whoami_at already gives the forge user and a made-up machine name (the hostname only seeds its hash), and no other path writes the hostname. This holds it: with the forge user named as the local account, the runner isn't that account at this hostname, and the hostname is nowhere in the note.
- commit
- abf4f2a085ee5307cc543cca20bfeede8e9077f9
- parent
- 1283f9e0f1748aa765dd47489ae9a95fe74249d1
- author
- cat <admin@dev.site>
- ci
- ✓ passed in 115s, signed by cat
- kind
- test risk score 0.1 of 3, Jev's estimate
- review
- #30 Security: sign-in, invites, owner pages, lake, caps and the edge
ci attestation
forge-attestation 1 type ci commit abf4f2a085ee5307cc543cca20bfeede8e9077f9 tree e77bd4d27b98abeb1070a758beffff45c70ae92d script .forge/ci 8d2000a416f8160bcf710d98b72af9eb76287f58 result pass exit 0 started 2026-10-19T08:04:09Z duration 115s runner (not shown here; refs/notes/ci has it) system Darwin 25.5.0 arm64 env host log sha256:5aad498bb8377e5d64b9f978013aca99c555b72cfb2ea3546cfb6a4472e66527 327 lines |pushed wip/i18n |341a21d running .forge/ci: greet.sh: say what it is | | sh: /bin/sh | | ok greet |341a21d pass in 0s, signed |pushed main |remote: review #4: /dami/greet/reviews/4/ |pushed wip/i18n |69fdacf running .forge/ci: wave at the world | | sh: /bin/sh | | FAIL greet : got 'hello, world o/', want 'hello, world' |69fdacf fail in 0s, signed |forge: 1 commit(s) did not pass |remote: review #6: /dami/greet/reviews/6/ |pushed ana/wave |d551b21 running .forge/ci: update the test for the wave | | sh: /bin/sh | | ok greet |d551b21 pass in 0s, signed |remote: review #6: /dami/greet/reviews/6/ |pushed ana/wave |warning: You appear to have cloned an empty repository. |site home: deployed d0aa594 -> /sites/ana/dotfiles/home/ |created ana/notes |remote: review #1: /ana/notes/reviews/1/ |pushed ana/todo |landing #1 A todo list: ana/todo -> main |804a269 running .forge/ci: web, server and Python versions of greet | | sh: /bin/sh | | ok greet |804a269 pass in 0s, signed |pushed main |be5a4f7 running .forge/ci: messages: notes for the later regions | | sh: /bin/sh | | ok greet |be5a4f7 pass in 0s, signed |remote: review #7: /dami/greet/reviews/7/ |pushed dami/regions |created dami/forge |warning: You appear to have cloned an empty repository. |site guide: mkdir -p guide/fonts && cp site/assets/fonts/*.woff2 guide/fonts/ |site guide: deployed d6554dc -> /sites/dami/forge/guide/ |(node:36024) ExperimentalWarning: stripTypeScriptTypes is an experimental feature and might change at any time |(Use `node --trace-warnings ...` to show where the warning was created) |built ana/dotfiles in 0s -> /var/folders/b4/mv8w4c8j0zj0_mldppxdbdw00000gn/T/forge-ci.iDxKTF/wt/demo/root/.forge/www |(node:36291) ExperimentalWarning: stripTypeScriptTypes is an experimental feature and might change at any time |(Use `node --trace-warnings ...` to show where the warning was created) |built ana/notes in 1s -> /var/folders/b4/mv8w4c8j0zj0_mldppxdbdw00000gn/T/forge-ci.iDxKTF/wt/demo/root/.forge/www |(node:36478) ExperimentalWarning: stripTypeScriptTypes is an experimental feature and might change at any time |(Use `node --trace-warnings ...` to show where the warning was created) |built dami/forge in 1s -> /var/folders/b4/mv8w4c8j0zj0_mldppxdbdw00000gn/T/forge-ci.iDxKTF/wt/demo/root/.forge/www |(node:36659) ExperimentalWarning: stripTypeScriptTypes is an experimental feature and might change at any time |(Use `node --trace-warnings ...` to show where the warning was created) |built dami/greet in 1s -> /var/folders/b4/mv8w4c8j0zj0_mldppxdbdw00000gn/T/forge-ci.iDxKTF/wt/demo/root/.forge/www |(node:37381) ExperimentalWarning: stripTypeScriptTypes is an experimental feature and might change at any time |(Use `node --trace-warnings ...` to show where the warning was created) |built - in 1s -> /var/folders/b4/mv8w4c8j0zj0_mldppxdbdw00000gn/T/forge-ci.iDxKTF/wt/demo/root/.forge/www |235 of 235 pages render the same without 11ty |guide: 8 files, links ok |ok
Signature: good, cat
| A | test/ | 23 | +++++++++++++++++++++++ |
@@ -0,0 +1,23 @@
1+# A CI note's runner is never this machine's account@hostname, even when2+# the forge user has the same name as the local account: the machine part3+# is a made-up name, and the hostname appears nowhere in the note.4+. "$(dirname "$0")/../lib.sh"5+me=$(id -un)6+host=$(hostname -s 2>/dev/null || hostname)7+user "$me"8+repo "$me/greet"9+clone "$me" "$me/greet" "$T/w/d"10+mkdir -p "$T/w/d/.forge"11+printf '#!/bin/sh\ntrue\n' >"$T/w/d/.forge/ci"12+chmod +x "$T/w/d/.forge/ci"13+at "$T/w/d" commit "first"14+at "$T/w/d" git config forge.user "$me"15+export FORGE_USER=$me16+ok at "$T/w/d" "$FORGE" attest17+git -C "$T/w/d" notes --ref=ci show HEAD >"$T/note"18+r=$(sed -n 's/^runner //p' "$T/note" | tail -n 1)19+[ -n "$r" ] || fail "no runner in the note"20+[ "$r" != "$me@$host" ] || fail "the runner is $me@$host"21+case $r in "$me"@[a-z]*-[a-z]*-[0-9a-f][0-9a-f]) ;; *) fail "runner is '$r'" ;; esac22+grep -v '^|' "$T/note" | grep -qiwF "$host" && fail "the note names the host $host"23+true