Janady13/missionmatch / tools/verify/secret-sweep/sweep.sh

1#!/usr/bin/env bash 2# 3# THE SECRETS SWEEP. Refuses to let a credential into the repository or its history. 4# 5# It exists because three plaintext passwords were written into docs/BUILD_STATE.md and sat there across 6# more than twenty commits before anyone looked. The previous check only looked for API KEY SHAPES, so it 7# passed the entire time: sk-proj- prefixed keys were caught and a password on a line saying "password" was 8# not. A sweep that only finds the secrets you already thought of is not a sweep. 9# 10# Usage: 11# sweep.sh scan the working tree 12# sweep.sh --history scan every commit as well, which is slow and worth it before a push 13# sweep.sh --control plant a fake credential, require a FINDING, then remove it 14# sweep.sh --out-of-repo also sweep the enumerated ops scripts and units on the hosts, never printing a value 15# 16# EXIT 0 means clean. EXIT 1 means something was found and is printed with its file and line. 17set -uo pipefail 18 19cd "$(git rev-parse --show-toplevel)" || exit 2 20 21CONTROL=0 22HISTORY=0 23OUTOFREPO=0 24for a in "$@"; do 25 case "$a" in 26 --control) CONTROL=1 ;; 27 --history) HISTORY=1 ;; 28 --out-of-repo) OUTOFREPO=1 ;; 29 esac 30done 31 32# The patterns, each with a name so a finding says WHAT it found rather than just where. 33# 34# The password shapes are the ones this build actually produced, generalised: an assignment or a labelled 35# value whose right hand side looks like a secret rather than a placeholder. They are deliberately a little 36# noisy, because a false positive costs a glance and a false negative costs a rotation. 37PATTERNS=( 38 "api key, openai style|sk-proj-[A-Za-z0-9_-]{20,}" 39 "api key, generic sk|sk-[A-Za-z0-9]{32,}" 40 "aws access key|AKIA[0-9A-Z]{16}" 41 "private key block|BEGIN [A-Z ]*PRIVATE KEY" 42 "password assignment|(password|passwd|pwd)[[:space:]]*[:=][[:space:]]*['\"]?[A-Za-z0-9!@#%^_+=?-]{8,}" 43 "sshpass inline|sshpass[[:space:]]+-p[[:space:]]*['\"]?[^[:space:]'\"]{6,}" 44 "credential in a url|://[A-Za-z0-9._%+-]+:[^@/[:space:]]{6,}@" 45 "dsn with a password|postgres(ql)?://[^:@[:space:]]+:[^@[:space:]]{6,}@" 46) 47 48# Placeholders and documented examples are NOT secrets. This list is deliberately short: every entry is a 49# hole, and a long allowlist is how a sweep stops meaning anything. 50ALLOW='REDACTED|EXAMPLE|example\.(com|invalid|test)|PLACEHOLDER|CHANGE_?ME|your-|<[a-z-]*>|\$\{|\$\(|xxxxx|password_hash|passwordless|password policy|password guessing|password reset|password change|password cap|password input|password verify|password field|password prompt|://user:password@|://mig:secret@|sshpass -p [credential removed] 51 52# Paths that legitimately discuss credential SHAPES: the test fixtures that assert the sweep works, and 53# this file itself, which necessarily contains the patterns. 54SKIP_PATHS=':!tools/verify/secret-sweep/ :!**/*_test.go :!go.sum' 55 56findings=0 57scan_tree() { 58 for entry in "${PATTERNS[@]}"; do 59 name="${entry%%|*}"; rx="${entry#*|}" 60 while IFS= read -r hit; do 61 [ -z "$hit" ] && continue 62 echo "$hit" | grep -qE "$ALLOW" && continue 63 echo " FOUND [$name] $hit" 64 findings=$((findings + 1)) 65 done < <(git grep --untracked -nIE "$rx" -- . $SKIP_PATHS 2>/dev/null | head -40) 66 done 67} 68 69scan_history() { 70 echo " scanning history, this takes a moment" 71 for entry in "${PATTERNS[@]}"; do 72 name="${entry%%|*}"; rx="${entry#*|}" 73 while IFS= read -r c; do 74 [ -z "$c" ] && continue 75 # THE ALLOWLIST APPLIES HERE TOO. The history scan skipped it entirely, so it reported three findings 76 # that were a documentation example, a test constant, and the REDACTION TEXT ITSELF: the placeholder 77 # "[REDACTED, see the secrets store]" is long enough to match the sshpass pattern. A sweep that flags 78 # its own redactions teaches people to ignore it, which is the failure mode that let the original 79 # three passwords sit in this ledger for twenty commits. 80 hit=$(git grep -hoE "$rx" "$c" -- . $SKIP_PATHS 2>/dev/null | head -5) 81 [ -z "$hit" ] && continue 82 echo "$hit" | grep -qvE "$ALLOW" || continue 83 echo " FOUND IN HISTORY [$name] commit $c" 84 findings=$((findings + 1)) 85 done < <(git log --all --format=%h -S"$rx" --pickaxe-regex -- . $SKIP_PATHS 2>/dev/null | head -10) 86 done 87} 88 89# ============================================================================== 90# THE OUT OF REPO SWEEP, finding four. Added 29 July 2026. 91# ============================================================================== 92# 93# The repository sweep above is necessary and was never sufficient: two of the five consumers broken by the D5 94# rotation lived in /usr/local/sbin, and one of them held a migrator password in plaintext where this sweep 95# could never see it. A clean result meant "clean in the repository" and read as "clean". 96# 97# THE SCOPE IS ENUMERATED in outofrepo.scope, traced to docs/CREDENTIAL_CONSUMERS.md, so the inventory and the 98# sweep can be diffed against each other. 99# 100# NO VALUE IS EVER PRINTED. The remote half returns KIND, PATH, LINE and PATTERN NAME. Never the matched text. 101 102SCOPE_FILE="$(dirname "$0")/outofrepo.scope" 103REMOTE_SCAN="$(dirname "$0")/remote-scan.sh" 104 105oor_host_cmd() { 106 # $1 host token, $2... command. Kept in one place so the megamind WSL bridge quoting lives here only. 107 local host="$1"; shift 108 case "$host" in 109 bubbles) 110 ssh -n -o BatchMode=yes -o StrictHostKeyChecking=no -o ConnectTimeout=15 user@100.90.97.104 \ 111 "echo user | sudo -S bash -c $(printf '%q' "$*")" 2>/dev/null ;; 112 megamind) 113 # NESTED printf %q THROUGH wsl DOES NOT SURVIVE, which this ledger already recorded once. A single 114 # unnested invocation does, so the command is passed as one plain string and nothing is re quoted. 115 sshpass -p [credential removed] ssh -n -o PubkeyAuthentication=no -o PreferredAuthentications=password \ 116 -o StrictHostKeyChecking=no -o ConnectTimeout=15 josep@100.69.120.61 \ 117 "wsl -- sudo -n bash -c \"$*\"" 2>/dev/null ;; 118 *) return 1 ;; 119 esac 120} 121 122oor_stage() { 123 local host="$1" 124 case "$host" in 125 bubbles) 126 scp -q -o BatchMode=yes -o StrictHostKeyChecking=no "$REMOTE_SCAN" user@100.90.97.104:/tmp/mm-remote-scan.sh 2>/dev/null && 127 oor_host_cmd bubbles "chmod +x /tmp/mm-remote-scan.sh" >/dev/null ;; 128 megamind) 129 sshpass -p [credential removed] scp -O -o PubkeyAuthentication=no -o PreferredAuthentications=password \ 130 -o StrictHostKeyChecking=no "$REMOTE_SCAN" josep@100.69.120.61:mm-remote-scan.sh >/dev/null 2>&1 && 131 oor_host_cmd megamind "cp /mnt/c/Users/josep/mm-remote-scan.sh /tmp/mm-remote-scan.sh; chmod +x /tmp/mm-remote-scan.sh; echo staged" | grep -q staged ;; 132 esac 133} 134 135scan_out_of_repo() { 136 [ -r "$SCOPE_FILE" ] || { echo " out of repo scope file missing at $SCOPE_FILE, REFUSING to report clean"; findings=$((findings+1)); return; } 137 local staged_hosts="" 138 local scanned=0 139 # EXPECTED IS COUNTED FROM THE FILE, because "at least one scope answered" is not a check. The first version 140 # only refused on ZERO, and ssh silently ate the loop.s stdin so exactly ONE scope ran and it reported clean. 141 local expected 142 expected=$(grep -cE "^[a-z]" "$SCOPE_FILE") 143 while IFS=$'\t' read -r host kind glob; do 144 case "$host" in ''|'#'*) continue ;; esac 145 [ -z "${kind:-}" ] && continue 146 case " $staged_hosts " in 147 *" $host "*) : ;; 148 *) if oor_stage "$host"; then staged_hosts="$staged_hosts $host" 149 else echo " out of repo: could NOT reach $host, REFUSING to report clean for it"; findings=$((findings+1)); continue; fi ;; 150 esac 151 while IFS=$'\t' read -r rkind rpath rline rname; do 152 [ -z "${rkind:-}" ] && continue 153 if [ "$rkind" = "SUMMARY" ]; then scanned=$((scanned+1)); continue; fi 154 echo " FOUND OUT OF REPO [$rname] $host:$rpath line $rline" 155 findings=$((findings+1)) 156 done < <(oor_host_cmd "$host" "/tmp/mm-remote-scan.sh $kind '$glob'") 157 done < "$SCOPE_FILE" 158 if [ "$scanned" -ne "$expected" ]; then 159 echo " out of repo: $scanned of $expected enumerated scopes returned a summary. A scope that does not" 160 echo " answer has not been swept, so this result is NOT clean and is refused." 161 findings=$((findings+1)) 162 else 163 echo " out of repo: $scanned of $expected enumerated scopes scanned, all answered" 164 fi 165} 166 167# oor_probe runs ONE scope directly and prints the finding count the remote side reported, or the word 168# unreachable. It reads the count out of the SUMMARY line rather than counting printed findings, so a control 169# cannot be satisfied by output that happens to have the right number of lines. 170oor_probe() { 171 local host="$1" kind="$2" glob="$3" n="" 172 while IFS=$'\t' read -r rkind rpath rline rname; do 173 [ -z "${rkind:-}" ] && continue 174 [ "$rkind" = "SUMMARY" ] && n="$rname" 175 done < <(oor_host_cmd "$host" "/tmp/mm-remote-scan.sh $kind '$glob'") 176 [ -z "$n" ] && n="unreachable" 177 echo "$n" 178} 179 180# THE PLANTED VALUE. Fake, and shaped like the real thing so the patterns must actually work to catch it. It 181# deliberately avoids every allowlist entry, because a control that lands on the allowlist passes by being 182# ignored, which is the same as not running. 183CTL_PW='Zq7mKv3nRt9wLx2bYd' 184CTL_DSN="postgres://zzprobe:${CTL_PW}@127.0.0.1:5432/zzdb" 185 186if [ "$CONTROL" = "1" ]; then 187 # THE POSITIVE CONTROL. A sweep that has never found anything is indistinguishable from one whose 188 # patterns are broken, so a fake credential is planted in EVERY SCOPE THE SWEEP CLAIMS and each one must 189 # report it, then stop reporting it once the plant is removed. Both directions, per scope, because a check 190 # that always fires is as useless as one that never does. 191 # 192 # THE CONTROL ITSELF WAS BROKEN FIRST. git grep searches TRACKED files only, so the planted file was never 193 # scanned and the control was passing on unrelated real findings elsewhere in the tree. It reported 194 # success while testing nothing, which is the exact failure this whole sweep exists to prevent, and it was 195 # only caught because a later fix removed the unrelated findings and the control went red. scan_tree now 196 # passes --untracked, which is also what you want before a commit: a secret in a new unstaged file is the 197 # most likely way one arrives. 198 # 199 # FINDINGS ARE COUNTED, NEVER ECHOED, in this mode. The planted value is fake, and printing it anyway would 200 # teach the habit that disclosed a live credential through flag usage output in finding D14. 201 cpass=0; cfail=0 202 ctl() { # name, expectation met yes or no, detail 203 if [ "$2" = "yes" ]; then cpass=$((cpass+1)); echo " control OK $1: $3" 204 else cfail=$((cfail+1)); echo " CONTROL FAILED $1: $3"; fi 205 } 206 probe_repo() { local before="$findings"; scan_tree >/dev/null 2>&1; echo $((findings - before)); } 207 208 # ---- scope 1, INSIDE the repository, an UNTRACKED file. The historically broken one. ---- 209 utmp="docs/_secret_sweep_control.md" 210 printf 'host access: ssh admin@example.invalid\npassword: %s\n' "$CTL_PW" > "$utmp" 211 n=$(probe_repo); rm -f "$utmp" 212 [ "$n" -gt 0 ] && ctl "repo untracked" yes "planted credential detected, $n finding(s)" \ 213 || ctl "repo untracked" no "a planted credential in an UNTRACKED file was NOT detected" 214 n=$(probe_repo) 215 [ "$n" -eq 0 ] && ctl "repo untracked, cleared" yes "clean once the plant was removed" \ 216 || ctl "repo untracked, cleared" no "still reporting $n finding(s) with nothing planted" 217 218 # ---- scope 2, INSIDE the repository, a TRACKED file. ---- 219 # A MODIFIED tracked file rather than a newly added one, so the INDEX is never touched: staging a credential 220 # shaped string, even briefly, risks a crash leaving it staged for the next commit. The content is saved 221 # byte exactly and restored, and the restore is VERIFIED by hash rather than assumed. 222 ttrk="docs/CREDENTIAL_CONSUMERS.md" 223 if [ -f "$ttrk" ] && git ls-files --error-unmatch "$ttrk" >/dev/null 2>&1; then 224 tsave="$(mktemp)"; cp "$ttrk" "$tsave" 225 tbefore="$(shasum -a 256 "$ttrk" | cut -d' ' -f1)" 226 printf '\npassword: %s\n' "$CTL_PW" >> "$ttrk" 227 n=$(probe_repo) 228 cp "$tsave" "$ttrk"; rm -f "$tsave" 229 tafter="$(shasum -a 256 "$ttrk" | cut -d' ' -f1)" 230 [ "$n" -gt 0 ] && ctl "repo tracked" yes "planted credential detected, $n finding(s)" \ 231 || ctl "repo tracked" no "a planted credential in a TRACKED file was NOT detected" 232 [ "$tbefore" = "$tafter" ] && ctl "repo tracked, restored" yes "$ttrk restored, hash matches" \ 233 || ctl "repo tracked, restored" no "$ttrk did NOT restore to its original hash" 234 n=$(probe_repo) 235 [ "$n" -eq 0 ] && ctl "repo tracked, cleared" yes "clean once the plant was removed" \ 236 || ctl "repo tracked, cleared" no "still reporting $n finding(s) with nothing planted" 237 else 238 ctl "repo tracked" no "$ttrk is absent or untracked, so the tracked file scope was NOT controlled" 239 fi 240 241 # ---- scopes 3 and up, OUTSIDE the repository, one control per host and kind. ---- 242 if [ "$OUTOFREPO" = "1" ]; then 243 # Cleanup is a TRAP, not a trailing line, because a control that plants a credential shaped file on a 244 # server and then dies has made the problem it was testing for. 245 oor_cleanup() { 246 for h in bubbles megamind; do 247 oor_host_cmd "$h" "rm -f /usr/local/sbin/mm-zz-sweep-control.sh /etc/systemd/system/mm-zz-sweep-control.service /etc/missionmatch/zz-sweep-control.env" >/dev/null 2>&1 248 done 249 } 250 trap oor_cleanup EXIT INT TERM 251 252 for h in bubbles megamind; do 253 if ! oor_stage "$h"; then 254 ctl "$h out of repo" no "host unreachable, so NO out of repo scope on it was controlled" 255 continue 256 fi 257 258 # 3a. A SCRIPT that embeds a value. Exactly what mm-identity-sync.sh did until 29 July 2026. 259 p=/usr/local/sbin/mm-zz-sweep-control.sh 260 oor_host_cmd "$h" "printf 'CONTROL_DSN=$CTL_DSN\n' > $p" >/dev/null 2>&1 261 n=$(oor_probe "$h" script "/usr/local/sbin/mm-*.sh") 262 oor_host_cmd "$h" "rm -f $p" >/dev/null 2>&1 263 case "$n" in 264 unreachable) ctl "$h script" no "scope did not answer" ;; 265 0) ctl "$h script" no "a planted DSN in a script under the real glob was NOT detected" ;; 266 *) ctl "$h script" yes "planted DSN detected, $n finding(s)" ;; 267 esac 268 269 # 3b. A systemd UNIT that inlines a secret instead of pointing at an EnvironmentFile. The unit is never 270 # enabled and no daemon reload is issued, so it is inert on disk for the length of the check. 271 if grep -qE "^$h[[:space:]]+unit" "$SCOPE_FILE" 2>/dev/null; then 272 u=/etc/systemd/system/mm-zz-sweep-control.service 273 oor_host_cmd "$h" "printf '[Service]\nEnvironment=MM_ZZ_PASSWORD=$CTL_PW\n' > $u" >/dev/null 2>&1 274 n=$(oor_probe "$h" unit "/etc/systemd/system/mm-*.service") 275 oor_host_cmd "$h" "rm -f $u" >/dev/null 2>&1 276 case "$n" in 277 unreachable) ctl "$h unit" no "scope did not answer" ;; 278 0) ctl "$h unit" no "an inline Environment= secret in a unit under the real glob was NOT detected" ;; 279 *) ctl "$h unit" yes "inline unit secret detected, $n finding(s)" ;; 280 esac 281 fi 282 283 # 3c. The MODE check, controlled BOTH WAYS on a file of its own so no real credential file's permissions 284 # are ever loosened to test the instrument. World readable must fail, 0600 root owned must pass. The 285 # second half is the half that matters: a mode check that fires on everything proves nothing either. 286 m=/etc/missionmatch/zz-sweep-control.env 287 oor_host_cmd "$h" "printf 'MM_ZZ_URL=$CTL_DSN\n' > $m; chmod 644 $m; chown root:root $m" >/dev/null 2>&1 288 n=$(oor_probe "$h" mode "$m") 289 case "$n" in 290 unreachable) ctl "$h mode, loose" no "scope did not answer" ;; 291 0) ctl "$h mode, loose" no "a world readable credential file was NOT flagged" ;; 292 *) ctl "$h mode, loose" yes "world readable credential file flagged, $n finding(s)" ;; 293 esac 294 oor_host_cmd "$h" "chmod 600 $m" >/dev/null 2>&1 295 n=$(oor_probe "$h" mode "$m") 296 case "$n" in 297 unreachable) ctl "$h mode, correct" no "scope did not answer" ;; 298 0) ctl "$h mode, correct" yes "a 0600 root owned credential file was correctly NOT flagged" ;; 299 *) ctl "$h mode, correct" no "a correctly locked credential file was flagged anyway, $n finding(s)" ;; 300 esac 301 oor_host_cmd "$h" "rm -f $m" >/dev/null 2>&1 302 done 303 oor_cleanup 304 trap - EXIT INT TERM 305 else 306 echo " note: out of repo scopes were NOT controlled. Pass --control --out-of-repo to control them." 307 fi 308 309 echo "positive control: $cpass passed, $cfail failed" 310 if [ "$cfail" -gt 0 ]; then 311 echo "POSITIVE CONTROL FAILED: at least one scope the sweep claims to cover proves nothing." 312 exit 1 313 fi 314 exit 0 315fi 316 317echo "secret sweep: working tree" 318scan_tree 319if [ "$HISTORY" = "1" ]; then 320 scan_history 321fi 322if [ "$OUTOFREPO" = "1" ]; then 323 echo "secret sweep: out of repo scope" 324 scan_out_of_repo 325fi 326 327if [ "$findings" -gt 0 ]; then 328 echo "SECRET SWEEP FAILED: $findings finding(s). Rotate first, then redact, then purge history." 329 exit 1 330fi 331echo "secret sweep: clean" 332exit 0 333