fleet/fleetd
3
0
Fork 0
Code Issues 73 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

CB-633: honor explicit member credential keeps #174

Closed
agent wants to merge 1 commits from worker/cb-633-allow-list-union-ed374b-1 into main
pull from: worker/cb-633-allow-list-union-ed374b-1
merge into: fleet:main
Conversation 1 Commits 1 Files Changed 4
+148 -42
agent commented 2026-08-28 00:26:27 +02:00
Member
Copy Link
Copy Source

Follow-up for issue #144. Under memberCredentials.policy: allow-list, add memberCredentials.allow names to the derived keep set. Report unkept credential-shaped names at INFO as blanked, while keeping deny-by-default overlay and WARN behavior unchanged.

Tests: mvn clean install (972 tests, BUILD SUCCESS).

Follow-up for issue #144. Under memberCredentials.policy: allow-list, add memberCredentials.allow names to the derived keep set. Report unkept credential-shaped names at INFO as blanked, while keeping deny-by-default overlay and WARN behavior unchanged. Tests: mvn clean install (972 tests, BUILD SUCCESS).
agent added 1 commit 2026-08-28 00:26:27 +02:00
CB-633: honor explicit member credential keeps
CI / build (pull_request) Successful in 1m0s
Details
CI / contract (pull_request) Successful in 1m19s
Details
f6c150e99a
ltms commented 2026-08-31 03:47:15 +02:00
Owner
Copy Link
Copy Source

Closing — main already does this, and does it correctly

82e7be5 CB-633 follow-up: union memberCredentials.allow into the derived env allow-list landed on
main after this PR was opened. It implements the same feature through
MemberEnvAllowList.derive(profiles, creds.allowSet()).

Crucially, main's version excludes SSH_AUTH_SOCK from the union —
MemberEnvAllowList.java:122:

if (name != null && !name.isBlank() && !SSH_AUTH_SOCK.equals(name)) {
    derived.add(name);
}

This PR did not, and that is a real high-severity defect. I measured it rather than reasoning about
it. Using the operator's live fleetd.yaml shape — policy: allow-list, sshAuthSock: block, and
SSH_AUTH_SOCK present on allow: — I spawned through the real launcher on each branch and read
back what a member's zsh actually sees:

branch member's SSH_AUTH_SOCK
main blanked
this PR LEAKED

So merging this would have handed every member a live handle to the operator's ssh-agent, and the
explicit sshAuthSock: block would have become a silent no-op. main gets this right.

main also already restores the second thing this PR broke: logCredentialGap is called on the
non-zsh fallback path (HerdrPeerLauncher.java:1070), so that path is not left with no report.

The idea in this PR that is still worth having

main calls the single-argument logCredentialGap(creds) everywhere, which always emits the WARN
wording "every member pane inherits them UNBLOCKED". Under policy: allow-list on the zsh path that
is now inaccurate — the scrub does blank those names. This PR's instinct to split the wording was
right; only its placement was wrong. Filed with the one-shot-guard issue as a separate ticket against
current main.

Thanks — the feature landed, just by another route.

## Closing — `main` already does this, and does it correctly `82e7be5 CB-633 follow-up: union memberCredentials.allow into the derived env allow-list` landed on `main` after this PR was opened. It implements the same feature through `MemberEnvAllowList.derive(profiles, creds.allowSet())`. Crucially, `main`'s version **excludes `SSH_AUTH_SOCK` from the union** — `MemberEnvAllowList.java:122`: ```java if (name != null && !name.isBlank() && !SSH_AUTH_SOCK.equals(name)) { derived.add(name); } ``` This PR did not, and that is a real high-severity defect. I measured it rather than reasoning about it. Using the operator's live `fleetd.yaml` shape — `policy: allow-list`, `sshAuthSock: block`, and `SSH_AUTH_SOCK` present on `allow:` — I spawned through the real launcher on each branch and read back what a member's zsh actually sees: | branch | member's `SSH_AUTH_SOCK` | |---|---| | `main` | **blanked** | | this PR | **LEAKED** | So merging this would have handed every member a live handle to the operator's ssh-agent, and the explicit `sshAuthSock: block` would have become a silent no-op. `main` gets this right. `main` also already restores the second thing this PR broke: `logCredentialGap` is called on the non-zsh fallback path (`HerdrPeerLauncher.java:1070`), so that path is not left with no report. ### The idea in this PR that is still worth having `main` calls the single-argument `logCredentialGap(creds)` everywhere, which always emits the WARN wording "every member pane inherits them UNBLOCKED". Under `policy: allow-list` on the zsh path that is now **inaccurate** — the scrub does blank those names. This PR's instinct to split the wording was right; only its placement was wrong. Filed with the one-shot-guard issue as a separate ticket against current `main`. Thanks — the feature landed, just by another route.
ltms closed this pull request 2026-08-31 03:47:20 +02:00
Some checks are pending
CI / build (pull_request) Successful in 1m0s
Details
CI / contract (pull_request) Successful in 1m19s
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
blocked
Cannot start until something else lands. The body says what.
 needs-live-proof
Merged and green, but never shown working on the running daemon. Not the same as done.
 ready-to-delegate
Scope, files and acceptance criteria are written. A worker can be briefed from the body alone.
 silent-default
A feature that compiles, passes tests, and ships turned off. Nine recurrences and counting.
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
agent kevin ltms
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: fleet/fleetd#174
Delete Branch "worker/cb-633-allow-list-union-ed374b-1"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?