mosaicstack/stack
14
0
Fork 1
Code Issues 315 Pull Requests 11 Actions Packages Projects Releases 15 Wiki Activity

bash -x leaks staged credentials across the wrapper fleet (parity gap held open by mint-seat-credential #1367) #1369

New Issue
Open
opened 2026-08-22 04:20:08 +00:00 by code-infra-01 · 0 comments
code-infra-01 commented 2026-08-22 04:20:08 +00:00
Member
Copy Link
Copy Source

From rev-security-01's review 263 on #1367 (control run by the reviewer): the landed gitea_write_auth_config in detect-platform.sh — the in-tree standard used by issue-comment.sh, pr-review.sh, pr-edit.sh — still expands tokens into shell words and leaks them under bash -x (three trace sites measured). #1367's mint-seat-credential.sh closes both argv and trace channels for itself (file-to-file assembly; verified by an xtrace assertion in its suite), which puts it AHEAD of the landed pattern, not at parity.

This issue records the fleet-wide gap so the parity debt is owned rather than implied:

  • Affected class: every wrapper that stages a credential through a shell-word expansion before writing it to a curl --config (detect-platform.sh's gitea_write_auth_config is the shared instance).
  • Not affected in this PR's scope: mint-seat-credential.sh (closed at review 263 blocker 1).
  • The fix shape is already proven in #1367: helpers take file PATHS, not values; jq --rawfile assembles configs and bodies file-to-file; secrets never become shell words.

Also from review 263, same disposition-to-write-down class: the instance host maps in seat-logins.sh and mint-seat-credential.sh are per-estate constants in the framework tree (accepted on the seat-logins precedent in #1367, explicitly not a reason to stop looking). A fleet-wide host-map/domain parameterization decision belongs here too.

Disposition per fred's 2026-08-22 rulings on #1367: those files were deliberately left alone in that PR; this issue is the tracked owner of the gap.

From rev-security-01's review 263 on #1367 (control run by the reviewer): the landed `gitea_write_auth_config` in detect-platform.sh — the in-tree standard used by issue-comment.sh, pr-review.sh, pr-edit.sh — still expands tokens into shell words and leaks them under `bash -x` (three trace sites measured). #1367's mint-seat-credential.sh closes both argv and trace channels for itself (file-to-file assembly; verified by an xtrace assertion in its suite), which puts it AHEAD of the landed pattern, not at parity. This issue records the fleet-wide gap so the parity debt is owned rather than implied: - Affected class: every wrapper that stages a credential through a shell-word expansion before writing it to a curl --config (detect-platform.sh's gitea_write_auth_config is the shared instance). - Not affected in this PR's scope: mint-seat-credential.sh (closed at review 263 blocker 1). - The fix shape is already proven in #1367: helpers take file PATHS, not values; jq --rawfile assembles configs and bodies file-to-file; secrets never become shell words. Also from review 263, same disposition-to-write-down class: the instance host maps in seat-logins.sh and mint-seat-credential.sh are per-estate constants in the framework tree (accepted on the seat-logins precedent in #1367, explicitly not a reason to stop looking). A fleet-wide host-map/domain parameterization decision belongs here too. Disposition per fred's 2026-08-22 rulings on #1367: those files were deliberately left alone in that PR; this issue is the tracked owner of the gap.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
code-be-01 (Mosaic fleet seat code-be-01) code-infra-01 (Mosaic fleet seat code-infra-01) fargo fred gate-merge-01 (Mosaic fleet seat gate-merge-01) happy jason.woltje (Jason Woltje) merge-gate ops-01 (Mosaic fleet seat ops-01) ops-02 (Mosaic fleet seat ops-02) ops-03 (Mosaic fleet seat ops-03) ops-ci-01 (Mosaic fleet seat ops-ci-01) ops-deploy-01 (Mosaic fleet seat ops-deploy-01) pepper rev-code-01 rev-code-02 rev-security-01 rev-security-02 rev-security-03 (Mosaic fleet seat rev-security-03) sanity scooby (Scooby) scrappy shaggy tiny velma veronica (Mosaic fleet seat veronica) vision woodpecker
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1369