gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-08-20 03:22:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(scripts): excuse the mirrored Connect fixture key vectors in the secret guard

Browse Source 
The embedded-secret guard landed on main after this branch was cut, so the merge is the first run that sees the Connect agent protocol fixtures. Five of its PEM-header hits are the fixtures themselves: the inventory field registry samples a private-key header as a value class the frozen schema cannot carry, the inventory secret-like vectors feed one to the normalizer, and the redaction vectors feed one to the ruleset that must replace it.

Those files are a byte-identical mirror of the Connect tree — rustfs/tests/agent_protocol_fixtures.rs pins every set against its MANIFEST.sha256 — so the vectors cannot be reworded here, which is what NON_SECRET_LITERALS exists for.

The three new entries stay narrow. The bare-header entry carries its closing quote, so it excuses only a JSON string that ends at the header and can hold no key body; a header followed by one still fires, including on a line that holds both. The other two carry their bodies, and both bodies are unusable: a PKCS#8 wrapper whose OCTET STRING declares 32 bytes and holds the 7 ASCII bytes "example", and an RSA body that spells out it is not a real key.

Verification: scripts/check_embedded_secrets.sh passes, --self-test passes, and a probe file holding a real-shaped key — alone, and on the same line as the excused sample — still fails the guard.
This commit is contained in:
overtrue
2026-08-19 23:05:02 +08:00
parent c2b79327d7
commit d787392082
1 changed files with 16 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/check_embedded_secrets.sh
+16
View File
@@ -98,12 +98,28 @@ PATTERNS=(
# key across signer, IAM, madmin, and auth tests, plus the deliberate
# one-character variant rustfs/src/auth.rs uses to prove key comparison
# distinguishes near-identical ids.
# 5-7: the Connect agent protocol fixtures under protocol/agent/v1/fixtures,
# which this repository carries as a byte-identical mirror of the Connect
# tree (rustfs/tests/agent_protocol_fixtures.rs pins every set against its
# MANIFEST.sha256, so the vectors cannot be reworded on this side). Their
# subject *is* key material that the inventory schema must be unable to
# carry and the redaction ruleset must replace, so the header has to appear
# in the input. Entry 5 carries the closing quote, so it excuses only a
# JSON string that ends at the header and can therefore hold no key body;
# a header followed by one still fires. Entries 6-7 carry their bodies,
# both unusable: 6 is a PKCS#8 wrapper whose OCTET STRING declares 32
# bytes and holds the 7 ASCII bytes "example", and 7 spells out in the
# body that it is not a real key.
AWS_EXAMPLE_STEM="AKIAIOSFODNN7EXAMPL"
AGENT_FIXTURE_RSA_BODY="MIIEowIBAAKCAQEAxEXAMPLEKEYBODYnotarealkey0000000000000000000000"
NON_SECRET_LITERALS=(
"-----${BEGIN_MARK} PRIVATE KEY-----\\nsecret\\n-----END PRIVATE KEY-----"
"-----${BEGIN_MARK} RSA PRIVATE KEY-----\\nsecret\\n-----END RSA PRIVATE KEY-----"
"${AWS_EXAMPLE_STEM}E"
"${AWS_EXAMPLE_STEM}F"
"\"-----${BEGIN_MARK} PRIVATE KEY-----\""
"-----${BEGIN_MARK} PRIVATE KEY-----\\nMEECAQAwEwYHKoZIzj0CAQYIKoZIzj0DAQcEJzAlAgEBBCBleGFtcGxl\\n-----END PRIVATE KEY-----"
"-----${BEGIN_MARK} RSA PRIVATE KEY-----\\n${AGENT_FIXTURE_RSA_BODY}\\nEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE=\\n-----END RSA PRIVATE KEY-----"
)
run_scan() {