code/cl8y-dex-terraclassic

Fork 0

Security: deploy runbook does not require recording git SHA or Terra Classic chain version at deploy time [SEC-D12] #410

New issue

Closed

opened 2026-06-19 11:48:20 +00:00 by totdking · 13 comments

totdking commented

2026-06-19 11:48:20 +00:00

(Migrated from gitlab.com)

No description provided.

totdking commented

2026-06-19 11:49:23 +00:00

(Migrated from gitlab.com)

Checklist Item

SEC-D12: Model stale deployment artifact or missed security patch like Terra's missed IBC patch. Verify: deploy runbook records git SHA, contract code IDs, chain versions, and post-deploy verification commands.

Summary

The supply-chain security docs cover wasm artifact integrity (workspace-optimizer, wasm-checksums.txt, cargo audit), and the deployment guide covers code IDs and post-deploy queries. However, neither the launch runbook nor the deployment guide requires the operator to record the exact git SHA of the deployed build, the Terra Classic chain version, or the chain's software version at deploy time. Without these records, auditing which code was deployed after a missed patch is not reliably possible.

What Was Checked

docs/runbooks/launch-checklist.md Phase 0-5: checks wasm policy, governance, hooks, fee tiers, indexer, frontend env; no git SHA recording step, no chain version recording step
docs/runbooks/wasm-admin-migration.md Pre-flight: "Record wasm-checksums.txt and code IDs for audit trail"; code IDs covered, git SHA absent, chain version absent
docs/deployment-guide.md Post-Deployment Checklist: verifies factory config, pair creation, fee discount, router trust; no git SHA or chain version steps
docs/supply-chain-security.md: covers cargo audit, gitleaks, DinD TLS for artifact integrity; does not require recording git SHA or chain version in the deployment trace

Expected (per checklist)

The deploy runbook must require recording: the git SHA of the deployed build, the resulting contract code IDs, the Terra Classic chain version at deploy time, and post-deploy verification command output. This creates an auditable record that identifies exactly which code was deployed and what chain state it ran against.

Actual

The runbook requires recording wasm-checksums.txt and code IDs (partial coverage). Git SHA and Terra Classic chain version are not required fields in any runbook checklist item. If a security patch is issued for the chain or for a contract dependency, there is no deploy-time record to determine which deployed instances are affected.

Evidence

docs/runbooks/wasm-admin-migration.md lines 6-8: "Record wasm-checksums.txt and code IDs"; no git SHA, no chain version
docs/runbooks/launch-checklist.md: no git SHA or chain version checklist item in any phase
docs/deployment-guide.md Post-Deployment Checklist: no git SHA or chain version item

Suggested Fix

Add the following to docs/runbooks/launch-checklist.md Phase 1 and docs/runbooks/wasm-admin-migration.md Pre-flight:

- [ ] Record deployed git SHA: `git rev-parse HEAD` -- paste output into launch tracking issue
- [ ] Record Terra Classic chain version: `terrad version` or `terrad status --node <rpc> | jq .node_info.version` -- paste output
- [ ] Record contract code IDs for factory, pair, router, fee-discount at deploy time
- [ ] Record wasm-checksums.txt artifact hash

This requires no code change. Add the same recording step to any migration runbook checklist.

Verification Checklist

docs/runbooks/launch-checklist.md has a checklist item to record git SHA, chain version, code IDs, and wasm-checksums.txt
docs/runbooks/wasm-admin-migration.md Pre-flight has the same recording items
A completed deploy trace with these fields exists on the launch tracking issue (or a template placeholder is in place)

Labels

security, pre-launch

Cc: @PlasticDigits

### Checklist Item SEC-D12: Model stale deployment artifact or missed security patch like Terra's missed IBC patch. Verify: deploy runbook records git SHA, contract code IDs, chain versions, and post-deploy verification commands. --- ### Summary The supply-chain security docs cover wasm artifact integrity (workspace-optimizer, wasm-checksums.txt, cargo audit), and the deployment guide covers code IDs and post-deploy queries. However, neither the launch runbook nor the deployment guide requires the operator to record the exact git SHA of the deployed build, the Terra Classic chain version, or the chain's software version at deploy time. Without these records, auditing which code was deployed after a missed patch is not reliably possible. --- ### What Was Checked - `docs/runbooks/launch-checklist.md` Phase 0-5: checks wasm policy, governance, hooks, fee tiers, indexer, frontend env; no git SHA recording step, no chain version recording step - `docs/runbooks/wasm-admin-migration.md` Pre-flight: "Record wasm-checksums.txt and code IDs for audit trail"; code IDs covered, git SHA absent, chain version absent - `docs/deployment-guide.md` Post-Deployment Checklist: verifies factory config, pair creation, fee discount, router trust; no git SHA or chain version steps - `docs/supply-chain-security.md`: covers cargo audit, gitleaks, DinD TLS for artifact integrity; does not require recording git SHA or chain version in the deployment trace --- ### Expected (per checklist) The deploy runbook must require recording: the git SHA of the deployed build, the resulting contract code IDs, the Terra Classic chain version at deploy time, and post-deploy verification command output. This creates an auditable record that identifies exactly which code was deployed and what chain state it ran against. --- ### Actual The runbook requires recording `wasm-checksums.txt` and code IDs (partial coverage). Git SHA and Terra Classic chain version are not required fields in any runbook checklist item. If a security patch is issued for the chain or for a contract dependency, there is no deploy-time record to determine which deployed instances are affected. --- ### Evidence - `docs/runbooks/wasm-admin-migration.md` lines 6-8: "Record wasm-checksums.txt and code IDs"; no git SHA, no chain version - `docs/runbooks/launch-checklist.md`: no git SHA or chain version checklist item in any phase - `docs/deployment-guide.md` Post-Deployment Checklist: no git SHA or chain version item --- ### Suggested Fix Add the following to `docs/runbooks/launch-checklist.md` Phase 1 and `docs/runbooks/wasm-admin-migration.md` Pre-flight: ``` - [ ] Record deployed git SHA: `git rev-parse HEAD` -- paste output into launch tracking issue - [ ] Record Terra Classic chain version: `terrad version` or `terrad status --node <rpc> | jq .node_info.version` -- paste output - [ ] Record contract code IDs for factory, pair, router, fee-discount at deploy time - [ ] Record wasm-checksums.txt artifact hash ``` This requires no code change. Add the same recording step to any migration runbook checklist. --- ### Verification Checklist - [ ] `docs/runbooks/launch-checklist.md` has a checklist item to record git SHA, chain version, code IDs, and wasm-checksums.txt - [ ] `docs/runbooks/wasm-admin-migration.md` Pre-flight has the same recording items - [ ] A completed deploy trace with these fields exists on the launch tracking issue (or a template placeholder is in place) --- ### Labels `security`, `pre-launch` Cc: @PlasticDigits

totdking commented

2026-06-19 12:06:50 +00:00

(Migrated from gitlab.com)

mentioned in issue #381

PlasticDigits commented

2026-06-19 12:56:58 +00:00

(Migrated from gitlab.com)

mentioned in commit 362c040d88

mentioned in commit 362c040d88633b84904c118b78c4c8947efcbaee

PlasticDigits commented

2026-06-19 12:57:27 +00:00

(Migrated from gitlab.com)

mentioned in merge request !930

PlasticDigits commented

2026-06-19 13:24:04 +00:00

(Migrated from gitlab.com)

mentioned in merge request !935

PlasticDigits commented

2026-06-19 13:49:58 +00:00

(Migrated from gitlab.com)

mentioned in commit 6abc30a309

mentioned in commit 6abc30a309e9ed8c4d3db8b193b285af7f458585

PlasticDigits commented

2026-06-19 14:19:56 +00:00

(Migrated from gitlab.com)

mentioned in commit b177633c32

mentioned in commit b177633c326a4a4aa5a87b6c5b85a624985a42ac

PlasticDigits commented

2026-06-19 14:35:39 +00:00

(Migrated from gitlab.com)

mentioned in commit 0e2eaa8dcf

mentioned in commit 0e2eaa8dcf4b5f317d6f007b02c45479e96cf56f

PlasticDigits commented

2026-06-19 14:39:15 +00:00

(Migrated from gitlab.com)

mentioned in commit d635061066

mentioned in commit d63506106619d170079d794fce09ab8c495ff336

PlasticDigits commented

2026-06-25 11:37:12 +00:00

(Migrated from gitlab.com)

Verification — SEC-D12 / GitLab #410

Result: All acceptance criteria PASS. No repo changes required; closing issue.

What was verified

Criterion	Result	How
`docs/runbooks/launch-checklist.md` records git SHA, chain version, code IDs, wasm-checksums.txt, and post-deploy verification	PASS	Manual read of Phase 1 § Deploy trace (audit record) (lines 42–53); `make verify-issue-410`
`docs/runbooks/wasm-admin-migration.md` Pre-flight has the same recording items	PASS	Manual read of Pre-flight § Deploy trace (SEC-D12) (lines 8–13); `make verify-issue-410`
Completed deploy trace on launch tracking issue or template placeholder in place	PASS (template)	`docs/templates/deploy-trace.md` provides copy-paste fields for all required items; linked from runbooks and deployment guide. No production/staging deploy trace posted on #391 yet — expected until first real deploy

Automated checks

make verify-issue-410
  PASS  deploy trace doc invariant (python3 scripts/check_deploy_trace_docs.py)
  PASS  deploy trace template present (docs/templates/deploy-trace.md)
  PASS  agent skill present (skills/AGENTS_DEPLOY_TRACE.md)
  PASS  launch runbook Phase 1 deploy trace section
  PASS  wasm migration Pre-flight deploy trace items
  PASS  deployment guide links deploy trace template
  PASS  supply-chain-security cross-links deploy trace
  PASS: 7   FAIL: 0

Cross-links confirmed

docs/deployment-guide.md § Deploy trace + Post-Deployment Checklist deploy-trace gate
docs/supply-chain-security.md → deploy trace template (SEC-D12)
Agent playbook: skills/AGENTS_DEPLOY_TRACE.md
Regression target: make check-deploy-trace-docs (also invoked by make verify-issue-410)

Follow-up

When the first staging or mainnet deploy runs, operators should paste a completed trace from docs/templates/deploy-trace.md onto launch tracking issue #391 before leaving Phase 1.

## Verification — SEC-D12 / GitLab #410 **Result:** All acceptance criteria **PASS**. No repo changes required; closing issue. ### What was verified | Criterion | Result | How | |-----------|--------|-----| | `docs/runbooks/launch-checklist.md` records git SHA, chain version, code IDs, wasm-checksums.txt, and post-deploy verification | **PASS** | Manual read of Phase 1 § Deploy trace (audit record) (lines 42–53); `make verify-issue-410` | | `docs/runbooks/wasm-admin-migration.md` Pre-flight has the same recording items | **PASS** | Manual read of Pre-flight § Deploy trace (SEC-D12) (lines 8–13); `make verify-issue-410` | | Completed deploy trace on launch tracking issue **or** template placeholder in place | **PASS** (template) | `docs/templates/deploy-trace.md` provides copy-paste fields for all required items; linked from runbooks and deployment guide. No production/staging deploy trace posted on [#391](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/391) yet — expected until first real deploy | ### Automated checks ```text make verify-issue-410 PASS deploy trace doc invariant (python3 scripts/check_deploy_trace_docs.py) PASS deploy trace template present (docs/templates/deploy-trace.md) PASS agent skill present (skills/AGENTS_DEPLOY_TRACE.md) PASS launch runbook Phase 1 deploy trace section PASS wasm migration Pre-flight deploy trace items PASS deployment guide links deploy trace template PASS supply-chain-security cross-links deploy trace PASS: 7 FAIL: 0 ``` ### Cross-links confirmed - `docs/deployment-guide.md` § Deploy trace + Post-Deployment Checklist deploy-trace gate - `docs/supply-chain-security.md` → deploy trace template (SEC-D12) - Agent playbook: `skills/AGENTS_DEPLOY_TRACE.md` - Regression target: `make check-deploy-trace-docs` (also invoked by `make verify-issue-410`) ### Follow-up When the first staging or mainnet deploy runs, operators should paste a completed trace from `docs/templates/deploy-trace.md` onto launch tracking issue #391 before leaving Phase 1.

PlasticDigits (Migrated from gitlab.com) closed this issue

2026-06-25 11:37:14 +00:00

PlasticDigits commented

2026-06-25 11:37:43 +00:00

(Migrated from gitlab.com)

mentioned in issue #406