From d78739208267bc799f0df88588218b59ff54f0e3 Mon Sep 17 00:00:00 2001 From: overtrue Date: Wed, 19 Aug 2026 23:05:02 +0800 Subject: [PATCH] chore(scripts): excuse the mirrored Connect fixture key vectors in the secret guard MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The embedded-secret guard landed on main after this branch was cut, so the merge is the first run that sees the Connect agent protocol fixtures. Five of its PEM-header hits are the fixtures themselves: the inventory field registry samples a private-key header as a value class the frozen schema cannot carry, the inventory secret-like vectors feed one to the normalizer, and the redaction vectors feed one to the ruleset that must replace it. Those files are a byte-identical mirror of the Connect tree — rustfs/tests/agent_protocol_fixtures.rs pins every set against its MANIFEST.sha256 — so the vectors cannot be reworded here, which is what NON_SECRET_LITERALS exists for. The three new entries stay narrow. The bare-header entry carries its closing quote, so it excuses only a JSON string that ends at the header and can hold no key body; a header followed by one still fires, including on a line that holds both. The other two carry their bodies, and both bodies are unusable: a PKCS#8 wrapper whose OCTET STRING declares 32 bytes and holds the 7 ASCII bytes "example", and an RSA body that spells out it is not a real key. Verification: scripts/check_embedded_secrets.sh passes, --self-test passes, and a probe file holding a real-shaped key — alone, and on the same line as the excused sample — still fails the guard. --- scripts/check_embedded_secrets.sh | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/scripts/check_embedded_secrets.sh b/scripts/check_embedded_secrets.sh index 0634eb0f8..37c07baaf 100755 --- a/scripts/check_embedded_secrets.sh +++ b/scripts/check_embedded_secrets.sh @@ -98,12 +98,28 @@ PATTERNS=( # key across signer, IAM, madmin, and auth tests, plus the deliberate # one-character variant rustfs/src/auth.rs uses to prove key comparison # distinguishes near-identical ids. +# 5-7: the Connect agent protocol fixtures under protocol/agent/v1/fixtures, +# which this repository carries as a byte-identical mirror of the Connect +# tree (rustfs/tests/agent_protocol_fixtures.rs pins every set against its +# MANIFEST.sha256, so the vectors cannot be reworded on this side). Their +# subject *is* key material that the inventory schema must be unable to +# carry and the redaction ruleset must replace, so the header has to appear +# in the input. Entry 5 carries the closing quote, so it excuses only a +# JSON string that ends at the header and can therefore hold no key body; +# a header followed by one still fires. Entries 6-7 carry their bodies, +# both unusable: 6 is a PKCS#8 wrapper whose OCTET STRING declares 32 +# bytes and holds the 7 ASCII bytes "example", and 7 spells out in the +# body that it is not a real key. AWS_EXAMPLE_STEM="AKIAIOSFODNN7EXAMPL" +AGENT_FIXTURE_RSA_BODY="MIIEowIBAAKCAQEAxEXAMPLEKEYBODYnotarealkey0000000000000000000000" NON_SECRET_LITERALS=( "-----${BEGIN_MARK} PRIVATE KEY-----\\nsecret\\n-----END PRIVATE KEY-----" "-----${BEGIN_MARK} RSA PRIVATE KEY-----\\nsecret\\n-----END RSA PRIVATE KEY-----" "${AWS_EXAMPLE_STEM}E" "${AWS_EXAMPLE_STEM}F" + "\"-----${BEGIN_MARK} PRIVATE KEY-----\"" + "-----${BEGIN_MARK} PRIVATE KEY-----\\nMEECAQAwEwYHKoZIzj0CAQYIKoZIzj0DAQcEJzAlAgEBBCBleGFtcGxl\\n-----END PRIVATE KEY-----" + "-----${BEGIN_MARK} RSA PRIVATE KEY-----\\n${AGENT_FIXTURE_RSA_BODY}\\nEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE=\\n-----END RSA PRIVATE KEY-----" ) run_scan() {