Files

check / check (push) Failing after 1m45s

Details

Make script/test fail on flaky failures and enable -race (closes #32 )

script/test ended with `go test ./... || go test -v ./...`, so the
verbose rerun's exit status became the script's. A test that failed
once and passed on the retry produced exit 0, and since the Dockerfile
runs `make test` and CI runs script/cibuild, flaky failures were
invisible repo-wide.

Replace that with the pattern from REPO_POLICIES.md: run
`go test -timeout 30s -race -cover ./...`, and on failure rerun
verbosely and then exit 1, so the rerun is diagnostic only and can
never turn a failed run green. `go vet ./...` still runs first; the
script stays POSIX sh with set -eu, the CGO_ENABLED=1 export, and the
repo-root cd idiom.

Enabling -race surfaced a genuine timing conflict rather than a data
race: no package that ran to completion reported one, but internal/cli
now exceeds the 30s timeout because the 99MB/100MB boundary cases in
secrets_size_test.go are about 10x slower under race instrumentation.
Measured in the CI-equivalent container (script/cibuild, with the
memlock ulimit): 18.7s for the make test layer without -race, versus
internal/cli alone needing roughly 55-60s with it. Neither the flags
nor the tests were weakened to hide this; the conflict is filed as #52
for a decision.

2026-08-09 05:03:54 +00:00

4.9 KiB

Raw Blame History

Workflow

branch (from main)
do the work in Next Step
move Next Step to the top of Completed Steps
move the top item of Future Steps into Next Step
commit (TODO.md changes in the same commit as the work)
merge to main if the branch is not protected, otherwise open a PR
push

Status

pre-1.0. No git tags. TODO.md carries open 1.0 security blockers. Work in flight on branch secure-enclave-unlocker (clean tree as of 2026-07-06).

Next Step

Bring the repo into policy compliance in one commit:

Add fmt-check and hooks targets to the Makefile (test/lint/fmt/check/ docker already exist).
Add REPO_POLICIES.md and .editorconfig.
Add .gitea/workflows/check.yml running make check.
Verify Dockerfile base images are pinned by sha256.

Completed Steps

2026-08-09: script/test now runs go test -timeout 30s -race -cover ./... and, on failure, reruns verbosely and then exits non-zero, so a test that fails once and passes on the retry can no longer produce a green build (closes #32). Enabling -race showed the suite cannot meet the 20-second policy budget: internal/cli exceeds the 30-second timeout because the 99MB/100MB boundary cases in secrets_size_test.go run roughly 10x slower under race instrumentation. No flags were weakened and no tests skipped; the conflict is tracked in #52 for a decision.
2026-07-07 Adopted scripts-to-rule-them-all: script/ entrypoints, Makefile shims, README Entrypoints section
2026-03-11: Secure Enclave unlocker for hardware-backed secret protection, plus review fixes (stub panics, derivation index, tests, README) on branch secure-enclave-unlocker.
2026-02-28: Repo cleanup, removed stale .cursorrules and coverage.out.
Audit fix wave (issues #1, #2, #3, #13, #14): skip unlockers with missing metadata, allow uppercase secret names, fix hardcoded derivation index, validate names in GetSecretVersion against path traversal, return errors instead of panicking, add Warn() on silent anomalies.
Memory security hardening: LockedBuffer used through encrypt/decrypt paths (Save/EncryptWithPassphrase/GetValue/gpg helpers), deprecated bare-[]byte APIs removed.
Per-secret keypair architecture, vault package refactor, versioning with --version, comprehensive test suite with in-memory filesystem.
Debug logging system (slog, GODEBUG flag, TTY-aware output).
Renamed SEP unlocker to Keychain, reorganized import commands.
2025-05-28: Initial implementation (vault, age encryption, mnemonic, CLI).

Future Steps

Compliance (after Next Step lands): keep main green under the new .gitea workflow; run make check before every merge.
Merge secure-enclave-unlocker to main once review is done.
1.0 critical security blockers (from repo TODO.md):
- Command injection: GPG key IDs passed unescaped to exec.Command (pgpunlocker.go:323-327); data.String() passed unescaped to the security command (keychainunlocker.go:472-476).
- Memory security: KeychainData stores AgePrivKeyPassphrase as a plain string (keychainunlocker.go:342,393-396); age identity .String() creates unprotected copies (keychainunlocker.go:356, pgpunlocker.go:256, version.go:155); age secret key held in a plain string in cli/crypto.go:86,91,113; private keys exposed via buffer.Bytes() to GPGEncryptFunc and EncryptWithPassphrase.
- Race conditions: no file locking in vault/secrets.go:142-176; non-atomic writes can leave the vault inconsistent.
- Input validation: dots in secret names risk path traversal (vault/secrets.go:75-99); no maximum secret size (DoS).
- Timing attacks: bytes.Equal passphrase compare (cli/init.go: 209-216); non-constant-time public key compare (vault.go:95-100).
High priority:
- Return errors instead of panicking on corrupted metadata (pgpunlocker.go:116, keychainunlocker.go:141).
- Secure temporary file handling and cleanup.
- Print cobra usage only for argument errors, not internal failures.
- Initialize a default unlock key at vault creation.
- Confirmation prompts for destructive operations (keys rm, vault deletion).
- Add secret rm and vault deletion commands.
Medium priority:
- Standardize error messages; stop leaking internals.
- Graceful handling of corrupted or missing key files with recovery suggestions.
- Validate GPG key existence before creating PGP unlock keys.
- Split oversized CLI functions.
- Document env var security (SB_UNLOCK_PASSPHRASE, SB_SECRET_MNEMONIC); clear after use.
- mlock/munlock for sensitive allocations.
Cleanups: read statedir from environment or default instead of passing it around.
Enhancements: help examples, shell completion, colored output, --quiet flag, name suggestions on miss, audit logging, hardware integration tests (Keychain, GPG), naming consistency, vault export/import, batch operations, search, secret metadata (descriptions, tags).