1486 lines
58 KiB
Bash
1486 lines
58 KiB
Bash
#!/usr/bin/env bash
|
|
|
|
set -Eeuo pipefail
|
|
set +x
|
|
umask 077
|
|
|
|
readonly ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd -P)"
|
|
readonly SCANNER="$ROOT/scripts/validate/scan-platform-sensitive-source.sh"
|
|
# shellcheck source=scan-platform-sensitive-source.sh
|
|
source "$SCANNER"
|
|
|
|
WORK=''
|
|
ASSERTIONS=0
|
|
|
|
fail() {
|
|
printf 'FAIL: %s\n' "$*" >&2
|
|
exit 1
|
|
}
|
|
|
|
pass() {
|
|
ASSERTIONS=$((ASSERTIONS + 1))
|
|
printf 'PASS: %s\n' "$1"
|
|
}
|
|
|
|
cleanup() {
|
|
trap - EXIT HUP INT TERM
|
|
case "$WORK" in
|
|
/tmp/platform-sensitive-source-test.??????)
|
|
rm -rf -- "$WORK"
|
|
;;
|
|
esac
|
|
}
|
|
install_cleanup_traps() {
|
|
trap cleanup EXIT
|
|
trap 'exit 129' HUP
|
|
trap 'exit 130' INT
|
|
trap 'exit 143' TERM
|
|
}
|
|
install_cleanup_traps
|
|
|
|
new_fixture() {
|
|
cleanup
|
|
install_cleanup_traps
|
|
WORK="$(mktemp -d /tmp/platform-sensitive-source-test.XXXXXX)"
|
|
mkdir -p -- \
|
|
"$WORK/platform/scripts/validate" \
|
|
"$WORK/platform/services/observability" \
|
|
"$WORK/platform/infrastructure" \
|
|
"$WORK/platform/bootstrap" \
|
|
"$WORK/platform/clusters" \
|
|
"$WORK/platform/components" \
|
|
"$WORK/docs/plans"
|
|
chmod 0700 "$WORK" "$WORK/platform" "$WORK/docs"
|
|
}
|
|
|
|
if [[ "${PLATFORM_SENSITIVE_SOURCE_CLEANUP_PROBE:-0}" == 1 ]]; then
|
|
new_fixture
|
|
new_fixture
|
|
exit 0
|
|
fi
|
|
|
|
run_scanner() {
|
|
env -i HOME="$HOME" PATH="${PLATFORM_SENSITIVE_SOURCE_TEST_PATH:-/usr/local/bin:/usr/bin:/bin}" \
|
|
PLATFORM_SENSITIVE_SOURCE_LIBRARY="$SCANNER" \
|
|
PLATFORM_SENSITIVE_SOURCE_PLATFORM_ROOT="$WORK/platform" \
|
|
PLATFORM_SENSITIVE_SOURCE_DOCS_ROOT="$WORK/docs" \
|
|
PLATFORM_SENSITIVE_SOURCE_RENDERED_MANIFESTS="${PLATFORM_SENSITIVE_SOURCE_RENDERED_MANIFESTS:-}" \
|
|
bash -s -- "$@" <<'RUNNER'
|
|
set -Eeuo pipefail
|
|
source "$PLATFORM_SENSITIVE_SOURCE_LIBRARY"
|
|
scanner_args=("$@")
|
|
if [[ -n "$PLATFORM_SENSITIVE_SOURCE_RENDERED_MANIFESTS" ]]; then
|
|
scanner_args+=(--rendered-manifest "$PLATFORM_SENSITIVE_SOURCE_RENDERED_MANIFESTS")
|
|
fi
|
|
scan_platform_sensitive_roots \
|
|
"$PLATFORM_SENSITIVE_SOURCE_PLATFORM_ROOT" \
|
|
"$PLATFORM_SENSITIVE_SOURCE_DOCS_ROOT" \
|
|
"${scanner_args[@]}"
|
|
RUNNER
|
|
}
|
|
|
|
expect_clean() {
|
|
local description=$1 output
|
|
if ! output="$(run_scanner 2>&1)"; then
|
|
printf '%s\n' "$output" >&2
|
|
fail "$description"
|
|
fi
|
|
[[ "$output" == *'PLATFORM SENSITIVE SOURCE SCAN PASS'* ]] || {
|
|
printf '%s\n' "$output" >&2
|
|
fail "$description did not emit the PASS marker"
|
|
}
|
|
pass "$description"
|
|
}
|
|
|
|
expect_reject() {
|
|
local description=$1 expected_file=$2 output rc=0
|
|
shift 2
|
|
output="$(run_scanner "$@" 2>&1)" || rc=$?
|
|
(( rc != 0 )) || {
|
|
printf '%s\n' "$output" >&2
|
|
fail "$description was accepted"
|
|
}
|
|
[[ "$output" == *"$expected_file"* ]] || {
|
|
printf '%s\n' "$output" >&2
|
|
fail "$description did not report the filename"
|
|
}
|
|
[[ "$output" != *'should-never-be-printed'* ]] || {
|
|
printf '%s\n' "$output" >&2
|
|
fail "$description leaked matched content"
|
|
}
|
|
[[ "$output" != *'hooks.slack.com/services/'* ]] || {
|
|
printf '%s\n' "$output" >&2
|
|
fail "$description leaked a Slack URL"
|
|
}
|
|
pass "$description"
|
|
}
|
|
|
|
expect_scanner_error() {
|
|
local description=$1 output rc=0
|
|
output="$(run_scanner 2>&1)" || rc=$?
|
|
(( rc != 0 )) || {
|
|
printf '%s\n' "$output" >&2
|
|
fail "$description was accepted"
|
|
}
|
|
[[ "$output" == *'SCANNER_ERROR:'* ]] || {
|
|
printf '%s\n' "$output" >&2
|
|
fail "$description did not fail as a scanner error"
|
|
}
|
|
[[ "$output" != *'ActualProductionSecretValue9283'* ]] || {
|
|
fail "$description leaked matched content"
|
|
}
|
|
pass "$description"
|
|
}
|
|
|
|
expect_canonical_test_source_clean() {
|
|
local finding
|
|
finding="$(_sensitive_source_python_scan "$ROOT/scripts/validate/test-scan-platform-sensitive-source.sh" \
|
|
1 "$SCANNER")" || fail 'canonical scanner test content leaf returned an execution error'
|
|
[[ -z "$finding" ]] || {
|
|
[[ "$finding" == CREDENTIAL_LITERAL ]] || \
|
|
fail 'canonical scanner test content leaf returned an unexpected finding class'
|
|
fail 'canonical scanner test content leaf found a credential literal'
|
|
}
|
|
pass 'canonical scanner test source has no content-scan finding'
|
|
}
|
|
|
|
expect_canonical_test_source_clean
|
|
|
|
new_fixture
|
|
expect_clean 'empty full-root fixture is accepted'
|
|
|
|
mkdir -p "$WORK/platform/docs/superpowers/plans"
|
|
printf 'UNRESOLVED_%s\n' 'PLACEHOLDER' >"$WORK/platform/docs/superpowers/plans/pending.md"
|
|
expect_reject 'platform/docs remains in the platform-root scan' 'platform/docs/superpowers/plans/pending.md'
|
|
|
|
new_fixture
|
|
newline_file=$'odd\nname.md'
|
|
printf 'TO%s should-never-be-printed\n' 'DO' >"$WORK/docs/plans/$newline_file"
|
|
expect_reject 'NUL-safe traversal reports a newline filename without content' 'docs/plans/odd'
|
|
|
|
new_fixture
|
|
mkdir -p "$WORK/platform/.git" "$WORK/platform/vendor/.helm"
|
|
printf 'TO%s should-never-be-printed\n' 'DO' >"$WORK/platform/.git/ignored"
|
|
printf 'TB%s should-never-be-printed\n' 'D' >"$WORK/platform/vendor/.helm/ignored"
|
|
expect_clean 'only .git and .helm directory contents are excluded'
|
|
|
|
new_fixture
|
|
mkdir -p "$WORK/platform/.superpowers/sdd/test-scratch"
|
|
printf 'password = should-never-be-printed-value\n' > \
|
|
"$WORK/platform/.superpowers/sdd/test-scratch/snapshot.env"
|
|
expect_clean 'the exact platform-root SDD scratch subtree is excluded'
|
|
|
|
new_fixture
|
|
mkdir -p "$WORK/platform/.superpowers/not-sdd"
|
|
printf 'password = should-never-be-printed-value\n' > \
|
|
"$WORK/platform/.superpowers/not-sdd/source.env"
|
|
expect_reject 'a platform-root .superpowers non-SDD subtree remains scanned' \
|
|
'platform/.superpowers/not-sdd/source.env'
|
|
|
|
new_fixture
|
|
mkdir -p "$WORK/docs/.superpowers/sdd/test-scratch"
|
|
printf 'password = should-never-be-printed-value\n' > \
|
|
"$WORK/docs/.superpowers/sdd/test-scratch/snapshot.env"
|
|
expect_reject 'a .superpowers subtree under another scanned root remains scanned' \
|
|
'docs/.superpowers/sdd/test-scratch/snapshot.env'
|
|
|
|
new_fixture
|
|
printf 'TO%s should-never-be-printed\n' 'DO' >"$WORK/docs/plans/unresolved.md"
|
|
expect_reject 'unfinished English marker is rejected' 'docs/plans/unresolved.md'
|
|
printf '%s%s should-never-be-printed\n' '나중에' '채움' >"$WORK/docs/plans/unresolved.md"
|
|
expect_reject 'unfinished Korean marker is rejected' 'docs/plans/unresolved.md'
|
|
|
|
new_fixture
|
|
printf 'pattern | TO%s real work | TB%s should-never-be-printed\n' 'DO' 'D' > \
|
|
"$WORK/docs/plans/detector-context-bypass.md"
|
|
expect_reject 'detector prose cannot exempt real unfinished markers' \
|
|
'docs/plans/detector-context-bypass.md'
|
|
|
|
new_fixture
|
|
mkdir -p "$WORK/docs/mirror/scripts/validate"
|
|
printf '%s\n' \
|
|
'unfinished = ("TO" + "DO", "TB" + "D", "나중에" + "채움", "UNRESOLVED_" + "PLACEHOLDER")' > \
|
|
"$WORK/docs/mirror/scripts/validate/scan-platform-sensitive-source.sh"
|
|
expect_reject 'only the canonical production scanner may hold the exact detector definition' \
|
|
'docs/mirror/scripts/validate/scan-platform-sensitive-source.sh'
|
|
|
|
new_fixture
|
|
printf '%s\n' 'readonly SLACK_URL='"'"'https://hooks.slack.com/services/T123/B456/S789'"'" > \
|
|
"$WORK/platform/scripts/validate/test-example.sh"
|
|
printf '%s\n' 'readonly ADMIN_PASSWORD='"'"'SyntheticFixturePassword-123456789'"'" >> \
|
|
"$WORK/platform/scripts/validate/test-example.sh"
|
|
expect_clean 'clearly synthetic focused-test credential literals are contextually allowed'
|
|
printf 'pass%sword = Actual%s\n' '' 'ProductionSecretValue9283' > \
|
|
"$WORK/platform/scripts/validate/test-real-credential.sh"
|
|
expect_reject 'test-source context does not exempt a non-synthetic credential literal' \
|
|
'platform/scripts/validate/test-real-credential.sh'
|
|
rm -f -- "$WORK/platform/scripts/validate/test-real-credential.sh"
|
|
cat >"$WORK/platform/services/reference-only.yaml" <<'YAML'
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
spec:
|
|
template:
|
|
spec:
|
|
containers:
|
|
- name: example
|
|
env:
|
|
- name: CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: runtime-only
|
|
key: client-secret
|
|
- name: PASSWORD_TEMPLATE
|
|
value: ${RUNTIME_PASSWORD}
|
|
- name: ACCESS_KEY_PLACEHOLDER
|
|
value: <non-credential-placeholder>
|
|
YAML
|
|
printf '%s\n' 'OBSERVABILITY_SLACK_WEBHOOK=CREATE_CONFIRMED' > \
|
|
"$WORK/platform/bootstrap/status.env"
|
|
printf '%s\n' \
|
|
"check_pattern PASSWORD_NONPLACEHOLDER 'Password:[[:space:]]*[^<[:space:]][^[:space:]]*'" > \
|
|
"$WORK/docs/plans/scanner-pattern.md"
|
|
expect_clean 'references, bare key names, templates, and explicit placeholders are accepted'
|
|
printf '%s\n' 'webhook = https://hooks.slack.com/services/should-never-be-printed/B456/S789' > \
|
|
"$WORK/platform/bootstrap/live.env"
|
|
expect_reject 'Slack-shaped literal outside test-source context is rejected' 'platform/bootstrap/live.env'
|
|
printf '%s\n' 'password = should-never-be-printed-value' >"$WORK/platform/bootstrap/live.env"
|
|
expect_reject 'credential literal outside test-source context is rejected' 'platform/bootstrap/live.env'
|
|
|
|
new_fixture
|
|
printf '%s\n' '{"password": "should-never-be-printed-quoted-literal"}' > \
|
|
"$WORK/platform/bootstrap/quoted.json"
|
|
expect_reject 'quoted JSON credential key with a literal RHS is rejected' \
|
|
'platform/bootstrap/quoted.json'
|
|
printf '%s\n' 'password=should-never-be-printed-$-literal' > \
|
|
"$WORK/platform/bootstrap/dollar.env"
|
|
expect_reject 'a literal dollar does not exempt a credential RHS' \
|
|
'platform/bootstrap/dollar.env'
|
|
|
|
new_fixture
|
|
printf '%s\n' 'password = " should-never-be-printed-spaced-literal "' > \
|
|
"$WORK/platform/bootstrap/spaced.env"
|
|
expect_reject 'quoted whitespace cannot hide a credential literal' \
|
|
'platform/bootstrap/spaced.env'
|
|
rm -f -- "$WORK/platform/bootstrap/spaced.env"
|
|
printf 'pass%sword="${RUNTIME_PASSWORD}"-Actual%s\n' '' \
|
|
'ProductionSecretValue9283' >"$WORK/platform/bootstrap/quoted-tail.env"
|
|
expect_reject 'a quoted runtime reference cannot hide a literal suffix' \
|
|
'platform/bootstrap/quoted-tail.env'
|
|
rm -f -- "$WORK/platform/bootstrap/quoted-tail.env"
|
|
|
|
for separator in space comma semicolon; do
|
|
case "$separator" in
|
|
space) tail=' ActualProductionSecretValue9283' ;;
|
|
comma) tail=',ActualProductionSecretValue9283' ;;
|
|
semicolon) tail=';ActualProductionSecretValue9283' ;;
|
|
esac
|
|
printf 'pass%sword=${RUNTIME_PASSWORD}%s\n' '' "$tail" > \
|
|
"$WORK/platform/bootstrap/unquoted-$separator-tail.env"
|
|
expect_reject "an unquoted runtime reference cannot hide a $separator literal suffix" \
|
|
"platform/bootstrap/unquoted-$separator-tail.env"
|
|
rm -f -- "$WORK/platform/bootstrap/unquoted-$separator-tail.env"
|
|
done
|
|
|
|
printf 'pass%sword=pass%sword_Actual%s\n' \
|
|
'' '' 'ProductionSecretValue9283' >"$WORK/platform/bootstrap/bare-identifier.env"
|
|
expect_reject 'a credential-key-prefixed bare identifier RHS is still a literal' \
|
|
'platform/bootstrap/bare-identifier.env'
|
|
rm -f -- "$WORK/platform/bootstrap/bare-identifier.env"
|
|
printf 'client_%ssecret=client_%ssecret_Actual%s\n' \
|
|
'' '' 'ProductionValue9283' >"$WORK/platform/bootstrap/bare-client-identifier.env"
|
|
expect_reject 'a client-secret-prefixed bare identifier RHS is still a literal' \
|
|
'platform/bootstrap/bare-client-identifier.env'
|
|
|
|
new_fixture
|
|
printf '%s; pass%sword=Actual%s\n' \
|
|
"check_pattern X 'Password:[[:space:]]*[^<[:space:]]+'" \
|
|
'' 'ProductionSecretValue9283' >"$WORK/platform/bootstrap/mixed-regex.env"
|
|
expect_reject 'a detector regex cannot exempt a later credential assignment' \
|
|
'platform/bootstrap/mixed-regex.env'
|
|
rm -f -- "$WORK/platform/bootstrap/mixed-regex.env"
|
|
|
|
printf '%s pass%sword=Actual%s\n' \
|
|
"check_pattern X 'Password:[[:space:]]*[^<[:space:]]+'" \
|
|
'' 'ProductionSecretValue9283' >"$WORK/platform/bootstrap/mixed-regex-space.env"
|
|
expect_reject 'a detector regex cannot consume a same-statement credential assignment' \
|
|
'platform/bootstrap/mixed-regex-space.env'
|
|
|
|
new_fixture
|
|
printf 'config: {"pass%sword": Actual%s}\n' \
|
|
'' 'ProductionSecretValue9283' >"$WORK/platform/bootstrap/mapping-literal.yaml"
|
|
expect_reject 'a YAML mapping credential key cannot use a bare literal scalar' \
|
|
'platform/bootstrap/mapping-literal.yaml'
|
|
printf 'pass%sword: Actual%s SecretValue9283\n' \
|
|
'' 'Production' >"$WORK/platform/bootstrap/spaced-scalar.yaml"
|
|
expect_reject 'YAML credential scalar whitespace is not prose' \
|
|
'platform/bootstrap/spaced-scalar.yaml'
|
|
rm -f -- "$WORK/platform/bootstrap/spaced-scalar.yaml"
|
|
printf 'pass%sword: Actual%s,tail\n' \
|
|
'' 'ProductionSecretValue9283' >"$WORK/platform/bootstrap/comma-scalar.yaml"
|
|
expect_reject 'YAML credential scalar punctuation is not prose' \
|
|
'platform/bootstrap/comma-scalar.yaml'
|
|
|
|
new_fixture
|
|
printf 'admin_pass%sword: Actual%s\n' \
|
|
'' 'ProductionSecretValue9283' >"$WORK/platform/bootstrap/admin-password.yaml"
|
|
expect_reject 'a normalized YAML admin password key is credential-bearing' \
|
|
'platform/bootstrap/admin-password.yaml'
|
|
printf 'oidc_client_%ssecret: Actual%s\n' \
|
|
'' 'ProductionSecretValue9283' >"$WORK/platform/bootstrap/oidc-client-secret.yaml"
|
|
expect_reject 'a normalized YAML OIDC client-secret key is credential-bearing' \
|
|
'platform/bootstrap/oidc-client-secret.yaml'
|
|
|
|
new_fixture
|
|
printf 'OIDCClient%sSecret: Actual%s\n' \
|
|
'' 'ProductionSecretValue9283' >"$WORK/platform/bootstrap/acronym-client-secret.yaml"
|
|
expect_reject 'an acronym CamelCase OIDC client-secret key is credential-bearing' \
|
|
'platform/bootstrap/acronym-client-secret.yaml'
|
|
printf 'DBPass%sword: Actual%s\n' \
|
|
'' 'ProductionSecretValue9283' >"$WORK/platform/bootstrap/acronym-password.yaml"
|
|
expect_reject 'an acronym CamelCase DB password key is credential-bearing' \
|
|
'platform/bootstrap/acronym-password.yaml'
|
|
|
|
new_fixture
|
|
printf '{"pass\\u0077ord":"Actual%s","pass%sword":"${RUNTIME_PASSWORD}"}\n' \
|
|
'ProductionSecretValue9283' '' >"$WORK/platform/bootstrap/duplicate-key.json"
|
|
expect_reject 'JSON rejects a Unicode-decoded duplicate credential key before collapse' \
|
|
'platform/bootstrap/duplicate-key.json'
|
|
|
|
for value_kind in numeric array object; do
|
|
case "$value_kind" in
|
|
numeric) value='12345678901234567890' ;;
|
|
array) value='["ActualProductionSecretValue9283"]' ;;
|
|
object) value='{"value":"ActualProductionSecretValue9283"}' ;;
|
|
esac
|
|
printf '{"admin_pass%sword":%s}\n' '' "$value" > \
|
|
"$WORK/platform/bootstrap/$value_kind-credential.json"
|
|
expect_reject "a credential-key JSON $value_kind value fails closed" \
|
|
"platform/bootstrap/$value_kind-credential.json"
|
|
rm -f -- "$WORK/platform/bootstrap/$value_kind-credential.json"
|
|
done
|
|
rm -f -- "$WORK/platform/bootstrap/duplicate-key.json"
|
|
|
|
cat >"$WORK/platform/bootstrap/reference-container.yaml" <<'YAML'
|
|
envValueFrom:
|
|
GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET:
|
|
secretKeyRef:
|
|
name: grafana-keycloak-oidc
|
|
key: client-secret
|
|
YAML
|
|
expect_clean 'an exact Kubernetes secretKeyRef container remains a reference'
|
|
cat >"$WORK/platform/bootstrap/reference-container.yaml" <<'YAML'
|
|
envValueFrom:
|
|
GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET:
|
|
secretKeyRef:
|
|
name: grafana-keycloak-oidc
|
|
key: client-secret
|
|
value: ActualProductionSecretValue9283
|
|
YAML
|
|
expect_reject 'a secretKeyRef container with a literal child fails closed' \
|
|
'platform/bootstrap/reference-container.yaml'
|
|
|
|
new_fixture
|
|
cat >"$WORK/platform/bootstrap/webhook-feature.yaml" <<'YAML'
|
|
operators:
|
|
object-store:
|
|
webhook:
|
|
enabled: true
|
|
replicas: 1
|
|
YAML
|
|
expect_clean 'the exact chart webhook feature block is not a credential value'
|
|
cat >"$WORK/platform/bootstrap/webhook-feature.yaml" <<'YAML'
|
|
operators:
|
|
object-store:
|
|
webhook:
|
|
enabled: true
|
|
replicas: 1
|
|
value: ActualProductionSecretValue9283
|
|
YAML
|
|
expect_reject 'a webhook feature block with a literal child fails closed' \
|
|
'platform/bootstrap/webhook-feature.yaml'
|
|
|
|
new_fixture
|
|
printf 'pass%sword: Actual%s\n' \
|
|
'' 'ProductionSecretValue9283' >"$WORK/docs/plans/literal-password.md"
|
|
expect_reject 'Markdown assignment-shaped password literals are rejected' \
|
|
'docs/plans/literal-password.md'
|
|
printf 'client-%ssecret: Actual%s\n' \
|
|
'' 'ProductionSecretValue9283' >"$WORK/docs/plans/literal-client-secret.md"
|
|
expect_reject 'Markdown assignment-shaped client-secret literals are rejected' \
|
|
'docs/plans/literal-client-secret.md'
|
|
rm -f -- "$WORK/docs/plans/literal-password.md" "$WORK/docs/plans/literal-client-secret.md"
|
|
printf ' pass%sword: Actual%s\n' \
|
|
'' 'ProductionSecretValue9283' >"$WORK/docs/plans/indented-literal-password.md"
|
|
expect_reject 'indented Markdown assignment-shaped password literals are rejected' \
|
|
'docs/plans/indented-literal-password.md'
|
|
|
|
new_fixture
|
|
printf 'pass%sword:Actual%s\n' \
|
|
'' 'ProductionSecretValue9283' >"$WORK/platform/bootstrap/literal.conf"
|
|
expect_reject 'a colon credential in configuration syntax is not prose' \
|
|
'platform/bootstrap/literal.conf'
|
|
|
|
new_fixture
|
|
printf 'cmd --from-file="pass%sword=${password_file}" pass%sword=Actual%s\n' \
|
|
'' '' 'ProductionSecretValue9283' >"$WORK/platform/bootstrap/from-file-tail.sh"
|
|
expect_reject 'one safe from-file argv cannot exempt a later credential assignment' \
|
|
'platform/bootstrap/from-file-tail.sh'
|
|
|
|
new_fixture
|
|
cat >"$WORK/platform/bootstrap/references.env" <<'EOF'
|
|
password=${RUNTIME_PASSWORD}
|
|
client_secret="${OIDC_CLIENT_SECRET}"
|
|
access_key=$(runtime_access_key)
|
|
webhook='$(runtime_webhook)'
|
|
password=" ${SPACED_RUNTIME_PASSWORD} "
|
|
--from-file="password=${password_file}"
|
|
EOF
|
|
cat >"$WORK/platform/bootstrap/references.py" <<'PY'
|
|
sources = {"admin-password": password_file}
|
|
item = {"client-secret": base64.b64encode(payload).decode()}
|
|
PY
|
|
expect_clean 'exact shell interpolation and command references remain accepted'
|
|
|
|
new_fixture
|
|
cat >"$WORK/platform/bootstrap/typed-none-reference.py" <<'PY'
|
|
def retain_required(
|
|
webhook: RetainedWebhook,
|
|
):
|
|
return webhook
|
|
|
|
def retain_optional(
|
|
webhook: RetainedWebhook | None = None,
|
|
):
|
|
return webhook
|
|
PY
|
|
printf 'web%shook = runtime / "input-webhook"\n' '' > \
|
|
"$WORK/platform/scripts/validate/test-runtime-path-reference.py"
|
|
printf 'web%shook = open_validated_webhook(webhook_file)\nself.web%shook = self.vault.open_validated_webhook(os.fspath(self.webhook_path))\n' \
|
|
'' '' >"$WORK/platform/bootstrap/runtime-call-reference.py"
|
|
expect_clean 'Python typed defaults, fixed test paths, and literal-free calls are references'
|
|
|
|
printf 'web%shook: RetainedWebhook | None = "Actual%s"\n' \
|
|
'' 'ProductionSecretValue9283' >"$WORK/platform/bootstrap/typed-literal.py"
|
|
expect_reject 'a Python typed credential parameter cannot hide a literal default' \
|
|
'platform/bootstrap/typed-literal.py'
|
|
printf 'web%shook = runtime / "Actual%s"\n' \
|
|
'' 'ProductionSecretValue9283' >"$WORK/platform/bootstrap/path-literal.py"
|
|
expect_reject 'a Python credential runtime path cannot hide a literal basename' \
|
|
'platform/bootstrap/path-literal.py'
|
|
for call_kind in string bytes nested star kwargs; do
|
|
case "$call_kind" in
|
|
string) expression='open_validated_webhook("ActualProductionSecretValue9283")' ;;
|
|
bytes) expression='open_validated_webhook(b"ActualProductionSecretValue9283")' ;;
|
|
nested) expression='open_validated_webhook(os.fspath("ActualProductionSecretValue9283"))' ;;
|
|
star) expression='open_validated_webhook(*webhook_file)' ;;
|
|
kwargs) expression='open_validated_webhook(**webhook_file)' ;;
|
|
esac
|
|
printf 'web%shook = %s\n' '' "$expression" > \
|
|
"$WORK/platform/bootstrap/call-$call_kind-literal.py"
|
|
expect_reject "a Python credential call rejects $call_kind literal or expansion input" \
|
|
"platform/bootstrap/call-$call_kind-literal.py"
|
|
done
|
|
|
|
printf 'pass%sword=base64.b64encode(b"Actual%s").decode()\n' \
|
|
'' 'ProductionSecretValue9283' >"$WORK/platform/bootstrap/base64-literal.py"
|
|
expect_reject 'base64 syntax does not exempt a literal credential' \
|
|
'platform/bootstrap/base64-literal.py'
|
|
|
|
new_fixture
|
|
prompt_expected="$WORK/prompt-fixture.expected"
|
|
printf '%s%s\n%s\n' \
|
|
'while b"KeePassXC master pass' \
|
|
'word: " not in observed:' \
|
|
' observed += read_prompt()' >"$prompt_expected"
|
|
printf '%s%s\n%s\n' \
|
|
'while b"KeePassXC master pass' \
|
|
'word: " not in observed:' \
|
|
' observed += read_prompt()' > \
|
|
"$WORK/platform/scripts/validate/test-python-prompt.py"
|
|
cmp -s -- "$prompt_expected" "$WORK/platform/scripts/validate/test-python-prompt.py" || \
|
|
fail 'fixed-format prompt fixture bytes changed'
|
|
[[ "$(sha256sum "$WORK/platform/scripts/validate/test-python-prompt.py" | awk '{print $1}')" == \
|
|
3c3cec8dc3f1d273be0e5a4760f2c89a01b11f851e28f0d2bbf960ff37fb1c56 ]] || \
|
|
fail 'fixed-format prompt fixture hash changed'
|
|
rm -f -- "$prompt_expected"
|
|
expect_clean 'a Python test prompt ending at a credential label is not a credential literal'
|
|
|
|
new_fixture
|
|
cat >"$WORK/platform/scripts/validate/test-python-assert-prompt.py" <<'PY'
|
|
self.assertEqual(prompt, b"KeePassXC master password: ")
|
|
PY
|
|
expect_clean 'a sole Python assertEqual prompt constant remains accepted'
|
|
|
|
new_fixture
|
|
python3 - "$WORK/platform/scripts/validate/test-python-unknown-encoding.py" <<'PY'
|
|
import pathlib
|
|
import sys
|
|
|
|
path = pathlib.Path(sys.argv[1])
|
|
path.write_bytes(
|
|
b"# coding: unknown-scanner-encoding\n"
|
|
b"pass" b"word = ActualProductionSecretValue9283\n"
|
|
)
|
|
PY
|
|
[[ "$(sha256sum "$WORK/platform/scripts/validate/test-python-unknown-encoding.py" | awk '{print $1}')" == \
|
|
2daee060681860677b2bffc8f7a086505299e2d321c1201cfa187fb24f99a3f4 ]] || \
|
|
fail 'unknown-encoding fixture bytes changed'
|
|
expect_scanner_error 'an unknown Python source encoding fails closed as a scanner error'
|
|
|
|
new_fixture
|
|
python3 - "$WORK/platform/scripts/validate/test-python-latin1-prompt.py" <<'PY'
|
|
import pathlib
|
|
import sys
|
|
|
|
path = pathlib.Path(sys.argv[1])
|
|
path.write_bytes(
|
|
b"# coding: latin-1\n"
|
|
b"marker = 'caf\xe9'\n"
|
|
b"while b'KeePassXC master pass" b"word: ' not in observed:\n"
|
|
b" observed += read_prompt()\n"
|
|
)
|
|
PY
|
|
python3 -m py_compile "$WORK/platform/scripts/validate/test-python-latin1-prompt.py"
|
|
find "$WORK/platform/scripts/validate" -type d -name __pycache__ -exec rm -rf -- {} +
|
|
[[ "$(sha256sum "$WORK/platform/scripts/validate/test-python-latin1-prompt.py" | awk '{print $1}')" == \
|
|
06b3e6067415d4241e65b704e861707cfdff0372319075d69cf32f7178f55577 ]] || \
|
|
fail 'Latin-1 prompt fixture bytes changed'
|
|
expect_clean 'a valid Latin-1 Python prompt-only context remains accepted'
|
|
|
|
new_fixture
|
|
python3 - "$WORK/platform/scripts/validate/test-python-latin1-literal.py" <<'PY'
|
|
import pathlib
|
|
import sys
|
|
|
|
path = pathlib.Path(sys.argv[1])
|
|
path.write_bytes(
|
|
b"# coding: latin-1\n"
|
|
b"marker = 'caf\xe9'\n"
|
|
b"pass" b"word = ActualProductionSecretValue9283\n"
|
|
)
|
|
PY
|
|
python3 -m py_compile "$WORK/platform/scripts/validate/test-python-latin1-literal.py"
|
|
find "$WORK/platform/scripts/validate" -type d -name __pycache__ -exec rm -rf -- {} +
|
|
[[ "$(sha256sum "$WORK/platform/scripts/validate/test-python-latin1-literal.py" | awk '{print $1}')" == \
|
|
f7cf7c400e901e17d8f460ec1aa087cd31c21208e01050d2a81e777b9066ec16 ]] || \
|
|
fail 'Latin-1 literal fixture bytes changed'
|
|
expect_reject 'a valid Latin-1 Python credential literal is rejected' \
|
|
'platform/scripts/validate/test-python-latin1-literal.py'
|
|
|
|
new_fixture
|
|
printf '%s%s\n%s\n' \
|
|
'while b"KeePassXC master pass' \
|
|
'word: " not in observed' \
|
|
' observed += read_prompt()' > \
|
|
"$WORK/platform/scripts/validate/test-python-malformed-prompt.py"
|
|
[[ "$(sha256sum "$WORK/platform/scripts/validate/test-python-malformed-prompt.py" | awk '{print $1}')" == \
|
|
05e824e262eec08a1be21c4c3488c9a5d2c32418ee2ab6b1e8a325a898eaed3d ]] || \
|
|
fail 'malformed prompt fixture bytes changed'
|
|
expect_scanner_error 'malformed Python containing a credential prompt fails closed as a scanner error'
|
|
|
|
new_fixture
|
|
cat >"$WORK/platform/scripts/validate/test-python-triple-prompt-bypass.py" <<'PY'
|
|
message = b"""KeePassXC master password:
|
|
ActualProductionSecretValue9283"""
|
|
PY
|
|
expect_reject 'a triple-quoted Python prompt token cannot contain a credential literal' \
|
|
'platform/scripts/validate/test-python-triple-prompt-bypass.py'
|
|
|
|
new_fixture
|
|
cat >"$WORK/platform/scripts/validate/test-python-multiline-prompt-bypass.py" <<'PY'
|
|
message = (
|
|
b"KeePassXC master password: "
|
|
b"ActualProductionSecretValue9283"
|
|
)
|
|
PY
|
|
expect_reject 'a multiline adjacent Python literal cannot continue an empty credential prompt' \
|
|
'platform/scripts/validate/test-python-multiline-prompt-bypass.py'
|
|
|
|
new_fixture
|
|
printf 'message = b"".join((b"KeePassXC master pass%sword: ", b"Actual%s"))\n' \
|
|
'' 'ProductionSecretValue9283' > \
|
|
"$WORK/platform/scripts/validate/test-python-join-prompt-bypass.py"
|
|
expect_reject 'a join expression cannot continue an empty credential prompt with a literal' \
|
|
'platform/scripts/validate/test-python-join-prompt-bypass.py'
|
|
|
|
new_fixture
|
|
printf 'message = b"KeePassXC master pass%sword: " + b"Actual%s"\n' \
|
|
'' 'ProductionSecretValue9283' > \
|
|
"$WORK/platform/scripts/validate/test-python-plus-prompt-bypass.py"
|
|
expect_reject 'a plus-joined Python string literal cannot continue an empty credential prompt' \
|
|
'platform/scripts/validate/test-python-plus-prompt-bypass.py'
|
|
|
|
new_fixture
|
|
printf 'message = b"KeePassXC master pass%sword: " b"Actual%s"\n' \
|
|
'' 'ProductionSecretValue9283' > \
|
|
"$WORK/platform/scripts/validate/test-python-adjacent-prompt-bypass.py"
|
|
expect_reject 'an adjacent Python string literal cannot continue an empty credential prompt' \
|
|
'platform/scripts/validate/test-python-adjacent-prompt-bypass.py'
|
|
|
|
new_fixture
|
|
printf 'message = "pass%sword: Actual%s; pass%sword: "\n' \
|
|
'' 'ProductionSecretValue9283' '' > \
|
|
"$WORK/platform/scripts/validate/test-python-prompt-bypass.py"
|
|
expect_reject 'a later empty Python prompt cannot exempt an earlier quoted credential literal' \
|
|
'platform/scripts/validate/test-python-prompt-bypass.py'
|
|
printf 'pass%sword = "Actual%s"\n' '' 'ProductionSecretValue9283' > \
|
|
"$WORK/platform/scripts/validate/test-python-quoted-literal.py"
|
|
expect_reject 'a Python test file rejects a quoted credential literal' \
|
|
'platform/scripts/validate/test-python-quoted-literal.py'
|
|
|
|
new_fixture
|
|
cp -- "$ROOT/scripts/validate/test-slack-webhook-recovery-vault.py" \
|
|
"$WORK/platform/scripts/validate/test-slack-webhook-recovery-vault.py"
|
|
expect_clean 'a test-named Python vault fixture permits safe test context and nonliteral references'
|
|
printf 'web%shook = Actual%s\n' '' 'ProductionSecretValue9283' > \
|
|
"$WORK/platform/scripts/validate/test-python-explicit-literal.py"
|
|
expect_reject 'a Python test file rejects an explicit credential literal' \
|
|
'platform/scripts/validate/test-python-explicit-literal.py'
|
|
|
|
new_fixture
|
|
printf '%s\n' '-----BEGIN PRI''VATE KEY-----' 'should-never-be-printed' >"$WORK/docs/private.pem"
|
|
expect_reject 'private key header is rejected' 'docs/private.pem'
|
|
|
|
new_fixture
|
|
cat >"$WORK/platform/services/credential-secret.yaml" <<'YAML'
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: forbidden-source
|
|
stringData:
|
|
password: should-never-be-printed
|
|
YAML
|
|
expect_reject 'source-controlled credential Secret payload is rejected' 'platform/services/credential-secret.yaml'
|
|
|
|
new_fixture
|
|
cat >"$WORK/platform/services/custom-tag-stream.yaml" <<'YAML'
|
|
apiVersion: example.test/v1
|
|
kind: Synthetic
|
|
spec:
|
|
tagged: !!value fixture
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: forbidden-source
|
|
stringData:
|
|
opaque: c2hvdWxkLW5ldmVyLWJlLXByaW50ZWQ=
|
|
YAML
|
|
expect_reject 'custom-tag streams still expose later source Secret payloads' \
|
|
'platform/services/custom-tag-stream.yaml'
|
|
|
|
new_fixture
|
|
cat >"$WORK/platform/services/duplicate-payload.yaml" <<'YAML'
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: duplicate-payload
|
|
stringData:
|
|
opaque: c2hvdWxkLW5ldmVyLWJlLXByaW50ZWQ=
|
|
stringData: {}
|
|
YAML
|
|
expect_reject 'duplicate source Secret keys fail closed' \
|
|
'platform/services/duplicate-payload.yaml'
|
|
|
|
new_fixture
|
|
cat >"$WORK/platform/services/credential-secret.YAML" <<'YAML'
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: uppercase-extension
|
|
stringData:
|
|
opaque: c2hvdWxkLW5ldmVyLWJlLXByaW50ZWQ=
|
|
YAML
|
|
expect_reject 'uppercase YAML source Secret payload is rejected' \
|
|
'platform/services/credential-secret.YAML'
|
|
|
|
new_fixture
|
|
printf '%s\n' 'kind: [unterminated' >"$WORK/platform/services/malformed.yaml"
|
|
expect_reject 'a source YAML parser error fails closed without content' \
|
|
'platform/services/malformed.yaml'
|
|
|
|
new_fixture
|
|
stream_fifo="$WORK/source-stream.yaml"
|
|
stream_output="$WORK/source-stream.finding"
|
|
mkfifo -m 0600 "$stream_fifo"
|
|
PYTHONUNBUFFERED=1 _sensitive_source_yaml_secret_scan "$stream_fifo" >"$stream_output" &
|
|
stream_pid=$!
|
|
exec {stream_fd}>"$stream_fifo"
|
|
printf '%s\n' \
|
|
'apiVersion: v1' \
|
|
'kind: Secret' \
|
|
'metadata:' \
|
|
' name: first-streamed-secret' \
|
|
'stringData:' \
|
|
' opaque: c2hvdWxkLW5ldmVyLWJlLXByaW50ZWQ=' >&"$stream_fd"
|
|
for stream_document in {1..200}; do
|
|
printf '%s\n' \
|
|
'---' \
|
|
'apiVersion: v1' \
|
|
'kind: ConfigMap' \
|
|
'metadata:' \
|
|
" name: streamed-padding-$stream_document" >&"$stream_fd"
|
|
done
|
|
stream_seen=false
|
|
for _ in {1..50}; do
|
|
if [[ -s "$stream_output" ]]; then
|
|
stream_seen=true
|
|
break
|
|
fi
|
|
sleep 0.02
|
|
done
|
|
exec {stream_fd}>&-
|
|
wait "$stream_pid"
|
|
[[ "$stream_seen" == true ]] || \
|
|
fail 'source YAML scan materialized the stream before reporting the first Secret'
|
|
[[ "$(<"$stream_output")" == SECRET_SOURCE_PAYLOAD ]] || \
|
|
fail 'streamed source YAML scan returned an unexpected finding class'
|
|
pass 'source YAML documents are inspected incrementally before end-of-stream'
|
|
|
|
new_fixture
|
|
mkdir -p "$WORK/render-handoff"
|
|
cat >"$WORK/render-handoff/rendered.yaml" <<'YAML'
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: alertmanager-observability-core-kube-pr-alertmanager
|
|
namespace: observability
|
|
type: Opaque
|
|
data:
|
|
alertmanager.yaml: cmVjZWl2ZXJzOgotIG5hbWU6ICJudWxsIgpyb3V0ZToKICByZWNlaXZlcjogIm51bGwiCiAgcm91dGVzOiBbXQo=
|
|
YAML
|
|
PLATFORM_SENSITIVE_SOURCE_RENDERED_MANIFESTS="$WORK/render-handoff/rendered.yaml" \
|
|
run_scanner >/dev/null || \
|
|
fail 'credential-free allowlisted rendered Secret was rejected'
|
|
pass 'credential-free allowlisted rendered Secret is accepted'
|
|
source_secret_rc=0
|
|
cp -- "$WORK/render-handoff/rendered.yaml" "$WORK/platform/rendered.yaml"
|
|
source_secret_output="$(run_scanner 2>&1)" || source_secret_rc=$?
|
|
(( source_secret_rc != 0 )) || fail 'an allowlisted-looking Secret in source was accepted'
|
|
[[ "$source_secret_output" == *'platform/rendered.yaml'* ]] || \
|
|
fail 'allowlisted-looking source Secret did not report its filename'
|
|
pass 'an allowlisted-looking Secret remains forbidden in source'
|
|
python3 - "$WORK/platform/rendered.yaml" <<'PY'
|
|
import base64
|
|
import pathlib
|
|
import sys
|
|
|
|
path = pathlib.Path(sys.argv[1])
|
|
encoded = base64.b64encode(b"password: should-never-be-printed\n").decode()
|
|
text = path.read_text()
|
|
head, _ = text.rsplit(" alertmanager.yaml: ", 1)
|
|
path.write_text(head + " alertmanager.yaml: " + encoded + "\n")
|
|
PY
|
|
cp -- "$WORK/platform/rendered.yaml" "$WORK/render-handoff/rendered.yaml"
|
|
rm -f -- "$WORK/platform/rendered.yaml"
|
|
PLATFORM_SENSITIVE_SOURCE_RENDERED_MANIFESTS="$WORK/render-handoff/rendered.yaml" \
|
|
expect_reject 'decoded rendered Secret credential payload is rejected' 'rendered.yaml'
|
|
cat >"$WORK/render-handoff/rendered.yaml" <<'YAML'
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: gitea
|
|
namespace: gitea
|
|
type: Opaque
|
|
stringData:
|
|
assertions: ""
|
|
config_environment.sh: synthetic-fixture
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: gitea-init
|
|
namespace: gitea
|
|
type: Opaque
|
|
stringData:
|
|
configure_gitea.sh: synthetic-fixture
|
|
configure_gpg_environment.sh: synthetic-fixture
|
|
init_directory_structure.sh: synthetic-fixture
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: gitea-inline-config
|
|
namespace: gitea
|
|
type: Opaque
|
|
stringData:
|
|
_generals_: ""
|
|
actions: synthetic-fixture
|
|
cache: synthetic-fixture
|
|
database: synthetic-fixture
|
|
indexer: synthetic-fixture
|
|
metrics: synthetic-fixture
|
|
packages: synthetic-fixture
|
|
queue: synthetic-fixture
|
|
repository: synthetic-fixture
|
|
security: synthetic-fixture
|
|
server: synthetic-fixture
|
|
service: synthetic-fixture
|
|
session: synthetic-fixture
|
|
YAML
|
|
if PLATFORM_SENSITIVE_SOURCE_RENDERED_MANIFESTS="$WORK/render-handoff/rendered.yaml" \
|
|
run_scanner >/dev/null; then
|
|
pass 'expected credential-free Gitea renderer Secrets are accepted'
|
|
else
|
|
fail 'expected credential-free Gitea renderer Secrets were rejected'
|
|
fi
|
|
python3 - "$WORK/render-handoff/rendered.yaml" <<'PY'
|
|
import sys
|
|
import yaml
|
|
|
|
path = sys.argv[1]
|
|
with open(path, encoding="utf-8") as stream:
|
|
documents = list(yaml.safe_load_all(stream))
|
|
documents[0]["stringData"]["config_environment.sh"] = (
|
|
"pass" + "word = Actual" + "ProductionSecretValue9283"
|
|
)
|
|
with open(path, "w", encoding="utf-8") as stream:
|
|
yaml.safe_dump_all(documents, stream, explicit_start=True, sort_keys=False)
|
|
PY
|
|
PLATFORM_SENSITIVE_SOURCE_RENDERED_MANIFESTS="$WORK/render-handoff/rendered.yaml" \
|
|
expect_reject 'literal credential inside an allowlisted Gitea Secret is rejected' 'rendered.yaml'
|
|
python3 - "$WORK/render-handoff/rendered.yaml" <<'PY'
|
|
import sys
|
|
import yaml
|
|
|
|
path = sys.argv[1]
|
|
with open(path, encoding="utf-8") as stream:
|
|
documents = list(yaml.safe_load_all(stream))
|
|
documents[0]["stringData"]["config_environment.sh"] = (
|
|
"password = should-never-be-printed-${RUNTIME_SUFFIX}"
|
|
)
|
|
with open(path, "w", encoding="utf-8") as stream:
|
|
yaml.safe_dump_all(documents, stream, explicit_start=True, sort_keys=False)
|
|
PY
|
|
PLATFORM_SENSITIVE_SOURCE_RENDERED_MANIFESTS="$WORK/render-handoff/rendered.yaml" \
|
|
expect_reject 'a decoded literal prefix plus interpolation is rejected' 'rendered.yaml'
|
|
python3 - "$WORK/render-handoff/rendered.yaml" <<'PY'
|
|
import sys
|
|
import yaml
|
|
|
|
path = sys.argv[1]
|
|
with open(path, encoding="utf-8") as stream:
|
|
documents = list(yaml.safe_load_all(stream))
|
|
documents[0]["stringData"]["config_environment.sh"] = (
|
|
'pass' + 'word = " ${RUNTIME_PASSWORD} "'
|
|
)
|
|
with open(path, "w", encoding="utf-8") as stream:
|
|
yaml.safe_dump_all(documents, stream, explicit_start=True, sort_keys=False)
|
|
PY
|
|
if PLATFORM_SENSITIVE_SOURCE_RENDERED_MANIFESTS="$WORK/render-handoff/rendered.yaml" \
|
|
run_scanner >/dev/null; then
|
|
pass 'a decoded quoted and spaced exact runtime reference remains accepted'
|
|
else
|
|
fail 'a decoded quoted and spaced exact runtime reference was rejected'
|
|
fi
|
|
python3 - "$WORK/render-handoff/rendered.yaml" <<'PY'
|
|
import sys
|
|
import yaml
|
|
|
|
path = sys.argv[1]
|
|
with open(path, encoding="utf-8") as stream:
|
|
documents = list(yaml.safe_load_all(stream))
|
|
documents[0]["stringData"]["config_environment.sh"] = (
|
|
'pass' + 'word="${RUNTIME_PASSWORD}"-ActualProductionSecretValue9283'
|
|
)
|
|
with open(path, "w", encoding="utf-8") as stream:
|
|
yaml.safe_dump_all(documents, stream, explicit_start=True, sort_keys=False)
|
|
PY
|
|
PLATFORM_SENSITIVE_SOURCE_RENDERED_MANIFESTS="$WORK/render-handoff/rendered.yaml" \
|
|
expect_reject 'a decoded quoted runtime reference cannot hide a literal suffix' \
|
|
'rendered.yaml'
|
|
cat >"$WORK/render-handoff/rendered.yaml" <<'YAML'
|
|
apiVersion: apiextensions.k8s.io/v1
|
|
kind: CustomResourceDefinition
|
|
metadata:
|
|
name: synthetic.example.test
|
|
spec:
|
|
synthetic: !!value fixture
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: alertmanager-observability-core-kube-pr-alertmanager
|
|
namespace: observability
|
|
type: Opaque
|
|
data:
|
|
alertmanager.yaml: cmVjZWl2ZXJzOgotIG5hbWU6ICJudWxsIgpyb3V0ZToKICByZWNlaXZlcjogIm51bGwiCiAgcm91dGVzOiBbXQo=
|
|
YAML
|
|
if PLATFORM_SENSITIVE_SOURCE_RENDERED_MANIFESTS="$WORK/render-handoff/rendered.yaml" \
|
|
run_scanner >/dev/null; then
|
|
pass 'non-Secret CRD custom tags do not block streamed Secret validation'
|
|
else
|
|
fail 'non-Secret CRD custom tag blocked streamed Secret validation'
|
|
fi
|
|
cat >"$WORK/render-handoff/rendered.yaml" <<'YAML'
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: alertmanager-observability-core-kube-pr-alertmanager
|
|
namespace: observability
|
|
type: Opaque
|
|
data:
|
|
alertmanager.yaml: cmVjZWl2ZXJzOgotIG5hbWU6ICJudWxsIgpyb3V0ZToKICByZWNlaXZlcjogIm51bGwiCiAgcm91dGVzOiBbXQo=
|
|
alertmanager.yaml: cmVjZWl2ZXJzOgotIG5hbWU6ICJudWxsIgpyb3V0ZToKICByZWNlaXZlcjogIm51bGwiCiAgcm91dGVzOiBbXQo=
|
|
YAML
|
|
PLATFORM_SENSITIVE_SOURCE_RENDERED_MANIFESTS="$WORK/render-handoff/rendered.yaml" \
|
|
expect_reject 'duplicate rendered Secret keys fail closed' 'rendered.yaml'
|
|
cat >"$WORK/render-handoff/rendered.yaml" <<'YAML'
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: unexpected-rendered-secret
|
|
namespace: observability
|
|
type: Opaque
|
|
data:
|
|
allowed-looking-key: bm9uY3JlZGVudGlhbAo=
|
|
YAML
|
|
PLATFORM_SENSITIVE_SOURCE_RENDERED_MANIFESTS="$WORK/render-handoff/rendered.yaml" \
|
|
expect_reject 'a rendered Secret outside the exact allowlist is rejected' 'rendered.yaml'
|
|
|
|
new_fixture
|
|
printf 'target: spring-boot\n' >"$WORK/platform/services/observability/future-target.yaml"
|
|
expect_reject 'future observability target is rejected' 'platform/services/observability/future-target.yaml'
|
|
printf 'monitor-target: batch\n' >"$WORK/platform/services/observability/future-target.yaml"
|
|
expect_reject 'future batch target is rejected' 'platform/services/observability/future-target.yaml'
|
|
printf 'alert-target: backup\n' >"$WORK/platform/services/observability/future-target.yaml"
|
|
expect_reject 'future backup target is rejected' 'platform/services/observability/future-target.yaml'
|
|
rm -f -- "$WORK/platform/services/observability/future-target.yaml"
|
|
printf 'target: spring-boot\n' >"$WORK/platform/services/observability/future-target.md"
|
|
expect_reject 'future observability target in Markdown is rejected' \
|
|
'platform/services/observability/future-target.md'
|
|
|
|
new_fixture
|
|
cat >"$WORK/platform/scripts/validate/fake-renderer" <<'SH'
|
|
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
out=''
|
|
component=''
|
|
while (( $# > 0 )); do
|
|
case "$1" in
|
|
--verified-output-dir) out=$2; shift 2 ;;
|
|
--component) component=$2; shift 2 ;;
|
|
*) shift ;;
|
|
esac
|
|
done
|
|
label="$(basename -- "$0")"
|
|
handoff=no
|
|
[[ -z "$out" ]] || handoff=yes
|
|
printf '%s\n' "$label${component:+:$component}:handoff=$handoff" >>"$PLATFORM_SENSITIVE_SOURCE_RENDER_LOG"
|
|
|
|
emit_phase1_log() {
|
|
local publish=$1 name
|
|
for name in namespaces ssd-local-pv; do
|
|
printf 'Rendered %-20s %8d bytes\n' "$name" 123
|
|
done
|
|
printf 'Verified %-20s SHA-256 %064d\n' cloudnative-pg-chart 1
|
|
for name in cnpg-operator platform-postgres; do
|
|
printf 'Rendered %-20s %8d bytes\n' "$name" 123
|
|
done
|
|
printf 'Verified %-20s SHA-256 %064d\n' gitea-chart 2
|
|
for name in gitea gitea-oidc; do
|
|
printf 'Rendered %-20s %8d bytes\n' "$name" 123
|
|
done
|
|
if [[ "$publish" == yes ]]; then
|
|
printf 'Preserved six verified manifests for the apply handoff.\n'
|
|
fi
|
|
printf 'Phase 1 baseline and Gitea OIDC desired rendering invariants passed.\n'
|
|
printf 'Temporary rendered manifests and generated chart caches will be removed on exit.\n'
|
|
}
|
|
|
|
emit_core_log() {
|
|
local name count=10
|
|
for name in prometheus-operator-crds kube-prometheus-stack loki tempo alloy \
|
|
prometheus-node-exporter grafana prometheus-blackbox-exporter; do
|
|
printf 'Verified %-28s SHA-256 %064d\n' "$name" "$count"
|
|
count=$((count + 1))
|
|
done
|
|
for name in namespaces crds storage kps loki tempo alloy node-exporter grafana \
|
|
blackbox core-policies targets core-rules alerting dashboards aggregate; do
|
|
printf 'Rendered %-18s %8d bytes SHA-256 %064d\n' "$name" 123 "$count"
|
|
count=$((count + 1))
|
|
done
|
|
printf 'OBSERVABILITY CORE STATIC RENDER PASS\n'
|
|
}
|
|
|
|
emit_access_log() {
|
|
local name count=40
|
|
for name in prometheus-operator-crds kube-prometheus-stack loki tempo alloy \
|
|
prometheus-node-exporter grafana prometheus-blackbox-exporter; do
|
|
if [[ "${PLATFORM_SENSITIVE_SOURCE_FAKE_ACCESS_MISSING_VERIFIED:-0}" != 0 && \
|
|
"$name" == grafana ]]; then
|
|
continue
|
|
fi
|
|
printf 'Verified %-28s SHA-256 %064d\n' "$name" "$count"
|
|
count=$((count + 1))
|
|
done
|
|
access_rendered=(
|
|
namespaces crds storage kps loki tempo alloy node-exporter grafana
|
|
blackbox core-policies targets core-rules alerting dashboards aggregate
|
|
)
|
|
if [[ "${PLATFORM_SENSITIVE_SOURCE_FAKE_ACCESS_SWAP_RENDERED:-0}" != 0 ]]; then
|
|
access_rendered=(crds namespaces "${access_rendered[@]:2}")
|
|
fi
|
|
for name in "${access_rendered[@]}"; do
|
|
printf 'Rendered %-18s %8d bytes SHA-256 %064d\n' "$name" 123 "$count"
|
|
count=$((count + 1))
|
|
done
|
|
printf 'OBSERVABILITY CORE STATIC RENDER PASS\n'
|
|
printf 'OBSERVABILITY ACCESS STATIC RENDER PASS\n'
|
|
}
|
|
|
|
emit_admin_metadata_log() {
|
|
case "${PLATFORM_SENSITIVE_SOURCE_FAKE_ADMIN_LOG_VARIANT:-safe}" in
|
|
safe)
|
|
printf 'Pulled: docker.io/dpage/pgadmin4-helm:9.16.0\n'
|
|
printf 'Digest: sha256:%064d\n' 8
|
|
;;
|
|
wrong-registry)
|
|
printf 'Pulled: registry.example.test/dpage/pgadmin4-helm:9.16.0\n'
|
|
printf 'Digest: sha256:%064d\n' 8
|
|
;;
|
|
wrong-chart)
|
|
printf 'Pulled: docker.io/dpage/other-chart:9.16.0\n'
|
|
printf 'Digest: sha256:%064d\n' 8
|
|
;;
|
|
wrong-version)
|
|
printf 'Pulled: docker.io/dpage/pgadmin4-helm:9.16.1\n'
|
|
printf 'Digest: sha256:%064d\n' 8
|
|
;;
|
|
bad-digest)
|
|
printf 'Pulled: docker.io/dpage/pgadmin4-helm:9.16.0\n'
|
|
printf 'Digest: sha256:%063d\n' 8
|
|
;;
|
|
wrong-order)
|
|
printf 'Digest: sha256:%064d\n' 8
|
|
printf 'Pulled: docker.io/dpage/pgadmin4-helm:9.16.0\n'
|
|
;;
|
|
extra)
|
|
printf 'Pulled: docker.io/dpage/pgadmin4-helm:9.16.0\n'
|
|
printf 'Digest: sha256:%064d\n' 8
|
|
printf 'Fetched chart metadata.\n'
|
|
;;
|
|
*) exit 44 ;;
|
|
esac
|
|
}
|
|
|
|
if [[ "$label" == render-observability-access.sh ]]; then
|
|
[[ -z "$out" ]] || exit 42
|
|
[[ "${PLATFORM_SENSITIVE_SOURCE_FAKE_ACCESS_FAIL:-0}" == 0 ]] || exit 41
|
|
emit_access_log
|
|
if [[ "${PLATFORM_SENSITIVE_SOURCE_FAKE_ACCESS_PATH:-0}" != 0 ]]; then
|
|
printf 'Rendered /tmp/should-never-be-printed %d bytes SHA-256 %064d\n' 123 2
|
|
fi
|
|
if [[ "${PLATFORM_SENSITIVE_SOURCE_FAKE_ACCESS_DUPLICATE_CORE:-0}" != 0 ]]; then
|
|
printf 'OBSERVABILITY CORE STATIC RENDER PASS\n'
|
|
fi
|
|
if [[ "${PLATFORM_SENSITIVE_SOURCE_FAKE_ACCESS_SECRET:-0}" != 0 ]]; then
|
|
printf '%s\n' 'apiVersion: v1' 'kind: Secret' 'stringData:' ' password: should-never-be-printed'
|
|
fi
|
|
exit 0
|
|
fi
|
|
[[ -n "$out" && -d "$out" ]]
|
|
case "$label" in
|
|
render-phase1.sh)
|
|
names=(namespaces ssd-local-pv cnpg-operator platform-postgres gitea gitea-oidc)
|
|
;;
|
|
render-phase2.sh)
|
|
names=(phase2-namespaces aistor-local-pv keycloak-operator platform-postgres-keycloak keycloak aistor-operator minio-aistor aistor-network-policies)
|
|
;;
|
|
render-admin-services.sh)
|
|
names=(admin-namespace pgadmin-local-pv coredns-custom aistor-admin-oidc pgadmin)
|
|
;;
|
|
render-observability-core.sh)
|
|
names=(namespaces crds storage kps loki tempo alloy node-exporter grafana blackbox core-policies targets core-rules alerting dashboards aggregate)
|
|
;;
|
|
*) exit 43 ;;
|
|
esac
|
|
for name in "${names[@]}"; do
|
|
cat >"$out/$name.yaml" <<YAML
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: synthetic-$name
|
|
YAML
|
|
done
|
|
if [[ "$label" == render-phase1.sh ]]; then
|
|
for artifact in gitea gitea-oidc; do
|
|
cat >"$out/$artifact.yaml" <<'YAML'
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: gitea
|
|
namespace: gitea
|
|
type: Opaque
|
|
stringData:
|
|
assertions: ""
|
|
config_environment.sh: synthetic-fixture
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: gitea-init
|
|
namespace: gitea
|
|
type: Opaque
|
|
stringData:
|
|
configure_gitea.sh: synthetic-fixture
|
|
configure_gpg_environment.sh: synthetic-fixture
|
|
init_directory_structure.sh: synthetic-fixture
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: gitea-inline-config
|
|
namespace: gitea
|
|
type: Opaque
|
|
stringData:
|
|
_generals_: ""
|
|
actions: synthetic-fixture
|
|
cache: synthetic-fixture
|
|
database: synthetic-fixture
|
|
indexer: synthetic-fixture
|
|
metrics: synthetic-fixture
|
|
packages: synthetic-fixture
|
|
queue: synthetic-fixture
|
|
repository: synthetic-fixture
|
|
security: synthetic-fixture
|
|
server: synthetic-fixture
|
|
service: synthetic-fixture
|
|
session: synthetic-fixture
|
|
YAML
|
|
if [[ "$artifact" == gitea && \
|
|
"${PLATFORM_SENSITIVE_SOURCE_FAKE_BASELINE_OIDC_KEYS:-0}" != 0 ]]; then
|
|
printf ' oauth2_client: synthetic-fixture\n' >>"$out/$artifact.yaml"
|
|
fi
|
|
if [[ "$artifact" == gitea-oidc && \
|
|
"${PLATFORM_SENSITIVE_SOURCE_FAKE_OIDC_BASELINE_KEYS:-0}" == 0 ]]; then
|
|
printf ' oauth2_client: synthetic-fixture\n' >>"$out/$artifact.yaml"
|
|
fi
|
|
done
|
|
fi
|
|
if [[ "$label" == render-observability-core.sh ]]; then
|
|
if [[ "${PLATFORM_SENSITIVE_SOURCE_FAKE_CORE_MISSING:-0}" == 0 ]]; then
|
|
secret_name=alertmanager-observability-core-kube-pr-alertmanager
|
|
[[ "${PLATFORM_SENSITIVE_SOURCE_FAKE_UNKNOWN:-0}" == 0 ]] || secret_name=unexpected-rendered-secret
|
|
cat >"$out/kps.yaml" <<YAML
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: $secret_name
|
|
namespace: observability
|
|
type: Opaque
|
|
data:
|
|
alertmanager.yaml: cmVjZWl2ZXJzOgotIG5hbWU6ICJudWxsIgpyb3V0ZToKICByZWNlaXZlcjogIm51bGwiCiAgcm91dGVzOiBbXQo=
|
|
YAML
|
|
fi
|
|
if [[ "${PLATFORM_SENSITIVE_SOURCE_FAKE_AGGREGATE_MISSING:-0}" == 0 ]]; then
|
|
cat >>"$out/aggregate.yaml" <<'YAML'
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: alertmanager-observability-core-kube-pr-alertmanager
|
|
namespace: observability
|
|
type: Opaque
|
|
data:
|
|
alertmanager.yaml: cmVjZWl2ZXJzOgotIG5hbWU6ICJudWxsIgpyb3V0ZToKICByZWNlaXZlcjogIm51bGwiCiAgcm91dGVzOiBbXQo=
|
|
YAML
|
|
fi
|
|
python3 - "$out" <<'PY'
|
|
import hashlib
|
|
import json
|
|
import os
|
|
import sys
|
|
import yaml
|
|
|
|
directory = sys.argv[1]
|
|
artifacts = (
|
|
"namespaces", "crds", "storage", "kps", "loki", "tempo", "alloy",
|
|
"node-exporter", "grafana", "blackbox", "core-policies", "targets",
|
|
"core-rules", "alerting", "dashboards",
|
|
)
|
|
with open(os.path.join(directory, "resource-index.tsv"), "w", encoding="utf-8") as target:
|
|
target.write("order\tartifact\tapiVersion\tkind\tnamespace\tname\tcanonicalSha256\n")
|
|
order = 0
|
|
for artifact in artifacts:
|
|
with open(os.path.join(directory, artifact + ".yaml"), encoding="utf-8") as source:
|
|
for item in yaml.safe_load_all(source):
|
|
if item is None:
|
|
continue
|
|
order += 1
|
|
metadata = item.get("metadata") or {}
|
|
identity = (
|
|
str(item.get("apiVersion", "")), str(item.get("kind", "")),
|
|
str(metadata.get("namespace", "")), str(metadata.get("name", "")),
|
|
)
|
|
canonical = json.dumps(item, sort_keys=True, separators=(",", ":"), ensure_ascii=False)
|
|
digest = hashlib.sha256(canonical.encode("utf-8")).hexdigest()
|
|
target.write("\t".join((str(order), artifact, *identity, digest)) + "\n")
|
|
PY
|
|
if [[ "${PLATFORM_SENSITIVE_SOURCE_FAKE_INDEX_BAD:-0}" != 0 ]]; then
|
|
sed -i '2s/[0-9a-f]$/0/' "$out/resource-index.tsv"
|
|
fi
|
|
fi
|
|
if [[ "${PLATFORM_SENSITIVE_SOURCE_FAKE_GITEA_WRONG_ARTIFACT:-0}" != 0 && \
|
|
"$label" == render-phase1.sh ]]; then
|
|
cat >"$out/namespaces.yaml" <<'YAML'
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: gitea
|
|
namespace: gitea
|
|
type: Opaque
|
|
stringData:
|
|
assertions: synthetic-fixture
|
|
config_environment.sh: synthetic-fixture
|
|
YAML
|
|
fi
|
|
if [[ "${PLATFORM_SENSITIVE_SOURCE_FAKE_CORE_MISSING_GITEA_CROSSOVER:-0}" != 0 && \
|
|
"$label" == render-phase1.sh ]]; then
|
|
cat >"$out/gitea.yaml" <<'YAML'
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: gitea
|
|
namespace: gitea
|
|
type: Opaque
|
|
stringData:
|
|
assertions: synthetic-fixture
|
|
config_environment.sh: synthetic-fixture
|
|
YAML
|
|
fi
|
|
if [[ "${PLATFORM_SENSITIVE_SOURCE_FAKE_EXTRA_FILE:-0}" != 0 ]]; then
|
|
printf 'unexpected\n' >"$out/unexpected.bin"
|
|
fi
|
|
case "$label" in
|
|
render-phase1.sh)
|
|
emit_phase1_log yes
|
|
;;
|
|
render-phase2.sh)
|
|
printf 'Validating the Phase 1 baseline and Gitea OIDC desired profile first.\n'
|
|
emit_phase1_log no
|
|
for name in phase2-namespaces aistor-local-pv aistor-network-policies \
|
|
keycloak-operator platform-postgres-keycloak keycloak; do
|
|
printf 'Rendered %-24s %8d bytes\n' "$name" 123
|
|
done
|
|
printf 'Verified %-24s SHA-256 %064d\n' aistor-operator-chart 3
|
|
printf 'Rendered %-24s %8d bytes\n' aistor-operator 123
|
|
printf 'Verified %-24s SHA-256 %064d\n' aistor-objectstore-chart 4
|
|
printf 'Rendered %-24s %8d bytes\n' minio-aistor 123
|
|
printf 'Preserved eight verified manifests for the AIStor apply handoff.\n'
|
|
printf 'Phase 2 rendering and source invariants passed.\n'
|
|
printf 'No live ObjectStore CRD or Kubernetes cluster access was required.\n'
|
|
printf 'Temporary Phase 2 rendered manifests and generated chart caches will be removed on exit.\n'
|
|
;;
|
|
render-admin-services.sh)
|
|
emit_admin_metadata_log
|
|
printf '검증 %-18s SHA-256 %064d\n' pgadmin 5
|
|
printf '검증 %-18s SHA-256 %064d\n' aistor-objectstore 6
|
|
for name in admin-namespace pgadmin-local-pv coredns-custom aistor-admin-oidc pgadmin; do
|
|
printf '렌더 %-20s %8d bytes SHA-256 %064d\n' "$name" 123 7
|
|
done
|
|
printf 'ADMIN SERVICES STATIC RENDER PASS\n'
|
|
;;
|
|
render-observability-core.sh)
|
|
emit_core_log
|
|
;;
|
|
esac
|
|
if [[ "${PLATFORM_SENSITIVE_SOURCE_FAKE_LOG_INJECTION_LABEL:-}" == "$label" ]]; then
|
|
printf 'password: should-never-be-printed-renderer-log\n'
|
|
fi
|
|
SH
|
|
chmod 0755 "$WORK/platform/scripts/validate/fake-renderer"
|
|
for renderer in \
|
|
render-phase1.sh render-phase2.sh render-admin-services.sh \
|
|
render-observability-core.sh render-observability-access.sh; do
|
|
cp -- "$WORK/platform/scripts/validate/fake-renderer" \
|
|
"$WORK/platform/scripts/validate/$renderer"
|
|
done
|
|
: >"$WORK/renderer.log"
|
|
export PLATFORM_SENSITIVE_SOURCE_RENDER_LOG="$WORK/renderer.log"
|
|
scan_platform_renderer_secrets "$WORK/platform" >/dev/null || \
|
|
fail 'private renderer orchestration rejected safe exact outputs'
|
|
expected_renderers=$'render-phase1.sh:handoff=yes\nrender-phase2.sh:handoff=yes\nrender-admin-services.sh:handoff=yes\nrender-observability-core.sh:handoff=yes\nrender-observability-access.sh:grafana:handoff=no'
|
|
[[ "$(cat "$WORK/renderer.log")" == "$expected_renderers" ]] || \
|
|
fail 'private renderer orchestration did not run the exact renderer set'
|
|
pass 'private renderer orchestration scans the exact renderer set'
|
|
pass 'access renderer receives no verified output handoff'
|
|
pass 'core metadata is validated separately from exact YAML Secret inputs'
|
|
: >"$WORK/renderer.log"
|
|
renderer_rc=0
|
|
renderer_output="$(PLATFORM_SENSITIVE_SOURCE_FAKE_INDEX_BAD=1 \
|
|
scan_platform_renderer_secrets "$WORK/platform" 2>&1)" || renderer_rc=$?
|
|
(( renderer_rc != 0 )) || fail 'mismatched core canonical resource index was accepted'
|
|
[[ "$renderer_output" == *'observability-core resource index contract failed'* ]] || \
|
|
fail 'mismatched core canonical resource index did not fail at its contract'
|
|
pass 'core canonical resource index mismatch fails closed'
|
|
: >"$WORK/renderer.log"
|
|
renderer_rc=0
|
|
renderer_output="$(PLATFORM_SENSITIVE_SOURCE_FAKE_EXTRA_FILE=1 \
|
|
scan_platform_renderer_secrets "$WORK/platform" 2>&1)" || renderer_rc=$?
|
|
(( renderer_rc != 0 )) || fail 'unknown renderer handoff entry was accepted'
|
|
[[ "$renderer_output" == *'renderer handoff entry contract failed'* ]] || \
|
|
fail 'unknown renderer handoff entry did not fail at its entry contract'
|
|
pass 'unknown renderer handoff entries fail closed'
|
|
: >"$WORK/renderer.log"
|
|
renderer_rc=0
|
|
renderer_output="$(PLATFORM_SENSITIVE_SOURCE_FAKE_UNKNOWN=1 \
|
|
scan_platform_renderer_secrets "$WORK/platform" 2>&1)" || renderer_rc=$?
|
|
(( renderer_rc != 0 )) || fail 'non-allowlisted Secret from renderer orchestration was accepted'
|
|
[[ "$renderer_output" != *'alertmanager.yaml:'* ]] || fail 'renderer failure leaked manifest content'
|
|
pass 'private renderer orchestration rejects non-allowlisted Secret output'
|
|
: >"$WORK/renderer.log"
|
|
renderer_rc=0
|
|
renderer_output="$(PLATFORM_SENSITIVE_SOURCE_FAKE_CORE_MISSING=1 \
|
|
scan_platform_renderer_secrets "$WORK/platform" 2>&1)" || renderer_rc=$?
|
|
(( renderer_rc != 0 )) || fail 'missing allowlisted core Secret was accepted'
|
|
[[ "$renderer_output" == *'RENDERED_REQUIRED_SECRET_MISSING'* ]] || \
|
|
fail 'missing allowlisted core Secret did not produce its filename-free finding'
|
|
pass 'private renderer orchestration requires the core allowlisted Secret'
|
|
: >"$WORK/renderer.log"
|
|
renderer_rc=0
|
|
renderer_output="$(PLATFORM_SENSITIVE_SOURCE_FAKE_AGGREGATE_MISSING=1 \
|
|
scan_platform_renderer_secrets "$WORK/platform" 2>&1)" || renderer_rc=$?
|
|
(( renderer_rc != 0 )) || fail 'core aggregate without its Alertmanager Secret was accepted'
|
|
[[ "$renderer_output" == *'RENDERED_REQUIRED_SECRET_MISSING'* ]] || \
|
|
fail 'missing aggregate Alertmanager Secret did not produce its filename-free finding'
|
|
pass 'core aggregate requires its own exact Alertmanager Secret'
|
|
: >"$WORK/renderer.log"
|
|
renderer_rc=0
|
|
renderer_output="$(PLATFORM_SENSITIVE_SOURCE_FAKE_GITEA_WRONG_ARTIFACT=1 \
|
|
scan_platform_renderer_secrets "$WORK/platform" 2>&1)" || renderer_rc=$?
|
|
(( renderer_rc != 0 )) || fail 'allowlisted Gitea Secret in the wrong artifact was accepted'
|
|
pass 'Gitea rendered Secrets are pinned to their exact handoff artifacts'
|
|
: >"$WORK/renderer.log"
|
|
baseline_key_rc=0
|
|
baseline_key_output="$(PLATFORM_SENSITIVE_SOURCE_FAKE_BASELINE_OIDC_KEYS=1 \
|
|
scan_platform_renderer_secrets "$WORK/platform" 2>&1)" || baseline_key_rc=$?
|
|
: >"$WORK/renderer.log"
|
|
oidc_key_rc=0
|
|
oidc_key_output="$(PLATFORM_SENSITIVE_SOURCE_FAKE_OIDC_BASELINE_KEYS=1 \
|
|
scan_platform_renderer_secrets "$WORK/platform" 2>&1)" || oidc_key_rc=$?
|
|
(( baseline_key_rc != 0 )) || fail 'OIDC-only inline config keys were accepted in baseline Gitea'
|
|
(( oidc_key_rc != 0 )) || fail 'baseline inline config keys were accepted in OIDC Gitea'
|
|
[[ "$baseline_key_output$oidc_key_output" != *'should-never-be-printed'* ]] || \
|
|
fail 'Gitea artifact-specific key rejection leaked content'
|
|
pass 'Gitea inline config keys are exact for baseline and OIDC artifacts'
|
|
: >"$WORK/renderer.log"
|
|
renderer_rc=0
|
|
renderer_output="$(PLATFORM_SENSITIVE_SOURCE_FAKE_CORE_MISSING=1 \
|
|
PLATFORM_SENSITIVE_SOURCE_FAKE_CORE_MISSING_GITEA_CROSSOVER=1 \
|
|
scan_platform_renderer_secrets "$WORK/platform" 2>&1)" || renderer_rc=$?
|
|
(( renderer_rc != 0 )) || fail 'a Gitea Secret satisfied the missing core Secret requirement'
|
|
[[ "$renderer_output" == *'RENDERED_REQUIRED_SECRET_MISSING'* ]] || \
|
|
fail 'missing exact core Secret did not produce its filename-free finding'
|
|
pass 'Gitea allowlist results cannot satisfy the core Secret requirement'
|
|
for admin_log_variant in \
|
|
wrong-registry wrong-chart wrong-version bad-digest wrong-order extra; do
|
|
: >"$WORK/renderer.log"
|
|
renderer_rc=0
|
|
renderer_output="$(PLATFORM_SENSITIVE_SOURCE_FAKE_ADMIN_LOG_VARIANT="$admin_log_variant" \
|
|
scan_platform_renderer_secrets "$WORK/platform" 2>&1)" || renderer_rc=$?
|
|
(( renderer_rc != 0 )) || fail "admin $admin_log_variant metadata output was accepted"
|
|
[[ "$renderer_output" == *'unexpected renderer output contract: admin'* ]] || \
|
|
fail "admin $admin_log_variant metadata did not fail at its output contract"
|
|
pass "admin metadata rejects $admin_log_variant output"
|
|
done
|
|
: >"$WORK/renderer.log"
|
|
renderer_rc=0
|
|
renderer_output="$(PLATFORM_SENSITIVE_SOURCE_FAKE_ACCESS_FAIL=1 \
|
|
scan_platform_renderer_secrets "$WORK/platform" 2>&1)" || renderer_rc=$?
|
|
(( renderer_rc != 0 )) || fail 'nonzero access renderer was accepted'
|
|
[[ "$renderer_output" == *'renderer failed: observability-access RC=41'* ]] || \
|
|
fail 'nonzero access renderer did not fail closed at the access boundary'
|
|
pass 'private renderer orchestration fails closed on access renderer failure'
|
|
: >"$WORK/renderer.log"
|
|
renderer_rc=0
|
|
renderer_output="$(PLATFORM_SENSITIVE_SOURCE_FAKE_ACCESS_DUPLICATE_CORE=1 \
|
|
scan_platform_renderer_secrets "$WORK/platform" 2>&1)" || renderer_rc=$?
|
|
(( renderer_rc != 0 )) || fail 'duplicate access CORE PASS marker was accepted'
|
|
pass 'access output requires exactly one ordered CORE PASS marker'
|
|
: >"$WORK/renderer.log"
|
|
renderer_rc=0
|
|
renderer_output="$(PLATFORM_SENSITIVE_SOURCE_FAKE_ACCESS_MISSING_VERIFIED=1 \
|
|
scan_platform_renderer_secrets "$WORK/platform" 2>&1)" || renderer_rc=$?
|
|
(( renderer_rc != 0 )) || fail 'access output with only seven Verified lines was accepted'
|
|
pass 'access output requires the exact eight ordered Verified lines'
|
|
: >"$WORK/renderer.log"
|
|
renderer_rc=0
|
|
renderer_output="$(PLATFORM_SENSITIVE_SOURCE_FAKE_ACCESS_SWAP_RENDERED=1 \
|
|
scan_platform_renderer_secrets "$WORK/platform" 2>&1)" || renderer_rc=$?
|
|
(( renderer_rc != 0 )) || fail 'access output with reordered Rendered lines was accepted'
|
|
pass 'access output requires the exact sixteen ordered Rendered lines'
|
|
: >"$WORK/renderer.log"
|
|
renderer_rc=0
|
|
renderer_output="$(PLATFORM_SENSITIVE_SOURCE_FAKE_ACCESS_PATH=1 \
|
|
scan_platform_renderer_secrets "$WORK/platform" 2>&1)" || renderer_rc=$?
|
|
(( renderer_rc != 0 )) || fail 'access path-bearing progress output was accepted'
|
|
[[ "$renderer_output" != *'should-never-be-printed'* ]] || \
|
|
fail 'access path-bearing output leaked its path'
|
|
pass 'access output rejects path-bearing progress diagnostics'
|
|
: >"$WORK/renderer.log"
|
|
renderer_rc=0
|
|
renderer_output="$(PLATFORM_SENSITIVE_SOURCE_FAKE_ACCESS_SECRET=1 \
|
|
scan_platform_renderer_secrets "$WORK/platform" 2>&1)" || renderer_rc=$?
|
|
(( renderer_rc != 0 )) || fail 'unexpected access renderer Secret output was accepted'
|
|
[[ "$renderer_output" != *'should-never-be-printed'* ]] || \
|
|
fail 'unexpected access output leaked content'
|
|
pass 'access renderer cannot smuggle an independently unscanned Secret'
|
|
for injected_renderer in \
|
|
render-phase1.sh render-phase2.sh render-admin-services.sh \
|
|
render-observability-core.sh; do
|
|
: >"$WORK/renderer.log"
|
|
renderer_rc=0
|
|
renderer_output="$(PLATFORM_SENSITIVE_SOURCE_FAKE_LOG_INJECTION_LABEL="$injected_renderer" \
|
|
scan_platform_renderer_secrets "$WORK/platform" 2>&1)" || renderer_rc=$?
|
|
(( renderer_rc != 0 )) || fail "$injected_renderer unexpected stdout was accepted"
|
|
[[ "$renderer_output" != *'should-never-be-printed'* ]] || \
|
|
fail "$injected_renderer unexpected stdout leaked content"
|
|
pass "$injected_renderer stdout is restricted to its bounded grammar"
|
|
done
|
|
unset PLATFORM_SENSITIVE_SOURCE_RENDER_LOG
|
|
|
|
new_fixture
|
|
mkdir -p "$WORK/fake-bin"
|
|
printf '#!/usr/bin/env bash\nexit 2\n' >"$WORK/fake-bin/find"
|
|
chmod 0755 "$WORK/fake-bin/find"
|
|
PLATFORM_SENSITIVE_SOURCE_TEST_PATH="$WORK/fake-bin:/usr/local/bin:/usr/bin:/bin"
|
|
find_error_rc=0
|
|
output="$(run_scanner 2>&1)" || find_error_rc=$?
|
|
(( find_error_rc != 0 )) || fail 'find error was accepted'
|
|
[[ "$output" == *'SCANNER_ERROR'* ]] || {
|
|
printf '%s\n' "$output" >&2
|
|
fail 'find error did not fail closed'
|
|
}
|
|
pass 'find errors fail closed'
|
|
|
|
new_fixture
|
|
mkdir -p "$WORK/fake-bin"
|
|
printf '#!/usr/bin/env bash\nexit 2\n' >"$WORK/fake-bin/rg"
|
|
chmod 0755 "$WORK/fake-bin/rg"
|
|
printf 'ordinary input\n' >"$WORK/docs/plans/scanner-error.md"
|
|
PLATFORM_SENSITIVE_SOURCE_TEST_PATH="$WORK/fake-bin:/usr/local/bin:/usr/bin:/bin"
|
|
scanner_error_rc=0
|
|
output="$(run_scanner 2>&1)" || scanner_error_rc=$?
|
|
(( scanner_error_rc != 0 )) || fail 'scanner error was accepted'
|
|
[[ "$output" == *'SCANNER_ERROR'* ]] || {
|
|
printf '%s\n' "$output" >&2
|
|
fail 'scanner error did not fail closed'
|
|
}
|
|
pass 'rg errors fail closed'
|
|
|
|
cleanup_before="$(
|
|
find /tmp -maxdepth 1 -type d -name 'platform-sensitive-source-test.??????' \
|
|
-printf '%f\n' | LC_ALL=C sort
|
|
)"
|
|
PLATFORM_SENSITIVE_SOURCE_CLEANUP_PROBE=1 bash "$BASH_SOURCE"
|
|
cleanup_after="$(
|
|
find /tmp -maxdepth 1 -type d -name 'platform-sensitive-source-test.??????' \
|
|
-printf '%f\n' | LC_ALL=C sort
|
|
)"
|
|
[[ "$cleanup_after" == "$cleanup_before" ]] || \
|
|
fail 'focused cleanup probe left a platform-sensitive-source-test directory'
|
|
pass 'focused test cleanup leaves no temporary fixture residue'
|
|
|
|
printf 'PLATFORM SENSITIVE SOURCE ASSERTION TEST PASS (%d assertions)\n' "$ASSERTIONS"
|