AppInspector logoAppInspector
Automated Analysis != Safety. This is a Developer Transparency Tool.
Inspector

Cloudron community app transparency reports

Inspect a Cloudron community app `CloudronVersions.json` feed. Repository analysis is derived from the package metadata in that feed, and the report stays intentionally conservative: it surfaces what the package appears to do, but it does not certify safety.

What this checks
CHECKS EXPLAINED
Checks Explained
Metadata links and missing fields
Reads the Cloudron feed metadata, checks whether important links are valid, and notes when required fields are missing.
Dockerfile command patterns
Scans Docker build steps for risky commands such as destructive deletes, world-writable permissions, or remote scripts piped into a shell.
Runtime shell network calls
Looks through startup shell scripts for commands like curl, wget, nc, or ssh that may contact remote systems during runtime.
Privilege escalation and credential leakage
Flags startup-script patterns that touch privileged system paths, invoke sudo, or combine secrets with outbound commands.
Feed vs repo version drift
Compares the version published in CloudronVersions.json with the version found in the package repository when that repository can be identified reliably.
  • Metadata links and missing fields
  • Dockerfile command patterns
  • Runtime shell network calls
  • Privilege escalation and credential leakage
  • Feed vs repo version drift
Refresh
Example inputs
https://communityapps.appx.uk/cloudron-notediscovery/CloudronVersions.json
https://raw.githubusercontent.com/BrutalBirdie/cloudron-tachyon-app/refs/heads/master/CloudronVersions.json
https://communityapps.appx.uk/cloudron-ocular/CloudronVersions.json
Generated Report

Pijul Nest

Repository hosting for the Pijul version control system

Score
57/100
57 reached43 still requires deeper inspection
Automated checks can score at most 70/100. The remaining 30 points require deep inspection.
This tool is for informational purposes only. Use at your own risk.
Safety Flags
1
Fail
2
Unsure
7
Pass
Master Info
Install feed
https://raw.githubusercontent.com/OrcVole/pijul-cloudron/main/CloudronVersions.json
packageUrl
Not available
Website link
https://pijul.org
Repository
Not available
Packager
OrcVole
packagerUrl
https://github.com/OrcVole/pijul-cloudron
minBox
9.2.0
Version
1.2.0
Tags
githostingproject
Detailed Checklist
packageUrl link is present and well formed when required (7/7)
pass
No `packageUrl` declared. This is valid for packages targeting minBoxVersion below 10.
Website link is present and well formed (7/7)
pass
https://pijul.org
Metadata and README links avoid insecure HTTP (7/7)
pass
No HTTP links found.
Metadata and README links avoid URL shorteners (7/7)
pass
No shortener links found.
Cloudron feed version matches the repository manifest (7/7)
pass
Feed and repo both report 1.2.0.
Repository content was fetched for static analysis (7/7)
pass
https://github.com/OrcVole/pijul-cloudron @ 0c5b8a360e961e443086dca5ade1ed98a190c71f
Dockerfile scan did not detect clearly suspicious commands (4/7)
unsure
Dockerfile:22 System package installation found. Review whether all packages are justified. Dockerfile:62 System package installation found. Review whether all packages are justified.
Runtime shell scripts avoid suspicious outbound network calls (4/7)
unsure
start.sh:49 Network-capable command found in a runtime shell script. start.sh:76 Network-capable command found in a runtime shell script. test/gate2-flows.sh:24 Network-capable command found in a runtime shell script. test/gate2-flows.sh:64 Network-capable command found in a runtime shell script. test/gate2-flows.sh:66 Network-capable command found in a runtime shell script. test/gate2-flows.sh:70 Network-capable command found in a runtime shell script. test/gate2-flows.sh:104 Network-capable command found in a runtime shell script. test/gate2-flows.sh:119 Network-capable command found in a runtime shell script. test/gate2-flows.sh:168 Network-capable command found in a runtime shell script. test/gate2-flows.sh:173 Network-capable command found in a runtime shell script. test/gate2-flows.sh:209 Network-capable command found in a runtime shell script. test/gate3-backup-race.sh:25 Network-capable command found in a runtime shell script. test/gate3-backup-race.sh:37 Network-capable command found in a runtime shell script. test/gate3-backup-race.sh:38 Network-capable command found in a runtime shell script. test/gate3-backup-race.sh:44 Network-capable command found in a runtime shell script. test/gate3-backup-race.sh:51 Network-capable command found in a runtime shell script. test/gate3-backup-race.sh:53 Network-capable command found in a runtime shell script. test/gate3-backup-race.sh:54 Network-capable command found in a runtime shell script. test/gate3-backup-race.sh:56 Network-capable command found in a runtime shell script. test/gate3-backup-race.sh:60 Network-capable command found in a runtime shell script. test/gate3-backup-race.sh:61 Network-capable command found in a runtime shell script. test/gate3-backup-race.sh:65 Network-capable command found in a runtime shell script. test/gate3-backup-race.sh:74 Network-capable command found in a runtime shell script. test/gate3-backup-race.sh:86 Network-capable command found in a runtime shell script. test/gate3-backup-race.sh:87 Network-capable command found in a runtime shell script. test/gate3-backup-race.sh:89 Network-capable command found in a runtime shell script. test/gate3-backup-race.sh:111 Network-capable command found in a runtime shell script. test/gate3-backup-race.sh:151 Network-capable command found in a runtime shell script. test/gate3-backup-race.sh:153 Network-capable command found in a runtime shell script. test/local-stack.sh:37 Network-capable command found in a runtime shell script. test/local-stack.sh:80 Network-capable command found in a runtime shell script. test/local-stack.sh:119 Network-capable command found in a runtime shell script. test/local-stack.sh:122 Network-capable command found in a runtime shell script. test/secret-scan.sh:227 Network-capable command found in a runtime shell script. test/secret-scan.sh:228 Network-capable command found in a runtime shell script. test/secret-scan.sh:229 Network-capable command found in a runtime shell script. test/secret-scan.sh:232 Network-capable command found in a runtime shell script. test/secret-scan.sh:243 Network-capable command found in a runtime shell script. test/secret-scan.sh:248 Network-capable command found in a runtime shell script.
Runtime shell scripts avoid privilege escalation patterns (0/7)
fail
test/secret-scan.sh:156 Privileged command or direct system-path modification detected in startup script. test/secret-scan.sh:227 Privileged command or direct system-path modification detected in startup script. test/secret-scan.sh:228 Privileged command or direct system-path modification detected in startup script. test/secret-scan.sh:229 Privileged command or direct system-path modification detected in startup script. test/secret-scan.sh:232 Privileged command or direct system-path modification detected in startup script. test/secret-scan.sh:257 Privileged command or direct system-path modification detected in startup script.
Runtime shell scripts avoid credential leakage patterns (7/7)
pass
No credential leakage patterns found in scanned shell scripts.
Raw Findings
Flagged lines are highlighted directly in the code snippet.
47 findings
Dockerfile:22
low
System package installation found. Review whether all packages are justified.
20    PATH=/opt/cargo/bin:$PATH
21 
22RUN apt-get update && apt-get install -y --no-install-recommends \
23        build-essential pkg-config libsodium-dev libssl-dev libzstd-dev \
24        libclang-dev clang cmake curl ca-certificates \
Dockerfile:62
low
System package installation found. Review whether all packages are justified.
60    PATH=/opt/cargo/bin:$PATH
61 
62RUN apt-get update && apt-get install -y --no-install-recommends \
63        build-essential pkg-config libsodium-dev libpq-dev protobuf-compiler \
64        libssl-dev libzstd-dev libxxhash-dev libclang-dev clang cmake bison flex \
start.sh:49
medium
Network-capable command found in a runtime shell script.
47if [[ ! -f "${DATA}/secrets/ssh_host_ed25519_key" ]]; then
48    echo "==> generating the SSH host key (first run)"
49    ssh-keygen -t ed25519 -N '' -C 'pijul-nest' -f "${DATA}/secrets/ssh_host_ed25519_key" -q
50else
51    echo "==> existing SSH host key found, keeping it"
start.sh:76
medium
Network-capable command found in a runtime shell script.
74http_port = 5000
75 
76[ssh]
77port = 2222
78
test/gate2-flows.sh:24
medium
Network-capable command found in a runtime shell script.
22set -uo pipefail
23 
24CLOUDRON_HOST="${CLOUDRON_HOST:?set CLOUDRON_HOST to the ssh alias for the rig, e.g. myrig}"
25 
26# `pijul` runs inside the toolchain probe container rather than on the runner
test/gate2-flows.sh:64
medium
Network-capable command found in a runtime shell script.
62# because a query embedded in nested local/ssh/docker/bash quoting is exactly
63# how the earlier version of this script silently mis-encoded a token.
64CID="$(ssh "$CLOUDRON_HOST" "docker ps --filter label=fqdn=$APP -q" 2>/dev/null | head -1)"
65sql() {
66    printf '%s\n' "$1" | ssh "$CLOUDRON_HOST" "docker exec -i $CID bash -c 'psql \"\$CLOUDRON_POSTGRESQL_URL\" -tA'"
test/gate2-flows.sh:66
medium
Network-capable command found in a runtime shell script.
64CID="$(ssh "$CLOUDRON_HOST" "docker ps --filter label=fqdn=$APP -q" 2>/dev/null | head -1)"
65sql() {
66    printf '%s\n' "$1" | ssh "$CLOUDRON_HOST" "docker exec -i $CID bash -c 'psql \"\$CLOUDRON_POSTGRESQL_URL\" -tA'"
67}
68
test/gate2-flows.sh:70
medium
Network-capable command found in a runtime shell script.
68 
69say "flow: registration (exercises sendmail, rolls back the row on send failure)"
70resp="$(curl -s -o /dev/null -w '%{http_code}' -c "$JAR" -X POST "$BASE/register" \
71    --data-urlencode "login=$LOGIN" \
72    --data-urlencode "email=$EMAIL" \
test/gate2-flows.sh:104
medium
Network-capable command found in a runtime shell script.
102    bad "no confirmation token found in the tokens table"
103else
104    confirm_headers="$(curl -sD - -o /dev/null -c "$JAR" -b "$JAR" "$BASE/register?token=$token_urlenc")"
105    confirm_location="$(printf '%s' "$confirm_headers" | grep -i '^location:' | tr -d '\r')"
106    invalid_flag="$(sql "SELECT email_is_invalid FROM users WHERE id='${user_row}';" | tr -d ' \r')"
test/gate2-flows.sh:119
medium
Network-capable command found in a runtime shell script.
117 
118say "flow: sign in with the confirmed account"
119login_status="$(curl -s -o /dev/null -w '%{http_code}' -c "$JAR" -X POST "$BASE/login" \
120    --data-urlencode "login=$LOGIN" --data-urlencode "pass=$PASS")"
121if [[ "$login_status" =~ ^30 ]]; then
test/gate2-flows.sh:168
medium
Network-capable command found in a runtime shell script.
166#    only reading source settled which one was actually firing.
167REPO_NAME="gate2-repo-$$"
168settings_json="$(curl -s -b "$JAR" -c "$JAR" "$BASE/api/settings")"
169csrf_token="$(printf '%s' "$settings_json" | python3 -c "import json,sys; print(json.load(sys.stdin).get('token',''))" 2>/dev/null)"
170if [[ -z "$csrf_token" ]]; then
test/gate2-flows.sh:173
medium
Network-capable command found in a runtime shell script.
171    bad "GET /api/settings returned no 'token' field; check the session is actually authenticated"
172else
173    create_status="$(curl -s -o /dev/null -w '%{http_code}' -b "$JAR" -c "$JAR" -X POST "$BASE/api/settings/repo/add" \
174        --data-urlencode "name=$REPO_NAME" \
175        --data-urlencode "private=false" \
test/gate2-flows.sh:209
medium
Network-capable command found in a runtime shell script.
207 
208say "flow: PageRank job runs (nest-rank, every 6h, exercises postgresql read+write)"
209rank_seen="$(ssh "$CLOUDRON_HOST" "docker logs $CID 2>&1 | grep -c 'nest-rank starting'" 2>/dev/null || echo 0)"
210if [[ "${rank_seen:-0}" -gt 0 ]]; then
211    ok "nest-rank has run at least once (log evidence)"
test/gate3-backup-race.sh:25
medium
Network-capable command found in a runtime shell script.
23: "${CLOUDRON_SERVER:?set CLOUDRON_SERVER to the Cloudron you are gating, e.g. my.example.com; this suite never uses the CLI default profile}"
24 
25CLOUDRON_HOST="${CLOUDRON_HOST:?set CLOUDRON_HOST to the ssh alias for the rig, e.g. myrig}"
26BASE="${1:?usage: gate3-backup-race.sh <base-url> <app-fqdn> [trials]}"
27APP="${2:?usage: gate3-backup-race.sh <base-url> <app-fqdn> [trials]}"
test/gate3-backup-race.sh:37
medium
Network-capable command found in a runtime shell script.
35bad() { printf '  \033[31m✗\033[0m %s\n' "$*"; }
36 
37CID="$(ssh "$CLOUDRON_HOST" "docker ps --filter label=fqdn=$APP -q" 2>/dev/null | head -1)"
38sql() { printf '%s\n' "$1" | ssh "$CLOUDRON_HOST" "docker exec -i $CID bash -c 'psql \"\$CLOUDRON_POSTGRESQL_URL\" -tA'"; }
39
test/gate3-backup-race.sh:38
medium
Network-capable command found in a runtime shell script.
36 
37CID="$(ssh "$CLOUDRON_HOST" "docker ps --filter label=fqdn=$APP -q" 2>/dev/null | head -1)"
38sql() { printf '%s\n' "$1" | ssh "$CLOUDRON_HOST" "docker exec -i $CID bash -c 'psql \"\$CLOUDRON_POSTGRESQL_URL\" -tA'"; }
39 
40say "setup: registered user, SSH key, one repository"
test/gate3-backup-race.sh:44
medium
Network-capable command found in a runtime shell script.
42PASS="race-test-password-123"
43JAR="$WORK/jar"
44curl -s -c "$JAR" -X POST "$BASE/register" \
45    --data-urlencode "login=$LOGIN" --data-urlencode "email=$LOGIN@example.com" \
46    --data-urlencode "pass=$PASS" --data-urlencode "confpass=$PASS" -o /dev/null
test/gate3-backup-race.sh:51
medium
Network-capable command found in a runtime shell script.
49token="$(printf '%s' "$raw_b64" | tr '+/' '-_')"
50token_urlenc="$(python3 -c "import urllib.parse,sys; print(urllib.parse.quote(sys.argv[1]))" "$token")"
51curl -s -c "$JAR" -b "$JAR" "$BASE/register?token=$token_urlenc" -o /dev/null
52 
53ssh-keygen -t ed25519 -N '' -C 'gate3-race-test' -f "$WORK/id_ed25519" -q
test/gate3-backup-race.sh:53
medium
Network-capable command found in a runtime shell script.
51curl -s -c "$JAR" -b "$JAR" "$BASE/register?token=$token_urlenc" -o /dev/null
52 
53ssh-keygen -t ed25519 -N '' -C 'gate3-race-test' -f "$WORK/id_ed25519" -q
54settings_json="$(curl -s -b "$JAR" -c "$JAR" "$BASE/api/settings")"
55csrf_token="$(printf '%s' "$settings_json" | python3 -c "import json,sys; print(json.load(sys.stdin).get('token',''))")"
test/gate3-backup-race.sh:54
medium
Network-capable command found in a runtime shell script.
52 
53ssh-keygen -t ed25519 -N '' -C 'gate3-race-test' -f "$WORK/id_ed25519" -q
54settings_json="$(curl -s -b "$JAR" -c "$JAR" "$BASE/api/settings")"
55csrf_token="$(printf '%s' "$settings_json" | python3 -c "import json,sys; print(json.load(sys.stdin).get('token',''))")"
56curl -s -b "$JAR" -c "$JAR" -X POST "$BASE/api/settings/ssh/add" \
test/gate3-backup-race.sh:56
medium
Network-capable command found in a runtime shell script.
54settings_json="$(curl -s -b "$JAR" -c "$JAR" "$BASE/api/settings")"
55csrf_token="$(printf '%s' "$settings_json" | python3 -c "import json,sys; print(json.load(sys.stdin).get('token',''))")"
56curl -s -b "$JAR" -c "$JAR" -X POST "$BASE/api/settings/ssh/add" \
57    --data-urlencode "key=$(cat "$WORK/id_ed25519.pub")" --data-urlencode "token=$csrf_token" -o /dev/null
58
test/gate3-backup-race.sh:60
medium
Network-capable command found in a runtime shell script.
58 
59REPO="race-repo-$$"
60csrf_token="$(curl -s -b "$JAR" -c "$JAR" "$BASE/api/settings" | python3 -c "import json,sys; print(json.load(sys.stdin).get('token',''))")"
61curl -s -b "$JAR" -c "$JAR" -X POST "$BASE/api/settings/repo/add" \
62    --data-urlencode "name=$REPO" --data-urlencode "private=false" --data-urlencode "token=$csrf_token" -o /dev/null
test/gate3-backup-race.sh:61
medium
Network-capable command found in a runtime shell script.
59REPO="race-repo-$$"
60csrf_token="$(curl -s -b "$JAR" -c "$JAR" "$BASE/api/settings" | python3 -c "import json,sys; print(json.load(sys.stdin).get('token',''))")"
61curl -s -b "$JAR" -c "$JAR" -X POST "$BASE/api/settings/repo/add" \
62    --data-urlencode "name=$REPO" --data-urlencode "private=false" --data-urlencode "token=$csrf_token" -o /dev/null
63
test/gate3-backup-race.sh:65
medium
Network-capable command found in a runtime shell script.
63 
64APP_HOST="$(printf '%s' "$BASE" | sed -E 's#https?://##')"
65SSH_PORT="$(ssh "$CLOUDRON_HOST" "docker port $CID 2222/tcp" | head -1 | sed -E 's/.*:([0-9]+)$/\1/')"
66 
67podman rm -f gate3-race-agent >/dev/null 2>&1
test/gate3-backup-race.sh:74
medium
Network-capable command found in a runtime shell script.
72# only the two SSH_* export lines.
73podman exec gate3-race-agent bash -c \
74  'ssh-agent -s | grep "^SSH_" > /tmp/agent-env; . /tmp/agent-env; ssh-add /keys/id_ed25519' >/dev/null 2>&1
75AUTH_SOCK="$(podman exec gate3-race-agent bash -c '. /tmp/agent-env >/dev/null; echo $SSH_AUTH_SOCK')"
76
test/gate3-backup-race.sh:86
medium
Network-capable command found in a runtime shell script.
84podman exec -e SSH_AUTH_SOCK="$AUTH_SOCK" -w /work/src gate3-race-agent bash -c "
85export HOME=/tmp
86mkdir -p /tmp/.ssh
87ssh-keyscan -p ${SSH_PORT} -H ${APP_HOST} >> /tmp/.ssh/known_hosts 2>/dev/null
88pijul record -a -m baseline >/dev/null 2>&1
test/gate3-backup-race.sh:87
medium
Network-capable command found in a runtime shell script.
85export HOME=/tmp
86mkdir -p /tmp/.ssh
87ssh-keyscan -p ${SSH_PORT} -H ${APP_HOST} >> /tmp/.ssh/known_hosts 2>/dev/null
88pijul record -a -m baseline >/dev/null 2>&1
89script -qefc 'pijul push -a ssh://${LOGIN}@${APP_HOST}:${SSH_PORT}/${LOGIN}/${REPO}' /dev/null <<< y >/dev/null 2>&1
test/gate3-backup-race.sh:89
medium
Network-capable command found in a runtime shell script.
87ssh-keyscan -p ${SSH_PORT} -H ${APP_HOST} >> /tmp/.ssh/known_hosts 2>/dev/null
88pijul record -a -m baseline >/dev/null 2>&1
89script -qefc 'pijul push -a ssh://${LOGIN}@${APP_HOST}:${SSH_PORT}/${LOGIN}/${REPO}' /dev/null <<< y >/dev/null 2>&1
90"
91ok "baseline commit pushed"
test/gate3-backup-race.sh:111
medium
Network-capable command found in a runtime shell script.
109        podman exec -e SSH_AUTH_SOCK="$AUTH_SOCK" -w /work/src gate3-race-agent bash -c "
110            export HOME=/tmp
111            script -qefc 'pijul push -a ssh://${LOGIN}@${APP_HOST}:${SSH_PORT}/${LOGIN}/${REPO}' /dev/null <<< y >/dev/null 2>&1
112        "
113    ) &
test/gate3-backup-race.sh:151
medium
Network-capable command found in a runtime shell script.
149ok "restore completed"
150 
151NEW_CID="$(ssh "$CLOUDRON_HOST" "docker ps --filter label=fqdn=$APP -q" 2>/dev/null | head -1)"
152for _ in $(seq 1 30); do
153    [[ "$(curl -s -o /dev/null -w '%{http_code}' --max-time 5 "$BASE/" 2>/dev/null)" == "200" ]] && break
test/gate3-backup-race.sh:153
medium
Network-capable command found in a runtime shell script.
151NEW_CID="$(ssh "$CLOUDRON_HOST" "docker ps --filter label=fqdn=$APP -q" 2>/dev/null | head -1)"
152for _ in $(seq 1 30); do
153    [[ "$(curl -s -o /dev/null -w '%{http_code}' --max-time 5 "$BASE/" 2>/dev/null)" == "200" ]] && break
154    sleep 2
155done
test/local-stack.sh:37
medium
Network-capable command found in a runtime shell script.
35check_status() {   # path, expected, why
36    local got
37    got="$(curl -s -o /dev/null -w '%{http_code}' --max-time 15 "http://127.0.0.1:${HOST_PORT}$1")"
38    if [[ "$got" == "$2" ]]; then ok "$1 → $got  ($3)"; else bad "$1 → $got, expected $2  ($3)"; fi
39}
test/local-stack.sh:80
medium
Network-capable command found in a runtime shell script.
78say "waiting for the health check path"
79for _ in $(seq 1 90); do
80    [[ "$(curl -s -o /dev/null -w '%{http_code}' --max-time 5 "http://127.0.0.1:${HOST_PORT}/" 2>/dev/null)" == "200" ]] && break
81    sleep 2
82done
test/local-stack.sh:119
medium
Network-capable command found in a runtime shell script.
117if $CRI restart "$APP" >/dev/null 2>&1; then
118    for _ in $(seq 1 60); do
119        [[ "$(curl -s -o /dev/null -w '%{http_code}' --max-time 5 "http://127.0.0.1:${HOST_PORT}/" 2>/dev/null)" == "200" ]] && break
120        sleep 2
121    done
test/local-stack.sh:122
medium
Network-capable command found in a runtime shell script.
120        sleep 2
121    done
122    if [[ "$(curl -s -o /dev/null -w '%{http_code}' --max-time 5 "http://127.0.0.1:${HOST_PORT}/")" == "200" ]]; then
123        ok "survives a restart with migrations already applied"
124    else bad "did not come back after a restart"; fi
test/secret-scan.sh:156
high
Privileged command or direct system-path modification detected in startup script.
154  # it does not ship is simply absent. Only then are the container-side hits for these exact paths
155  # dropped, and only for these exact paths, in the same spirit as the pinned SSH keys below.
156  RUNTIME_PATHS=(/etc/hosts /etc/resolv.conf /etc/hostname)
157  RUNFLAGS=(--network=none)                       # no DNS/hosts wiring either engine can avoid
158  [[ "$CRI" == *podman* ]] && RUNFLAGS+=(--no-hosts)   # podman only; docker always injects
test/secret-scan.sh:227
high
Privileged command or direct system-path modification detected in startup script.
225  # hashes whenever the base image digest changes.
226  declare -A PINNED_SSH=(
227    [/etc/ssh/ssh_host_ecdsa_key]=677458f83d985da3fd7cdd208e90e4eac09da5be205425a5f96a6242dc985c33
228    [/etc/ssh/ssh_host_ed25519_key]=0c575ce8d9ba487b05cc473fad4b0650fb950181028e6ac19796f86f56f22a7a
229    [/etc/ssh/ssh_host_rsa_key]=ae0ea8087e90baf138d277ca52b6cf47b5010adc0e5bd84236713eee1b85de85
test/secret-scan.sh:227
medium
Network-capable command found in a runtime shell script.
225  # hashes whenever the base image digest changes.
226  declare -A PINNED_SSH=(
227    [/etc/ssh/ssh_host_ecdsa_key]=677458f83d985da3fd7cdd208e90e4eac09da5be205425a5f96a6242dc985c33
228    [/etc/ssh/ssh_host_ed25519_key]=0c575ce8d9ba487b05cc473fad4b0650fb950181028e6ac19796f86f56f22a7a
229    [/etc/ssh/ssh_host_rsa_key]=ae0ea8087e90baf138d277ca52b6cf47b5010adc0e5bd84236713eee1b85de85
test/secret-scan.sh:228
high
Privileged command or direct system-path modification detected in startup script.
226  declare -A PINNED_SSH=(
227    [/etc/ssh/ssh_host_ecdsa_key]=677458f83d985da3fd7cdd208e90e4eac09da5be205425a5f96a6242dc985c33
228    [/etc/ssh/ssh_host_ed25519_key]=0c575ce8d9ba487b05cc473fad4b0650fb950181028e6ac19796f86f56f22a7a
229    [/etc/ssh/ssh_host_rsa_key]=ae0ea8087e90baf138d277ca52b6cf47b5010adc0e5bd84236713eee1b85de85
230  )
test/secret-scan.sh:228
medium
Network-capable command found in a runtime shell script.
226  declare -A PINNED_SSH=(
227    [/etc/ssh/ssh_host_ecdsa_key]=677458f83d985da3fd7cdd208e90e4eac09da5be205425a5f96a6242dc985c33
228    [/etc/ssh/ssh_host_ed25519_key]=0c575ce8d9ba487b05cc473fad4b0650fb950181028e6ac19796f86f56f22a7a
229    [/etc/ssh/ssh_host_rsa_key]=ae0ea8087e90baf138d277ca52b6cf47b5010adc0e5bd84236713eee1b85de85
230  )
test/secret-scan.sh:229
high
Privileged command or direct system-path modification detected in startup script.
227    [/etc/ssh/ssh_host_ecdsa_key]=677458f83d985da3fd7cdd208e90e4eac09da5be205425a5f96a6242dc985c33
228    [/etc/ssh/ssh_host_ed25519_key]=0c575ce8d9ba487b05cc473fad4b0650fb950181028e6ac19796f86f56f22a7a
229    [/etc/ssh/ssh_host_rsa_key]=ae0ea8087e90baf138d277ca52b6cf47b5010adc0e5bd84236713eee1b85de85
230  )
231  ssh_listing="$("$CRI" run --rm --user 0 "${RUNFLAGS[@]}" --entrypoint /bin/bash "$IMAGE" \
test/secret-scan.sh:229
medium
Network-capable command found in a runtime shell script.
227    [/etc/ssh/ssh_host_ecdsa_key]=677458f83d985da3fd7cdd208e90e4eac09da5be205425a5f96a6242dc985c33
228    [/etc/ssh/ssh_host_ed25519_key]=0c575ce8d9ba487b05cc473fad4b0650fb950181028e6ac19796f86f56f22a7a
229    [/etc/ssh/ssh_host_rsa_key]=ae0ea8087e90baf138d277ca52b6cf47b5010adc0e5bd84236713eee1b85de85
230  )
231  ssh_listing="$("$CRI" run --rm --user 0 "${RUNFLAGS[@]}" --entrypoint /bin/bash "$IMAGE" \
test/secret-scan.sh:232
high
Privileged command or direct system-path modification detected in startup script.
230  )
231  ssh_listing="$("$CRI" run --rm --user 0 "${RUNFLAGS[@]}" --entrypoint /bin/bash "$IMAGE" \
232                  -c 'for f in /etc/ssh/ssh_host_*_key; do [ -e "$f" ] && sha256sum "$f"; done' 2>/dev/null)"
233  found=0; pinned_ok=0
234  while IFS= read -r line; do
test/secret-scan.sh:232
medium
Network-capable command found in a runtime shell script.
230  )
231  ssh_listing="$("$CRI" run --rm --user 0 "${RUNFLAGS[@]}" --entrypoint /bin/bash "$IMAGE" \
232                  -c 'for f in /etc/ssh/ssh_host_*_key; do [ -e "$f" ] && sha256sum "$f"; done' 2>/dev/null)"
233  found=0; pinned_ok=0
234  while IFS= read -r line; do
test/secret-scan.sh:243
medium
Network-capable command found in a runtime shell script.
241      shp="$(printf '%s\n' "$shp" | grep -vF "$f:" || true)"   # drop ONLY this verified exact path
242    else
243      emit ssh-key "$f sha256=$h is NOT a pinned base host key (new, changed or extra: treat as a leak)"
244    fi
245  done <<< "$ssh_listing"
test/secret-scan.sh:248
medium
Network-capable command found in a runtime shell script.
246  echo "  host keys: $found found, $pinned_ok pinned-ok, ${#PINNED_SSH[@]} expected"
247  [[ "$found" -eq "${#PINNED_SSH[@]}" && "$pinned_ok" -eq "${#PINNED_SSH[@]}" ]] \
248    || emit ssh-key "host key count mismatch: $found found, $pinned_ok pinned-ok, ${#PINNED_SSH[@]} expected"
249 
250  # DISTRO-GENERATED PLACEHOLDER KEYS. Some Debian packages mint a self-signed key in their
test/secret-scan.sh:257
high
Privileged command or direct system-path modification detected in startup script.
255  # Nothing else is exempt: a key at any other path is still a finding, including a second key in
256  # the same directory. Add a path here only after confirming the package does not reference it.
257  PLACEHOLDER_KEYS=(/etc/ssl/private/ssl-cert-snakeoil.key /etc/prosody/certs/localhost.key)
258  for k in "${PLACEHOLDER_KEYS[@]}"; do
259    if printf '%s' "$shp" | grep -qF "$k:"; then
0.0.11