nsaspy/a0-symbolics

Fork 0

Fail closed when log secret masking errors #55

Open

lost-rob0t wants to merge 19 commits from rage/33-log-secret-mask-fail-closed into main

lost-rob0t commented

2026-08-24 15:23:26 +00:00

(Migrated from github.com)

Fixes #33.

TDD-first security slice. The first commit adds deterministic regression tests proving the current masking boundary returns raw candidate secrets when secret-manager lookup or masking raises.

Security invariant: masking failures must never emit the original candidate string/object into LogItem output, state snapshots, or persistence. Production code follows only after the red contract is established.

Fixes #33. TDD-first security slice. The first commit adds deterministic regression tests proving the current masking boundary returns raw candidate secrets when secret-manager lookup or masking raises. Security invariant: masking failures must never emit the original candidate string/object into LogItem output, state snapshots, or persistence. Production code follows only after the red contract is established.

nsaspy changed title from ~~WIP: Fail closed when log secret masking errors~~ to Fail closed when log secret masking errors

2026-08-27 19:43:11 +00:00

nsaspy added 1 commit

2026-09-04 16:06:39 +00:00

Merge branch 'main' into rage/33-log-secret-mask-fail-closed

Log Secret Masking / regression (pull_request) Failing after 6s

Details

f6a0ae0dbe

nsaspy added 1 commit

2026-09-05 04:38:42 +00:00

ci(log-masking): fetch install-nix-action by full URL

Log Secret Masking / regression (pull_request) Failing after 2m5s

Details

f69fde250e

cachix/install-nix-action is not mirrored on data.forgejo.org, so the
runner fails action resolution before any step runs. Reference the
action by its fully-qualified URL instead.

nsaspy added 1 commit

2026-09-05 05:07:30 +00:00

ci(log-masking): drop forgejo token from nix github fetches

Log Secret Masking / regression (pull_request) Has been cancelled

Details

781ef8e582

secrets.GITHUB_TOKEN on Forgejo is an instance token, not a GitHub one;
nix tarball fetches with it get HTTP 401 from api.github.com. Fetch the
public flake inputs anonymously.

nsaspy added 1 commit

2026-09-06 11:49:09 +00:00

ci(log-masking): retrigger when the nix environment changes

Log Secret Masking / regression (pull_request) Has been cancelled

Details

b2a0297858

nsaspy referenced this pull request

2026-09-06 11:49:10 +00:00

fix(nix): build nixpkgs mcp without its upstream test suite #112

nsaspy added 1 commit

2026-09-06 11:50:52 +00:00

Merge branch 'main' into rage/33-log-secret-mask-fail-closed

Log Secret Masking / regression (pull_request) Has been cancelled

Details

6315d4e85f

nsaspy added 1 commit

2026-09-06 11:57:01 +00:00

Merge branch 'main' into HEAD

Log Secret Masking / regression (pull_request) Has been cancelled

Details

Android APK / build (pull_request) Has been cancelled

Details

280aedcf06

nsaspy added 1 commit

2026-09-06 13:11:45 +00:00

ci(log-masking): share the heavy-ci queue across workflows

Log Secret Masking / regression (pull_request) Has been cancelled

Details

a5e9aa4009

nsaspy referenced this pull request

2026-09-06 13:12:06 +00:00

ci(android): serialize heavy CI jobs in one queue #113

nsaspy added 1 commit

2026-09-06 13:36:55 +00:00

fix(nix): sandbox derivation builds on the CI runner

Log Secret Masking / regression (pull_request) Failing after 29m59s

Details

e1cbb861c7

nsaspy added 1 commit

2026-09-06 15:35:40 +00:00

ci(log-masking): run on the host nix runner

Log Secret Masking / regression (pull_request) Failing after 43s

Details

a198e20b6b

The docker runner container cannot sandbox nix builds (unsandboxed
root builds fail the /homeless-shelter purity check and upstream tests
assume an environment the container lacks). The registered host runner
(nix) has multi-user sandboxed nix with non-root build users; run the
regression there and drop the redundant installer step.

nsaspy added 1 commit

2026-09-06 16:26:35 +00:00

ci(log-masking): use the nix-ci lane

Log Secret Masking / regression (pull_request) Failing after 3m28s

Details

edfc962b5a

nsaspy added 1 commit

2026-09-06 17:06:24 +00:00

fix(ci): run pytest as a module so the repo root is importable

Log Secret Masking / regression (pull_request) Successful in 54s

Details

e549b23a8d

Bare pytest does not put the working directory on sys.path, so
'tests/test_log_secret_masking.py' cannot import the helpers package
(ModuleNotFoundError on the host runner; the docker runs never reached
this step). 'python -m pytest' inserts the cwd, matching the other
workflows.

Log Secret Masking / regression (pull_request) Successful in 54s

Details

This pull request can be merged automatically.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin rage/33-log-secret-mask-fail-closed:rage/33-log-secret-mask-fail-closed

git switch rage/33-log-secret-mask-fail-closed

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff rage/33-log-secret-mask-fail-closed

git switch rage/33-log-secret-mask-fail-closed

git rebase main

git switch main

git merge --ff-only rage/33-log-secret-mask-fail-closed

git switch rage/33-log-secret-mask-fail-closed

git rebase main

git switch main

git merge --no-ff rage/33-log-secret-mask-fail-closed

git switch main

git merge --squash rage/33-log-secret-mask-fail-closed