From a6655a5e2c7fbe951c6165870005d308c8903fa8 Mon Sep 17 00:00:00 2001
From: mptyl <mp@tylconsulting.it>
Date: Tue, 25 Aug 2026 19:56:48 +0200
Subject: [PATCH] fix(ci): preserve secure secret mount ownership

---
 scripts/unified-deployment-smoke.sh | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/scripts/unified-deployment-smoke.sh b/scripts/unified-deployment-smoke.sh
index 499bf930..629902c4 100755
--- a/scripts/unified-deployment-smoke.sh
+++ b/scripts/unified-deployment-smoke.sh
@@ -1018,10 +1018,11 @@ task13_prepare_local_application_secrets() {
       test -f /source/task13-runtime-password && test ! -L /source/task13-runtime-password
       test -z "$(find /target -mindepth 1 -maxdepth 1 -print -quit)"
       cp /source/thothii.secrets /source/task13-runtime-password /target/
-      chown 10001:10001 /target /target/thothii.secrets /target/task13-runtime-password
-      chmod 0700 /target
+      chown 0:0 /target
+      chown 10001:10001 /target/thothii.secrets /target/task13-runtime-password
+      chmod 0755 /target
       chmod 0600 /target/thothii.secrets /target/task13-runtime-password
-      test "$(stat -c "%u:%g:%a" /target)" = 10001:10001:700
+      test "$(stat -c "%u:%g:%a" /target)" = 0:0:755
       test "$(stat -c "%u:%g:%a" /target/thothii.secrets)" = 10001:10001:600
       test "$(stat -c "%u:%g:%a" /target/task13-runtime-password)" = 10001:10001:600
     '
@@ -2471,6 +2472,7 @@ task13_self_test_source_contract() {
   local auth_runtime_mount auth_root_mount auth_projection auth_runtime_owner
   local pi_auth_bind pi_projection registry_runtime_mount registry_root_mount registry_projection
   local application_secret_bind application_secret_mount application_secret_projection
+  local application_secret_parent_owner application_secret_file_owner
   root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
   workflow="$root/.github/workflows/deployment.yml"
   host_network='--network'' host'
@@ -2488,6 +2490,8 @@ task13_self_test_source_contract() {
   application_secret_bind='$TASK13_''SECRETS:/run/secrets/thothii.secrets:ro'
   application_secret_mount='application-secrets:/run/''secrets:ro'
   application_secret_projection='task13_prepare_local_application_''secrets'
+  application_secret_parent_owner='chown 0:''0 /target'
+  application_secret_file_owner='chown 10001:''10001 /target/thothii.secrets /target/task13-runtime-password'
   if rg -n 'docker[[:space:]]+(system[[:space:]]+)?prune' \
     "$root/scripts/unified-deployment-smoke.sh" \
     "$root/scripts/tht-update-smoke.sh" \
@@ -2528,6 +2532,10 @@ task13_self_test_source_contract() {
   [[ "$(grep -Ec "^${application_secret_projection}\\(\\)|^[[:space:]]+${application_secret_projection}$" \
     "$root/scripts/unified-deployment-smoke.sh")" -eq 2 ]] \
     || task13_fail "the local application-secret projection must be defined and invoked once"
+  grep -Fq -- "$application_secret_parent_owner" "$root/scripts/unified-deployment-smoke.sh" \
+    || task13_fail "the local application-secret mount root must remain root-owned"
+  grep -Fq -- "$application_secret_file_owner" "$root/scripts/unified-deployment-smoke.sh" \
+    || task13_fail "the projected application secrets must remain readable only by the core UID"
   grep -Eq '^TASK13_BAD_CANDIDATE_IMAGE="[^"[:space:]]+@sha256:[0-9a-f]{64}"$' \
     "$root/scripts/unified-deployment-smoke.sh" \
     || task13_fail "the bad rollback candidate must be an immutable digest reference"