Files
felhom.eu/documentation/audits/SPIKE-cc-creds-2026-10-17/probes/seen.py
T
adminandClaude Opus 5.5 b9c4f73bfa
gates / gates (push) Failing after 6m36s
SPIKE cc-creds: secret broker + CC transcript guards measured with canaries (R-1118..R-1122, 168 -> 173)
Mask PASS, PreToolUse refuse PASS, PostToolUse replace PARTIAL (crash and
large-output disk leaks, both with a measured fix), SOPS+age store PARTIAL
(private repo could not be created), transcript sweep PASS. Fake secrets
only; ~/.config/credentials not read; no CC settings changed. Files use
"creds": .gitignore *secret* ignores the brief's names. STATUS D10: the
store choice.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb
2026-10-17 11:57:24 +02:00

11 lines
642 B
Python

#!/usr/bin/env python3
"""Count occurrences of a canary in a capture file — raw, URL-encoded, and base64 as the `base64`
tool prints it (computed by the coreutils tool, NOT by mask.py, so a bug in mask's form table cannot
hide a leak from this checker). Prints a count only, never the value. seen.py CANARYFILE CAPTURE"""
import subprocess, sys, urllib.parse
v = open(sys.argv[1]).read().rstrip("\n")
data = open(sys.argv[2], "rb").read()
b64 = subprocess.run(["base64", "-w0"], input=v.encode(), capture_output=True).stdout
forms = {v.encode(), urllib.parse.quote(v, safe="").encode(), b64}
print(sum(data.count(f) for f in forms if f))