SmartConfig

Review of chunk K: the M5 follow-ups’ secrets

Date: 2026-10-16, after M5 follow-ups 6 and 7 were built (9ef175e..63e60d2):

How it was reviewed:

Gate: one high-severity finding, K1, fixed. Three were medium (K2, K3, K4). All 13 are fixed. Two asked for a decision, and the owner picked the recommended answer for each (2026-10-16): K1 and K7.

What held up

Findings

Area Finding Severity Fixed
the list (K1) About 40 more files that hold passwords or keys were stored and shown in full: /etc/fstab’s CIFS options, sssd, wpa_supplicant, cloud-init, ifupdown, VPN and IPsec, mail relays, LDAP and Kerberos secrets, Let’s Encrypt keys, and copies of shadow by any name. Several were in no format the redaction read. high Your pick: widen the list and keep the content, so sc restore can still put any of them back. More secret lines; a new verb, hide, for files that are only a secret, shown with every line hidden; shadow’s rule for any file named after it and a crypt hash in shadow’s place anywhere; key value lines; OpenVPN’s inline keys; more key names (c404bd1).
netplan (K2) Forms netplan accepts still showed a Wi-Fi password: {"password":"x"}, a quoted value continued at a lower indentation, ? key / : value, a flow mapping’s value on the next line. medium Each is read (7d8fec1); a key after [, and a line that is only a flow sequence, too (a5078a6).
one-line keys (K3) A private key on one line under a secret key was shown whole. medium Its body is hidden and the line’s key rules still run (7d8fec1); a body that begins on the BEGIN line, too (a5078a6).
NetworkManager (K4) mka-cak, 802-1x.pin in netplan’s passthrough, and vpnc’s keys with blanks were shown. medium Recognised (7d8fec1).
PGP, marker text (K5) PGP private key blocks were shown, and so was any value that began with <hidden. low Both hidden. Each rule now finds its spans in the line as it is, so no rule reads another’s marker (7d8fec1).
the note (K6) sc diff ID said nothing on stderr when only the file on disk hid values. low One note for each path that hid anything (0df7f46).
diff numbers (K7) <hidden N> told which hidden values were equal: two accounts with one hash, one key reused. low Your pick: <hidden> for a value the other version hides too, else <hidden, old> or <hidden, new> (0df7f46).
validator lines (K8) A short value was replaced inside other words, where the marker’s place told it (a PIN inside a file name); a value a validator printed unquoted or unescaped was missed. low A value under 8 bytes is hidden only where it stands alone; values are also matched unquoted and unescaped (7d8fec1).
sc scope (K9) It said “stored” for a secret path scd does not record. low For such a path it says what holds if sc snapshot saves it (a5078a6).
over-hiding (K10) A key named in a YAML comment hid every line indented after it, so a diff of an address hid the change. low A key in a comment hides its own value and leaves nothing open (7d8fec1).
a test helper (K11) secretEnv put back a weaker rule than the one it replaced. cleanup It puts back the old one; the real rule has a test (c404bd1).
tests (K12) 21 of 52 mutations survived. low Tests for each, re-anchored on today’s code (a5078a6).
docs (K13) progress.html still said sc cat prints a version exactly; nothing warned that sc cat ID > FILE writes markers into a secret file. low Fixed and warned, in sc cat --help and the README’s rescue part (a5078a6).

Left as it is