base-layer/releasekit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 3 Wiki Activity

Redact quoted credentials in Git diagnostics

Browse Source
This commit is contained in:
Eric Rakestraw
2026-11-02 11:32:11 +00:00
parent 473670185c
commit 31f9e48219
3 changed files with 53 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
docs/roadmap/remediation.md
View File

@@ -4,14 +4,20 @@ Reviewed `2f95753`, including the implementation commits after `a1dc705`,
against the accepted [audit target](audit.md) and completed
[implementation plan](implementation.md). A follow-up integration audit reviewed
`c8fa165`, whose production code is identical, and added R02 and R03. Findings
below identify remaining work; production code and existing tests were unchanged
during both reviews.
and completion records below track the remediation. Production code and existing
tests were unchanged during both reviews.
## R01. Git diagnostic redaction misses apostrophes in credentials
**Priority:** P2. **Status:** Pending. This is a remaining gap in A04 and
**Priority:** P2. **Status:** Complete. This addressed a gap in A04 and
[Stage 6](implementation.md#stage-6-sanitize-git-endpoint-diagnostics).
**Completion:** Diagnostic matching recognizes complete userinfo before
surrounding quotation, preserving error context and wrapped causes. Native Git,
literal/encoded apostrophe, malformed userinfo, and wrapped-error regressions
pass; the new regressions failed before the fix. The complete `internal/git`
suite and public/CLI endpoint-mismatch redaction tests passed offline.
**Relevant code:** `httpURLSpan` and `displayDiagnostic` in
[internal/git/display.go](../../internal/git/display.go), lines 9 and 32–39;
`pushURLs` and `run` in
@@ -143,10 +149,10 @@ sequences; build settings have one internal representation; artifact declaration
matching is shared; neutral delivery policy remains separate from Gitea protocol
operations; and private CLI handlers own presentation.
R01–R03 are the remaining findings from the initial review and follow-up
integration audit. Package ownership and public facade shape match the target;
the findings concern diagnostic and subprocess-environment behavior across
existing boundaries. The review identified no inadvertently strengthened public
R01–R03 record findings and remediation status from the initial review and
follow-up integration audit. Package ownership and public facade shape match
the target; the findings concern diagnostic and subprocess-environment behavior
across existing boundaries. The review identified no inadvertently strengthened public
contract. The selected redirect and diagnostic limits match the accepted scope.
JSON response caps and production exclusion indexing remain explicitly deferred
with assessment evidence, as planned.
@@ -187,7 +193,8 @@ inherited-pipe cancellation, forwarding errors, joined cleanup outcomes,
bounded asset reads, upload reconciliation, and tree-reader cleanup precedence.
R02 and R03 were reproduced independently with temporary Go test overlays.
Their assertions failed against the current implementation; R02's comparison
using the earlier Git environment behavior passed. The checkout contains no
probe code or production changes. The previously passing full-suite, static,
and compiled API/dependency checks apply to the unchanged production sources.
Their assertions failed against the reviewed implementation; R02's comparison
using the earlier Git environment behavior passed. Both audits left production
code and existing tests unchanged. The full-suite, static, and compiled
API/dependency results above record the audit baseline; completion notes record
verification of the subsequent repairs.