timothy/ersatztv
1
0
Fork 0
Code Issues 54 Pull Requests 6 Actions Packages Projects Releases 9 Wiki Activity

curl -u "$VAR" puts a credential in argv on shared hosts — five call sites, one class #821

New Issue
Open
opened 2026-08-22 23:42:26 +02:00 by timothy · 0 comments
timothy commented 2026-08-22 23:42:26 +02:00
Owner
Copy Link
Copy Source

Raised by a cold review of #772's preflight and deliberately NOT fixed there: fixing one site would leave the class intact and the codebase inconsistent, which is the shape docs/decisions/records/process/ keeps recording as the wrong move.

The shape

curl -u "$SOMETHING" places user:pass in the process's argv, where any user on the host can read it with ps for the duration of the call. Call sites:

Site Credential
scripts/ci-detect-already-validated.sh:75 ETV_STATUS_AUTH (= REGISTRY_USER:REGISTRY_PASSWORD)
scripts/ci-toolchain-image-resolves.sh ETV_REGISTRY_AUTH (same secrets)
scripts/pr-changed-files.sh:99 ETV_GITEA_BASICAUTH
scripts/select-queue.sh:59 ETV_GITEA_BASICAUTH
scripts/issue-qualification-audit.sh:24 ETV_GITEA_BASICAUTH

Exposure is worst on the container-free lane (runs-on: small, no container:), because that is the shared host — bumblebee/jazz, which also run the prod transcoders — rather than a per-job container. ci.required-job-step-execution-markers already carves that lane out of its isolation reasoning for the same underlying reason.

The registry credential is the one that matters: #697 established it reaches ersatztv:prod (the tag prod's stack follows) and ersatztv-ci:<sha> (the toolchain image five container: jobs execute).

Not urgent, and worth saying why

The hosts are single-tenant homelab machines, the window is one HTTP call wide, and the token/basic-auth values are already in the runner's environment (which ps -E can also reach on some configurations). This is defence in depth, not an open door — which is exactly why it should be fixed as a class in one pass rather than opportunistically in whatever PR happens to touch a caller.

Options

  1. curl -K - reading user = "..." from stdin — no file, no argv; needs care with " and \ in the value.
  2. An Authorization: Basic <base64> header built in-process — but -H is argv too, so this only helps if the header is also passed via -K -.
  3. A shared scripts/lib/gitea-curl.sh helper so there is ONE place that gets this right, which would also collapse four near-identical api_get implementations.

(3) is the one that stops the class recurring; the four copies are why this is five rows instead of one.

Done-when

  • No scripts/ caller passes a credential in argv (enumerate from the git index, not from this list — an issue's file list is not the population)
  • The chosen mechanism is exercised by a test, not just read
  • Adversarial review passed
Raised by a cold review of #772's preflight and deliberately NOT fixed there: fixing one site would leave the class intact and the codebase inconsistent, which is the shape `docs/decisions/records/process/` keeps recording as the wrong move. ## The shape `curl -u "$SOMETHING"` places `user:pass` in the process's argv, where any user on the host can read it with `ps` for the duration of the call. Call sites: | Site | Credential | |---|---| | `scripts/ci-detect-already-validated.sh:75` | `ETV_STATUS_AUTH` (= `REGISTRY_USER`:`REGISTRY_PASSWORD`) | | `scripts/ci-toolchain-image-resolves.sh` | `ETV_REGISTRY_AUTH` (same secrets) | | `scripts/pr-changed-files.sh:99` | `ETV_GITEA_BASICAUTH` | | `scripts/select-queue.sh:59` | `ETV_GITEA_BASICAUTH` | | `scripts/issue-qualification-audit.sh:24` | `ETV_GITEA_BASICAUTH` | Exposure is worst on the **container-free** lane (`runs-on: small`, no `container:`), because that is the shared host — bumblebee/jazz, which also run the prod transcoders — rather than a per-job container. `ci.required-job-step-execution-markers` already carves that lane out of its isolation reasoning for the same underlying reason. The registry credential is the one that matters: #697 established it reaches `ersatztv:prod` (the tag prod's stack follows) and `ersatztv-ci:<sha>` (the toolchain image five `container:` jobs execute). ## Not urgent, and worth saying why The hosts are single-tenant homelab machines, the window is one HTTP call wide, and the token/basic-auth values are already in the runner's environment (which `ps -E` can also reach on some configurations). This is defence in depth, not an open door — which is exactly why it should be fixed as a class in one pass rather than opportunistically in whatever PR happens to touch a caller. ## Options 1. `curl -K -` reading `user = "..."` from stdin — no file, no argv; needs care with `"` and `\` in the value. 2. An `Authorization: Basic <base64>` header built in-process — but `-H` is argv too, so this only helps if the header is also passed via `-K -`. 3. A shared `scripts/lib/gitea-curl.sh` helper so there is ONE place that gets this right, which would also collapse four near-identical `api_get` implementations. (3) is the one that stops the class recurring; the four copies are why this is five rows instead of one. ## Done-when - [ ] No `scripts/` caller passes a credential in argv (enumerate from the git index, not from this list — an issue's file list is not the population) - [ ] The chosen mechanism is exercised by a test, not just read - [ ] Adversarial review passed
timothy added the ci-cdpriority: lowsecurity labels 2026-08-22 23:42:35 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
ad-hoc
One-off / ad-hoc work not tracked by a dedicated issue
 api
REST API / HTTP endpoints
 bug
Something isn't working
 ci-cd
Build, test, deploy pipeline
 content
Channel content / schedules / playlists
 dependencies
Dependency updates (Renovate)
 enhancement
New feature or improvement
 frontend
ChicoryTV React SPA frontend
 in-progress
Claimed by an active session — do not pick up
 jellyfin
Jellyfin tuner / IPTV integration
 parked
Excluded from automatic queue pickup; work only when explicitly selected
 priority: high
priority: low
priority: medium
review
Adversarial review finding
 security
Security / vulnerability fix
No labels ci-cd priority: low security
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
renovate timothy (Timothy)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: timothy/ersatztv#821