and-deletion (5.41s)
|
||||
--- PASS: TestNativePushBoundaries/initial-repository-clean-and-secret (7.07s)
|
||||
--- PASS: TestNativePushBoundaries/initial-repository-clean-and-secret/false (3.53s)
|
||||
--- PASS: TestNativePushBoundaries/initial-repository-clean-and-secret/true (3.54s)
|
||||
--- PASS: TestNativePushBoundaries/sha256-object-format (7.37s)
|
||||
--- PASS: TestNativePushBoundaries/secret-in-tip (4.00s)
|
||||
--- PASS: TestNativePushBoundaries/secret-added-then-deleted (3.75s)
|
||||
--- PASS: TestNativePushBoundaries/new-branch-and-force-update (8.24s)
|
||||
--- PASS: TestNativePushBoundaries/merge-second-parent-history (8.75s)
|
||||
--- PASS: TestNativePushBoundaries/commit-message (2.05s)
|
||||
--- PASS: TestNativePushBoundaries/annotated-tag-message (2.27s)
|
||||
--- PASS: TestNativePushBoundaries/tag-direct-to-blob (2.42s)
|
||||
--- PASS: TestNativePushBoundaries/multi-ref-all-refused (4.55s)
|
||||
--- PASS: TestNativePushBoundaries/missing-scanner-and-deletion-refused (0.32s)
|
||||
--- PASS: TestNativePushBoundaries/wrong-executable-refused (0.29s)
|
||||
--- PASS: TestNativePushBoundaries/inline-and-config-suppression-refused (6.95s)
|
||||
--- PASS: TestNativePushBoundaries/replacement-objects-cannot-hide-secret (2.25s)
|
||||
--- PASS: TestNativePushBoundaries/grafts-cannot-hide-introduced-history (14.53s)
|
||||
--- PASS: TestNativePushBoundaries/ref-name-token (6.01s)
|
||||
--- PASS: TestNativePushBoundaries/partial-config-include-refused (0.79s)
|
||||
--- PASS: TestNativePushBoundaries/object-count-limit-refused (6.71s)
|
||||
--- PASS: TestNativePushBoundaries/external-gitlink-refused (5.30s)
|
||||
--- PASS: TestNativePushBoundaries/partial-repository-refused (0.49s)
|
||||
--- PASS: TestNativePushBoundaries/aggregate-byte-limit-refused (11.41s)
|
||||
--- PASS: TestNativePushBoundaries/oversized-object-refused (0.87s)
|
||||
=== RUN TestScannerFileAndTimeoutRefusal
|
||||
=== RUN TestScannerFileAndTimeoutRefusal/nonexecutable
|
||||
=== RUN TestScannerFileAndTimeoutRefusal/symlink
|
||||
=== RUN TestScannerFileAndTimeoutRefusal/expired-context
|
||||
=== RUN TestScannerFileAndTimeoutRefusal/scanner-process-failure
|
||||
=== RUN TestScannerFileAndTimeoutRefusal/unknown-old-ref
|
||||
--- PASS: TestScannerFileAndTimeoutRefusal (2.44s)
|
||||
--- PASS: TestScannerFileAndTimeoutRefusal/nonexecutable (0.19s)
|
||||
--- PASS: TestScannerFileAndTimeoutRefusal/symlink (0.01s)
|
||||
--- PASS: TestScannerFileAndTimeoutRefusal/expired-context (0.05s)
|
||||
--- PASS: TestScannerFileAndTimeoutRefusal/scanner-process-failure (0.84s)
|
||||
--- PASS: TestScannerFileAndTimeoutRefusal/unknown-old-ref (0.05s)
|
||||
PASS
|
||||
ok railiance-forge/receive-secret-scan 114.784s
|
||||
|
|
@ -841,12 +841,13 @@
|
|||
"closure_evidence": [],
|
||||
"assessment": {
|
||||
"scope": "Repo Manager scanner adapter and reviewed workstation hook wiring; no estate-wide conformance inferred",
|
||||
"observed": "Inherited generated-only hook allowed a synthetic private-key commit. New pinned scanner adapter detects that fixture in complete changed staged blobs with real-scanner tests. Actual configured hooks now enforce the pinned scanner on 22 exact workstation roots: clean accepted, disposable private key rejected, generated-only guard retained, unavailable scanner refused. Temporary alternate indexes/object stores preserved user state; unreviewed checkout behavior and routing stayed unchanged.",
|
||||
"observed": "Inherited generated-only hook allowed a synthetic private-key commit. New pinned scanner adapter detects that fixture in complete changed staged blobs with real-scanner tests. Actual configured hooks now enforce the pinned scanner on 22 exact workstation roots: clean accepted, disposable private key rejected, generated-only guard retained, unavailable scanner refused. Temporary alternate indexes/object stores preserved user state; unreviewed checkout behavior and routing stayed unchanged. Forge-owned introduced-history adapter now passes 33 source/protocol leaf cases with actual disposable pushes; exact-binary native activation remains unverified.",
|
||||
"remaining": "Production repository denominator, other workstation clones, independent automation coverage and historical/runtime findings remain unverified.",
|
||||
"owner_task": "RMGR-WP-0021-T01/T02/T03/T04; CUST-WP-0080-T03",
|
||||
"owner_task": "RMGR-WP-0021-T01/T02/T03/T04; CUST-WP-0080-T03; FORGE-WP-0006-T02/T03",
|
||||
"verification_evidence": [
|
||||
"secret-detection.json",
|
||||
"secret-hook-activation.json"
|
||||
"secret-hook-activation.json",
|
||||
"receive-secret-detection.json"
|
||||
],
|
||||
"assessed_at": "2026-10-12"
|
||||
}
|
||||
|
|
@ -865,12 +866,13 @@
|
|||
"closure_evidence": [],
|
||||
"assessment": {
|
||||
"scope": "Repo Manager scanner adapter and reviewed workstation hook wiring; no estate-wide conformance inferred",
|
||||
"observed": "Verified local hook wiring in 21 review repositories plus Custodian; source adapter covers changed Git index blobs only. Actual configured hooks now enforce the pinned scanner on 22 exact workstation roots: clean accepted, disposable private key rejected, generated-only guard retained, unavailable scanner refused. Temporary alternate indexes/object stores preserved user state; unreviewed checkout behavior and routing stayed unchanged.",
|
||||
"observed": "Verified local hook wiring in 21 review repositories plus Custodian; source adapter covers changed Git index blobs only. Actual configured hooks now enforce the pinned scanner on 22 exact workstation roots: clean accepted, disposable private key rejected, generated-only guard retained, unavailable scanner refused. Temporary alternate indexes/object stores preserved user state; unreviewed checkout behavior and routing stayed unchanged. Forge-owned introduced-history adapter now passes 33 source/protocol leaf cases with actual disposable pushes; exact-binary native activation remains unverified.",
|
||||
"remaining": "Push/server/CI controls, logs/artifacts/runtime detection and independent boundary coverage remain unverified.",
|
||||
"owner_task": "RMGR-WP-0021-T01/T02/T03/T04; CUST-WP-0080-T03",
|
||||
"owner_task": "RMGR-WP-0021-T01/T02/T03/T04; CUST-WP-0080-T03; FORGE-WP-0006-T02/T03",
|
||||
"verification_evidence": [
|
||||
"secret-detection.json",
|
||||
"secret-hook-activation.json"
|
||||
"secret-hook-activation.json",
|
||||
"receive-secret-detection.json"
|
||||
],
|
||||
"assessed_at": "2026-10-12"
|
||||
}
|
||||
|
|
@ -889,12 +891,13 @@
|
|||
"closure_evidence": [],
|
||||
"assessment": {
|
||||
"scope": "Repo Manager scanner adapter and reviewed workstation hook wiring; no estate-wide conformance inferred",
|
||||
"observed": "A disposable secret commit succeeds through the inherited hook and is rejected through the candidate scanner hook; git commit --only and partial/alternate-index cases are tested. Actual configured hooks now enforce the pinned scanner on 22 exact workstation roots: clean accepted, disposable private key rejected, generated-only guard retained, unavailable scanner refused. Temporary alternate indexes/object stores preserved user state; unreviewed checkout behavior and routing stayed unchanged.",
|
||||
"observed": "A disposable secret commit succeeds through the inherited hook and is rejected through the candidate scanner hook; git commit --only and partial/alternate-index cases are tested. Actual configured hooks now enforce the pinned scanner on 22 exact workstation roots: clean accepted, disposable private key rejected, generated-only guard retained, unavailable scanner refused. Temporary alternate indexes/object stores preserved user state; unreviewed checkout behavior and routing stayed unchanged. Forge-owned introduced-history adapter now passes 33 source/protocol leaf cases with actual disposable pushes; exact-binary native activation remains unverified.",
|
||||
"remaining": "Independent push prevention has not been demonstrated. A local hook alone remains bypassable; introduced-history and remote acceptance proof are required.",
|
||||
"owner_task": "RMGR-WP-0021-T01/T02/T03/T04; CUST-WP-0080-T03",
|
||||
"owner_task": "RMGR-WP-0021-T01/T02/T03/T04; CUST-WP-0080-T03; FORGE-WP-0006-T02/T03",
|
||||
"verification_evidence": [
|
||||
"secret-detection.json",
|
||||
"secret-hook-activation.json"
|
||||
"secret-hook-activation.json",
|
||||
"receive-secret-detection.json"
|
||||
],
|
||||
"assessed_at": "2026-10-12"
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue