Paul Hitt
ac42e44919
Nothing here is an app. This is the protocol implemented a third time, and it is deliberately first: a third implementation is only worth writing if it is written against the specification and the published vectors rather than against a reading of the Swift and JavaScript that already agree. So far: canonical bytes, safety numbers, and the RFC 6962 key log with its inclusion and consistency proofs. Nine tests, all against the vectors the other two engines are held to. X25519, Ed25519, X3DH, the Double Ratchet, sealed sender and the post-quantum halves are not written yet. The vectors are read from the protocol repository rather than copied here, and the suite fails rather than skips when it cannot find them -- an engine that quietly stops checking itself is worth less than no third engine.
68 lines
3.0 KiB
Bash
Executable File
68 lines
3.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Refuse to publish anything that looks like a credential.
|
|
#
|
|
# This subtree is mirrored to a PUBLIC repository, and a public git history is
|
|
# not something you can take back — a leaked key is leaked the moment the push
|
|
# lands, regardless of what the next commit does. So this runs as a gate before
|
|
# the mirror, not as a report afterwards.
|
|
#
|
|
# scripts/secret-sweep.sh [dir] # defaults to the package root
|
|
#
|
|
# Exits non-zero on the first credible hit. False positives are expected and are
|
|
# the correct trade here: the cost of one is a person reading a line of output,
|
|
# and the cost of a miss is a rotation and an incident.
|
|
set -euo pipefail
|
|
|
|
ROOT="${1:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
|
|
cd "$ROOT"
|
|
|
|
# Build products and vendored upstream are excluded: .build is compiler output,
|
|
# and vendor/ is checked separately by the supply-chain digest test. This script
|
|
# excludes ITSELF by filename rather than by one hardcoded path -- it is the file
|
|
# with every pattern in it, so a copy living anywhere else reports itself as a
|
|
# find, and a repo with a `Scripts/` rather than a `scripts/` did exactly that.
|
|
# `git ls-files .` and not plain `git ls-files`: this subtree may be untracked
|
|
# in the repo that contains it, and an unscoped call there returns the WHOLE
|
|
# repository. An empty result means untracked, not empty — fall back to find,
|
|
# or the sweep silently passes by looking at nothing, which is worse than not
|
|
# running it at all.
|
|
FILES=$(git ls-files . 2>/dev/null || true)
|
|
if [ -z "$FILES" ]; then
|
|
FILES=$(find . -type f -not -path '*/.build/*' -not -path '*/node_modules/*' -not -path '*/.git/*')
|
|
fi
|
|
|
|
hits=0
|
|
probe() {
|
|
local label="$1" pattern="$2"
|
|
local found
|
|
found=$(printf '%s\n' "$FILES" \
|
|
| grep -vE '(^|/)vendor/|\.build/|secret-sweep\.sh$' \
|
|
| xargs -I{} grep -HnE "$pattern" {} 2>/dev/null || true)
|
|
if [ -n "$found" ]; then
|
|
echo "── $label"
|
|
printf '%s\n' "$found" | head -8
|
|
hits=$((hits + 1))
|
|
fi
|
|
}
|
|
|
|
# Shapes, not names: a variable called API_KEY holding "" is fine, and a
|
|
# variable called `x` holding a live token is not.
|
|
probe "Stripe live key" 'sk_live_[0-9A-Za-z]{16,}'
|
|
probe "GitLab token" 'glpat-[0-9A-Za-z_-]{20,}'
|
|
probe "AWS access key id" 'AKIA[0-9A-Z]{16}'
|
|
probe "Anthropic key" 'sk-ant-[0-9A-Za-z_-]{20,}'
|
|
probe "Google API key" 'AIza[0-9A-Za-z_-]{35}'
|
|
probe "Slack token" 'xox[baprs]-[0-9A-Za-z-]{10,}'
|
|
probe "private key block" '-----BEGIN (RSA |EC |OPENSSH |PGP )?PRIVATE KEY'
|
|
probe "JWT" 'eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.'
|
|
probe "Supabase service role" 'service_role.{0,40}eyJ'
|
|
probe "assigned password" '(password|passwd|secret|token)[[:space:]]*[:=][[:space:]]*["'"'"'][^"'"'"'{}$][^"'"'"']{7,}["'"'"']'
|
|
|
|
if [ "$hits" -gt 0 ]; then
|
|
echo
|
|
echo "secret sweep FAILED: $hits pattern(s) matched. Nothing was published."
|
|
exit 1
|
|
fi
|
|
echo "secret sweep clean ($(printf '%s\n' "$FILES" | wc -l | tr -d ' ') files)"
|