chore(security): ignore .updater-key-password Tauri signing passphrase#302
chore(security): ignore .updater-key-password Tauri signing passphrase#302KooshaPari wants to merge 1 commit into
Conversation
The Tauri updater private-key passphrase was sitting untracked in src-tauri/.updater-key-password with no .gitignore coverage. Risk: anyone with access to a stale git-status or git-add -A run could inadvertently commit it, leaking the passphrase that decrypts the updater private key (which IS committed as the non-secret sibling updater.key.pub). Fix: add to root .gitignore so future clones/commits skip it. Public half of the key (updater.key.pub) is already in .gitignore's sibling section and stays that way. No other behavior changes. No files moved or renamed.
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
|
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
| *.local | ||
| *.pem | ||
| *.key | ||
| *.password |
There was a problem hiding this comment.
SUGGESTION: *.password does not match the target secret and is broader than needed
The secret named in the PR is .updater-key-password, which has no .password extension, so this glob does not actually cover it — protection for that file comes entirely from the .updater-key* pattern on line 65. This glob is also broad: it would silently ignore any future tracked file ending in .password (e.g. a test fixture db.password). Consider removing *.password, or scoping it to the real target so the ignore is intentional and auditable.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
Code Review SummaryStatus: 1 Issue Found | Recommendation: Address before merge Overview
Issue Details (click to expand)SUGGESTION
Files Reviewed (1 file)
Considerations
Fix these issues in Kilo Cloud Reviewed by hy3-20260706:free · Input: 54.3K · Output: 9.1K · Cached: 72.6K |
1 participant
Summary
The Tauri updater private-key passphrase was sitting untracked in
src-tauri/.updater-key-passwordwith no.gitignorecoverage.Risk
Anyone with access to a stale
git-statusorgit-add -Arun could inadvertently commit it, leaking the passphrase that decrypts the updater private key (the sibling halfupdater.key.pubis intentionally committed because it's a public key).Fix
Add to root
.gitignoreso future clones/commits skip it.Refs: BytePort-audit.json §L5 (security)