Frank
812be6a0a6
Three ways the fail-closed gate failed open, all reproduced by new tests first: - `git diff --name-only` quotes any path it cannot print as UTF-8 (core.quotePath, on by default). The quoted string was handed back to `git diff -- <path>`, which matches nothing, and an empty diff is `continue`d — so a credential under `café/` committed cleanly. The list is now NUL-delimited and read from a temp file, because command substitution deletes NUL bytes and the names must survive to the loop that reads them. - The placeholder filter matched the whole added line, so `API_TOKEN=<live> # example, placeholder, changeme` was exempt on the strength of its own comment. The filter now reads the assigned value only — the token up to whitespace or `#`. Truncation errs toward blocking; ALLOW_SECRETS remains the way out. - `report+=` ended on a command substitution, so the next file's name was glued onto the previous file's last hit line and the report blamed the wrong file. Three tests, all red before the change: a quoted path, a placeholder comment beside a live value, and two leaking files each named on their own line. Refs #60
192 lines
7.2 KiB
Bash
Executable File
192 lines
7.2 KiB
Bash
Executable File
#!/usr/bin/env bats
|
|
# tests/secret-gate.bats — black-box tests for .githooks/pre-commit
|
|
#
|
|
# Contract: a commit whose staged content contains a credential is blocked
|
|
# (non-zero exit, stderr names the file); a commit whose content is benign
|
|
# configuration or prose about credentials is allowed. The gate is copied into a
|
|
# scratch repo so git itself invokes it — no sourcing, no internal state.
|
|
|
|
setup() {
|
|
HOOK="$BATS_TEST_DIRNAME/../.githooks/pre-commit"
|
|
REPO="$(mktemp -d)/g"
|
|
mkdir -p "$REPO/.git/hooks"
|
|
git init -q "$REPO"
|
|
git -C "$REPO" config user.email gate@test
|
|
git -C "$REPO" config user.name gate
|
|
cp "$HOOK" "$REPO/.git/hooks/pre-commit"
|
|
chmod +x "$REPO/.git/hooks/pre-commit"
|
|
}
|
|
|
|
teardown() { rm -rf "$(dirname "$REPO")"; }
|
|
|
|
# try_commit <file> <content> -> sets status/output from the real commit attempt
|
|
try_commit() {
|
|
local file="$1" content="$2"
|
|
mkdir -p "$REPO/$(dirname "$file")"
|
|
printf '%s\n' "$content" > "$REPO/$file"
|
|
run git -C "$REPO" add -A
|
|
run git -C "$REPO" commit -q -m "attempt: $file"
|
|
}
|
|
|
|
@test "blocks a low-entropy password in a .env file" {
|
|
try_commit "postgres.env" 'POSTGRES_PASSWORD=hunter2corp2026'
|
|
[ "$status" -ne 0 ]
|
|
[[ "$output" == *"SECRET GATE"* ]]
|
|
[[ "$output" == *"postgres.env"* ]]
|
|
}
|
|
|
|
@test "blocks a credential in a file type the extension whitelist used to skip" {
|
|
try_commit "app.conf" '[app]
|
|
secret_key = "rotatedvalue99"'
|
|
[ "$status" -ne 0 ]
|
|
[[ "$output" == *"app.conf"* ]]
|
|
}
|
|
|
|
@test "blocks a token shape in a plain text file" {
|
|
try_commit "notes.txt" "backup remote: ghp_$(printf 'a%.0s' {1..36})"
|
|
[ "$status" -ne 0 ]
|
|
[[ "$output" == *"notes.txt"* ]]
|
|
}
|
|
|
|
@test "blocks a bcrypt hash" {
|
|
try_commit "dump.txt" 'basicauth: $2b$14$'"$(printf 'a%.0s' {1..53})"
|
|
[ "$status" -ne 0 ]
|
|
[[ "$output" == *"dump.txt"* ]]
|
|
}
|
|
|
|
@test "blocks a credential in a quadlet unit" {
|
|
try_commit "db.container" '[Container]
|
|
Environment=POSTGRES_PASSWORD=devpostgres2026'
|
|
[ "$status" -ne 0 ]
|
|
[[ "$output" == *"db.container"* ]]
|
|
}
|
|
|
|
@test "prose about credentials in markdown is still allowed" {
|
|
try_commit "docs/runbook.md" 'The GITEA_TOKEN moved out of .zshrc into secrets.env.
|
|
Set password: user.set_password(value) and api_key = "sk-no-key-required".'
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "placeholder and indirected values in config files are allowed" {
|
|
try_commit "app.conf" '[db]
|
|
PASSWORD = CHANGEME
|
|
SECRET_KEY = ${VAULT_SECRET}
|
|
api_key = "sk-no-key-required"
|
|
token_file = <operator_token>'
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "environment variable indirection is not a secret" {
|
|
try_commit "start.sh" '#!/bin/sh
|
|
export GITEA_TOKEN="$GITEA_TOKEN"
|
|
export API_KEY_FILE=/run/secrets/api_key'
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "binary content never trips the gate" {
|
|
head -c 4096 /dev/urandom > "$REPO/wall.jpg"
|
|
run git -C "$REPO" add -A
|
|
run git -C "$REPO" commit -q -m "binary"
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "ALLOW_SECRETS still overrides, and says so" {
|
|
try_commit "postgres.env" 'POSTGRES_PASSWORD=hunter2corp2026'
|
|
[ "$status" -ne 0 ]
|
|
mkdir -p "$REPO/.git/hooks"
|
|
run env ALLOW_SECRETS=1 git -C "$REPO" commit -q -m "override"
|
|
[ "$status" -eq 0 ]
|
|
[[ "$output" == *"ALLOW_SECRETS set"* ]]
|
|
}
|
|
|
|
@test "this repo's ignore policy quarantines env files at any name" {
|
|
repo="$BATS_TEST_DIRNAME/.."
|
|
run git -C "$repo" check-ignore -q --no-index dotfiles/db/postgres.env
|
|
[ "$status" -eq 0 ]
|
|
run git -C "$repo" check-ignore -q --no-index dotfiles/app/frank-job-hunt.env
|
|
[ "$status" -eq 0 ]
|
|
run git -C "$repo" check-ignore -q --no-index dotfiles/bat/config
|
|
[ "$status" -ne 0 ]
|
|
}
|
|
|
|
@test "the gate refuses to pass when it cannot read the staged diff" {
|
|
# A gate that swallows a git error reports success on every commit. This is not
|
|
# hypothetical: the 2026-10-20 rewrite passed `-I` to git diff, which is not a
|
|
# valid flag there, and the empty file list made every secret commit sail through.
|
|
nodir="$(mktemp -d)"
|
|
run bash -c "cd '$nodir' && '$HOOK'"
|
|
rm -rf "$nodir"
|
|
[ "$status" -ne 0 ]
|
|
[[ "$output" == *"cannot read the staged diff"* ]]
|
|
}
|
|
|
|
@test "deleting a credential is never blocked" {
|
|
# The commit that removes a secret must always be possible, or the gate holds a
|
|
# leak hostage. It did exactly that on 2026-10-20: matching removed lines made
|
|
# the redaction commit look like the leak. Seed with the documented override,
|
|
# then remove with an ordinary commit.
|
|
printf 'POSTGRES_PASSWORD=hunter2corp2026\n' > "$REPO/db.conf"
|
|
run git -C "$REPO" add -A
|
|
run env ALLOW_SECRETS=1 git -C "$REPO" commit -q -m "seed a leak"
|
|
[ "$status" -eq 0 ]
|
|
printf '[db]\nPASSWORD = ${VAULT_SECRET}\n' > "$REPO/db.conf"
|
|
run git -C "$REPO" add -A
|
|
run git -C "$REPO" commit -q -m "redact the leaked password"
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "the gate can commit itself" {
|
|
# Fixtures have to look like credentials, so a gate that scans its own test file
|
|
# without exemption can never be committed — it holds its own maintenance
|
|
# hostage. The exemption is two exact paths, and it must announce itself.
|
|
mkdir -p "$REPO/.githooks" "$REPO/tests"
|
|
cp "$HOOK" "$REPO/.githooks/pre-commit"
|
|
printf 'POSTGRES_PASSWORD=hunter2corp2026\n' > "$REPO/tests/secret-gate.bats"
|
|
run git -C "$REPO" add -A
|
|
run git -C "$REPO" commit -q -m "gate and its fixtures"
|
|
[ "$status" -eq 0 ]
|
|
[[ "$output" == *"self-test fixtures exempt"* ]]
|
|
}
|
|
|
|
@test "a credential hidden in some other test file is still caught" {
|
|
# The exemption is a filename list, not the tests/ directory.
|
|
mkdir -p "$REPO/tests"
|
|
printf 'POSTGRES_PASSWORD=hunter2corp2026\n' > "$REPO/tests/other.bats"
|
|
run git -C "$REPO" add -A
|
|
run git -C "$REPO" commit -q -m "smuggle"
|
|
[ "$status" -ne 0 ]
|
|
[[ "$output" == *"tests/other.bats"* ]]
|
|
}
|
|
|
|
@test "a credential under a path git quotes is still read" {
|
|
# core.quotePath is on by default, so `git diff --name-only` prints "caf\303\251/…" for a
|
|
# non-ASCII directory. Feed that quoted string back to `git diff -- <path>` and the diff is
|
|
# empty — and a gate that skips an unreadable file reports success. This is the fail-closed
|
|
# promise breaking on its own terms, not a cosmetic quoting complaint.
|
|
try_commit "café/postgres.env" 'POSTGRES_PASSWORD=hunter2corp2026'
|
|
[ "$status" -ne 0 ]
|
|
[[ "$output" == *"postgres.env"* ]]
|
|
}
|
|
|
|
@test "a placeholder word elsewhere on the line does not exempt a live value" {
|
|
# The rule is about the VALUE. `# example` in a comment says nothing about the token the
|
|
# line assigns, but a whole-line placeholder filter lets the comment vouch for the secret.
|
|
try_commit "app.env" 'API_TOKEN=hunter2corp2026 # example, placeholder, changeme'
|
|
[ "$status" -ne 0 ]
|
|
[[ "$output" == *"app.env"* ]]
|
|
}
|
|
|
|
@test "each hit is attributed to the file it came from" {
|
|
# The report is how the next agent finds the leak. If one file's last hit line runs into the
|
|
# next file's name, the audit starts at a clean file and the leaker keeps its name.
|
|
mkdir -p "$REPO/a" "$REPO/b"
|
|
printf 'A_PASSWORD=hunter2corp2026\n' > "$REPO/a/one.env"
|
|
printf 'B_PASSWORD=hunter2corp2026\n' > "$REPO/b/two.env"
|
|
run git -C "$REPO" add -A
|
|
run git -C "$REPO" commit -q -m "two leakers"
|
|
[ "$status" -ne 0 ]
|
|
printf '%s\n' "$output" | grep -qx ' a/one.env'
|
|
printf '%s\n' "$output" | grep -qx ' b/two.env'
|
|
! printf '%s\n' "$output" | grep -qE 'hunter2corp2026 +b/two\.env'
|
|
}
|