cgalo5758
b245bdb0a9
Remediate six confirmed security issues: deployment-only config keys, bounded provider responses, short-lived registration sessions, private init file mode, FedWiki workflow authorization, and switch preview gates. - Add DeploymentOnly config key declaration; refuse runtime overrides for keys that decide where secrets are sent - Create httplimit package; bound all provider response reads at 8 MiB - Set fifteen-minute deadline on /register sessions - Write mc-config.yaml with 0600 permissions - Derive FedWiki workflow IDs from site IDs; re-authorize sites before mutating activities - Apply switch authorization gates to the proration preview
77 lines
3.1 KiB
Bash
Executable File
77 lines
3.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Prepare the sandbox both lanes share: export a disposable copy of HEAD, seed
|
|
# it with the auditor config and scope, build the images, and pre-start the
|
|
# egress proxy. Nothing here touches the real working tree or the live stack.
|
|
# Run it once per session; then ./run-tools.sh and ./run-audit.sh (security),
|
|
# or ./run-ux.sh (ideation).
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")"
|
|
HERE="$(pwd)"
|
|
REPO="$(git rev-parse --show-toplevel)" # the runner lives under scripts/, not at the root
|
|
PROJECT=member-console-audit
|
|
|
|
. ./harness.sh
|
|
# At least one harness must be signed in on the host; the run scripts check
|
|
# the one each named model needs.
|
|
AUTH_SUMMARY=""
|
|
for h in $HARNESSES; do
|
|
f="$(harness_auth_path "$h")"
|
|
[[ -f "$f" ]] && AUTH_SUMMARY+="$h=$f "
|
|
done
|
|
if [[ -z "$AUTH_SUMMARY" ]]; then
|
|
echo "ERROR: no harness is signed in on the host." >&2
|
|
echo " opencode: 'opencode auth login' (or set AUDIT_AUTH_JSON)" >&2
|
|
echo " codex: 'codex login' (or set AUDIT_CODEX_AUTH_JSON)" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "==> Exporting a disposable copy of HEAD into .code/ (real repo untouched)"
|
|
rm -rf .code && mkdir -p .code
|
|
# Lane state lives under .run/. Create it as the invoking user now: a compose
|
|
# call made without OUT lets the daemon create .run/out as root, and a
|
|
# root-owned .run/ would refuse the lanes their state directories.
|
|
mkdir -p .run
|
|
git -C "$REPO" archive HEAD | tar -x -C .code
|
|
# The export carries the repo's own .opencode/ skills (OpenSpec workflow
|
|
# helpers). They are irrelevant to a security audit and a model that notices
|
|
# them wastes a turn on them, so they do not travel.
|
|
rm -rf .code/.opencode .code/.claude
|
|
|
|
# Seed the throwaway copy with the auditor's config, instructions, and scope.
|
|
cp opencode.json .code/opencode.json
|
|
cp AUDITOR.md .code/AUDITOR.md
|
|
cp CONTEXT.md .code/CONTEXT.md
|
|
cp REPORT.md .code/REPORT.md
|
|
rm -rf .code/scope .code/open .code/codex-security && cp -r scope .code/scope && cp -r open .code/open && cp -r codex-security .code/codex-security
|
|
|
|
[[ -f .code/go.mod && -f .code/go.sum ]] || {
|
|
echo "ERROR: .code/go.mod missing; the image bakes the module cache from it." >&2
|
|
exit 1
|
|
}
|
|
COMMIT="$(git -C "$REPO" rev-parse --short HEAD)"
|
|
echo "$COMMIT" > .code/AUDIT_COMMIT.txt
|
|
|
|
echo "==> Building images (auditor + egress proxy) — first build pulls the"
|
|
echo " Go toolchain, opencode, Codex CLI, the scanners, the semgrep rules,"
|
|
echo " the Go vulnerability database, and this project's module cache."
|
|
docker compose build
|
|
|
|
echo "==> Starting the egress proxy (deny-by-default; allowlist.txt governs)"
|
|
docker compose up -d egress-proxy
|
|
|
|
cat <<MSG
|
|
|
|
Ready.
|
|
Audited commit : $COMMIT
|
|
Signed in : $AUTH_SUMMARY
|
|
Egress : proxy only, allowlist = $(grep -c . allowlist.txt) host patterns
|
|
Runner : $HERE
|
|
|
|
Findings go where you send them: export OUT to a directory outside this one.
|
|
|
|
Next: OUT=<dir> ./run-tools.sh # offline scanner pass -> <dir>/tools/
|
|
OUT=<dir> ./run-audit.sh # all models x all scope tasks
|
|
./run-ux.sh <brief-dir> # the ideation lane
|
|
./teardown.sh # remove the containers and the copy
|
|
MSG
|