Privatae
123 lines
5.0 KiB
Go
123 lines
5.0 KiB
Go
package main
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"regexp"
|
|
"strconv"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// The member repository publishes this tree to strangers byte for byte, and
|
|
// its release step refuses outright a tree that carries any of the classes
|
|
// below. Each is checked here as well, so a change that brings one in fails
|
|
// before it merges, not after a release has been built and signed from it.
|
|
//
|
|
// A class is described, never named: a comment says what happened and why, not
|
|
// on which of our machines, by whom, under which ticket, or on which day it was
|
|
// decided. Test data is invented (example.com, .example, the 9000 range).
|
|
//
|
|
// Not checked here: names held outside this repository (they cannot be listed
|
|
// in a published file; the release step and the personal-data check read them
|
|
// from the machine they are kept on), and the two classes the release step
|
|
// compares against the previous release instead of refusing outright: paths
|
|
// under root's home directory, which the bastion's own state and its tests of
|
|
// credential-store refusals legitimately use, and the bastion's own tunnel
|
|
// addresses in the private range.
|
|
//
|
|
// Every pattern is written so that this file does not match it: a bracketed
|
|
// letter keeps the text from being the word it finds.
|
|
var publishedInternalClasses = []struct {
|
|
name string
|
|
re *regexp.Regexp
|
|
}{
|
|
{"a machine of the platform's own fleet",
|
|
regexp.MustCompile(`mgmt-[12]|platform-meta[l]|entity-poo[l]|edge-vi[n]|edge-hi[l]|dmz-[a-z]+-[0-9]`)},
|
|
{"a credential store of the platform",
|
|
regexp.MustCompile(`gitea-[s]kema-credentials|/roo[t]/\.config/git|INTERNAL_API_SECRE[T]`)},
|
|
{"a ticket id", regexp.MustCompile(`T-[0-9]{4}\b|R-[0-9]{3}\b`)},
|
|
{"the name of a person or a review agent who worked on the code",
|
|
regexp.MustCompile(`\b(Fabl[e]|Maddi[e]|Opu[s])\b|[Cc]ase[y]`)},
|
|
{"a dated decision", regexp.MustCompile(`(Decided|Reported|Measured|measured) 20[0-9]{2}-[0-9]{2}`)},
|
|
{"a design document reference", regexp.MustCompile(`DESIGN-[a-z]|plan [§]`)},
|
|
{"the old module path", regexp.MustCompile(`github\.com/privata[e]`)},
|
|
{"the platform's install directory", regexp.MustCompile(`/opt/privata[e]`)},
|
|
{"an address in the platform's fleet mesh", regexp.MustCompile(`fd0[0]:aa:`)},
|
|
}
|
|
|
|
// publishedInternalHits returns "class: line N" for every line of src that a
|
|
// class matches.
|
|
func publishedInternalHits(src string) []string {
|
|
var hits []string
|
|
for i, line := range strings.Split(src, "\n") {
|
|
for _, c := range publishedInternalClasses {
|
|
if c.re.MatchString(line) {
|
|
hits = append(hits, strconv.Itoa(i+1)+": "+c.name)
|
|
}
|
|
}
|
|
}
|
|
return hits
|
|
}
|
|
|
|
func TestPublishedSourceNamesNothingInternal(t *testing.T) {
|
|
root, err := filepath.Abs("..")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
files := publishedFiles(t, root)
|
|
if len(files) < 50 {
|
|
t.Fatalf("found only %d files under %s; the scan is not looking at the repository", len(files), root)
|
|
}
|
|
var hits []string
|
|
for _, rel := range files {
|
|
for _, h := range publishedInternalHits(rel) {
|
|
hits = append(hits, rel+" (in the file name) "+h[strings.Index(h, " ")+1:])
|
|
}
|
|
data, err := os.ReadFile(filepath.Join(root, rel))
|
|
if err != nil {
|
|
continue // a tracked file deleted in the working tree
|
|
}
|
|
for _, h := range publishedInternalHits(string(data)) {
|
|
hits = append(hits, rel+":"+h)
|
|
}
|
|
}
|
|
// The lines themselves are not printed: a hit of the first two classes can
|
|
// be the very value that must not be published, and a CI log is published too.
|
|
if len(hits) > 0 {
|
|
t.Errorf("%d published lines name something internal; describe it instead, with invented values:\n %s",
|
|
len(hits), strings.Join(hits, "\n "))
|
|
}
|
|
}
|
|
|
|
// The check itself: each class fires on a planted line and stays quiet on its
|
|
// look-alikes. Planted lines carry a "|" that is removed before they are read.
|
|
func TestPublishedInternalCheckCatchesEachClass(t *testing.T) {
|
|
live := func(s string) string { return strings.ReplaceAll(s, "|", "") }
|
|
for _, line := range []string{
|
|
"seen on mgmt|-2 at noon", "ssh platform-met|al", "the entity-po|ol nodes", "via edge-v|in",
|
|
"edge-h|il took over", "dmz-ro|uter-1 is up",
|
|
"read /ro|ot/.config/g|it/creds", "gitea-sk|ema-credentials", "INTERNAL_API_SEC|RET=x",
|
|
"fixed in T-|1234", "see R-|101.",
|
|
"Fab|le found it", "per Mad|die", "Op|us said so", "Ca|sey asked", `owner "ca|sey"`,
|
|
"Decid|ed 2026-10-01: keep it", "measu|red 2026-11-03 on a box",
|
|
"DESIGN|-bastion.md", "plan| § 4",
|
|
"github.com/priv|atae/bastion", "/opt/priv|atae/bin", "addr fd0|0:aa::1",
|
|
} {
|
|
if len(publishedInternalHits(live(line))) == 0 {
|
|
t.Errorf("%q: not caught", live(line))
|
|
}
|
|
}
|
|
for _, line := range []string{
|
|
"mgmt-3 is not ours", "platform metal", "edge-v",
|
|
"dmz-router", "~/.config/git", "T-123 and T-12345x", "R-1000",
|
|
"Fables and Opuses", "Maddies", "a case, yes", "decided in 2026",
|
|
"design doc", "github.com/example/thing", "/opt/example/privatae-bastion",
|
|
"fd12:3456::a:1", "fdaa::1",
|
|
} {
|
|
if hits := publishedInternalHits(live(line)); len(hits) != 0 {
|
|
t.Errorf("%q: false hit %v", line, hits)
|
|
}
|
|
}
|
|
}
|