golem15/summercms
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(14.2): WR-06 gate checks the seed secret stays private

Browse Source 
The self-test feeds a planted token line through dev-stack.sh redact-seed
and refuses when the secret survives; --e2e refuses unless
tmp/dev-stack/seed.out has mode 600.
This commit is contained in:
Jakub Zych
2026-10-12 11:25:42 +02:00
parent 8b835f328f
commit bb5c2d32fa
1 changed files with 25 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
scripts/check-phase14.2.sh
View File

@@ -296,6 +296,15 @@ run_self_test() {
return 1 return 1
fi fi
# The seed's minted API token secret never reaches the terminal (WR-06).
local redacted
redacted="$(printf '%s\n' 'user: created' 'api token: created inv_selftestSecret-0123 (shown once)' |
env -i PATH="$PATH" HOME="$HOME" bash "$DEV_STACK" redact-seed)"
if grep -q 'inv_selftestSecret' <<<"$redacted" || ! grep -q '^api token: created' <<<"$redacted" || ! grep -q '^user: created$' <<<"$redacted"; then
echo "refuse: self-test redact-seed did not hide the token secret: $redacted" >&2
return 1
fi
# Go log scan (T-14.2-20) and summaries. # Go log scan (T-14.2-20) and summaries.
local dir local dir
dir="$(mktemp -d)" dir="$(mktemp -d)"
@@ -527,6 +536,7 @@ run_e2e() {
trap 'bash "$DEV_STACK" down || true' EXIT trap 'bash "$DEV_STACK" down || true' EXIT
fi fi
bash "$DEV_STACK" up --detach bash "$DEV_STACK" up --detach
seed_out_private
bash "$DEV_STACK" guard bash "$DEV_STACK" guard
bash "$DEV_STACK" e2e "${GATE_SPECS[@]}" bash "$DEV_STACK" e2e "${GATE_SPECS[@]}"
echo "e2e (report only, D-15): ${REPORT_SPECS[*]}" echo "e2e (report only, D-15): ${REPORT_SPECS[*]}"
@@ -536,6 +546,21 @@ run_e2e() {
echo "phase14.2 e2e passed" echo "phase14.2 e2e passed"
} }
# seed_out_private refuses unless tmp/dev-stack/seed.out, which can hold a
# minted API token secret, is readable by its owner only (WR-06).
seed_out_private() {
local file="$APP/tmp/dev-stack/seed.out" mode
[[ -f "$file" ]] || {
echo "refuse: $file not found" >&2
return 1
}
mode="$(stat -c '%a' "$file")"
[[ "$mode" == 600 ]] || {
echo "refuse: $file has mode $mode, want 600 (it can hold an API token secret)" >&2
return 1
}
}
run_all() { run_all() {
local stage local stage
for stage in self-test go docs parity contracts guard e2e; do for stage in self-test go docs parity contracts guard e2e; do