93 lines
3.6 KiB
Markdown
93 lines
3.6 KiB
Markdown
# Gitea 管理匯出 Redaction Checklist
|
||
|
||
| 項目 | 內容 |
|
||
|------|------|
|
||
| 日期 | 2026-05-17 |
|
||
| 狀態 | 第一版，給 `gitea_repo_inventory_v1` 管理匯入使用 |
|
||
| 搭配文件 | `docs/security/GITEA-SERVER-SIDE-INVENTORY-RUNBOOK.md` |
|
||
| Approval | `docs/security/GITEA-READONLY-INVENTORY-APPROVAL-PACKAGE.md` |
|
||
| S4.5 export request | `docs/security/GITEA-AUTHENTICATED-INVENTORY-EXPORT-REQUEST.md` |
|
||
| S4.6 import acceptance | `docs/security/GITEA-AUTHENTICATED-INVENTORY-IMPORT-ACCEPTANCE.md` |
|
||
| S4.7 coverage attestation | `docs/security/GITEA-INVENTORY-COVERAGE-ATTESTATION.md` |
|
||
|
||
## 0. 允許保留的欄位
|
||
|
||
| 欄位 | 用途 |
|
||
|------|------|
|
||
| `full_name` | Gitea repo identity，例如 `wooo/awoooi` |
|
||
| `name` | repo short name |
|
||
| `owner.login` | owner / org / user 名稱 |
|
||
| `private` | 判斷 visibility migration |
|
||
| `archived` | 判斷封存策略 |
|
||
| `empty` | 判斷是否需要搬遷 refs |
|
||
| `default_branch` | 後續 branch/tag diff 起點 |
|
||
| `clone_url` | 只允許無帳密 URL，工具會再次 redacted |
|
||
| `ssh_url` | 只允許 public repo path，不含 private key |
|
||
|
||
## 1. 絕對不能出現在匯出 JSON
|
||
|
||
1. API token value。
|
||
2. Personal access token。
|
||
3. Webhook secret value。
|
||
4. Repository secret value。
|
||
5. Deploy key private key。
|
||
6. SSH private key。
|
||
7. Cookie、session、CSRF token。
|
||
8. 帶 username/password/token 的 remote URL。
|
||
9. CI/CD runner registration token。
|
||
|
||
## 2. 最小 JSON 模板
|
||
|
||
```json
|
||
[
|
||
{
|
||
"full_name": "wooo/example",
|
||
"name": "example",
|
||
"owner": {
|
||
"login": "wooo"
|
||
},
|
||
"private": true,
|
||
"archived": false,
|
||
"empty": false,
|
||
"default_branch": "main",
|
||
"clone_url": "http://192.168.0.110:3001/wooo/example.git",
|
||
"ssh_url": "git@192.168.0.110:wooo/example.git"
|
||
}
|
||
]
|
||
```
|
||
|
||
## 3. 匯入前人工檢查
|
||
|
||
| Gate | 檢查方式 | 必須結果 |
|
||
|------|----------|----------|
|
||
| 無 token | 搜尋 token / authorization / provider token prefix 等字樣 | 不得出現 value |
|
||
| 無帳密 URL | 搜尋 URL 中是否含帳號、密碼、token 與 at-sign 組合 | 不得出現 |
|
||
| 無 private key | 搜尋 `BEGIN .* PRIVATE KEY` | 不得出現 |
|
||
| repo 欄位完整 | 檢查 `full_name` 或 `owner.login + name` | 每個 repo 可識別 |
|
||
| visibility 可判斷 | 檢查 `private` | 每個 repo 有布林值 |
|
||
| S4.6 驗收 | 依 `GITEA-AUTHENTICATED-INVENTORY-IMPORT-ACCEPTANCE.md` 檢查 payload | 不完整或含敏感值時必須拒收或隔離 |
|
||
| S4.7 owner attestation | 依 `GITEA-INVENTORY-COVERAGE-ATTESTATION.md` 補 scope decision | public-only / local remote gap、org/user endpoint、110 adjacent source 都有 owner 判定 |
|
||
|
||
## 4. 匯入指令
|
||
|
||
```bash
|
||
python3 scripts/security/gitea-repo-inventory.py \
|
||
--base-url http://192.168.0.110:3001 \
|
||
--org wooo \
|
||
--github-owner owenhytsai \
|
||
--input-json /path/to/redacted-gitea-repos.json \
|
||
--output-json docs/security/gitea-repo-inventory.snapshot.json \
|
||
--output-md docs/security/GITEA-REPO-INVENTORY-SNAPSHOT.md
|
||
```
|
||
|
||
## 5. 匯入後驗收
|
||
|
||
1. `gitea_repo_inventory_v1.status=ok`。
|
||
2. `visibility_scope=admin_export`。
|
||
3. `repo_count` 大於或等於 public-only repo count。
|
||
4. `repos[].clone_url_redacted` 與 `repos[].ssh_url_redacted` 不含帳密。
|
||
5. 下一步仍只更新 migration matrix，不同步 refs、不建 repo、不切 primary。
|
||
6. 必須能解釋 public-only API 看到 2 個 repos、本機 Gitea remote 看到 4 個 unique Gitea repos 的 coverage gap。
|
||
7. 必須通過 S4.6 import acceptance；payload 驗收通過仍不代表 GitHub primary 已批准。
|
||
8. 必須補 S4.7 owner coverage attestation；attestation 只更新 evidence / matrix / gate，不執行 repo 遷移。
|