clawdie/clawdie-iso
Watch
1
0
Fork
You've already forked clawdie-iso
 0
Code Issues Pull requests Projects Releases 1 Packages Activity Actions

fix(release): refuse credential-bearing inputs for shared images #27

Merged
clawdie merged 1 commit from clawdie/fix/release-credential-exclusion into main 2026-10-30 00:28:58 +01:00 AGit
Conversation 0 Commits 1 Files changed 3 +143 -4
clawdie commented 2026-10-30 00:18:02 +01:00
Owner
Copy link

The release gate only inspected exported environment variables. It never
looked at the build host's provider.env store, the explicit tailscale auth key,
or the pi auth.json derived from that store, so a release assembly could still
place usable credentials inside the image.

  • scripts/release-credentials.sh: names violating inputs (TAILSCALE_AUTH_KEY,
    PROVIDER_ENV_STORE) without reading or printing values; stages provider lines
    only on the dev channel and writes nothing on release
  • build.sh: source the policy; check it in check_release_gate; use the staging
    helper so the provider store is not read on release (defense in depth exits if
    the gate is ever bypassed); pi auth.json is dev-only
  • tests/release-credentials-test.sh: hermetic canary fixtures for host store
    present, tailscale key supplied, SEED_PIN set and unset, dev exemption, and a
    negative control that dev still writes; 14 checks

SEED_PIN no longer changes the outcome: sealing is not exclusion.

Gates: sh -n build.sh, sh -n scripts/release-credentials.sh, new test 14/14,
scripts/ci-checks.sh PASS. Native FreeBSD run pending.

The release gate only inspected exported environment variables. It never looked at the build host's provider.env store, the explicit tailscale auth key, or the pi auth.json derived from that store, so a release assembly could still place usable credentials inside the image. - scripts/release-credentials.sh: names violating inputs (TAILSCALE_AUTH_KEY, PROVIDER_ENV_STORE) without reading or printing values; stages provider lines only on the dev channel and writes nothing on release - build.sh: source the policy; check it in check_release_gate; use the staging helper so the provider store is not read on release (defense in depth exits if the gate is ever bypassed); pi auth.json is dev-only - tests/release-credentials-test.sh: hermetic canary fixtures for host store present, tailscale key supplied, SEED_PIN set and unset, dev exemption, and a negative control that dev still writes; 14 checks SEED_PIN no longer changes the outcome: sealing is not exclusion. Gates: sh -n build.sh, sh -n scripts/release-credentials.sh, new test 14/14, scripts/ci-checks.sh PASS. Native FreeBSD run pending.
fix(release): refuse credential-bearing inputs for shared images
All checks were successful
format-check / gates (pull_request) Successful in 19s
Details
d7782f5397 
The release gate only inspected exported environment variables. It never
looked at the build host's provider.env store, the explicit tailscale auth key,
or the pi auth.json derived from that store, so a release assembly could still
place usable credentials inside the image.

- scripts/release-credentials.sh: names violating inputs (TAILSCALE_AUTH_KEY,
  PROVIDER_ENV_STORE) without reading or printing values; stages provider lines
  only on the dev channel and writes nothing on release
- build.sh: source the policy; check it in check_release_gate; use the staging
  helper so the provider store is not read on release (defense in depth exits if
  the gate is ever bypassed); pi auth.json is dev-only
- tests/release-credentials-test.sh: hermetic canary fixtures for host store
  present, tailscale key supplied, SEED_PIN set and unset, dev exemption, and a
  negative control that dev still writes; 14 checks

SEED_PIN no longer changes the outcome: sealing is not exclusion.

Gates: sh -n build.sh, sh -n scripts/release-credentials.sh, new test 14/14,
scripts/ci-checks.sh PASS. Native FreeBSD run pending.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
clawdie/clawdie-iso!27
No description provided.