97 lines
2.5 KiB
Markdown
97 lines
2.5 KiB
Markdown
# Canonical all-modified-files packager and secret scanning
|
|
|
|
## Problem
|
|
|
|
The historical all-modified-files evidence packager lived only as a copied handoff script.
|
|
|
|
Its private-key scanner matched the fragment:
|
|
|
|
```text
|
|
BEGIN PRIVATE KEY
|
|
```
|
|
|
|
instead of a complete PEM header. A regression test containing that literal therefore caused a
|
|
false secret finding even though the candidate contained no credential.
|
|
|
|
A task had to use a temporary evidence-only compatibility packager to complete its bundle. That is
|
|
acceptable as an emergency workaround but not as a durable unattended path.
|
|
|
|
## Repository source of truth
|
|
|
|
The canonical implementation is now:
|
|
|
|
```text
|
|
active-runtime/app/aios_all_modified_files_packager.py
|
|
```
|
|
|
|
It preserves the historical output/bundle schemas:
|
|
|
|
```text
|
|
aios.all-modified-files.bundle.v1
|
|
aios.all-modified-files.bundle-summary.v1
|
|
aios.modified-documents.index.v1
|
|
```
|
|
|
|
and the host-visible status lines:
|
|
|
|
```text
|
|
ALL_MODIFIED_FILES_BUNDLE=PASS
|
|
ALL_MODIFIED_FILES_BUNDLE_PATH=...
|
|
ALL_MODIFIED_FILES_BUNDLE_SHA256=...
|
|
```
|
|
|
|
Future governed tasks should use this repository version instead of copying an unversioned scanner.
|
|
|
|
## Secret scanning invariant
|
|
|
|
Private-key detection requires a complete PEM header:
|
|
|
|
```text
|
|
-----BEGIN [RSA|EC|DSA|OPENSSH ]PRIVATE KEY-----
|
|
```
|
|
|
|
The following source/test/document text is not secret material and must remain packageable:
|
|
|
|
```text
|
|
BEGIN PRIVATE KEY
|
|
PRIVATE KEY
|
|
PEM private-key header
|
|
```
|
|
|
|
Bearer and key/value credential detection remains fail-closed:
|
|
|
|
```text
|
|
Authorization: Bearer <20+ token chars>
|
|
password=<12+ non-space chars>
|
|
passwd=<12+ non-space chars>
|
|
secret=<12+ non-space chars>
|
|
api_key=<12+ non-space chars>
|
|
api-key=<12+ non-space chars>
|
|
```
|
|
|
|
Tests construct the real PEM header dynamically so the scanner's own test source does not contain a
|
|
literal credential-looking header.
|
|
|
|
## Bundle integrity
|
|
|
|
The packager continues to enforce:
|
|
|
|
- exact base→candidate ancestry;
|
|
- before/after file capture;
|
|
- rename/copy/delete handling;
|
|
- path traversal denial;
|
|
- execution evidence symlink denial;
|
|
- secret scan over repository before/after and execution evidence;
|
|
- document index;
|
|
- SHA-256 closure;
|
|
- ZIP without symlinks.
|
|
|
|
No secret finding is downgraded to a warning.
|
|
|
|
## Migration
|
|
|
|
The old handoff script may remain for historical reproducibility, but new handoffs should call the
|
|
repository packager from the verified candidate lineage.
|
|
|
|
A temporary compatibility scanner is no longer needed once this candidate is in the lineage.
|