fleetd

fleet/fleetd

Fork 0

Author SHA1 Message Date

Author	SHA1	Message	Date
ltms	141ae3b04d	Merge PR #640 : fleetd #639 — redact()'s comment claimed more than the code does CI / shell-tests (push) Failing after 7s Details CI / contract (push) Successful in 1m32s Details CI / build (push) Failing after 2m29s Details Comment text only, no behaviour change. Corrects the paragraph added in `d7f94ca` so it no longer claims the continuation masking holds for any masked key "present or future". It holds only while the masked key's own line is inside the printed hunk; diff -u's three lines of context routinely leave it out, and a blank line inside a block scalar drops the anchor too. Verified: suite green in a clean copy of the edited tree (16 criteria + 3 extras, exit 0), bash -n clean, and a control on the edit itself (old claim gone, #639 reference present). Evidence in #639.	2026-10-01 19:00:56 +02:00
Dai Ha	faefea14c4	fleetd #639 : redact()'s comment claimed more than the code does CI / shell-tests (pull_request) Failing after 6s Details CI / contract (pull_request) Successful in 1m8s Details CI / build (pull_request) Failing after 2m11s Details The paragraph added in `d7f94ca` ended with "This needs no knowledge of the key's name and so protects a block scalar under any masked key, present or future." The continuation masking is real and it is an improvement, but that sentence is too strong: the masking only holds while the masked key's own line is inside the hunk being printed. redact() is fed `diff -u` output, which prints three lines of context. A block scalar's body therefore often arrives with its key line left out. With no key line, `masked` is never set and the body prints in full, with no "<redacted>" anywhere. A blank line inside a block scalar loses the anchor the same way: a blank diff line measures as indent 0, so `indent > masked_indent` is false and the mask ends early — this time directly under a "<redacted>" marker. Both were reproduced through the real script with --dry-run, each with a positive control run first to prove the secret's lines actually reached the output (without that control, "the secret never entered the diff" and "it entered and was redacted" are indistinguishable). Filed as fleetd #639, which also records that this is latent rather than live: today's fleetd.yaml holds 5 block scalars and all 5 sit under non-secret keys. Comment text only. No change to redact() or to any other function, and no change to the test suite. scripts/test-config-edit.sh still passes in a clean copy (16 criteria + 3 extras, exit 0); bash -n clean. The reason this is worth its own commit: #635 exists because an incomplete redactor that looks complete is worse than one that visibly does nothing. A comment that overstates the guarantee is the same defect in prose, and the next session to read it has no other source.	2026-10-01 19:00:29 +02:00
ltms	ea6896f2ef	Merge PR #636 : fleetd #635 — config-edit.sh, the one auditable way to edit fleetd.yaml CI / shell-tests (push) Failing after 14s Details CI / contract (push) Successful in 50s Details CI / build (push) Failing after 2m5s Details Closes fleetd #635. Verified by the lead before merge: - scripts/test-config-edit.sh run in a PRISTINE copy of `d7f94ca` (git archive + git init, no worktree, no daemon): 16 criteria + 3 extras, exit 0. - Diff read in full. 4 files, 1325 additions, 0 deletions, no .java/pom.xml/.yaml (checked with a positive control, so the negative is real) — no Maven gate needed. - Defects 1-6 were verified by the previous lead by mutation; defects 7 and 8 (criteria 15a/15b/16) are fixed in `d7f94ca` and the fix was re-measured here independently. Known limitation, filed as #639 and NOT a regression: redact()'s continuation masking only holds while the masked key line is itself inside the printed diff hunk. diff -u prints three lines of context, so a block scalar's body can appear without its key, and then nothing is masked; a blank line inside a block scalar loses the anchor the same way. Reproduced through the real script with a positive control proving the body reached the output. Latent, not live: today's fleetd.yaml has 5 block scalars and all 5 sit under non-secret keys. The pre-fix code leaked these cases too, so this commit is a strict improvement. Two sentences in config-edit.sh's redact() comment and in this PR's body claim the masking holds regardless of the key's name. That is too strong; see #639. Being corrected in a follow-up.	2026-10-01 18:58:27 +02:00

ltms

141ae3b04d

Merge PR #640 : fleetd #639 — redact()'s comment claimed more than the code does

CI / shell-tests (push) Failing after 7s

Details

CI / contract (push) Successful in 1m32s

Details

CI / build (push) Failing after 2m29s

Details

Comment text only, no behaviour change. Corrects the paragraph added in d7f94ca so it no longer
claims the continuation masking holds for any masked key "present or future". It holds only while
the masked key's own line is inside the printed hunk; diff -u's three lines of context routinely
leave it out, and a blank line inside a block scalar drops the anchor too.

Verified: suite green in a clean copy of the edited tree (16 criteria + 3 extras, exit 0), bash -n
clean, and a control on the edit itself (old claim gone, #639 reference present). Evidence in #639.

2026-10-01 19:00:56 +02:00

Dai Ha

faefea14c4

fleetd #639 : redact()'s comment claimed more than the code does

CI / shell-tests (pull_request) Failing after 6s

Details

CI / contract (pull_request) Successful in 1m8s

Details

CI / build (pull_request) Failing after 2m11s

Details

The paragraph added in d7f94ca ended with "This needs no knowledge of the key's
name and so protects a block scalar under any masked key, present or future."
The continuation masking is real and it is an improvement, but that sentence is
too strong: the masking only holds while the masked key's own line is inside the
hunk being printed.

redact() is fed `diff -u` output, which prints three lines of context. A block
scalar's body therefore often arrives with its key line left out. With no key
line, `masked` is never set and the body prints in full, with no "<redacted>"
anywhere. A blank line inside a block scalar loses the anchor the same way: a
blank diff line measures as indent 0, so `indent > masked_indent` is false and
the mask ends early — this time directly under a "<redacted>" marker.

Both were reproduced through the real script with --dry-run, each with a
positive control run first to prove the secret's lines actually reached the
output (without that control, "the secret never entered the diff" and "it
entered and was redacted" are indistinguishable). Filed as fleetd #639, which
also records that this is latent rather than live: today's fleetd.yaml holds 5
block scalars and all 5 sit under non-secret keys.

Comment text only. No change to redact() or to any other function, and no
change to the test suite. scripts/test-config-edit.sh still passes in a clean
copy (16 criteria + 3 extras, exit 0); bash -n clean.

The reason this is worth its own commit: #635 exists because an incomplete
redactor that looks complete is worse than one that visibly does nothing. A
comment that overstates the guarantee is the same defect in prose, and the next
session to read it has no other source.

2026-10-01 19:00:29 +02:00

ltms

ea6896f2ef

Merge PR #636 : fleetd #635 — config-edit.sh, the one auditable way to edit fleetd.yaml

CI / shell-tests (push) Failing after 14s

Details

CI / contract (push) Successful in 50s

Details

CI / build (push) Failing after 2m5s

Details

Closes fleetd #635.

Verified by the lead before merge:
- scripts/test-config-edit.sh run in a PRISTINE copy of d7f94ca (git archive + git init, no
  worktree, no daemon): 16 criteria + 3 extras, exit 0.
- Diff read in full. 4 files, 1325 additions, 0 deletions, no .java/pom.xml/.yaml (checked with a
  positive control, so the negative is real) — no Maven gate needed.
- Defects 1-6 were verified by the previous lead by mutation; defects 7 and 8 (criteria 15a/15b/16)
  are fixed in d7f94ca and the fix was re-measured here independently.

Known limitation, filed as #639 and NOT a regression: redact()'s continuation masking only holds
while the masked key line is itself inside the printed diff hunk. diff -u prints three lines of
context, so a block scalar's body can appear without its key, and then nothing is masked; a blank
line inside a block scalar loses the anchor the same way. Reproduced through the real script with
a positive control proving the body reached the output. Latent, not live: today's fleetd.yaml has
5 block scalars and all 5 sit under non-secret keys. The pre-fix code leaked these cases too, so
this commit is a strict improvement.

Two sentences in config-edit.sh's redact() comment and in this PR's body claim the masking holds
regardless of the key's name. That is too strong; see #639. Being corrected in a follow-up.

2026-10-01 18:58:27 +02:00

1 changed files with 7 additions and 1 deletions

									
										scripts/config-edit.sh
									
		+7
		-1
	
												View File
												
				@@ -159,7 +159,13 @@ done

				# The fix is structural, not another name to match: once a key line is masked, every following

				# line indented STRICTLY DEEPER than that key is masked too, by indentation alone, until the

				# indentation returns to the key's own level or shallower. This needs no knowledge of the key's

				# name and so protects a block scalar under any masked key, present or future.

				# name, so it covers a block scalar under any masked key — but ONLY while that key's own line is

				# itself inside the hunk being printed. `diff -u` prints just three lines of context, so a block

				# scalar's body often reaches this function with its key line left out; there is then nothing to

				# anchor to, `masked` is never set, and the body prints in full. A blank line inside a block

				# scalar loses the anchor the same way, because a blank diff line measures as indent 0. Both are

				# measured and filed as fleetd #639 — do not read this paragraph as a guarantee that a masked

				# key's value can never be printed.

				#

				# `redact` is always fed `diff -u` output, and every line of a unified diff starts with exactly

				# one of ' ', '+', '-' (the three body markers; '@'/'-'/'+' for the three header-line kinds too).

Compare commits

3 Commits

worker/config-edit-seam-ca8dc1-1 .. main

Compare commits

3 Commits worker/config-edit-seam-ca8dc1-1 .. main

3 Commits

worker/config-edit-seam-ca8dc1-1 .. main