Repository navigation
fix(security): prove and scope the cgm_cbio vendor-material guard - #173
Closed
shroominic wants to merge 1 commit into
Closed
shroominic wants to merge 1 commit into
shroominic wants to merge 1 commit into
Conversation
The guard that keeps the vendor material out of the tree had never been exercised, and as written it belonged in the wrong place. - `security/gitleaks-vendor-material.toml` holds one tree-scoped rule that matches a material-shaped binding plus a literal payload. It restates no byte, no key-derived vector, and no device address, and it carries no allowlist, because an exemption would have to name the value it exempts. - `scripts/check-cbio-vendor-material.sh` makes the rule prove itself: it scans the checked-out tree, then asserts the same rule still reports a deliberate synthetic canary. A rule that silently stops matching now fails instead of reporting a clean tree. - The scanner is installed through the repository's existing checksum-pinned quality-tool installer, so local runs and CI use gitleaks 8.24.3, the version `gitleaks-action` resolves to. - `make vendor-material-guard` runs it locally and is part of `make check`; the `Vendor Material Guard` job in `security.yml` runs it on every pull request. The rule is deliberately not added to `.gitleaks.toml`: the material and a key-derived masked vector are already in this repository's public history, so a history-wide rule would fail forever and no change on the tip could clear it. Fixes #172.
This was referenced Sep 18, 2026
Owner
Author
|
Carried by the GS1 consolidation in PR #209 (branch feature/cbio-gs1, head 3eca4f4). This PR is contained in the consolidated line; the merge that carries it is 0490128. Closing as subsumed by the consolidation - not as won't fix. The per-defect evidence stays in this thread, and the carrying commit above is where the change now lives. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #172. Base is
main.What was wrong
The rule that is supposed to keep the CBIO GS1 vendor material out of the tree
was never exercised, and it was headed for the wrong scan.
byte-list constant. gitleaks 8.24.3 reports
no leaks foundfor a tree thatcontains the material and a
generic-api-keyfinding for a synthetic fixtureof the same shape. The detector catches the fixture by accident and misses the
credential.
scanner change) still reports green.
masked vector are already in this repository's public history, so a
history-wide rule would fail forever and no fix on the tip could clear it.
[[allowlists]]block is silently ignored by the pinned scanner8.24.3, so it neither suppressed nor documented anything while reading like a
packages/cgm_cbioexemption.What this changes
security/gitleaks-vendor-material.tomlscripts/check-cbio-vendor-material.shscripts/install-quality-tools.sh.github/workflows/security.ymlVendor Material Guardjob.Makefilemake vendor-material-guard, wired intomake check.The rule, the script, and this body restate no byte, no key-derived vector, and
no device address. The canary is assembled at run time from a synthetic payload
so the script itself carries nothing material-shaped; that is not cosmetic — the
first version of this script was rejected by its own rule, which is recorded
because it is the clearest proof the rule works.
Verification
make tooling-bootstrapmake vendor-material-guardvendor-material guard: cbio-vendor-material-constant rejected the canary and the tree is clean.feature/cbio-gs1-glucose-livepackages/cgm_cbio/lib/src/cbio_crypto.dartand compiledapp.dill/kernel_blob.binoutputs.fix/cbio-credential-redactiontreeno leaks foundfor the material constants. Reproduces the gap this rule closes.Decisions taken
the finding, so the blocking rule runs with
--no-git --source <tree>.legitimate synthetic fixture belongs under a non-material binding name; the
self-test proves the rule rather than relaxing it.
workflow-local download, so local and CI runs cannot diverge.
make checkruns it. The guard is part of the repository commandcontract, not an extra job nobody runs locally.
Decision request
The material is already in this repository's public history, and one key-derived
masked vector is reachable from
origin/feature/cbio-gs1-glucose-liveand the0.4.0aggregates. No scanner setting can un-publish it. Purging it (a rewriteof the unmerged sensor branches, plus their open pull requests) and rotating it
are both calls only the owner can make; rotating vendor-derived interoperability
material may not even be possible without the vendor. Until that decision lands,
this guard keeps new commits clean and the historical exposure stays recorded in
#164, #167, and the scan policy landing in #150.