From 08107c2a1713c9789a1bea211d23fabe6d1538c0 Mon Sep 17 00:00:00 2001
From: sec-check <sec-check@hive.kubestellar.io>
Date: Sun, 6 Sep 2026 18:03:45 -0400
Subject: [PATCH] [scanner] fix: make test_git_credential_hive.sh mode-notice
 cases hermetic on per-UID hives

Run as an agent UID (>= 2001), git-credential-hive.sh derives AGENT from
/var/run/hive/uid-map.json - deliberately ignoring HIVE_AGENT, which an
agent could spoof - and then reads that REAL agent's live
/tmp/.hive-mode-AGENT file. The harness's unique TEST_AGENT and
HIVE_AGENT_MODE were silently ignored, so the two mode-notice assertions
tracked the host's deployment state: on this host (scanner, UID 2008,
mode ISSUES_AND_PRS) they failed; on a host whose live mode is ADVISORY
they would pass vacuously for every case.

Stub id(1) on PATH inside run_helper so "id -u" reports a sub-2001 UID,
forcing the helper down the HIVE_AGENT/HIVE_AGENT_MODE path the harness
already controls. Every other id invocation passes through to the real
binary. The helper itself is untouched - the uid-map derivation is a
security property, not the bug.

Fixes #6178

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: sec-check <sec-check@hive.kubestellar.io>
---
 bin/test_git_credential_hive.sh               | 20 +++++++++++++++++++
 .../fixed-6178-cred-helper-test-hermetic.md   |  1 +
 2 files changed, 21 insertions(+)
 create mode 100644 changelog.d/fixed-6178-cred-helper-test-hermetic.md

diff --git a/bin/test_git_credential_hive.sh b/bin/test_git_credential_hive.sh
index 3bc995f7e..293b50ece 100644
--- a/bin/test_git_credential_hive.sh
+++ b/bin/test_git_credential_hive.sh
@@ -30,6 +30,25 @@ echo "ghs_stubtoken" >"$TOKEN_CACHE"
 # never shadow the HIVE_AGENT_MODE env var the harness sets.
 TEST_AGENT="cred-harness-$$"
 
+# The unique name alone is not enough on a live per-UID hive: the helper
+# derives AGENT from /var/run/hive/uid-map.json whenever it runs as a
+# per-agent UID (>= 2001) — deliberately ignoring HIVE_AGENT, which an agent
+# could spoof. Run there, the harness's own UID resolved to the REAL agent
+# name, and the helper read that agent's live /tmp/.hive-mode-<agent> instead
+# of the mode each case sets — so the mode-notice assertions passed or failed
+# with the host's deployment state, not the code. Stub `id -u` to report a
+# sub-2001 UID so the helper takes the HIVE_AGENT/HIVE_AGENT_MODE path the
+# harness controls; every other `id` invocation passes through.
+STUB_BIN="${WORK}/bin"
+mkdir -p "$STUB_BIN"
+REAL_ID="$(command -v id)"
+cat >"$STUB_BIN/id" <<EOF
+#!/bin/sh
+if [ "\${1:-}" = "-u" ] && [ \$# -eq 1 ]; then echo 1000; exit 0; fi
+exec "$REAL_ID" "\$@"
+EOF
+chmod +x "$STUB_BIN/id"
+
 # run_helper <mode> <acmm> <token_file> <stdin> -- <helper args...>
 # Echoes "exit=<code>\n<combined stdout+stderr>" for the assertions below.
 run_helper() {
@@ -38,6 +57,7 @@ run_helper() {
   local out rc
   out="$(
     printf '%b' "$stdin" | \
+    PATH="${STUB_BIN}:${PATH}" \
     HIVE_AGENT="$TEST_AGENT" \
     HIVE_AGENT_MODE="$mode" \
     HIVE_ACMM_LEVEL="$acmm" \
diff --git a/changelog.d/fixed-6178-cred-helper-test-hermetic.md b/changelog.d/fixed-6178-cred-helper-test-hermetic.md
new file mode 100644
index 000000000..919ca7e0e
--- /dev/null
+++ b/changelog.d/fixed-6178-cred-helper-test-hermetic.md
@@ -0,0 +1 @@
+- `bin/test_git_credential_hive.sh` no longer tests the live host instead of itself on per-UID hives. Run as an agent UID (>= 2001), the credential helper derives the agent name from the uid-map — deliberately ignoring the `HIVE_AGENT` the harness sets — and reads that real agent's live `/tmp/.hive-mode-<agent>`, so the two mode-notice assertions failed (or passed vacuously) with the host's deployment state. The harness now stubs `id -u` to a sub-2001 UID so the helper takes the env-var path the harness controls; the helper's own uid-map trust model is untouched.