From d09e2a2743adce18a9a896fd95d0de48a234ff5a Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Tue, 25 Aug 2026 11:29:16 -0700 Subject: [PATCH] Stop using a live credential as a test fixture MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `the_custom_env_fingerprint_never_carries_the_value` asserted that the custom-env fingerprint does not leak a secret — using the maintainer's real Gitea token as the secret. It was committed on 2026-08-11 in 9b2f4fe, reached 92 commits, and was readable for fourteen days in the public GitHub mirror at `shadowdao/triple-c`, confirmed by fetching the raw file. The token was a **site-admin** token (`is_admin: true`, user id 1) with admin rights on every repository the account can see, not a repo-scoped one. It has been revoked; the API now answers 401. Release bundles were never affected — the literal is inside `#[cfg(test)]`, and a search of the shipped 0.4.62 AppImage finds nothing. The fixture is now an obviously fake string, and the test is unchanged otherwise. Mutation-checked against the replacement: a fingerprint that returns the raw value, one that returns the key name, and one that ignores its input are all still caught, so nothing about the test's power depended on the value being real — which was true the whole time. History is deliberately **not** rewritten. The value was public for two weeks, so rotation is the fix and the old value is now worthless; rewriting 92 commits of published history would break every clone to hide something already seen. Worth noting how this survived: five audit rounds and two independent reviews all pointed at new code, and this sat in a test file that none of them had reason to open. A high-entropy-literal check in CI would have caught it on the day. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01LHL9ty7arp8FHwvE77ne7y --- app/src-tauri/src/docker/container.rs | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/app/src-tauri/src/docker/container.rs b/app/src-tauri/src/docker/container.rs index 01950bd..a48cf72 100644 --- a/app/src-tauri/src/docker/container.rs +++ b/app/src-tauri/src/docker/container.rs @@ -4177,7 +4177,12 @@ mod tests { // It goes into `triple-c.custom-env-fingerprint`, which `docker inspect` // hands to anything on the host, `docker commit` copies onto the // project's snapshot image, and the recreation check logs on a mismatch. - let secret = "33da01c1b320644920c20d6b5e0a1c6b3c3451c2"; + // **Never a real credential.** This literal was the maintainer's actual + // Gitea token for fourteen days and ninety-two commits, on a public + // mirror — in a test whose whole subject is that secrets do not escape. + // A fixture only has to be *a value*; it never has to be a live one, so + // there is no version of this that justifies pasting something real. + let secret = "not-a-real-token-0000000000000000000000"; let fp = compute_env_fingerprint(&[EnvVar { key: "TEA_TOKEN".to_string(), value: secret.to_string(),