From b14707f6caa0e171eaa6c899c98dac54e74ea736 Mon Sep 17 00:00:00 2001 From: homelab-runtime-publisher Date: Fri, 18 Sep 2026 11:53:55 +0000 Subject: [PATCH] runtime: publish SUPPORT-260918-INFRA-VPS-USA-PINNED-INVENTORY-MOLDOVA-TRUST-READONLY-517R6 --- ...NVENTORY-MOLDOVA-TRUST-READONLY-517R6.json | 38 +++++++++++++++++++ ...INVENTORY-MOLDOVA-TRUST-READONLY-517R6.txt | 36 ++++++++++++++++++ runtime/latest.json | 16 ++++---- runtime/latest.txt | 18 ++++----- 4 files changed, 91 insertions(+), 17 deletions(-) create mode 100644 runtime/history/SUPPORT-260918-INFRA-VPS-USA-PINNED-INVENTORY-MOLDOVA-TRUST-READONLY-517R6.json create mode 100644 runtime/history/SUPPORT-260918-INFRA-VPS-USA-PINNED-INVENTORY-MOLDOVA-TRUST-READONLY-517R6.txt diff --git a/runtime/history/SUPPORT-260918-INFRA-VPS-USA-PINNED-INVENTORY-MOLDOVA-TRUST-READONLY-517R6.json b/runtime/history/SUPPORT-260918-INFRA-VPS-USA-PINNED-INVENTORY-MOLDOVA-TRUST-READONLY-517R6.json new file mode 100644 index 00000000..fbb61d80 --- /dev/null +++ b/runtime/history/SUPPORT-260918-INFRA-VPS-USA-PINNED-INVENTORY-MOLDOVA-TRUST-READONLY-517R6.json @@ -0,0 +1,38 @@ +{ + "schema_version": 1, + "channel": "homelab-runtime", + "command_id": "SUPPORT-260918-INFRA-VPS-USA-PINNED-INVENTORY-MOLDOVA-TRUST-READONLY-517R6", + "status": "OK", + "rc": 0, + "host": "pve01", + "mode": "read-only", + "component": "infra-vps-usa-pinned-inventory-moldova-trust-readonly", + "started_at_utc": "2026-09-18T11:53:54Z", + "finished_at_utc": "2026-09-18T11:53:54Z", + "reference_register_checked": true, + "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66", + "error_register_checked": true, + "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0", + "command_sha256": "2894b3e9e4325838f880c152c0975d9f70a8a43d3fd143856decc62426b757e4", + "duplicate_failed_command_blocked": false, + "block_reason": null, + "execution_started": true, + "change_declared": false, + "result_contract_valid": true, + "result_contract_status": null, + "result_contract_error": null, + "command_rc": 0, + "changes_made": false, + "rollback_started": false, + "rollback_restored": null, + "mutation_outcome": "NO_MUTATION", + "sanitized": true, + "secrets_included": false, + "private_addresses_included": false, + "raw_evidence_retained_locally": true, + "raw_evidence_sha256": "8f314c210f2eeb75645c92b217f79427ef87c32b013f756d166eb1184836b471", + "sanitized_output_sha256": "8f314c210f2eeb75645c92b217f79427ef87c32b013f756d166eb1184836b471", + "output_truncated_in_json": false, + "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt", + "output": "VPS517R6_SAFE_REPORT={\"changes_made\":false,\"command_id\":\"SUPPORT-260918-INFRA-VPS-USA-PINNED-INVENTORY-MOLDOVA-TRUST-READONLY-517R6\",\"decision\":\"HOLD_USA_ACCESS_FAILED_AND_MOLDOVA_TRUST_NOT_PROVEN\",\"flash_required\":false,\"local_source_counts\":{\"ini_existing\":0,\"moba\":0,\"openssh\":0,\"putty\":0},\"mode\":\"read-only\",\"moldova\":{\"current_517R2_fingerprints\":[\"SHA256:805Q9eh/fePUci42dfY58I6q0lFiiPHn0/M+mckypmE\",\"SHA256:Q0Cfx2w9lGpHnMNIQtkJnq8z4mX34UCbR3BTQNuwJ9o\",\"SHA256:lUdLDguDrTStHVyMWsZmysgRJKxzjtU72Q7KUrazNoY\"],\"local_trust_fingerprints\":[],\"local_trust_records\":[],\"trust_proven\":false,\"trusted_current_intersection\":[]},\"schema_version\":1,\"usa\":{\"access_ok\":false,\"hostkey\":\"SHA256:DXJGwunC5tEVvnC3nRxyayTN8FXmyJcVgf+Oa6udQsY\",\"inventory\":null,\"rc\":1,\"stderr_bytes\":1193,\"stderr_class\":[\"AUTH_DENIED\",\"HOSTKEY_EVENT\",\"KEY_REFUSED\",\"PAGEANT_USED\"],\"stderr_sha256\":\"f36bbe808c74a2e21e80db33dc9aa7f5be9bdf51281c6ec3d426d85d261ff293\",\"target\":\"85.121.4.192\"}}\nVPS517R6_DECISION=HOLD_USA_ACCESS_FAILED_AND_MOLDOVA_TRUST_NOT_PROVEN\nVPS517R6_NEXT_GATE=MOLDOVA_PINNED_INVENTORY_IF_TRUST_PROVEN_ELSE_REVIEW_EXACT_LOCAL_TRUST_AND_USA_AUTH_CLASS\nHOMELAB_RESULT_CONTRACT={\"version\":1,\"command_id\":\"SUPPORT-260918-INFRA-VPS-USA-PINNED-INVENTORY-MOLDOVA-TRUST-READONLY-517R6\",\"status\":\"OK\",\"changes_made\":false,\"rollback_started\":false,\"rollback_restored\":null}\n" +} diff --git a/runtime/history/SUPPORT-260918-INFRA-VPS-USA-PINNED-INVENTORY-MOLDOVA-TRUST-READONLY-517R6.txt b/runtime/history/SUPPORT-260918-INFRA-VPS-USA-PINNED-INVENTORY-MOLDOVA-TRUST-READONLY-517R6.txt new file mode 100644 index 00000000..d5bb11cb --- /dev/null +++ b/runtime/history/SUPPORT-260918-INFRA-VPS-USA-PINNED-INVENTORY-MOLDOVA-TRUST-READONLY-517R6.txt @@ -0,0 +1,36 @@ +CHAT_OUTPUT_BEGIN +COMMAND_ID=SUPPORT-260918-INFRA-VPS-USA-PINNED-INVENTORY-MOLDOVA-TRUST-READONLY-517R6 +STATUS=OK +RC=0 +HOST=pve01 +MODE=read-only +COMPONENT=infra-vps-usa-pinned-inventory-moldova-trust-readonly +REFERENCE_REGISTER_CHECK=OK +REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66 +ERROR_REGISTER_CHECK=OK +ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0 +COMMAND_SHA256=2894b3e9e4325838f880c152c0975d9f70a8a43d3fd143856decc62426b757e4 +DUPLICATE_FAILED_COMMAND_BLOCKED=false +EXECUTION_STARTED=true +CHANGE_DECLARED=false +RESULT_CONTRACT_VALID=true +RESULT_CONTRACT_STATUS=NOT_APPLICABLE +RESULT_CONTRACT_ERROR=NONE +COMMAND_RC=0 +CHANGES_MADE=false +ROLLBACK_STARTED=false +ROLLBACK_RESTORED=null +MUTATION_OUTCOME=NO_MUTATION +SANITIZED=yes +SECRETS_INCLUDED=no +PRIVATE_ADDRESSES_INCLUDED=no +RAW_EVIDENCE_SHA256=8f314c210f2eeb75645c92b217f79427ef87c32b013f756d166eb1184836b471 +SANITIZED_OUTPUT_SHA256=8f314c210f2eeb75645c92b217f79427ef87c32b013f756d166eb1184836b471 +OUTPUT_BEGIN +VPS517R6_SAFE_REPORT={"changes_made":false,"command_id":"SUPPORT-260918-INFRA-VPS-USA-PINNED-INVENTORY-MOLDOVA-TRUST-READONLY-517R6","decision":"HOLD_USA_ACCESS_FAILED_AND_MOLDOVA_TRUST_NOT_PROVEN","flash_required":false,"local_source_counts":{"ini_existing":0,"moba":0,"openssh":0,"putty":0},"mode":"read-only","moldova":{"current_517R2_fingerprints":["SHA256:805Q9eh/fePUci42dfY58I6q0lFiiPHn0/M+mckypmE","SHA256:Q0Cfx2w9lGpHnMNIQtkJnq8z4mX34UCbR3BTQNuwJ9o","SHA256:lUdLDguDrTStHVyMWsZmysgRJKxzjtU72Q7KUrazNoY"],"local_trust_fingerprints":[],"local_trust_records":[],"trust_proven":false,"trusted_current_intersection":[]},"schema_version":1,"usa":{"access_ok":false,"hostkey":"SHA256:DXJGwunC5tEVvnC3nRxyayTN8FXmyJcVgf+Oa6udQsY","inventory":null,"rc":1,"stderr_bytes":1193,"stderr_class":["AUTH_DENIED","HOSTKEY_EVENT","KEY_REFUSED","PAGEANT_USED"],"stderr_sha256":"f36bbe808c74a2e21e80db33dc9aa7f5be9bdf51281c6ec3d426d85d261ff293","target":"85.121.4.192"}} +VPS517R6_DECISION=HOLD_USA_ACCESS_FAILED_AND_MOLDOVA_TRUST_NOT_PROVEN +VPS517R6_NEXT_GATE=MOLDOVA_PINNED_INVENTORY_IF_TRUST_PROVEN_ELSE_REVIEW_EXACT_LOCAL_TRUST_AND_USA_AUTH_CLASS +HOMELAB_RESULT_CONTRACT={"version":1,"command_id":"SUPPORT-260918-INFRA-VPS-USA-PINNED-INVENTORY-MOLDOVA-TRUST-READONLY-517R6","status":"OK","changes_made":false,"rollback_started":false,"rollback_restored":null} + +OUTPUT_END +CHAT_OUTPUT_END diff --git a/runtime/latest.json b/runtime/latest.json index 025d2b42..fbb61d80 100644 --- a/runtime/latest.json +++ b/runtime/latest.json @@ -1,19 +1,19 @@ { "schema_version": 1, "channel": "homelab-runtime", - "command_id": "SUPPORT-260918-INFRA-VPS-NESTED-BACKUP-ACCESS-RCA-READONLY-517R5R1", + "command_id": "SUPPORT-260918-INFRA-VPS-USA-PINNED-INVENTORY-MOLDOVA-TRUST-READONLY-517R6", "status": "OK", "rc": 0, "host": "pve01", "mode": "read-only", - "component": "infra-vps-nested-backup-access-rca-readonly", - "started_at_utc": "2026-09-18T11:36:40Z", - "finished_at_utc": "2026-09-18T11:36:41Z", + "component": "infra-vps-usa-pinned-inventory-moldova-trust-readonly", + "started_at_utc": "2026-09-18T11:53:54Z", + "finished_at_utc": "2026-09-18T11:53:54Z", "reference_register_checked": true, "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66", "error_register_checked": true, "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0", - "command_sha256": "56b16fefc6047ad4aa5f3a2caee8016d8961011c6e73b6a7e5e6f9de082c0f3b", + "command_sha256": "2894b3e9e4325838f880c152c0975d9f70a8a43d3fd143856decc62426b757e4", "duplicate_failed_command_blocked": false, "block_reason": null, "execution_started": true, @@ -30,9 +30,9 @@ "secrets_included": false, "private_addresses_included": false, "raw_evidence_retained_locally": true, - "raw_evidence_sha256": "74ed6bbd6639b96733d914c34b7addbf13736271c1f8000221b20b729f2e50ee", - "sanitized_output_sha256": "c5815c28c91af01291933bafdb3ee079385607b31cae310bc1744f24cb7721c1", + "raw_evidence_sha256": "8f314c210f2eeb75645c92b217f79427ef87c32b013f756d166eb1184836b471", + "sanitized_output_sha256": "8f314c210f2eeb75645c92b217f79427ef87c32b013f756d166eb1184836b471", "output_truncated_in_json": false, "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt", - "output": "VPS517R5R1_SAFE_REPORT={\"changes_made\":false,\"changeset_evidence\":[{\"bytes\":2150,\"hits\":[{\"line\":56,\"text\":\" \\\"authorized_keys\\\",\"}],\"path\":\"/var/lib/homelab-change-sets/stage4h-final-acceptance-task-contract-v1/20260714T182929Z/task.json\",\"sha256\":\"eaf46f109e83ae6a13610c411c1ab0e2fbd695c21297fdc9cac1d64b3d462d34\"},{\"bytes\":2595,\"hits\":[{\"line\":38,\"text\":\" \\\"description\\\": \\\"accept-new, StrictHostKeyChecking=no and unverified ssh-keyscan are forbidden.\\\",\"}],\"path\":\"/var/lib/homelab-change-sets/homelab-admin-pg-char-guard-install-v1/20260715T061637Z/error-policies.before.json\",\"sha256\":\"ce6d46a01dfe14adc8b2a35a683f2771e4324b04fea611dd4f4bd0458b09d1af\"},{\"bytes\":77451,\"hits\":[{\"line\":140,\"text\":\"33. Security finding: root authorized_keys \\u043d\\u0430 PVE-\\u043d\\u043e\\u0434\\u0430\\u0445 \\u0438\\u043c\\u0435\\u043b \\u043f\\u0440\\u0430\\u0432\\u0430 777.\"},{\"line\":141,\"text\":\"\\u0424\\u0430\\u043a\\u0442: inventory 158 \\u043f\\u043e\\u043a\\u0430\\u0437\\u0430\\u043b [SENSITIVE_PATH] \\u0438 backup-\\u0444\\u0430\\u0439\\u043b\\u044b \\u0441 \\u0440\\u0435\\u0436\\u0438\\u043c\\u043e\\u043c 777 \\u043d\\u0430 pve01/pve02/pve03.\"},{\"line\":142,\"text\":\"\\u041d\\u0443\\u0436\\u043d\\u043e \\u0438\\u0441\\u043f\\u0440\\u0430\\u0432\\u043b\\u044f\\u0442\\u044c \\u043d\\u0430 [SENSITIVE_PATH]=700 \\u0438 authorized_keys/authorized_keys.bak*=600, \\u0437\\u0430\\u0442\\u0435\\u043c \\u0444\\u0438\\u043a\\u0441\\u0438\\u0440\\u043e\\u0432\\u0430\\u0442\\u044c before/after proof.\"},{\"line\":144,\"text\":\"35. \\u041e\\u0448\\u0438\\u0431\\u043a\\u0430 \\u043f\\u0440\\u043e\\u0432\\u0435\\u0440\\u043a\\u0438: 160_PVE_ROOT_AUTHORIZED_KEYS_PERMISSIONS_FIXED \\u043d\\u0435 \\u0434\\u043e\\u043a\\u0430\\u0437\\u0430\\u043b \\u0438\\u0441\\u043f\\u0440\\u0430\\u0432\\u043b\\u0435\\u043d\\u0438\\u0435 \\u043f\\u0440\\u0430\\u0432.\"},{\"line\":145,\"text\":\"\\u0424\\u0430\\u043a\\u0442: AFTER \\u0432\\u0441\\u0451 \\u0435\\u0449\\u0451 \\u043f\\u043e\\u043a\\u0430\\u0437\\u0430\\u043b 777 \\u0434\\u043b\\u044f [SENSITIVE_PATH] \\u043d\\u0430 pve01/pve02/pve03.\"},{\"line\":146,\"text\":\"\\u0412\\u043e\\u0437\\u043c\\u043e\\u0436\\u043d\\u0430\\u044f \\u043f\\u0440\\u0438\\u0447\\u0438\\u043d\\u0430: authorized_keys \\u044f\\u0432\\u043b\\u044f\\u0435\\u0442\\u0441\\u044f symlink, \\u0430 stat \\u0431\\u0435\\u0437 -L \\u043f\\u043e\\u043a\\u0430\\u0437\\u044b\\u0432\\u0430\\u0435\\u0442 \\u0440\\u0435\\u0436\\u0438\\u043c \\u0441\\u0441\\u044b\\u043b\\u043a\\u0438 777.\"},{\"line\":662,\"text\":\"- Do not treat e3qxxx.netbird.selfhosted / 100.100.125.70 and e3qxxx-183-106.netbird.selfhosted / 100.100.183.106 as VPS egress nodes; they are user mobile peers.\"},{\"line\":663,\"text\":\"- Correct egress candidates are relay.pvepro.ru / relay.netbird.selfhosted / 100.100.19.1 for Moldova and mail.pvepro.ru / mail.netbird.selfhosted / 100.100.147.204 for USA.\"}],\"path\":\"/var/lib/homelab-change-sets/homelab-admin-pg-char-guard-install-v1/20260715T061637Z/error-register.new.md\",\"sha256\":\"6fd516bc953cae5f2c28194b4c2393898abc439b4401e1d6fb177ae7607ecb51\"},{\"bytes\":76486,\"hits\":[{\"line\":140,\"text\":\"33. Security finding: root authorized_keys \\u043d\\u0430 PVE-\\u043d\\u043e\\u0434\\u0430\\u0445 \\u0438\\u043c\\u0435\\u043b \\u043f\\u0440\\u0430\\u0432\\u0430 777.\"},{\"line\":141,\"text\":\"\\u0424\\u0430\\u043a\\u0442: inventory 158 \\u043f\\u043e\\u043a\\u0430\\u0437\\u0430\\u043b [SENSITIVE_PATH] \\u0438 backup-\\u0444\\u0430\\u0439\\u043b\\u044b \\u0441 \\u0440\\u0435\\u0436\\u0438\\u043c\\u043e\\u043c 777 \\u043d\\u0430 pve01/pve02/pve03.\"},{\"line\":142,\"text\":\"\\u041d\\u0443\\u0436\\u043d\\u043e \\u0438\\u0441\\u043f\\u0440\\u0430\\u0432\\u043b\\u044f\\u0442\\u044c \\u043d\\u0430 [SENSITIVE_PATH]=700 \\u0438 authorized_keys/authorized_keys.bak*=600, \\u0437\\u0430\\u0442\\u0435\\u043c \\u0444\\u0438\\u043a\\u0441\\u0438\\u0440\\u043e\\u0432\\u0430\\u0442\\u044c before/after proof.\"},{\"line\":144,\"text\":\"35. \\u041e\\u0448\\u0438\\u0431\\u043a\\u0430 \\u043f\\u0440\\u043e\\u0432\\u0435\\u0440\\u043a\\u0438: 160_PVE_ROOT_AUTHORIZED_KEYS_PERMISSIONS_FIXED \\u043d\\u0435 \\u0434\\u043e\\u043a\\u0430\\u0437\\u0430\\u043b \\u0438\\u0441\\u043f\\u0440\\u0430\\u0432\\u043b\\u0435\\u043d\\u0438\\u0435 \\u043f\\u0440\\u0430\\u0432.\"},{\"line\":145,\"text\":\"\\u0424\\u0430\\u043a\\u0442: AFTER \\u0432\\u0441\\u0451 \\u0435\\u0449\\u0451 \\u043f\\u043e\\u043a\\u0430\\u0437\\u0430\\u043b 777 \\u0434\\u043b\\u044f [SENSITIVE_PATH] \\u043d\\u0430 pve01/pve02/pve03.\"},{\"line\":146,\"text\":\"\\u0412\\u043e\\u0437\\u043c\\u043e\\u0436\\u043d\\u0430\\u044f \\u043f\\u0440\\u0438\\u0447\\u0438\\u043d\\u0430: authorized_keys \\u044f\\u0432\\u043b\\u044f\\u0435\\u0442\\u0441\\u044f symlink, \\u0430 stat \\u0431\\u0435\\u0437 -L \\u043f\\u043e\\u043a\\u0430\\u0437\\u044b\\u0432\\u0430\\u0435\\u0442 \\u0440\\u0435\\u0436\\u0438\\u043c \\u0441\\u0441\\u044b\\u043b\\u043a\\u0438 777.\"},{\"line\":662,\"text\":\"- Do not treat e3qxxx.netbird.selfhosted / 100.100.125.70 and e3qxxx-183-106.netbird.selfhosted / 100.100.183.106 as VPS egress nodes; they are user mobile peers.\"},{\"line\":663,\"text\":\"- Correct egress candidates are relay.pvepro.ru / relay.netbird.selfhosted / 100.100.19.1 for Moldova and mail.pvepro.ru / mail.netbird.selfhosted / 100.100.147.204 for USA.\"}],\"path\":\"/var/lib/homelab-change-sets/homelab-admin-pg-char-guard-install-v1/20260715T061637Z/error-register.before.md\",\"sha256\":\"750cb4d51300df08a00173c1dea6987078529a87b7eaad2cb89bc9c78fcf2d20\"},{\"bytes\":26777,\"hits\":[{\"line\":73,\"text\":\"SSH=(ssh -n -T -o BatchMode=yes -o ConnectTimeout=8 -o StrictHostKeyChecking=yes debian@[PRIVATE_IP])\"},{\"line\":74,\"text\":\"SCP=(scp -q -o BatchMode=yes -o ConnectTimeout=8 -o StrictHostKeyChecking=yes)\"}],\"path\":\"/var/lib/homelab-change-sets/crypto-portfolio-ui-retention-sync-closure-resume-v3/20260713T081210Z/main.sh\",\"sha256\":\"00f74e2a2be46cd31c83ce89f1657545c1bfa866e53952359802d0ab121df79e\"},{\"bytes\":318,\"hits\":[{\"line\":1,\"text\":\"33. Security finding: root authorized_keys \\u043d\\u0430 PVE-\\u043d\\u043e\\u0434\\u0430\\u0445 \\u0438\\u043c\\u0435\\u043b \\u043f\\u0440\\u0430\\u0432\\u0430 777.\"}],\"path\":\"/var/lib/homelab-change-sets/homelab-ops-bootstrap-audit-v1/20260715T214930Z/error-register-tail.txt\",\"sha256\":\"a940f28541fe6b47a44a0e61c0c74ca2c5e47d9f9d7631e869787a779de226c5\"},{\"bytes\":2865,\"hits\":[{\"line\":38,\"text\":\" \\\"description\\\": \\\"accept-new, StrictHostKeyChecking=no and unverified ssh-keyscan are forbidden.\\\",\"}],\"path\":\"/var/lib/homelab-change-sets/homelab-admin-pg-char-guard-candidate-v1/20260715T060858Z/error-policies.candidate.json\",\"sha256\":\"075ba849b67ec5f4b39179ecfe83ea98b3a493aee3987d0530de88d4447ded95\"},{\"bytes\":32437,\"hits\":[{\"line\":80,\"text\":\"SSH=(ssh -n -T -o BatchMode=yes -o ConnectTimeout=8 -o StrictHostKeyChecking=yes debian@[PRIVATE_IP])\"},{\"line\":81,\"text\":\"SCP=(scp -q -o BatchMode=yes -o ConnectTimeout=8 -o StrictHostKeyChecking=yes)\"}],\"path\":\"/var/lib/homelab-change-sets/crypto-portfolio-ui-production-closure/20260713T075748Z/main.sh\",\"sha256\":\"452b1c98604fc800cd1f395b787242dce7d5f6534b565381f910e4d2d1d480f3\"},{\"bytes\":2595,\"hits\":[{\"line\":38,\"text\":\" \\\"description\\\": \\\"accept-new, StrictHostKeyChecking=no and unverified ssh-keyscan are forbidden.\\\",\"}],\"path\":\"/var/lib/homelab-change-sets/homelab-admin-err014-install-v2/20260715T062705Z/error-policies.before.json\",\"sha256\":\"ce6d46a01dfe14adc8b2a35a683f2771e4324b04fea611dd4f4bd0458b09d1af\"},{\"bytes\":77979,\"hits\":[{\"line\":140,\"text\":\"33. Security finding: root authorized_keys \\u043d\\u0430 PVE-\\u043d\\u043e\\u0434\\u0430\\u0445 \\u0438\\u043c\\u0435\\u043b \\u043f\\u0440\\u0430\\u0432\\u0430 777.\"},{\"line\":141,\"text\":\"\\u0424\\u0430\\u043a\\u0442: inventory 158 \\u043f\\u043e\\u043a\\u0430\\u0437\\u0430\\u043b [SENSITIVE_PATH] \\u0438 backup-\\u0444\\u0430\\u0439\\u043b\\u044b \\u0441 \\u0440\\u0435\\u0436\\u0438\\u043c\\u043e\\u043c 777 \\u043d\\u0430 pve01/pve02/pve03.\"},{\"line\":142,\"text\":\"\\u041d\\u0443\\u0436\\u043d\\u043e \\u0438\\u0441\\u043f\\u0440\\u0430\\u0432\\u043b\\u044f\\u0442\\u044c \\u043d\\u0430 [SENSITIVE_PATH]=700 \\u0438 authorized_keys/authorized_keys.bak*=600, \\u0437\\u0430\\u0442\\u0435\\u043c \\u0444\\u0438\\u043a\\u0441\\u0438\\u0440\\u043e\\u0432\\u0430\\u0442\\u044c before/after proof.\"},{\"line\":144,\"text\":\"35. \\u041e\\u0448\\u0438\\u0431\\u043a\\u0430 \\u043f\\u0440\\u043e\\u0432\\u0435\\u0440\\u043a\\u0438: 160_PVE_ROOT_AUTHORIZED_KEYS_PERMISSIONS_FIXED \\u043d\\u0435 \\u0434\\u043e\\u043a\\u0430\\u0437\\u0430\\u043b \\u0438\\u0441\\u043f\\u0440\\u0430\\u0432\\u043b\\u0435\\u043d\\u0438\\u0435 \\u043f\\u0440\\u0430\\u0432.\"},{\"line\":145,\"text\":\"\\u0424\\u0430\\u043a\\u0442: AFTER \\u0432\\u0441\\u0451 \\u0435\\u0449\\u0451 \\u043f\\u043e\\u043a\\u0430\\u0437\\u0430\\u043b 777 \\u0434\\u043b\\u044f [SENSITIVE_PATH] \\u043d\\u0430 pve01/pve02/pve03.\"},{\"line\":146,\"text\":\"\\u0412\\u043e\\u0437\\u043c\\u043e\\u0436\\u043d\\u0430\\u044f \\u043f\\u0440\\u0438\\u0447\\u0438\\u043d\\u0430: authorized_keys \\u044f\\u0432\\u043b\\u044f\\u0435\\u0442\\u0441\\u044f symlink, \\u0430 stat \\u0431\\u0435\\u0437 -L \\u043f\\u043e\\u043a\\u0430\\u0437\\u044b\\u0432\\u0430\\u0435\\u0442 \\u0440\\u0435\\u0436\\u0438\\u043c \\u0441\\u0441\\u044b\\u043b\\u043a\\u0438 777.\"},{\"line\":662,\"text\":\"- Do not treat e3qxxx.netbird.selfhosted / 100.100.125.70 and e3qxxx-183-106.netbird.selfhosted / 100.100.183.106 as VPS egress nodes; they are user mobile peers.\"},{\"line\":663,\"text\":\"- Correct egress candidates are relay.pvepro.ru / relay.netbird.selfhosted / 100.100.19.1 for Moldova and mail.pvepro.ru / mail.netbird.selfhosted / 100.100.147.204 for USA.\"}],\"path\":\"/var/lib/homelab-change-sets/homelab-admin-err014-install-v2/20260715T062705Z/error-register.new.md\",\"sha256\":\"ab8308549db90d235b591af0581580c3c7ba1b287b129cc6111c2eef0a0f9ecc\"},{\"bytes\":76486,\"hits\":[{\"line\":140,\"text\":\"33. Security finding: root authorized_keys \\u043d\\u0430 PVE-\\u043d\\u043e\\u0434\\u0430\\u0445 \\u0438\\u043c\\u0435\\u043b \\u043f\\u0440\\u0430\\u0432\\u0430 777.\"},{\"line\":141,\"text\":\"\\u0424\\u0430\\u043a\\u0442: inventory 158 \\u043f\\u043e\\u043a\\u0430\\u0437\\u0430\\u043b [SENSITIVE_PATH] \\u0438 backup-\\u0444\\u0430\\u0439\\u043b\\u044b \\u0441 \\u0440\\u0435\\u0436\\u0438\\u043c\\u043e\\u043c 777 \\u043d\\u0430 pve01/pve02/pve03.\"},{\"line\":142,\"text\":\"\\u041d\\u0443\\u0436\\u043d\\u043e \\u0438\\u0441\\u043f\\u0440\\u0430\\u0432\\u043b\\u044f\\u0442\\u044c \\u043d\\u0430 [SENSITIVE_PATH]=700 \\u0438 authorized_keys/authorized_keys.bak*=600, \\u0437\\u0430\\u0442\\u0435\\u043c \\u0444\\u0438\\u043a\\u0441\\u0438\\u0440\\u043e\\u0432\\u0430\\u0442\\u044c before/after proof.\"},{\"line\":144,\"text\":\"35. \\u041e\\u0448\\u0438\\u0431\\u043a\\u0430 \\u043f\\u0440\\u043e\\u0432\\u0435\\u0440\\u043a\\u0438: 160_PVE_ROOT_AUTHORIZED_KEYS_PERMISSIONS_FIXED \\u043d\\u0435 \\u0434\\u043e\\u043a\\u0430\\u0437\\u0430\\u043b \\u0438\\u0441\\u043f\\u0440\\u0430\\u0432\\u043b\\u0435\\u043d\\u0438\\u0435 \\u043f\\u0440\\u0430\\u0432.\"},{\"line\":145,\"text\":\"\\u0424\\u0430\\u043a\\u0442: AFTER \\u0432\\u0441\\u0451 \\u0435\\u0449\\u0451 \\u043f\\u043e\\u043a\\u0430\\u0437\\u0430\\u043b 777 \\u0434\\u043b\\u044f [SENSITIVE_PATH] \\u043d\\u0430 pve01/pve02/pve03.\"},{\"line\":146,\"text\":\"\\u0412\\u043e\\u0437\\u043c\\u043e\\u0436\\u043d\\u0430\\u044f \\u043f\\u0440\\u0438\\u0447\\u0438\\u043d\\u0430: authorized_keys \\u044f\\u0432\\u043b\\u044f\\u0435\\u0442\\u0441\\u044f symlink, \\u0430 stat \\u0431\\u0435\\u0437 -L \\u043f\\u043e\\u043a\\u0430\\u0437\\u044b\\u0432\\u0430\\u0435\\u0442 \\u0440\\u0435\\u0436\\u0438\\u043c \\u0441\\u0441\\u044b\\u043b\\u043a\\u0438 777.\"},{\"line\":662,\"text\":\"- Do not treat e3qxxx.netbird.selfhosted / 100.100.125.70 and e3qxxx-183-106.netbird.selfhosted / 100.100.183.106 as VPS egress nodes; they are user mobile peers.\"},{\"line\":663,\"text\":\"- Correct egress candidates are relay.pvepro.ru / relay.netbird.selfhosted / 100.100.19.1 for Moldova and mail.pvepro.ru / mail.netbird.selfhosted / 100.100.147.204 for USA.\"}],\"path\":\"/var/lib/homelab-change-sets/homelab-admin-err014-install-v2/20260715T062705Z/error-register.before.md\",\"sha256\":\"750cb4d51300df08a00173c1dea6987078529a87b7eaad2cb89bc9c78fcf2d20\"},{\"bytes\":23331,\"hits\":[{\"line\":104,\"text\":\"SSH=(ssh -n -T -o BatchMode=yes -o ConnectTimeout=8 -o StrictHostKeyChecking=yes debian@[PRIVATE_IP])\"},{\"line\":105,\"text\":\"SCP=(scp -q -o BatchMode=yes -o ConnectTimeout=8 -o StrictHostKeyChecking=yes)\"}],\"path\":\"/var/lib/homelab-change-sets/crypto-portfolio-ui-retention-sync-closure-resume/20260713T080320Z/main.sh\",\"sha256\":\"9a4ce646203394e1b978efd40471d6ffa7b85212f4fb6a463f1c48b5f192194b\"}],\"cloud_reads\":0,\"cloud_writes\":0,\"command_id\":\"SUPPORT-260918-INFRA-VPS-NESTED-BACKUP-ACCESS-RCA-READONLY-517R5R1\",\"decision\":\"PASS_NESTED_BACKUP_OR_CHANGESET_ACCESS_EVIDENCE_FOUND\",\"exact_files\":[{\"bytes\":2811,\"hits\":[{\"line\":5,\"text\":\"KH=\\\"[SENSITIVE_PATH] -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=yes -o UserKnownHostsFile=\\\"$KH\\\" root@\\\"$VPS_IP\\\" \\\"TS='$TS' REMOTE_ARCH='$REMOTE_ARCH' bash -s\\\" <<'REMOTE'\"},{\"line\":48,\"text\":\"scp -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=yes -o UserKnownHostsFile=\\\"$KH\\\" root@\\\"$VPS_IP\\\":\\\"$REMOTE_ARCH\\\" \\\"$DEST/netbird-vps-backup.tgz\\\" >/dev/null\"},{\"line\":49,\"text\":\"scp -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=yes -o UserKnownHostsFile=\\\"$KH\\\" root@\\\"$VPS_IP\\\":\\\"$REMOTE_ARCH.sha256\\\" \\\"$DEST/netbird-vps-backup.tgz.sha256.remote\\\" >/dev/null\"},{\"line\":50,\"text\":\"ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=yes -o UserKnownHostsFile=\\\"$KH\\\" root@\\\"$VPS_IP\\\" \\\"rm -f '$REMOTE_ARCH' '$REMOTE_ARCH.sha256'\\\" >/dev/null\"}],\"path\":\"/root/netbird-vps-backup.sh\",\"present\":true,\"sha256\":\"a4546d7fff40e4f7cf935e5072847e11dd02758b1075421d7e27591faf8ac6d7\"},{\"bytes\":117,\"hits\":[],\"path\":\"[SENSITIVE_PATH] -o StrictHostKeyChecking=accept-new \\\\\"},{\"line\":52,\"text\":\" -o StrictHostKeyChecking=accept-new \\\\\"},{\"line\":108,\"text\":\" -o StrictHostKeyChecking=accept-new \\\\\"}],\"path\":\"/usr/local/sbin/homelab-gitea-secondary-backup\",\"present\":true,\"sha256\":\"5e3ad06f4d7777078a557ee53c75793d29966f82e1a1f2f6cb8f4857739d9b67\"},{\"bytes\":487,\"hits\":[],\"path\":\"/etc/hosts\",\"present\":true,\"sha256\":\"c3b9101ad96911d55328b70e12e87f9b17e4ef89fce47dc619478e113c4855ec\"}],\"external_ssh_attempts\":0,\"known_hosts_queries\":[{\"file\":\"[SENSITIVE_PATH] -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=yes -o UserKnownHostsFile=\\\"$KH\\\" root@\\\"$VPS_IP\\\" \\\"TS='$TS' REMOTE_ARCH='$REMOTE_ARCH' bash -s\\\" <<'REMOTE'\"},{\"line\":48,\"path\":\"/root/netbird-vps-backup.sh\",\"text\":\"scp -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=yes -o UserKnownHostsFile=\\\"$KH\\\" root@\\\"$VPS_IP\\\":\\\"$REMOTE_ARCH\\\" \\\"$DEST/netbird-vps-backup.tgz\\\" >/dev/null\"},{\"line\":49,\"path\":\"/root/netbird-vps-backup.sh\",\"text\":\"scp -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=yes -o UserKnownHostsFile=\\\"$KH\\\" root@\\\"$VPS_IP\\\":\\\"$REMOTE_ARCH.sha256\\\" \\\"$DEST/netbird-vps-backup.tgz.sha256.remote\\\" >/dev/null\"},{\"line\":50,\"path\":\"/root/netbird-vps-backup.sh\",\"text\":\"ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=yes -o UserKnownHostsFile=\\\"$KH\\\" root@\\\"$VPS_IP\\\" \\\"rm -f '$REMOTE_ARCH' '$REMOTE_ARCH.sha256'\\\" >/dev/null\"},{\"line\":663,\"path\":\"/var/lib/homelab-change-sets/homelab-admin-pg-char-guard-install-v1/20260715T061637Z/error-register.new.md\",\"text\":\"- Correct egress candidates are relay.pvepro.ru / relay.netbird.selfhosted / 100.100.19.1 for Moldova and mail.pvepro.ru / mail.netbird.selfhosted / 100.100.147.204 for USA.\"},{\"line\":663,\"path\":\"/var/lib/homelab-change-sets/homelab-admin-pg-char-guard-install-v1/20260715T061637Z/error-register.before.md\",\"text\":\"- Correct egress candidates are relay.pvepro.ru / relay.netbird.selfhosted / 100.100.19.1 for Moldova and mail.pvepro.ru / mail.netbird.selfhosted / 100.100.147.204 for USA.\"},{\"line\":663,\"path\":\"/var/lib/homelab-change-sets/homelab-admin-err014-install-v2/20260715T062705Z/error-register.new.md\",\"text\":\"- Correct egress candidates are relay.pvepro.ru / relay.netbird.selfhosted / 100.100.19.1 for Moldova and mail.pvepro.ru / mail.netbird.selfhosted / 100.100.147.204 for USA.\"},{\"line\":663,\"path\":\"/var/lib/homelab-change-sets/homelab-admin-err014-install-v2/20260715T062705Z/error-register.before.md\",\"text\":\"- Correct egress candidates are relay.pvepro.ru / relay.netbird.selfhosted / 100.100.19.1 for Moldova and mail.pvepro.ru / mail.netbird.selfhosted / 100.100.147.204 for USA.\"}],\"nested_key_artifact_count\":0,\"nested_key_artifacts\":[],\"us_netbird_known_hosts_hits\":0}}\nVPS517R5R1_DECISION=PASS_NESTED_BACKUP_OR_CHANGESET_ACCESS_EVIDENCE_FOUND\nVPS517R5R1_NEXT_GATE=USE_EXACT_RECOVERED_ROUTE_OR_TARGETED_CLOUD_ESCROW_READ\nHOMELAB_RESULT_CONTRACT={\"version\":1,\"command_id\":\"SUPPORT-260918-INFRA-VPS-NESTED-BACKUP-ACCESS-RCA-READONLY-517R5R1\",\"status\":\"OK\",\"changes_made\":false,\"rollback_started\":false,\"rollback_restored\":null}\n" + "output": "VPS517R6_SAFE_REPORT={\"changes_made\":false,\"command_id\":\"SUPPORT-260918-INFRA-VPS-USA-PINNED-INVENTORY-MOLDOVA-TRUST-READONLY-517R6\",\"decision\":\"HOLD_USA_ACCESS_FAILED_AND_MOLDOVA_TRUST_NOT_PROVEN\",\"flash_required\":false,\"local_source_counts\":{\"ini_existing\":0,\"moba\":0,\"openssh\":0,\"putty\":0},\"mode\":\"read-only\",\"moldova\":{\"current_517R2_fingerprints\":[\"SHA256:805Q9eh/fePUci42dfY58I6q0lFiiPHn0/M+mckypmE\",\"SHA256:Q0Cfx2w9lGpHnMNIQtkJnq8z4mX34UCbR3BTQNuwJ9o\",\"SHA256:lUdLDguDrTStHVyMWsZmysgRJKxzjtU72Q7KUrazNoY\"],\"local_trust_fingerprints\":[],\"local_trust_records\":[],\"trust_proven\":false,\"trusted_current_intersection\":[]},\"schema_version\":1,\"usa\":{\"access_ok\":false,\"hostkey\":\"SHA256:DXJGwunC5tEVvnC3nRxyayTN8FXmyJcVgf+Oa6udQsY\",\"inventory\":null,\"rc\":1,\"stderr_bytes\":1193,\"stderr_class\":[\"AUTH_DENIED\",\"HOSTKEY_EVENT\",\"KEY_REFUSED\",\"PAGEANT_USED\"],\"stderr_sha256\":\"f36bbe808c74a2e21e80db33dc9aa7f5be9bdf51281c6ec3d426d85d261ff293\",\"target\":\"85.121.4.192\"}}\nVPS517R6_DECISION=HOLD_USA_ACCESS_FAILED_AND_MOLDOVA_TRUST_NOT_PROVEN\nVPS517R6_NEXT_GATE=MOLDOVA_PINNED_INVENTORY_IF_TRUST_PROVEN_ELSE_REVIEW_EXACT_LOCAL_TRUST_AND_USA_AUTH_CLASS\nHOMELAB_RESULT_CONTRACT={\"version\":1,\"command_id\":\"SUPPORT-260918-INFRA-VPS-USA-PINNED-INVENTORY-MOLDOVA-TRUST-READONLY-517R6\",\"status\":\"OK\",\"changes_made\":false,\"rollback_started\":false,\"rollback_restored\":null}\n" } diff --git a/runtime/latest.txt b/runtime/latest.txt index 544930e3..d5bb11cb 100644 --- a/runtime/latest.txt +++ b/runtime/latest.txt @@ -1,15 +1,15 @@ CHAT_OUTPUT_BEGIN -COMMAND_ID=SUPPORT-260918-INFRA-VPS-NESTED-BACKUP-ACCESS-RCA-READONLY-517R5R1 +COMMAND_ID=SUPPORT-260918-INFRA-VPS-USA-PINNED-INVENTORY-MOLDOVA-TRUST-READONLY-517R6 STATUS=OK RC=0 HOST=pve01 MODE=read-only -COMPONENT=infra-vps-nested-backup-access-rca-readonly +COMPONENT=infra-vps-usa-pinned-inventory-moldova-trust-readonly REFERENCE_REGISTER_CHECK=OK REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66 ERROR_REGISTER_CHECK=OK ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0 -COMMAND_SHA256=56b16fefc6047ad4aa5f3a2caee8016d8961011c6e73b6a7e5e6f9de082c0f3b +COMMAND_SHA256=2894b3e9e4325838f880c152c0975d9f70a8a43d3fd143856decc62426b757e4 DUPLICATE_FAILED_COMMAND_BLOCKED=false EXECUTION_STARTED=true CHANGE_DECLARED=false @@ -24,13 +24,13 @@ MUTATION_OUTCOME=NO_MUTATION SANITIZED=yes SECRETS_INCLUDED=no PRIVATE_ADDRESSES_INCLUDED=no -RAW_EVIDENCE_SHA256=74ed6bbd6639b96733d914c34b7addbf13736271c1f8000221b20b729f2e50ee -SANITIZED_OUTPUT_SHA256=c5815c28c91af01291933bafdb3ee079385607b31cae310bc1744f24cb7721c1 +RAW_EVIDENCE_SHA256=8f314c210f2eeb75645c92b217f79427ef87c32b013f756d166eb1184836b471 +SANITIZED_OUTPUT_SHA256=8f314c210f2eeb75645c92b217f79427ef87c32b013f756d166eb1184836b471 OUTPUT_BEGIN -VPS517R5R1_SAFE_REPORT={"changes_made":false,"changeset_evidence":[{"bytes":2150,"hits":[{"line":56,"text":" \"authorized_keys\","}],"path":"/var/lib/homelab-change-sets/stage4h-final-acceptance-task-contract-v1/20260714T182929Z/task.json","sha256":"eaf46f109e83ae6a13610c411c1ab0e2fbd695c21297fdc9cac1d64b3d462d34"},{"bytes":2595,"hits":[{"line":38,"text":" \"description\": \"accept-new, StrictHostKeyChecking=no and unverified ssh-keyscan are forbidden.\","}],"path":"/var/lib/homelab-change-sets/homelab-admin-pg-char-guard-install-v1/20260715T061637Z/error-policies.before.json","sha256":"ce6d46a01dfe14adc8b2a35a683f2771e4324b04fea611dd4f4bd0458b09d1af"},{"bytes":77451,"hits":[{"line":140,"text":"33. Security finding: root authorized_keys \u043d\u0430 PVE-\u043d\u043e\u0434\u0430\u0445 \u0438\u043c\u0435\u043b \u043f\u0440\u0430\u0432\u0430 777."},{"line":141,"text":"\u0424\u0430\u043a\u0442: inventory 158 \u043f\u043e\u043a\u0430\u0437\u0430\u043b [SENSITIVE_PATH] \u0438 backup-\u0444\u0430\u0439\u043b\u044b \u0441 \u0440\u0435\u0436\u0438\u043c\u043e\u043c 777 \u043d\u0430 pve01/pve02/pve03."},{"line":142,"text":"\u041d\u0443\u0436\u043d\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u043d\u0430 [SENSITIVE_PATH]=700 \u0438 authorized_keys/authorized_keys.bak*=600, \u0437\u0430\u0442\u0435\u043c \u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u0442\u044c before/after proof."},{"line":144,"text":"35. \u041e\u0448\u0438\u0431\u043a\u0430 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438: 160_PVE_ROOT_AUTHORIZED_KEYS_PERMISSIONS_FIXED \u043d\u0435 \u0434\u043e\u043a\u0430\u0437\u0430\u043b \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u0430\u0432."},{"line":145,"text":"\u0424\u0430\u043a\u0442: AFTER \u0432\u0441\u0451 \u0435\u0449\u0451 \u043f\u043e\u043a\u0430\u0437\u0430\u043b 777 \u0434\u043b\u044f [SENSITIVE_PATH] \u043d\u0430 pve01/pve02/pve03."},{"line":146,"text":"\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u0430\u044f \u043f\u0440\u0438\u0447\u0438\u043d\u0430: authorized_keys \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f symlink, \u0430 stat \u0431\u0435\u0437 -L \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u0440\u0435\u0436\u0438\u043c \u0441\u0441\u044b\u043b\u043a\u0438 777."},{"line":662,"text":"- Do not treat e3qxxx.netbird.selfhosted / 100.100.125.70 and e3qxxx-183-106.netbird.selfhosted / 100.100.183.106 as VPS egress nodes; they are user mobile peers."},{"line":663,"text":"- Correct egress candidates are relay.pvepro.ru / relay.netbird.selfhosted / 100.100.19.1 for Moldova and mail.pvepro.ru / mail.netbird.selfhosted / 100.100.147.204 for USA."}],"path":"/var/lib/homelab-change-sets/homelab-admin-pg-char-guard-install-v1/20260715T061637Z/error-register.new.md","sha256":"6fd516bc953cae5f2c28194b4c2393898abc439b4401e1d6fb177ae7607ecb51"},{"bytes":76486,"hits":[{"line":140,"text":"33. Security finding: root authorized_keys \u043d\u0430 PVE-\u043d\u043e\u0434\u0430\u0445 \u0438\u043c\u0435\u043b \u043f\u0440\u0430\u0432\u0430 777."},{"line":141,"text":"\u0424\u0430\u043a\u0442: inventory 158 \u043f\u043e\u043a\u0430\u0437\u0430\u043b [SENSITIVE_PATH] \u0438 backup-\u0444\u0430\u0439\u043b\u044b \u0441 \u0440\u0435\u0436\u0438\u043c\u043e\u043c 777 \u043d\u0430 pve01/pve02/pve03."},{"line":142,"text":"\u041d\u0443\u0436\u043d\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u043d\u0430 [SENSITIVE_PATH]=700 \u0438 authorized_keys/authorized_keys.bak*=600, \u0437\u0430\u0442\u0435\u043c \u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u0442\u044c before/after proof."},{"line":144,"text":"35. \u041e\u0448\u0438\u0431\u043a\u0430 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438: 160_PVE_ROOT_AUTHORIZED_KEYS_PERMISSIONS_FIXED \u043d\u0435 \u0434\u043e\u043a\u0430\u0437\u0430\u043b \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u0430\u0432."},{"line":145,"text":"\u0424\u0430\u043a\u0442: AFTER \u0432\u0441\u0451 \u0435\u0449\u0451 \u043f\u043e\u043a\u0430\u0437\u0430\u043b 777 \u0434\u043b\u044f [SENSITIVE_PATH] \u043d\u0430 pve01/pve02/pve03."},{"line":146,"text":"\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u0430\u044f \u043f\u0440\u0438\u0447\u0438\u043d\u0430: authorized_keys \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f symlink, \u0430 stat \u0431\u0435\u0437 -L \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u0440\u0435\u0436\u0438\u043c \u0441\u0441\u044b\u043b\u043a\u0438 777."},{"line":662,"text":"- Do not treat e3qxxx.netbird.selfhosted / 100.100.125.70 and e3qxxx-183-106.netbird.selfhosted / 100.100.183.106 as VPS egress nodes; they are user mobile peers."},{"line":663,"text":"- Correct egress candidates are relay.pvepro.ru / relay.netbird.selfhosted / 100.100.19.1 for Moldova and mail.pvepro.ru / mail.netbird.selfhosted / 100.100.147.204 for USA."}],"path":"/var/lib/homelab-change-sets/homelab-admin-pg-char-guard-install-v1/20260715T061637Z/error-register.before.md","sha256":"750cb4d51300df08a00173c1dea6987078529a87b7eaad2cb89bc9c78fcf2d20"},{"bytes":26777,"hits":[{"line":73,"text":"SSH=(ssh -n -T -o BatchMode=yes -o ConnectTimeout=8 -o StrictHostKeyChecking=yes debian@[PRIVATE_IP])"},{"line":74,"text":"SCP=(scp -q -o BatchMode=yes -o ConnectTimeout=8 -o StrictHostKeyChecking=yes)"}],"path":"/var/lib/homelab-change-sets/crypto-portfolio-ui-retention-sync-closure-resume-v3/20260713T081210Z/main.sh","sha256":"00f74e2a2be46cd31c83ce89f1657545c1bfa866e53952359802d0ab121df79e"},{"bytes":318,"hits":[{"line":1,"text":"33. Security finding: root authorized_keys \u043d\u0430 PVE-\u043d\u043e\u0434\u0430\u0445 \u0438\u043c\u0435\u043b \u043f\u0440\u0430\u0432\u0430 777."}],"path":"/var/lib/homelab-change-sets/homelab-ops-bootstrap-audit-v1/20260715T214930Z/error-register-tail.txt","sha256":"a940f28541fe6b47a44a0e61c0c74ca2c5e47d9f9d7631e869787a779de226c5"},{"bytes":2865,"hits":[{"line":38,"text":" \"description\": \"accept-new, StrictHostKeyChecking=no and unverified ssh-keyscan are forbidden.\","}],"path":"/var/lib/homelab-change-sets/homelab-admin-pg-char-guard-candidate-v1/20260715T060858Z/error-policies.candidate.json","sha256":"075ba849b67ec5f4b39179ecfe83ea98b3a493aee3987d0530de88d4447ded95"},{"bytes":32437,"hits":[{"line":80,"text":"SSH=(ssh -n -T -o BatchMode=yes -o ConnectTimeout=8 -o StrictHostKeyChecking=yes debian@[PRIVATE_IP])"},{"line":81,"text":"SCP=(scp -q -o BatchMode=yes -o ConnectTimeout=8 -o StrictHostKeyChecking=yes)"}],"path":"/var/lib/homelab-change-sets/crypto-portfolio-ui-production-closure/20260713T075748Z/main.sh","sha256":"452b1c98604fc800cd1f395b787242dce7d5f6534b565381f910e4d2d1d480f3"},{"bytes":2595,"hits":[{"line":38,"text":" \"description\": \"accept-new, StrictHostKeyChecking=no and unverified ssh-keyscan are forbidden.\","}],"path":"/var/lib/homelab-change-sets/homelab-admin-err014-install-v2/20260715T062705Z/error-policies.before.json","sha256":"ce6d46a01dfe14adc8b2a35a683f2771e4324b04fea611dd4f4bd0458b09d1af"},{"bytes":77979,"hits":[{"line":140,"text":"33. Security finding: root authorized_keys \u043d\u0430 PVE-\u043d\u043e\u0434\u0430\u0445 \u0438\u043c\u0435\u043b \u043f\u0440\u0430\u0432\u0430 777."},{"line":141,"text":"\u0424\u0430\u043a\u0442: inventory 158 \u043f\u043e\u043a\u0430\u0437\u0430\u043b [SENSITIVE_PATH] \u0438 backup-\u0444\u0430\u0439\u043b\u044b \u0441 \u0440\u0435\u0436\u0438\u043c\u043e\u043c 777 \u043d\u0430 pve01/pve02/pve03."},{"line":142,"text":"\u041d\u0443\u0436\u043d\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u043d\u0430 [SENSITIVE_PATH]=700 \u0438 authorized_keys/authorized_keys.bak*=600, \u0437\u0430\u0442\u0435\u043c \u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u0442\u044c before/after proof."},{"line":144,"text":"35. \u041e\u0448\u0438\u0431\u043a\u0430 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438: 160_PVE_ROOT_AUTHORIZED_KEYS_PERMISSIONS_FIXED \u043d\u0435 \u0434\u043e\u043a\u0430\u0437\u0430\u043b \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u0430\u0432."},{"line":145,"text":"\u0424\u0430\u043a\u0442: AFTER \u0432\u0441\u0451 \u0435\u0449\u0451 \u043f\u043e\u043a\u0430\u0437\u0430\u043b 777 \u0434\u043b\u044f [SENSITIVE_PATH] \u043d\u0430 pve01/pve02/pve03."},{"line":146,"text":"\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u0430\u044f \u043f\u0440\u0438\u0447\u0438\u043d\u0430: authorized_keys \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f symlink, \u0430 stat \u0431\u0435\u0437 -L \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u0440\u0435\u0436\u0438\u043c \u0441\u0441\u044b\u043b\u043a\u0438 777."},{"line":662,"text":"- Do not treat e3qxxx.netbird.selfhosted / 100.100.125.70 and e3qxxx-183-106.netbird.selfhosted / 100.100.183.106 as VPS egress nodes; they are user mobile peers."},{"line":663,"text":"- Correct egress candidates are relay.pvepro.ru / relay.netbird.selfhosted / 100.100.19.1 for Moldova and mail.pvepro.ru / mail.netbird.selfhosted / 100.100.147.204 for USA."}],"path":"/var/lib/homelab-change-sets/homelab-admin-err014-install-v2/20260715T062705Z/error-register.new.md","sha256":"ab8308549db90d235b591af0581580c3c7ba1b287b129cc6111c2eef0a0f9ecc"},{"bytes":76486,"hits":[{"line":140,"text":"33. Security finding: root authorized_keys \u043d\u0430 PVE-\u043d\u043e\u0434\u0430\u0445 \u0438\u043c\u0435\u043b \u043f\u0440\u0430\u0432\u0430 777."},{"line":141,"text":"\u0424\u0430\u043a\u0442: inventory 158 \u043f\u043e\u043a\u0430\u0437\u0430\u043b [SENSITIVE_PATH] \u0438 backup-\u0444\u0430\u0439\u043b\u044b \u0441 \u0440\u0435\u0436\u0438\u043c\u043e\u043c 777 \u043d\u0430 pve01/pve02/pve03."},{"line":142,"text":"\u041d\u0443\u0436\u043d\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u043d\u0430 [SENSITIVE_PATH]=700 \u0438 authorized_keys/authorized_keys.bak*=600, \u0437\u0430\u0442\u0435\u043c \u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u0442\u044c before/after proof."},{"line":144,"text":"35. \u041e\u0448\u0438\u0431\u043a\u0430 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438: 160_PVE_ROOT_AUTHORIZED_KEYS_PERMISSIONS_FIXED \u043d\u0435 \u0434\u043e\u043a\u0430\u0437\u0430\u043b \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u0430\u0432."},{"line":145,"text":"\u0424\u0430\u043a\u0442: AFTER \u0432\u0441\u0451 \u0435\u0449\u0451 \u043f\u043e\u043a\u0430\u0437\u0430\u043b 777 \u0434\u043b\u044f [SENSITIVE_PATH] \u043d\u0430 pve01/pve02/pve03."},{"line":146,"text":"\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u0430\u044f \u043f\u0440\u0438\u0447\u0438\u043d\u0430: authorized_keys \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f symlink, \u0430 stat \u0431\u0435\u0437 -L \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u0440\u0435\u0436\u0438\u043c \u0441\u0441\u044b\u043b\u043a\u0438 777."},{"line":662,"text":"- Do not treat e3qxxx.netbird.selfhosted / 100.100.125.70 and e3qxxx-183-106.netbird.selfhosted / 100.100.183.106 as VPS egress nodes; they are user mobile peers."},{"line":663,"text":"- Correct egress candidates are relay.pvepro.ru / relay.netbird.selfhosted / 100.100.19.1 for Moldova and mail.pvepro.ru / mail.netbird.selfhosted / 100.100.147.204 for USA."}],"path":"/var/lib/homelab-change-sets/homelab-admin-err014-install-v2/20260715T062705Z/error-register.before.md","sha256":"750cb4d51300df08a00173c1dea6987078529a87b7eaad2cb89bc9c78fcf2d20"},{"bytes":23331,"hits":[{"line":104,"text":"SSH=(ssh -n -T -o BatchMode=yes -o ConnectTimeout=8 -o StrictHostKeyChecking=yes debian@[PRIVATE_IP])"},{"line":105,"text":"SCP=(scp -q -o BatchMode=yes -o ConnectTimeout=8 -o StrictHostKeyChecking=yes)"}],"path":"/var/lib/homelab-change-sets/crypto-portfolio-ui-retention-sync-closure-resume/20260713T080320Z/main.sh","sha256":"9a4ce646203394e1b978efd40471d6ffa7b85212f4fb6a463f1c48b5f192194b"}],"cloud_reads":0,"cloud_writes":0,"command_id":"SUPPORT-260918-INFRA-VPS-NESTED-BACKUP-ACCESS-RCA-READONLY-517R5R1","decision":"PASS_NESTED_BACKUP_OR_CHANGESET_ACCESS_EVIDENCE_FOUND","exact_files":[{"bytes":2811,"hits":[{"line":5,"text":"KH=\"[SENSITIVE_PATH] -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=yes -o UserKnownHostsFile=\"$KH\" root@\"$VPS_IP\" \"TS='$TS' REMOTE_ARCH='$REMOTE_ARCH' bash -s\" <<'REMOTE'"},{"line":48,"text":"scp -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=yes -o UserKnownHostsFile=\"$KH\" root@\"$VPS_IP\":\"$REMOTE_ARCH\" \"$DEST/netbird-vps-backup.tgz\" >/dev/null"},{"line":49,"text":"scp -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=yes -o UserKnownHostsFile=\"$KH\" root@\"$VPS_IP\":\"$REMOTE_ARCH.sha256\" \"$DEST/netbird-vps-backup.tgz.sha256.remote\" >/dev/null"},{"line":50,"text":"ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=yes -o UserKnownHostsFile=\"$KH\" root@\"$VPS_IP\" \"rm -f '$REMOTE_ARCH' '$REMOTE_ARCH.sha256'\" >/dev/null"}],"path":"/root/netbird-vps-backup.sh","present":true,"sha256":"a4546d7fff40e4f7cf935e5072847e11dd02758b1075421d7e27591faf8ac6d7"},{"bytes":117,"hits":[],"path":"[SENSITIVE_PATH] -o StrictHostKeyChecking=accept-new \\"},{"line":52,"text":" -o StrictHostKeyChecking=accept-new \\"},{"line":108,"text":" -o StrictHostKeyChecking=accept-new \\"}],"path":"/usr/local/sbin/homelab-gitea-secondary-backup","present":true,"sha256":"5e3ad06f4d7777078a557ee53c75793d29966f82e1a1f2f6cb8f4857739d9b67"},{"bytes":487,"hits":[],"path":"/etc/hosts","present":true,"sha256":"c3b9101ad96911d55328b70e12e87f9b17e4ef89fce47dc619478e113c4855ec"}],"external_ssh_attempts":0,"known_hosts_queries":[{"file":"[SENSITIVE_PATH] -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=yes -o UserKnownHostsFile=\"$KH\" root@\"$VPS_IP\" \"TS='$TS' REMOTE_ARCH='$REMOTE_ARCH' bash -s\" <<'REMOTE'"},{"line":48,"path":"/root/netbird-vps-backup.sh","text":"scp -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=yes -o UserKnownHostsFile=\"$KH\" root@\"$VPS_IP\":\"$REMOTE_ARCH\" \"$DEST/netbird-vps-backup.tgz\" >/dev/null"},{"line":49,"path":"/root/netbird-vps-backup.sh","text":"scp -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=yes -o UserKnownHostsFile=\"$KH\" root@\"$VPS_IP\":\"$REMOTE_ARCH.sha256\" \"$DEST/netbird-vps-backup.tgz.sha256.remote\" >/dev/null"},{"line":50,"path":"/root/netbird-vps-backup.sh","text":"ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=yes -o UserKnownHostsFile=\"$KH\" root@\"$VPS_IP\" \"rm -f '$REMOTE_ARCH' '$REMOTE_ARCH.sha256'\" >/dev/null"},{"line":663,"path":"/var/lib/homelab-change-sets/homelab-admin-pg-char-guard-install-v1/20260715T061637Z/error-register.new.md","text":"- Correct egress candidates are relay.pvepro.ru / relay.netbird.selfhosted / 100.100.19.1 for Moldova and mail.pvepro.ru / mail.netbird.selfhosted / 100.100.147.204 for USA."},{"line":663,"path":"/var/lib/homelab-change-sets/homelab-admin-pg-char-guard-install-v1/20260715T061637Z/error-register.before.md","text":"- Correct egress candidates are relay.pvepro.ru / relay.netbird.selfhosted / 100.100.19.1 for Moldova and mail.pvepro.ru / mail.netbird.selfhosted / 100.100.147.204 for USA."},{"line":663,"path":"/var/lib/homelab-change-sets/homelab-admin-err014-install-v2/20260715T062705Z/error-register.new.md","text":"- Correct egress candidates are relay.pvepro.ru / relay.netbird.selfhosted / 100.100.19.1 for Moldova and mail.pvepro.ru / mail.netbird.selfhosted / 100.100.147.204 for USA."},{"line":663,"path":"/var/lib/homelab-change-sets/homelab-admin-err014-install-v2/20260715T062705Z/error-register.before.md","text":"- Correct egress candidates are relay.pvepro.ru / relay.netbird.selfhosted / 100.100.19.1 for Moldova and mail.pvepro.ru / mail.netbird.selfhosted / 100.100.147.204 for USA."}],"nested_key_artifact_count":0,"nested_key_artifacts":[],"us_netbird_known_hosts_hits":0}} -VPS517R5R1_DECISION=PASS_NESTED_BACKUP_OR_CHANGESET_ACCESS_EVIDENCE_FOUND -VPS517R5R1_NEXT_GATE=USE_EXACT_RECOVERED_ROUTE_OR_TARGETED_CLOUD_ESCROW_READ -HOMELAB_RESULT_CONTRACT={"version":1,"command_id":"SUPPORT-260918-INFRA-VPS-NESTED-BACKUP-ACCESS-RCA-READONLY-517R5R1","status":"OK","changes_made":false,"rollback_started":false,"rollback_restored":null} +VPS517R6_SAFE_REPORT={"changes_made":false,"command_id":"SUPPORT-260918-INFRA-VPS-USA-PINNED-INVENTORY-MOLDOVA-TRUST-READONLY-517R6","decision":"HOLD_USA_ACCESS_FAILED_AND_MOLDOVA_TRUST_NOT_PROVEN","flash_required":false,"local_source_counts":{"ini_existing":0,"moba":0,"openssh":0,"putty":0},"mode":"read-only","moldova":{"current_517R2_fingerprints":["SHA256:805Q9eh/fePUci42dfY58I6q0lFiiPHn0/M+mckypmE","SHA256:Q0Cfx2w9lGpHnMNIQtkJnq8z4mX34UCbR3BTQNuwJ9o","SHA256:lUdLDguDrTStHVyMWsZmysgRJKxzjtU72Q7KUrazNoY"],"local_trust_fingerprints":[],"local_trust_records":[],"trust_proven":false,"trusted_current_intersection":[]},"schema_version":1,"usa":{"access_ok":false,"hostkey":"SHA256:DXJGwunC5tEVvnC3nRxyayTN8FXmyJcVgf+Oa6udQsY","inventory":null,"rc":1,"stderr_bytes":1193,"stderr_class":["AUTH_DENIED","HOSTKEY_EVENT","KEY_REFUSED","PAGEANT_USED"],"stderr_sha256":"f36bbe808c74a2e21e80db33dc9aa7f5be9bdf51281c6ec3d426d85d261ff293","target":"85.121.4.192"}} +VPS517R6_DECISION=HOLD_USA_ACCESS_FAILED_AND_MOLDOVA_TRUST_NOT_PROVEN +VPS517R6_NEXT_GATE=MOLDOVA_PINNED_INVENTORY_IF_TRUST_PROVEN_ELSE_REVIEW_EXACT_LOCAL_TRUST_AND_USA_AUTH_CLASS +HOMELAB_RESULT_CONTRACT={"version":1,"command_id":"SUPPORT-260918-INFRA-VPS-USA-PINNED-INVENTORY-MOLDOVA-TRUST-READONLY-517R6","status":"OK","changes_made":false,"rollback_started":false,"rollback_restored":null} OUTPUT_END CHAT_OUTPUT_END