gcaba-sync.sh vendored with the GCABA GitLab password inline in a tracked file (b6a41e5b, MOVILBA-460); commit scanner misses _PASS=

Sub-tickets

Activity

• wi-cli-venus created · 4w ago
• wi-cli-venus note · 4w ago
  Dos decisiones abiertas de Elazar, pendientes de su respuesta (no bloquean otro trabajo): (1) Purga de historia en GitHub (dev+main, remotos origin/lezama/dev/staging). El la autorizo con la premisa 'porque es un repo de GCABA'. Medido 2026-09-17: la exposicion del lado GCABA es el ARBOL VIVO de develop (source/gcaba-sync.sh con el literal del secreto, v5.5.222), NO la historia - el push del pod es un force-push historyless de un solo commit. Un push de mba-deploy-pod.sh con el arbol ya sin el archivo borra esa exposicion; reescribir nuestra historia de GitHub no toca nada del lado de ellos. Propuesto: push del pod primero en cualquier caso. (2) Backup de la segunda credencial de GitLab GCABA antes de borrar GCABA_GITLAB_USER/GCABA_GITLAB_PASSWORD de ~/.llmmsg-env. El pidio 'b (make sure they are backed up elsewhere)' y la condicion NO se cumple: ~/.git-credentials tiene una entrada de repositorio-asi de una cuenta DISTINTA (usuario 15 vs 11 caracteres, password 26 vs 17, no matchea ni crudo ni url-decodificado). Cero consumidores de GCABA_GITLAB_* quedan en el codigo. Borrado RETENIDO hasta que el diga donde va el backup.
• coder03assistant-mba-l-ca blocked · 3w ago
  coder03assistant-mba-l-ca | 2026-09-24 04:09:48 ART | dev 7d299b6a: old gcaba-sync.sh is absent from live tree, but tracked historical secret exposure remains a decision for Elazar; rotation requires his explicit request. sh.git gitcommit.sh _PASS scanner belongs host maintainer; its fix not verified here. Blocked on history disposition and host-owner scanner work; no credential operation.
• coder03-mba-l-cc assigned · 2w ago
  coder04-mba-l-ca
• audit-mba-l-cc audit-finding · 2w ago
  audit-mba-l-cc 2026-10-01 21:08 ART. Three measurements, no fix applied, no secret value pasted anywhere. 1) Working tree: gcaba-sync.sh absent, 'git ls-files --error-unmatch gcaba-sync.sh' fails (not tracked, not on disk). Removed from main by eee7fa59 (2026-09-18). 2) History: 4 commits touch the file - b6a41e5b (vendored, literal), 866dcba1 (moved to overlay, same session), 9ec90df3, eee7fa59 (dropped). NONE is an ancestor of current HEAD/any branch - confirmed via merge-base and 'branch --all --contains', zero hits. All 4 are reachable only via local reflog (refs/remotes/origin/dev@{261}, dev/dev@{262}) - a prior history purge (reset --soft, per project convention) removed them from live refs. Reflog is LOCAL and expires; whether the literal still exists on origin/GitHub or in any other clone was NOT checked from here. 3) Scanner gap (gitcommit.sh v1.8), tested black-box in an isolated throwaway repo, source not read (outside this project's read boundary): positive control 'TOKEN=<value>' -> ABORT, confirmed working. Then 'GITLAB_PASS=<value>' -> committed clean, no abort. Gap confirmed exactly as reported: the scanner's secret-named-key pattern misses the _PASS= form. Remediation (rotate/ignore/scrub) is Elazar's decision, not mine.
• coder03-mba-l-cc note · 2w ago
  2026-10-01 21:10 ART, coder03-mba-l-cc, on top of audit's measurement of the same hour. The scanner gap audit confirmed black-box in gitcommit.sh is REAL but it is not MovilBA's gate, and that makes the MovilBA-scope finding worse rather than better: MOVILBA-460 establishes that this repo owns its whole deploy toolchain and uses nothing from sh.git, so gitcommit.sh never runs on any ship path here. Measured now: grep for _PASS, TOKEN=, SECRET, API_KEY, PRIVATE_KEY, secret and scan across mba-deploy-dev.sh, mba-deploy-prod.sh, mba-deploy-pod.sh and mba-lib.sh returns ZERO hits, and .git/hooks/ holds no non-sample hook at all. Positive control that the files were actually read, same invocation: mba-deploy-dev.sh 229 lines 20 'git' hits, mba-deploy-prod.sh 110 lines 12, mba-deploy-pod.sh 177 lines 18, mba-lib.sh 344 lines 25. So MovilBA has NO secret scanner on any ship path - not one with a _PASS= gap, none. Both deploy scripts commit and push without inspecting content. SIN EJERCITAR: whether the four SHAs audit found (b6a41e5b, 866dcba1, 9ec90df3, eee7fa59) are reachable on the GitHub remote or on the GCABA mirror. Audit measured only this checkout's reflog and said so; unreachable-from-any-local-branch does not establish unreachable-from-a-remote, and the GCABA mirror is pushed manually from whey. Asked proxy-mba-w-cc, which owns the mirror, to measure it there. Nothing rotated, nothing reset, no value read or pasted - standing order, Elazar's explicit ask only.
• coder03-mba-l-cc note · 2w ago
  2026-10-01 21:12 ART, coder03-mba-l-cc. proxy-mba-w-cc measured the reachability from whey, which is the leg neither audit nor I could reach. Positive control first: a known-good SHA reported present on origin/main at GitHub and on gitlab/develop, so the probe works. Then all refs fetched from both remotes into one clone: b6a41e5b, 866dcba1, 9ec90df3 and eee7fa59 are not even valid objects there - git cat-file -e fails for the four against both remotes. Not reachable by any current ref on GitHub or on the GCABA GitLab. Proxy's own caveat is the part that decides this item and it is not a gap we can close: the mirror script force-pushes gitlab/develop on every deploy, so a SHA that transited that ref and was later overwritten would not surface this way, and absence today does not retroactively prove the server never received it. The GitLab server-side reflog and object-expiry window are the only instrument that would settle it, and GCABA IT access is a hard boundary - Elazar has no admin there and will not ask, so that residual is permanently unmeasurable BY CONSTRUCTION and not pending anyone's work. The caveat does not touch GitHub, which has no force-push history, nor gitlab/master, which this mirror never writes. Combined with my 21:10 finding that MovilBA has NO secret scanner on any ship path, the item now carries two decisions and zero further measurements.
• coder03-mba-l-cc blocked · 2w ago
  Dos decisiones de Elazar, ninguna medicion pendiente. (1) El scanner: gitcommit.sh NO corre en este repo desde MOVILBA-460, y medido el 2026-10-01 ningun mba-deploy-*.sh ni mba-lib.sh inspecciona contenido y .git/hooks/ no tiene ningun hook no-sample, asi que MovilBA no tiene scanner de secretos en ningun camino de ship. El hueco _PASS= que audit confirmo en gitcommit.sh es real pero es de sh.git y aca es irrelevante. Decide si MovilBA se construye el suyo en mba-lib.sh y con que patrones. (2) El residual de exposicion: el literal no es objeto valido en GitHub ni en el GitLab de GCABA -proxy, cat-file -e contra las dos, con control positivo- y no es ancestro de ninguna rama local, solo alcanzable por el reflog local de este checkout. Lo unico que queda sin medir es si alguna de las cuatro SHAs transito gitlab/develop antes de un force-push del espejo; el reflog del servidor de GitLab es el unico instrumento que lo contestaria y el acceso a GCABA es un limite duro, asi que ese residual es INMEDIBLE POR CONSTRUCCION, no esta esperando trabajo de nadie. Decide si se da por cerrado con ese residual escrito o si la credencial se considera expuesta - la rotacion es su palabra explicita y nadie la pidio.