Uh oh!
There was an error while loading. Please reload this page.
fix(installer): stop leaking user PII + tracebloc internals in logs/output (#576) - #579
Merged
Conversation
Uh oh!
There was an error while loading. Please reload this page.
…utput (#576) Root-caused from a client's shared install log, which exposed both her identity (Username/RunAs/Machine — the PowerShell transcript header) and our internals (the `& $cosign @cosignArgs` source line + internal codes) when cosign errored. Main installer (install-k8s.ps1): - Drop Start-Transcript entirely — its fixed header IS the PII, and it also captured PowerShell's raw error rendering (source lines, internal identifiers) into the log. The shareable install-*.log is now written only via the curated Log() writer, with a PII-free header. - Route the message helpers (Info/Ok/Warn/Err/Step/PromptHeader/Hint) through Log() so the log stays useful without the transcript — it mirrors the curated on-screen output: no user PII, no tracebloc internals. Drop the Stop-Transcript calls. Bootstrap (install.ps1): - Capture cosign's output (2>&1 | Out-Null under EAP=Continue) instead of letting a native-stderr NativeCommandError dump THIS script's source line + internal identifiers to the console / any user transcript. Sanitize the verification- failure messages to plain language (no RFC-0001 R8 / manifest.sha256 / $_). Bash (common.sh): drop the username from the HOST_DATASET_DIR "not writable" error (keep the uid number). Tests: +2 Pester (main: no transcript; helpers feed the curated log) and +3 Pester (bootstrap: cosign output captured, messages carry no internal codes, still fails closed). Both suites green (418/0/9). Manifest regenerated. Scope: the top-level error boundary that stops PowerShell rendering ANY unhandled throw raw is #577; a broader sweep of internal identifiers out of all remaining messages continues under #576. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
shujaatTraceblocforce-pushed
the
fix/576-log-hygiene
branch
from
August 4, 2026 08:19
e8632d6 to
af25d1dCompareUh oh!
There was an error while loading. Please reload this page.
… (Bugbot #579) Removing Start-Transcript (for #576) left Write-PfFail and a few summary failure headlines screen-only, so a forwarded install-*.log no longer showed the actual failing preflight checks (disk/virt/storage/connectivity/memory) — only the generic Err summary + hints. Route Write-PfFail and the bad_creds / image_pull_ca / diagnostics-archive failure headlines through Log(). +1 Pester (Write-PfFail reaches the log). Manifest regenerated. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 95d782e. Configure here.
Uh oh!
There was an error while loading. Please reload this page.
…ch (Bugbot #579) The default Print-Summary branch (image_pull / crash / other non-ready) still printed its failure headline via Write-Host only, so those outcomes missed the curated log after the Start-Transcript removal — while bad_creds / image_pull_ca were routed. Add a central `Log "Final client state: <state>"` before the switch so EVERY branch is covered, and route the default headline too. +1 Pester (Print-Summary records the final state). Manifest regenerated. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
saadqbal
reviewed
Aug 4, 2026
Uh oh!
There was an error while loading. Please reload this page.
saadqbal
previously approved these changes
Aug 4, 2026
saadqbal
left a comment
Contributor
There was a problem hiding this comment.
Clean, careful PR — integrity chain verified (manifest hashes match the branch files), cosign stays fail-closed, and the e2e smoke assert still lands because Creating k3d cluster goes through Log(). 👍
One parity note (below). The couple of nits I found are all cosmetic.
…view parity) Reviewer (saadqbal) on #579: install.ps1's cosign message was sanitized but the bash bootstrap still printed 'cosign signature verification FAILED for manifest.sha256 — refusing to install', leaking the same internals. Match the PowerShell wording: 'Couldn't confirm the installer download is authentic, so the install stopped before changing anything on your machine.' Same for the success line ('Download verified as published by tracebloc'). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…view) install.sh's cosign-failure message was sanitized in 2aa35db (reviewer parity), so install-bootstrap.bats's 'cosign signature failure aborts' test — which pinned the old 'signature verification FAILED' string — must expect the new plain wording. Behaviour coverage (aborts + never degrades to a same-channel sha256) is unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
saadqbal
approved these changes
Aug 4, 2026
Uh oh!
There was an error while loading. Please reload this page.
shujaatTracebloc added a commit
that referenced
this pull request
Aug 5, 2026
…rap messages (#581) (#602) * refactor(installer): scrub remaining internal identifiers from bootstrap messages (#581) Follow-up from the #576/#579 review (saadqbal). The cosign verification-failure message was sanitized in #579; this sweeps the remaining lower-signal internal identifiers still in user-facing bootstrap messages — the `manifest.sha256` release-asset filename and the `RFC-0001 R8` internal spec code — to plain language, for consistency. No behaviour change: fail-closed paths, verification logic, and exit codes are untouched; only the wording of echo/throw/Warn strings changes. - install.sh: "manifest.sha256" -> "the installer's integrity checksums" / "signed checksum list"; ".sig/.cert not published" / "authenticate the manifest" -> "the installer's signature isn't published" / "confirm the download is authentic". - install.ps1: same wording, plus `(RFC-0001 R8)` removed from every throw (Resolve-InstallRef, Confirm-ManifestSignature, Confirm-ScriptIntegrity, the temp-dir guard). RFC-0001 stays in code COMMENTS (not user-facing) and the actual manifest.sha256 file paths/URLs are untouched. - Tests: updated the two pinned assertions (install-bootstrap.bats + install.Tests.ps1) from "no entry in manifest" to "isn't in the installer's signed checksum list". Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#581): scrub the PS AllowUnverified warn too (Bugbot) The unverified-opt-in warn on the sig/cert path still said "manifest signature/cert not published" while the bash warn and the PS throw on the same path were already updated to "The installer's signature isn't published". My grep keyed on "manifest.sha256", so this "manifest signature/cert" variant slipped through. Aligned it with the rest. (The generic word "manifest" in the cosign-unavailable messages is descriptive supply-chain English, not the filename/spec-code #581 scopes, so it stays.) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * refactor(installer): align cosign-unavailable messages to #576 vocabulary Address saadqbal's consistency nit on #602: the two cosign-unavailable strings still said "signed manifest" / "manifest signature" while the sibling sig-not-published messages just below now say "the installer's signature". Align both the WARN (AllowUnverified) and the fail-closed throw/echo in install.ps1 and install.sh, and update the matching install-bootstrap.bats assertion. No behaviour change: only wording of the echo/throw/Warn strings. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes#576.
Problem
A client's shared install log leaked both her identity and our internals:
Username: <redacted>,RunAs,Machine: <redacted>, host path, PID — from PowerShell'sStart-Transcriptheader.& $cosign @cosignArgs,At line:360 char:5), variable names, and internal codes (RFC-0001 R8,manifest.sha256) — from PowerShell rendering an unhandled native-command error.What changed
Main installer (
install-k8s.ps1) — theinstall-*.logusers forward to support:Start-Transcript. Its fixed header is the PII, and it also captured PowerShell's raw error rendering into the log. The shareable log is now written only through the curatedLog()writer, with a PII-free header.Info/Ok/Warn/Err/Step/PromptHeader/Hint) throughLog()so the log stays useful without the transcript — it mirrors the curated on-screen output. No user PII, no internals, by construction. Removed theStop-Transcriptcalls.Bootstrap (
install.ps1) — the console a user (or a support-requested transcript) sees:2>&1 | Out-Nullunder$ErrorActionPreference='Continue') instead of letting a native-stderrNativeCommandErrordump this script's source line + internal identifiers. Only a curated message is shown.RFC-0001 R8/manifest.sha256/ raw$_.Bash (
common.sh) — dropped the username from theHOST_DATASET_DIR"not writable" error (kept the uid number).Tests
install-k8s.Tests.ps1+2: noStart-Transcript/Stop-Transcript; helpers feed the curated log and the transcript identity header can't appear.install.Tests.ps1+3: cosign output is captured (no raw& $cosign … 2>$null 1>$null), messages carry no internal codes, still fails closed.manifest.sha256regenerated;check-facts --checkgreen.Scope
PS>TerminatingError()without it) and never crashes — is PowerShell installer must never terminate ungracefully — always show the user a clean 'what happened' #577, done next.Part of the installer-robustness set: #576 (this) · #577 · #578.
Note
Low Risk
Logging and user-facing error text only; verification still aborts on cosign failure with no change to install security behavior.
Overview
Install logs and console output are curated for support sharing so they no longer expose Windows identity (transcript headers) or installer internals (source lines, RFC codes, manifest names).
install-k8s.ps1: DropsStart-Transcript/Stop-Transcriptin favor of a PII-free header andLog()-only writes.Info/Ok/Warn/Err/Step/Hint/ preflight failures / summary branches now mirror on-screen messages into the log, includingFinal client stateon every outcome.install.ps1&install.sh: Cosign verification stderr is captured so native errors do not dump script source; success/failure text is plain language (still fail-closed).common.shdrops the username from oneHOST_DATASET_DIRerror.Tests and
manifest.sha256updated for the new messages and logging behavior.Reviewed by Cursor Bugbot for commit a2a9c87. Bugbot is set up for automated code reviews on this repo. Configure here.