Issue 282: a secret on a command line is kept in the runtime's events #160

2026-10-06T23:38:43Z

mesh-admin commented

2026-10-06 23:38:43 +00:00

Opens issue 282 (status located). Role names only, no value.

The mosquitto module passed its broker's admin password to mosquitto_ctrl as -P on every docker exec. The container runtime records every exec's command line in its event stream, so docker events, and docker_events with execs: true, returned it. The record has the cause, the other modules found putting a secret on a command line (keycloak and minio fixed; minio's svcacct add --secret-key and gitea's admin-create step open), the fix proposed in mesh-catalog #100, where the old value went, and the rotation step, which waits for the operator's approval.

Checks: records.py, index.py and cycle.py pass.

Opens issue 282 (status `located`). Role names only, no value. The mosquitto module passed its broker's admin password to `mosquitto_ctrl` as `-P` on every `docker exec`. The container runtime records every exec's command line in its event stream, so `docker events`, and `docker_events` with `execs: true`, returned it. The record has the cause, the other modules found putting a secret on a command line (keycloak and minio fixed; minio's `svcacct add --secret-key` and gitea's admin-create step open), the fix proposed in mesh-catalog #100, where the old value went, and the rotation step, which waits for the operator's approval. Checks: `records.py`, `index.py` and `cycle.py` pass.

mesh-admin added 1 commit 2026-10-06 23:38:43 +00:00

Issue 282: a secret on a command line is kept in the runtime's events

mesh/merge-gate pass: the change touches no module of the mesh's graph

Details

mesh/repo-check pass: its merge-check.sh passed

Details

mesh/delivery delivered

Details

124943bdc3

The mosquitto module passed its broker's admin password to every docker
exec as an argument, which the container runtime records in its events.
Records the cause, the other modules found doing the same, the fix
proposed in mesh-catalog #100, and where the leaked value went.

mesh-admin commented

2026-10-06 23:39:19 +00:00

Delivery novox/hq@124943bdc349 — delivered since 2026-10-06T23:41:10Z

Delivery plan — builds nothing: the change touches no module of the mesh's graph

Transitions

2026-10-06 23:39 (new) → proposed (announced): novox/hq#160's head announced
2026-10-06 23:39 proposed → checked (checked): the verdict names this commit
2026-10-06 23:39 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-06 23:41 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
2026-10-06 23:41 published → delivered (done): nothing for a walk to move

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/hq@124943bdc349` — **delivered** since 2026-10-06T23:41:10Z **Delivery plan** — builds nothing: the change touches no module of the mesh's graph **Transitions** - 2026-10-06 23:39 (new) → proposed (announced): novox/hq#160's head announced - 2026-10-06 23:39 proposed → checked (checked): the verdict names this commit - 2026-10-06 23:39 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-06 23:41 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-06 23:41 published → delivered (done): nothing for a walk to move The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-admin merged commit 35d81e962e into main

2026-10-06 23:40:55 +00:00

mesh-admin deleted branch issue/282-a-secret-on-a-command-line

2026-10-06 23:40:55 +00:00

mesh-admin referenced this pull request

2026-10-07 00:04:56 +00:00

Issues 285, 286, 287, 288: the merge gate judged nothing; the seat's check disagreed with agents' machines; a seat and a module of one name were unreachable; the facts still name the installation #161

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/hq#160