fix: close evidence credential disclosure gaps

2026-08-09 19:15:00 +02:00
parent 7126b567b0
commit df8dc1e219
7 changed files with 100 additions and 13 deletions
@@ -363,16 +363,16 @@ evidence:
      root: {tmp_path}
      max_bytes: 123
    - type: http
-      urls: ['https://example.test/doc.md?token=transport-only']
+      urls: ['https://example.test/doc.md']
 """)
    cfg = load_config(modern)
-    assert "transport-only" not in repr(cfg.evidence)
-    assert "transport-only" not in cfg.evidence.model_dump_json()
+    assert "example.test" not in repr(cfg.evidence)
+    assert "example.test" not in cfg.evidence.model_dump_json()
    assert cfg.evidence.sources[1].allow_private_hosts is False
    sources = build_evidence_sources(cfg)
    assert isinstance(sources[0], FilesystemEvidenceSource)
    assert isinstance(sources[1], HttpManifestEvidenceSource)
-    assert "transport-only" not in repr(sources[1])
+    assert "example.test" not in repr(sources[1])

    legacy = tmp_path / "legacy.yaml"
    (tmp_path / "curated").mkdir()