mirror of
https://github.com/kuhyx/signal-bot.git
synced 2026-11-10 19:37:03 +01:00
Krzysztof kuhy Rudnicki
37a27c6dff
The leak this repository had was not carelessness with a secret. It was somebody reaching for a real name because it was the example in front of them -- a fixture built from a live database, an envelope pasted out of a running container, a help text written while looking at the actual group. Three different people-shaped mistakes, none of which a rule about "be careful" would have stopped. So it is a gate. The hard part is that the thing being checked must not contain the list of what to refuse, or the check *is* the leak. It reads the names at run time from outside: the photo pack's manifest, the message database, the local .env. It never prints the word it matched, because this output reaches CI logs. On a machine with none of that private data it says "shapes only" out loud rather than passing quietly, and CI enforces the half that needs nothing -- phone numbers, uuids and Signal group ids, compared against an allowlist of values invented for the fixtures. It runs on staged files, on the commit message -- where two of the leaks actually travelled -- and over the whole tree in CI. It paid for itself twice before it was wired up. The live test group's id was in tests/test_config.py in two spellings, and truncated in three more files, after four rounds of grepping by hand had pronounced the tree clean -- nobody thinks to grep for base64. Then it refused the commit that introduced it, because DOCS-privacy.md had used a real name as the example of a name. An allowlist line may be scoped to one file, which is how the given names that are also popes stay legal in popes.json and refused in every fixture that has no business carrying them. The threshold is three characters, because one of this group's given names is three characters long. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017w1HZ3cZ7neL3rFdQ6VMBA
88 lines
3.6 KiB
Plaintext
88 lines
3.6 KiB
Plaintext
# Values this public repository is allowed to contain.
|
|
#
|
|
# Everything a real person could be identified by is refused by
|
|
# scripts/check_personal_data.sh, which learns the names from OUTSIDE this
|
|
# repository (the photo pack, the message database, .env) so that the list of
|
|
# real names is never in it. What is left is shapes -- phone numbers, uuids,
|
|
# Signal group ids -- and those need an explicit list of the invented ones the
|
|
# documents and fixtures are built from. That list is this file.
|
|
#
|
|
# One value per line, lower-cased. Add a value here only after checking it
|
|
# belongs to nobody.
|
|
|
|
# Phone numbers. The 555 range is reserved for fiction; the two below are
|
|
# structurally valid and deliberately not anybody's.
|
|
+15550000000
|
|
+48123456789
|
|
+420111222333
|
|
+48000000000
|
|
+48111222333
|
|
|
|
# UUIDs used as fixtures.
|
|
b1c2d3e4-0000-4a00-8a00-000000000001
|
|
b1c2d3e4-0000-4a00-8a00-000000000002
|
|
|
|
# Group ids invented for the offline end-to-end run and the unit tests. Each
|
|
# one base64-decodes to a sentence saying it is a fixture.
|
|
group.wlrkbexyzghkr05vzldrdc1ncm91cc1pzc0zmi1ienl0zxmhisfd
|
|
group.zdjgmfkyagxaqzfuy205mwndmxbaqzb6twkxiwvyumxjeuvositfaelrpt0=
|
|
group.wtjllxdhdgnozwqtz3jvdxatawqtmzitynl0zxmhisfd
|
|
|
|
# The author's own handle, which is the repository owner and appears in the
|
|
# project URL, the User-Agent and every copyright line.
|
|
kuhy
|
|
# The sender name POST /_selftest injects. Not a person.
|
|
self-test
|
|
|
|
# Given names that are also popes. Permitted ONLY in the files that carry the
|
|
# papal list, so the same name in a test fixture or a document is still
|
|
# refused -- which is exactly how it leaked the first time.
|
|
signal_bot/popes.json::marek
|
|
signal_bot/popes.json::wiktor
|
|
tests/test_versioning.py::wiktor
|
|
DOCS-changelog.md::wiktor
|
|
|
|
# Invented Signal group ids. Every one of these base64-decodes twice to a
|
|
# sentence saying what it is, which is how you can tell it belongs to nobody:
|
|
# group.WlRKbExYZGhkR05vWldRdFozSnZkWEF0YVdRdE16SXRZbmwwWlhNaElTRT0=
|
|
# -> ZTJlLXdhdGNoZWQtZ3JvdXAtaWQtMzItYnl0ZXMhISE= -> e2e-watched-group-id-32-bytes!!!
|
|
group.WTI5dVptbG5MV2R5YjNWd0xXbGtMVE15TFdKNWRHVnpJU0VoSVNFaElRPT0=
|
|
group.WlRKbExYZGhkR05vWldRdFozSnZkWEF0YVdRdE16SXRZbmwwWlhNaElTRT0=
|
|
group.WlRKbExYTmxZMjl1WkMxbmNtOTFjQzFwWkMwek1pMWllWFJsY3lFaElTRT0=
|
|
group.WlRKbExYUm9hWEprTFdkeWIzVndMV2xrTFRNeUxXSjVkR1Z6SVNFaElRPT0=
|
|
group.WlRKbExXWnZkWEowYUMxbmNtOTFjQzFwWkMwek1pMWllWFJsY3lFaElTRT0=
|
|
group.WTI1c1pDMXZibVV0WjNKdmRYQXRhV1F0TXpJdFlubDBaWE1oSVNFaElTRT0=
|
|
group.WTI5c1pDMXZibVV0WjNKdmRYQXRhV1F0TXpJdFlubDBaWE1oSVNFaElTRT0=
|
|
group.WTI5c1pDMTBkMjh0WjNKdmRYQXRhV1F0TXpJdFlubDBaWE1oSVNFaElTRT0=
|
|
group.WTI5c1pDMTBhSEpsWlMxbmNtOTFjQzFwWkMwek1pMWllWFJsY3lFaElTRT0=
|
|
group.WTI5c1pDMW1iM1Z5TFdkeWIzVndMV2xrTFRNeUxXSjVkR1Z6SVNFaElTRT0=
|
|
group.YjNSb1pYSXRaM0p2ZFhBdGFXUXRNekl0WW5sMFpYTWhJU0VoSVNFPQ==
|
|
group.YzJWamIyNWtMV2R5YjNWd0xXbGtMVE15TFdKNWRHVnpJU0VoSVNFaA==
|
|
group.ZDJGMFkyaGxaQzFuY205MWNDMXBaQzB6TWkxaWVYUmxjeUVoSVNFaElRPT0=
|
|
group.WlRKbExYZGhkR05vWldRdA==
|
|
|
|
# Invented phone numbers used as fixtures. Reserved / non-allocated ranges.
|
|
+15550000001
|
|
+15550000002
|
|
+15550001111
|
|
+15550001234
|
|
+15555550123
|
|
+15559999999
|
|
+48987654321
|
|
signal_bot/versioning.py::wiktor
|
|
|
|
# Given names that are also popes, permitted only in the files that carry or
|
|
# assert the papal list. Anywhere else -- a test fixture, a document, a help
|
|
# text -- they are still refused, which is the case that leaked.
|
|
signal_bot/popes.json::jan
|
|
signal_bot/popes.json::marek
|
|
signal_bot/popes.json::wiktor
|
|
signal_bot/versioning.py::jan
|
|
tool/gen_popes.py::jan
|
|
tool/gen_popes.py::marek
|
|
tool/gen_popes.py::wiktor
|
|
tests/test_versioning.py::jan
|
|
tests/test_changelog.py::jan
|
|
tests/test_popes_command.py::jan
|
|
DOCS-changelog.md::jan
|