security_scan_gate.py: govulncheck (called vulns) + gitleaks on the pushed commits in every repo's fast set and CI, warn-first, with an accepted-hits file and 8 decoys (R-986); first scan triaged: 0 real secrets, 0 called vulnerabilities; evidence for R-953 and the 0.335.0 release
gates / gates (push) Failing after 12m59s
gates / gates (push) Failing after 12m59s
This commit is contained in:
admin committed
1 parent
d92a712ee4
commit
15f7428871
15 files changed
+811
-2
No files matched your search
@@ -0,0 +1,46 @@
|
||||
# R-953 read-back, 2026-10-19 18:21:10 UTC (read only; no sync, no kubectl change)
|
||||
|
||||
## ArgoCD app felhom
|
||||
sync: Synced rev: a28f162c health: Healthy
|
||||
tracked resources (25):
|
||||
ConfigMap/filebrowser-config Synced
|
||||
ConfigMap/git-sync-sparse-checkout Synced
|
||||
ConfigMap/hub-config Synced
|
||||
ConfigMap/nginx-config Synced
|
||||
PersistentVolumeClaim/filebrowser-db Synced
|
||||
PersistentVolumeClaim/filebrowser-files Synced
|
||||
PersistentVolumeClaim/hub-data Synced
|
||||
PersistentVolumeClaim/umami-db-data Synced
|
||||
Service/contact-mailer Synced
|
||||
Service/felhom-webpage Synced
|
||||
Service/filebrowser Synced
|
||||
Service/hub Synced
|
||||
Service/umami Synced
|
||||
Service/umami-db Synced
|
||||
Deployment/contact-mailer Synced
|
||||
Deployment/felhom-webpage Synced
|
||||
Deployment/filebrowser Synced
|
||||
Deployment/hub Synced
|
||||
Deployment/umami Synced
|
||||
Deployment/umami-db Synced
|
||||
Ingress/contact-mailer Synced
|
||||
Ingress/felhom-webpage Synced
|
||||
Ingress/filebrowser Synced
|
||||
Ingress/hub Synced
|
||||
Ingress/umami Synced
|
||||
|
||||
## the three Secrets (describe: names, labels, annotations, key sizes — no values)
|
||||
Name: gitea-creds
|
||||
Labels: <none>
|
||||
Annotations: <none>
|
||||
Name: umami-config
|
||||
Labels: <none>
|
||||
Annotations: <none>
|
||||
Name: healthchecks-config
|
||||
Labels: <none>
|
||||
Annotations: <none>
|
||||
|
||||
NAME TYPE DATA AGE
|
||||
gitea-creds Opaque 2 241d
|
||||
umami-config Opaque 2 255d
|
||||
healthchecks-config Opaque 10 257d
|
||||
@@ -0,0 +1,70 @@
|
||||
# R-986 — first scan of today's main, every hit with a verdict (2026-10-19)
|
||||
|
||||
Tools: gitleaks 8.24.3 (default rules pinned, no repo ignore file), govulncheck v1.8.0 built with go1.27.2
|
||||
(v1.1.4, the 2026-10-12 pin, panics on Go 1.27 source — `unexpected expr: *ast.KeyValueExpr` — so the
|
||||
newest release older than two weeks was taken). Values were never printed: each line was read with every
|
||||
value-like token replaced by its length and a hash prefix.
|
||||
|
||||
## govulncheck (called vulnerabilities only)
|
||||
|
||||
| module | called | imported/required only |
|
||||
|---|---|---|
|
||||
| felhom-controller `controller` | 0 | 1 |
|
||||
| felhom.eu `hub` | 0 | 1 |
|
||||
| felhom-agent `.` | 0 | 1 |
|
||||
| app-catalog | no Go module | — |
|
||||
|
||||
## gitleaks — full history (`--all`)
|
||||
|
||||
| repo | commits | hits | 2026-10-12 review | new since |
|
||||
|---|---|---|---|---|
|
||||
| felhom-controller | 1370 | 12 | 12 | 0 |
|
||||
| felhom.eu | 2102 | 50 | 43 | 7 (below) |
|
||||
| felhom-agent | 539 | 15 | 15 | 0 |
|
||||
| app-catalog-felhom.eu | 519 | 1 | 1 | 0 |
|
||||
|
||||
The 7 new history hits are files still in the tree (the usenet bench 5, the boot journal 1, r1140_accesslog_test.go 1) — their verdicts are in the tree table.
|
||||
|
||||
## gitleaks — today's tree (`git archive HEAD`)
|
||||
|
||||
Verdicts: **real** = a live secret (none); **accepted** = a value that opens nothing that matters now, listed in the repo's `.security-accepted`; **false** = not a secret.
|
||||
|
||||
| repo | n | rule | file | verdict | why |
|
||||
|---|---|---|---|---|---|
|
||||
| felhom-controller | 1 | generic-api-key | `controller/internal/backup/offbox_offer_shapec_r241_test.go` | false | a test constant or a decoy value, no live secret |
|
||||
| felhom-controller | 1 | generic-api-key | `controller/internal/stacks/samba_test.go` | false | a test constant or a decoy value, no live secret |
|
||||
| felhom-controller | 2 | generic-api-key | `controller/scripts/test_gate_decoys.py` | false | a test constant or a decoy value, no live secret |
|
||||
| felhom.eu | 1 | generic-api-key | `documentation/audits/evidence-fixes-first-tester-2026-09-30/part0/cloudflare-dns.txt` | false | a tunnel ID (a UUID), not the tunnel token |
|
||||
| felhom.eu | 1 | generic-api-key | `documentation/audits/evidence-rehearsal-2026-08-09/GATE0-demo-hp-before.txt` | false | a WireGuard PUBLIC key |
|
||||
| felhom.eu | 1 | generic-api-key | `documentation/audits/evidence-rehearsal-2026-08-09/P1-demo-hp-after.txt` | false | a WireGuard PUBLIC key |
|
||||
| felhom.eu | 1 | generic-api-key | `documentation/audits/family-gate-2026-10-02/tools/fg_items.py` | false | test strings in an audit tool (websocket probe labels) |
|
||||
| felhom.eu | 1 | generic-api-key | `documentation/audits/new-apps-2026-10-01/tools/newapp_box.py` | accepted | a throwaway test user's password in an audit tool for a fresh-app walk on a Tier-0 box |
|
||||
| felhom.eu | 1 | generic-api-key | `documentation/audits/night-2026-09-23/chaos/round-01-run.txt` | accepted | the same demo app session token as round-01.log |
|
||||
| felhom.eu | 1 | generic-api-key | `documentation/audits/night-2026-09-23/chaos/round-01.log` | accepted | a demo app's session token, demo-hp 2026-09-23 (Tier 0); the 2026-10-12 review found no running demo app with it |
|
||||
| felhom.eu | 1 | generic-api-key | `documentation/audits/night-rulings-2026-09-30/D/D3-wanderer-routes-probe.txt` | accepted | a throwaway app's session cookie (wanderer probe, 2026-09-30, Tier 0) |
|
||||
| felhom.eu | 3 | generic-api-key | `documentation/audits/offsite-lock-build-2026-10-03/partD/demo-hp-migration.txt` | false | an SSH key FINGERPRINT in a log line, not a key |
|
||||
| felhom.eu | 1 | generic-api-key | `documentation/audits/permanent-gate-2026-10-01/tools/items12.py` | false | test strings in an audit tool (websocket probe labels) |
|
||||
| felhom.eu | 1 | generic-api-key | `documentation/audits/power-cut-fixes-2026-10-14/E/demo-hp-journal-boot.txt` | false | the id of HP's public UEFI certificate in a boot journal |
|
||||
| felhom.eu | 1 | generic-api-key | `documentation/audits/r890-instructions-2026-10-06/tools/wgerwalk.py` | accepted | a throwaway wger walk's API token in an audit tool (Tier 0) |
|
||||
| felhom.eu | 2 | generic-api-key | `documentation/audits/signup-lock-2026-09-29/B/wd.sh` | accepted | a stranger-probe test password in an audit script (signup lock, Tier 0) |
|
||||
| felhom.eu | 1 | generic-api-key | `documentation/audits/update-night-2026-09-21/apps/actualbudget/log.txt` | accepted | a demo app's session token, demo-hp 2026-09-21 (Tier 0); no running demo app has it (2026-10-12 review) |
|
||||
| felhom.eu | 1 | generic-api-key | `documentation/audits/update-night-2026-09-21/batchA.log` | accepted | the same demo app session token as actualbudget/log.txt |
|
||||
| felhom.eu | 1 | generic-api-key | `documentation/audits/usenet-2026-10-12/nzbget-bench/03-process-and-entrypoint.txt` | accepted | a bench app's generated control password (LXC 9401, stopped; app removed from 9202 at teardown) |
|
||||
| felhom.eu | 2 | generic-api-key | `documentation/audits/usenet-2026-10-12/sabnzbd-bench/02-telemetry-and-net.txt` | accepted | a bench app's generated API key (LXC 9401, stopped; app removed from 9202 at teardown) |
|
||||
| felhom.eu | 2 | generic-api-key | `documentation/audits/usenet-2026-10-12/sabnzbd-bench/13-compose-resolved.txt` | accepted | a bench app's generated admin password and API key (LXC 9401, stopped; app removed from 9202) |
|
||||
| felhom.eu | 2 | generic-api-key | `documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_bookstack.json` | accepted | dry-run deploy values of a 2026-07-07 campaign (generated, demo boxes since rebuilt) |
|
||||
| felhom.eu | 3 | generic-api-key | `documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_paperless-ngx.json` | accepted | dry-run deploy values of a 2026-07-07 campaign (generated, demo boxes since rebuilt) |
|
||||
| felhom.eu | 1 | generic-api-key | `documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_vaultwarden.json` | accepted | dry-run deploy values of a 2026-07-07 campaign (generated, demo boxes since rebuilt) |
|
||||
| felhom.eu | 7 | generic-api-key | `documentation/tests/campaign2-evidence-2026-07-07/state/runner.log` | accepted | the same dry-run deploy values in the campaign runner's log |
|
||||
| felhom.eu | 2 | generic-api-key | `documentation/tests/walk5-r201-2026-08-07/journal.md` | false | sha256 digests compared in a walk journal, not secrets |
|
||||
| felhom.eu | 1 | generic-api-key | `hub/internal/api/r1140_accesslog_test.go` | false | a test constant or a decoy value, no live secret |
|
||||
| felhom.eu | 1 | generic-api-key | `hub/internal/store/r879_box_seal_test.go` | false | a test constant or a decoy value, no live secret |
|
||||
| felhom.eu | 1 | generic-api-key | `hub/internal/web/bind_language_test.go` | false | a test constant or a decoy value, no live secret |
|
||||
| felhom.eu | 1 | generic-api-key | `hub/internal/web/render_test.go` | false | a test constant or a decoy value, no live secret |
|
||||
| felhom-agent | 1 | generic-api-key | `internal/escrow/identity_test.go` | false | a test constant or a decoy value, no live secret |
|
||||
| felhom-agent | 11 | generic-api-key | `internal/escrow/recover_retained_test.go` | false | a test constant or a decoy value, no live secret |
|
||||
| felhom-agent | 1 | generic-api-key | `internal/escrow/recover_test.go` | false | a test constant or a decoy value, no live secret |
|
||||
| felhom-agent | 1 | generic-api-key | `internal/localapi/escrow_stage_test.go` | false | a test constant or a decoy value, no live secret |
|
||||
| felhom-agent | 1 | generic-api-key | `internal/pbsdr/wrapper_read_test.go` | false | a test constant or a decoy value, no live secret |
|
||||
|
||||
**Real secrets: 0.** app-catalog-felhom.eu: 0 tree hits (its one history hit is a health-probe URL, the 2026-10-12 verdict).
|
||||
@@ -0,0 +1,2 @@
|
||||
## per-customer floors 0.335.0 / MinAgent 0.158.1 — 18:22:21 UTC: tester-1, demo-hp, demo-felhom each HTTP 303 Location /customers/<id>?flash=floor_set
|
||||
## boxes moved (hub reports, 18:38:57 UTC read): demo-felhom 18:37:34 0.335.0; tester-1 18:37:34 0.335.0; demo-hp 18:37:36 0.335.0 (from 0.335.0-rc.1)
|
||||
@@ -0,0 +1,27 @@
|
||||
=== demo-hp (enkisfelhom.hu) 18:38:57
|
||||
containers: 24 running; not healthy/running: traefik Up 3 days;
|
||||
unhealthy: 0
|
||||
2026/10/19 18:22:34 updater.go:855: [INFO] [selfupdate] Post-update startup: update successful (0.335.0-rc.1 → 0.335.0)
|
||||
allow-list refusals since start: 0
|
||||
2026/10/19 18:22:34 sync.go:142: [INFO] [sync] Initial sync: Sablonok naprakészek — nincs változás
|
||||
installed apps (stacks with app.yaml): 12
|
||||
public https://felhom.enkisfelhom.hu/: 302
|
||||
public https://files.enkisfelhom.hu/: 200
|
||||
=== demo-felhom (demo-felhom.eu) 18:38:59
|
||||
containers: 9 running; not healthy/running: traefik Up 3 days;
|
||||
unhealthy: 0
|
||||
2026/10/19 18:22:23 [INFO] [selfupdate] Post-update startup: update successful (0.334.0 → 0.335.0)
|
||||
allow-list refusals since start: 0
|
||||
2026/10/19 18:22:24 [INFO] [sync] Initial sync: Sablonok naprakészek — nincs változás
|
||||
installed apps (stacks with app.yaml): 5
|
||||
public https://felhom.demo-felhom.eu/: 302
|
||||
public https://files.demo-felhom.eu/: 200
|
||||
=== tester-1 (enkicsifelhom.hu) 18:39:01
|
||||
containers: 10 running; not healthy/running: traefik Up 3 days;
|
||||
unhealthy: 0
|
||||
2026/10/19 18:22:33 [INFO] [selfupdate] Post-update startup: update successful (0.334.0 → 0.335.0)
|
||||
allow-list refusals since start: 0
|
||||
2026/10/19 18:22:33 [INFO] [sync] Initial sync: Sablonok naprakészek — nincs változás
|
||||
installed apps (stacks with app.yaml): 3
|
||||
public https://felhom.enkicsifelhom.hu/: 302
|
||||
public https://files.enkicsifelhom.hu/: 200
|
||||
@@ -0,0 +1,33 @@
|
||||
control NEGATIVE (a stub answering 200 over plain http): convicted, as it must (200 -)
|
||||
== tester-1 (enkicsifelhom.hu): 6 public name(s)
|
||||
OK control POSITIVE http://felhom.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://felhom.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://files.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://files.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://no-such-name-r1033.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://no-such-name-r1033.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://paperless.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://paperless.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://paste.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://paste.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://wiki.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://wiki.enkicsifelhom.hu/r1033-check?q=1
|
||||
== demo-hp (enkisfelhom.hu): 14 public name(s)
|
||||
OK http://arcade.enkisfelhom.hu/r1033-check?q=1 -> 301 https://arcade.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://books.enkisfelhom.hu/r1033-check?q=1 -> 301 https://books.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://docs.enkisfelhom.hu/r1033-check?q=1 -> 301 https://docs.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://felhom.enkisfelhom.hu/r1033-check?q=1 -> 301 https://felhom.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://files.enkisfelhom.hu/r1033-check?q=1 -> 301 https://files.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://gist.enkisfelhom.hu/r1033-check?q=1 -> 301 https://gist.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://ha.enkisfelhom.hu/r1033-check?q=1 -> 301 https://ha.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://no-such-name-r1033.enkisfelhom.hu/r1033-check?q=1 -> 301 https://no-such-name-r1033.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://papir.enkisfelhom.hu/r1033-check?q=1 -> 301 https://papir.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://paste.enkisfelhom.hu/r1033-check?q=1 -> 301 https://paste.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://pdf.enkisfelhom.hu/r1033-check?q=1 -> 301 https://pdf.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://plex.enkisfelhom.hu/r1033-check?q=1 -> 301 https://plex.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://travel.enkisfelhom.hu/r1033-check?q=1 -> 301 https://travel.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://wiki.enkisfelhom.hu/r1033-check?q=1 -> 301 https://wiki.enkisfelhom.hu/r1033-check?q=1
|
||||
== demo-felhom (demo-felhom.eu): 8 public name(s)
|
||||
OK http://felhom.demo-felhom.eu/r1033-check?q=1 -> 301 https://felhom.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://files.demo-felhom.eu/r1033-check?q=1 -> 301 https://files.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://gist.demo-felhom.eu/r1033-check?q=1 -> 301 https://gist.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://no-such-name-r1033.demo-felhom.eu/r1033-check?q=1 -> 301 https://no-such-name-r1033.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://prowlarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://prowlarr.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://radarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://radarr.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://sonarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://sonarr.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://torrent.demo-felhom.eu/r1033-check?q=1 -> 301 https://torrent.demo-felhom.eu/r1033-check?q=1
|
||||
== every public name redirects http -> https
|
||||
@@ -0,0 +1,16 @@
|
||||
== demo-hp
|
||||
dashboard sign-in: 302
|
||||
the Fajlok button goes to: https://files.enkisfelhom.hu/_felhom/sso
|
||||
the pass answer goes to: https://files.enkisfelhom.hu/files/; files cookie set: 1
|
||||
FileBrowser with the files cookie: felhom-household admin: False modify: True
|
||||
FileBrowser without it, a fresh browser: HTTP 401
|
||||
dashboard sign-out: 302
|
||||
after the sign-out, the files cookie sends the browser to: https://felhom.enkisfelhom.hu/__files/open?to=%2Ffiles%2F
|
||||
== tester-1
|
||||
dashboard sign-in: 302
|
||||
the Fajlok button goes to: https://files.enkicsifelhom.hu/_felhom/sso
|
||||
the pass answer goes to: https://files.enkicsifelhom.hu/files/; files cookie set: 1
|
||||
FileBrowser with the files cookie: felhom-household admin: False modify: True
|
||||
FileBrowser without it, a fresh browser: HTTP 401
|
||||
dashboard sign-out: 302
|
||||
after the sign-out, the files cookie sends the browser to: https://felhom.enkicsifelhom.hu/__files/open?to=%2Ffiles%2F
|
||||
@@ -0,0 +1,13 @@
|
||||
## global floor 0.335.0 / MinAgent 0.158.1 — 18:39:26 UTC
|
||||
HTTP/1.1 303 See Other
|
||||
Location: /configuration?flash=floor_set
|
||||
## per-box floors cleared — 18:39:26 UTC
|
||||
tester-1: HTTP/1.1 303 See Other Location: /customers/tester-1?flash=floor_set
|
||||
demo-hp: HTTP/1.1 303 See Other Location: /customers/demo-hp?flash=floor_set
|
||||
demo-felhom: HTTP/1.1 303 See Other Location: /customers/demo-felhom?flash=floor_set
|
||||
## read back (hub.db + WAL, one tar)
|
||||
min_controller_version|0.335.0
|
||||
min_controller_version_declared_min_agent|0.335.0=0.158.1
|
||||
demo-felhom|
|
||||
demo-hp|
|
||||
tester-1|
|
||||
@@ -76,6 +76,23 @@ verify off) — each sits beside a certificate pin, noise. G407/G404 — the exp
|
||||
backoff jitter uses math/rand, noise. G101 — comments and constant names, noise. G304/G301/G306/G104 — bulk noise,
|
||||
not filed.
|
||||
|
||||
## 5. Proposed push gate
|
||||
## 5. The push gate (R-986, wired 2026-10-19)
|
||||
|
||||
Not wired in this session. Shape: R-986.
|
||||
`scripts/security_scan_gate.py` (shared by the four repos, in each runner's FAST set and in CI), **warn-first**: it lists
|
||||
hits and exits 0. govulncheck (called vulnerabilities only) on each Go module; gitleaks on the commits being pushed;
|
||||
accepted hits per repo in `.security-accepted` (gitleaks by rule + a hash of the hit's line + file, so one accepted
|
||||
test constant does not accept the next secret in the same file). First scan of every repo's `main` with verdicts:
|
||||
`documentation/audits/night-2026-10-19/P7/triage.md` (0 real secrets, 0 called vulnerabilities).
|
||||
|
||||
| tool | version | how installed | sha256 |
|
||||
|---|---|---|---|
|
||||
| govulncheck | **v1.8.0** (2026-09-08), built with go1.27.2 | `GOTOOLCHAIN=go1.27.2 go install golang.org/x/vuln/cmd/govulncheck@v1.8.0` → `tools/security/bin/govulncheck-v1.8.0` (`govulncheck` links to it) | `aec435d4c0b29cb8987d466ae61ed4c334eab7d4b58073aaa873702c50a0da02` |
|
||||
| gitleaks | 8.24.3 (unchanged) | the same binary; CI fetches the release tarball | tarball `9991e0b2903da4c8f6122b5c3186448b927a5da4deef1fe45271c3793f4ee29c` (the release's own checksums file), binary `e18325d5…69ad` |
|
||||
|
||||
**Why the govulncheck pin moved:** v1.1.4 (the 2026-10-12 pin) cannot read the repos since they moved to Go 1.27.2:
|
||||
built with go1.26 it fails to load the standard library (`unknown field rfd in struct literal of type splicePipe`), and
|
||||
rebuilt with go1.27.2 it panics in its SSA builder (`unexpected expr: *ast.KeyValueExpr`). v1.8.0 is the newest release
|
||||
older than two weeks (v1.9.0 is from 2026-10-11). The old binary is kept as `govulncheck-v1.1.4-go1.26.0`.
|
||||
|
||||
**CI:** the runner has python3 and git and no Go, so govulncheck says NOT CHECKED there, out loud; the pre-push hook
|
||||
(with Go) runs it. gitleaks is fetched pinned (`FELHOM_SCAN_FETCH=1` in each `gates.yml`), both checksums checked.
|
||||
Reference in new issue
Block a user