A live test for the file round trip, and four published passwords #85

2026-09-04T20:28:13Z

paulhitt commented

2026-09-04 20:28:13 +00:00

(Migrated from gitlab.com)

LiveFileTransferTest covers the one seam nothing else does: a document
leaving one vault, crossing a real relay, and arriving in another's with
its label intact. FileShareWireTest proves the envelope's shape and
LocalVaultTest proves the vault at both ends; neither puts a byte on a
wire.

Written, compiles, UNRUN — the same state LiveSignUpFleetTest is
in, and the same caveat applies: an unrun test proves nothing. It creates
accounts, so it needs a throwaway relay and an explicit decision to point
it at one.

Writing it surfaced four published passwords and a guard that could
not see them.

TestSafetyTest exists to stop a credential being written into a suite
that creates real accounts. It matched val X = "…" only. So:

LiveConversationTest passed the literal straight as an ARGUMENT,
twice — invisible to the check.
LiveSignUpTest, LiveKeyLogTest and LiveSealedSenderTest wrote
password = "…" on its own line inside a multi-line argument list, the
most ordinary Kotlin formatting there is — also invisible.

I copied the same literal into the new suite before noticing, which is
how I found it.

A guard that passes while the thing it guards against is present in the
tree is worse than no guard, because it is read as evidence. All five
call sites now read LiveTarget.passphrase() from the environment with no
fallback, and announce a SKIP when it is unset.

The check itself took two wrong turns worth recording:

Skipping every named argument, to avoid flagging
product = "messenger" — which let the three password = "…" suites
through. Trading one blind spot for another is not a fix; a named
argument is now judged by its NAME.
Widening the sign-up match to a few lines around the call — which
flagged forty test tags, assertion messages and message bodies as
credentials. That is how a check stops being read, so it is same-line
only, and rule 1 covers the multi-line case properly.

"secret" was dropped from the credential names for the same reason: test
prose is full of it, and a marker string called secret is a fixture.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com

`LiveFileTransferTest` covers the one seam nothing else does: a document leaving one vault, crossing a real relay, and arriving in another's with its label intact. `FileShareWireTest` proves the envelope's shape and `LocalVaultTest` proves the vault at both ends; neither puts a byte on a wire. **Written, compiles, UNRUN** — the same state `LiveSignUpFleetTest` is in, and the same caveat applies: an unrun test proves nothing. It creates accounts, so it needs a throwaway relay and an explicit decision to point it at one. **Writing it surfaced four published passwords and a guard that could not see them.** `TestSafetyTest` exists to stop a credential being written into a suite that creates real accounts. It matched `val X = "…"` only. So: - `LiveConversationTest` passed the literal straight as an ARGUMENT, twice — invisible to the check. - `LiveSignUpTest`, `LiveKeyLogTest` and `LiveSealedSenderTest` wrote `password = "…"` on its own line inside a multi-line argument list, the most ordinary Kotlin formatting there is — also invisible. I copied the same literal into the new suite before noticing, which is how I found it. **A guard that passes while the thing it guards against is present in the tree is worse than no guard, because it is read as evidence.** All five call sites now read `LiveTarget.passphrase()` from the environment with no fallback, and announce a SKIP when it is unset. The check itself took two wrong turns worth recording: - Skipping every named argument, to avoid flagging `product = "messenger"` — which let the three `password = "…"` suites through. Trading one blind spot for another is not a fix; a named argument is now judged by its NAME. - Widening the sign-up match to a few lines around the call — which flagged forty test tags, assertion messages and message bodies as credentials. That is how a check stops being read, so it is same-line only, and rule 1 covers the multi-line case properly. "secret" was dropped from the credential names for the same reason: test prose is full of it, and a marker string called `secret` is a fixture. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

paulhitt commented

2026-09-04 20:28:13 +00:00

(Migrated from gitlab.com)

assigned to @paulhitt

paulhitt (Migrated from gitlab.com) changed target branch from docs/parity-history-at-rest to main

2026-09-04 20:50:17 +00:00

paulhitt (Migrated from gitlab.com) merged commit e3d0c0c121 into main

2026-09-04 20:50:19 +00:00

paulhitt commented

2026-09-04 20:50:22 +00:00

(Migrated from gitlab.com)

mentioned in commit e3d0c0c121

mentioned in commit e3d0c0c121cf8d29ae81983d8d0e95272e4e11b3

paulhitt commented

2026-09-09 19:01:23 +00:00

(Migrated from gitlab.com)

changed the description

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: extant2000/flamenet-messenger-android#85