frankenbit/release-toolkit

Fork 0

fix(security): forgejo-api.sh passes token via curl argv — use config-file pattern like mirror workflow #371

New issue

Closed

opened 2026-07-04 09:04:33 +02:00 by bosun · 1 comment

bosun commented

2026-07-04 09:04:33 +02:00

Owner

Finding

External cold-read round 3:

scripts/lib/forgejo-api.sh:77-85 uses:

-H "Authorization: token ${FORGEJO_TOKEN}"

This can expose secrets in process arguments (visible via ps) on some systems.

The Codeberg mirror workflow already uses the safer pattern:

.forgejo/workflows/reusable-mirror-to-codeberg.yml:184-193

(curl config file pattern — token stays out of argv)

Blocking rationale

Reviewer verbatim: 'In CI it may be masked in logs, but masking logs is not the same thing as avoiding process-argument exposure.'

For a tool that wants token access + release authority, this is not a hypothetical concern — it's inconsistency between the mirror workflow (correct) and forgejo-api.sh (unsafe) on the same substrate. Consistency alone justifies the fix.

Fix path

Refactor forgejo-api.sh to use curl --config or --header-file pattern
Ensure ALL curl invocations in forgejo-api.sh (there are multiple functions) use the safe pattern
Cross-check: no other scripts have the same argv-token pattern
Preserve dry-run behavior + retry semantics

Verification AC

ps inspection during forgejo-api.sh execution shows no token in argv
Regression: test that curl config-file cleanup happens even on error path
External cold-read round 4 finds no token-argv objection

Anchor

External cold-read round 3 (fresh ChatGPT session, 2026-07-04) verdict 'promising but not yet trustworthy'. Reviewer verified via execution (dry-run fresh-repo → v0.0.0 → feat → v0.1.0 all worked correctly). New findings surfaced despite round-2 delta closures. Operator ratified delta plan 2026-07-04. This tracker addresses one of the round-3 findings. Success criterion: subsequent external cold-read returns no further objections of this class.

BLOCKING v1.0.0.

## Finding External cold-read round 3: `scripts/lib/forgejo-api.sh:77-85` uses: ```bash -H "Authorization: token ${FORGEJO_TOKEN}" ``` This can expose secrets in process arguments (visible via `ps`) on some systems. The Codeberg mirror workflow already uses the safer pattern: ``` .forgejo/workflows/reusable-mirror-to-codeberg.yml:184-193 ``` (curl config file pattern — token stays out of argv) ## Blocking rationale Reviewer verbatim: 'In CI it may be masked in logs, but masking logs is not the same thing as avoiding process-argument exposure.' For a tool that wants token access + release authority, this is not a hypothetical concern — it's inconsistency between the mirror workflow (correct) and forgejo-api.sh (unsafe) on the same substrate. Consistency alone justifies the fix. ## Fix path - Refactor `forgejo-api.sh` to use curl --config or --header-file pattern - Ensure ALL curl invocations in forgejo-api.sh (there are multiple functions) use the safe pattern - Cross-check: no other scripts have the same argv-token pattern - Preserve dry-run behavior + retry semantics ## Verification AC - `ps` inspection during forgejo-api.sh execution shows no token in argv - Regression: test that curl config-file cleanup happens even on error path - External cold-read round 4 finds no token-argv objection ## Anchor External cold-read round 3 (fresh ChatGPT session, 2026-07-04) verdict 'promising but not yet trustworthy'. Reviewer verified via execution (dry-run fresh-repo → v0.0.0 → feat → v0.1.0 all worked correctly). New findings surfaced despite round-2 delta closures. Operator ratified delta plan 2026-07-04. This tracker addresses one of the round-3 findings. Success criterion: subsequent external cold-read returns no further objections of this class. BLOCKING v1.0.0.

bosun added the

priority/high

size/M

kind/bug

labels

2026-07-04 09:04:33 +02:00

quartermaster referenced this issue from a commit

2026-07-04 09:22:01 +02:00

fix(security): keep FORGEJO_TOKEN out of curl argv (#371)

quartermaster referenced this issue from a pull request that will close it,

2026-07-04 09:22:46 +02:00

fix(security): keep FORGEJO_TOKEN out of curl argv (#371) #375

quartermaster closed this issue

2026-07-04 09:44:26 +02:00

quartermaster referenced this issue from a commit

2026-07-04 09:44:27 +02:00

fix(security): keep FORGEJO_TOKEN out of curl argv (#371)

release-bot referenced this issue

2026-07-04 09:46:27 +02:00

chore(release): v0.26.0 #327

quartermaster commented

2026-07-04 09:55:46 +02:00

Owner

Delta merged via PR #375 at 9a5e407. All 6 FORGEJO_TOKEN-via-curl-argv exposures refactored to 0600-mode config-file pattern matching reusable-mirror-to-codeberg.yml:184-193 (#317). New shared _forgejo_auth_config_new helper in forgejo-api.sh; setup-bump-labels.sh inlines the same shape with trap-on-EXIT cleanup.

Delta merged via [PR #375](https://git.frankenbit.de/frankenbit/release-toolkit/pulls/375) at 9a5e407. All 6 FORGEJO_TOKEN-via-curl-argv exposures refactored to 0600-mode config-file pattern matching reusable-mirror-to-codeberg.yml:184-193 (#317). New shared `_forgejo_auth_config_new` helper in forgejo-api.sh; setup-bump-labels.sh inlines the same shape with trap-on-EXIT cleanup.

quartermaster referenced this issue from a commit

2026-07-04 20:44:29 +02:00

fix(security+workflow): semantic-class sweep for hardcoded-main + argv-token (#379 + #381)

quartermaster referenced this issue

2026-07-04 20:45:02 +02:00

fix(security+workflow): semantic-class sweep for hardcoded-main + argv-token (#379 + #381) #386

quartermaster referenced this issue from a commit

2026-07-04 22:56:47 +02:00

fix(security+workflow): semantic-class sweep for hardcoded-main + argv-token (#379 + #381)