Trilltechnician/incredigo
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

rotate: gitea LIVE-REAL — first real credential rotated (M2 rung 3)

Browse Source 
First real-credential rotation on the safe-candidate ladder: full
create→verify→store→revoke against a real Gitea PAT on
git.churchofmalware.org (self-owned, no 2FA). To keep blast radius at
zero, the run targets a purpose-made THROWAWAY token — a genuine token
used by nothing — so the driver's real lifecycle earns LIVE-REAL without
risking any in-use PAT (which is also referenced across .git-credentials,
embedded git remotes and tea config, and needs the multi-reference
blast-and-cutover, still to build).

- lab/lab-rung3-gitea-real.sh: env-only secrets, isolated throwaway gopass
  store, independent cutover check (new->200, old->401), sealed backup.
- proofs.go + ROTATION-PROOFS.md: gitea promoted LIVE-VM -> LIVE-REAL,
  LIVE-REAL section added; "no driver carries this yet" removed.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
leetcrypt
2026-07-19 12:00:02 -07:00
parent 0c4e599342
commit 9f227bb05f
3 changed files with 143 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/rotate/proofs.go
+5 -1
View File
@@ -62,12 +62,16 @@ func (p ProofLevel) String() string {
// AWS ran in the VM but only against moto (a mock AWS), so it is MOCK-ONLY. LIVE-VM
// means the real target software validated the cutover.
var proofLevels = map[string]ProofLevel{
// proven against a REAL, host-owned credential at the real provider (safe-candidate
// ladder, ROADMAP M2 — the highest level):
"gitea": ProofLiveReal, // real Gitea PAT on git.churchofmalware.org, create→verify→store→revoke
// end-to-end against a purpose-made throwaway token (lab-rung3-gitea-real.sh, 2026-07-19)
// proven against the real target software in the sandbox VM:
"postgres": ProofLiveVM, // real PostgreSQL (lab-provision-pg.sh)
"mysql": ProofLiveVM, // real MariaDB (lab-provision-dbclones.sh)
"redis": ProofLiveVM, // real redis-server(lab-provision-dbclones.sh)
"wireguard": ProofLiveVM, // real wg (lab-provision-wg.sh)
"gitea": ProofLiveVM, // real Gitea (lab-provision-gitea.sh)
"appsecret": ProofLiveVM, // real local files (lab-provision-appsec.sh)
"mongo": ProofLiveVM, // real mongod 8.0 (lab-provision-mongo.sh)
"k8s": ProofLiveVM, // real k3s v1.35 (lab-provision-k8s.sh)