fix(security): harden Dockerfile (#71) + audit credential-logger calls (#72) + annotate JWT shape-detect (#73)

Batch of three findings from the 2026-05-04 owner-self code audit.

#71 (HIGH) — Dockerfile ran as root with no HEALTHCHECK (trivy DS002 +
semgrep dockerfile.security.missing-user). Added a dedicated UID 10001
user (primary group root for arbitrary-UID platform compatibility),
chown the app dir, switch USER, and add a HEALTHCHECK against the real
endpoint (port 8080, /health). Healthcheck uses a stdlib urllib
one-liner instead of curl to avoid adding a package to the slim base
image (no new deps). Dockerfile.test left as root by design: it only
runs pytest (editable install + writes caches/artifacts under /app), so
a non-root switch adds risk with no production-surface benefit.

#72 (MEDIUM) — semgrep python-logger-credential-disclosure flagged 6
logger calls (credentials.py:66,88,104,129,145 + blockchain.py:96).
Reviewed each: all log only credential IDs and service-generated error
strings — never the credential body, signature, or key. No real leak.
Added inline nosemgrep with a per-line rationale stating what is logged.

#73 (LOW) — annotated the two intentional unverified jwt.decode calls in
auth/token_parser.py (token-shape detection + claim extraction for
identity bridging; real EdDSA signature verification happens in
services/delegation_service.py and auth/crypto.py) with nosemgrep +
explanatory comments. Renamed synthetic test fixtures that tripped
gitleaks generic-api-key (test_identity.py, test_advanced_personas.py,
simulate_users.py) to obvious sk-FAKE-fixture-* names; preserved the
masking assertions in test_identity.py.

Closes #71
Closes #72
Closes #73

Author: ascender1729

Dockerfile

@@ -27,5 +27,15 @@ COPY . .
 ENV PORT=8080
 EXPOSE 8080
 
+# Drop root: run as a dedicated unprivileged user (UID 10001, primary group root
+# so the image stays compatible with arbitrary-UID platforms like OpenShift).
+# Fixes trivy DS002 + semgrep dockerfile.security.missing-user.missing-user (#71).
+RUN useradd -r -u 10001 -g root attestix && chown -R attestix:root /app
+USER attestix
+
+# Liveness probe via stdlib urllib (no curl in the slim base image, no new deps).
+HEALTHCHECK --interval=30s --timeout=3s --retries=3 \
+  CMD python -c "import urllib.request,sys; sys.exit(0) if urllib.request.urlopen('http://localhost:8080/health').status == 200 else sys.exit(1)" || exit 1
+
 # Run the API server
 CMD ["uvicorn", "api.main:app", "--host", "0.0.0.0", "--port", "8080"]

attestix/api/routers/blockchain.py

@@ -93,6 +93,7 @@ def anchor_credential(
         artifact_id=body.credential_id,
     )
     if isinstance(result, dict) and "error" in result:
+        # nosemgrep: python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure -- logs credential_id + service error string only; no credential body/signature/key
         logger.warning(
             "Credential anchor failed for %s: %s",
             body.credential_id, result["error"],

attestix/api/routers/credentials.py

@@ -63,6 +63,7 @@ def issue_credential(
         expiry_days=body.expiry_days,
     )
     if isinstance(result, dict) and "error" in result:
+        # nosemgrep: python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure -- logs the service error string only; no credential body/signature/key
         logger.warning("Credential issuance failed: %s", result["error"])
         raise HTTPException(status_code=400, detail="Credential issuance failed")
     return result
@@ -85,6 +86,7 @@ def list_credentials(
     )
     # Service returns list with error dict on failure
     if results and isinstance(results[0], dict) and "error" in results[0]:
+        # nosemgrep: python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure -- logs the service error string only; no credential body/signature/key
         logger.error("Credential listing failed: %s", results[0]["error"])
         raise HTTPException(status_code=500, detail="Credential listing failed")
     return results
@@ -101,6 +103,7 @@ def verify_credential_external(
     """
     result = svc.verify_credential_external(body.credential)
     if isinstance(result, dict) and "error" in result:
+        # nosemgrep: python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure -- logs the service error string only; no credential body/signature/key
         logger.warning("External credential verification failed: %s", result["error"])
         raise HTTPException(status_code=400, detail="Credential verification failed")
     return result
@@ -126,6 +129,7 @@ def verify_credential(
     """Verify a credential by ID: check signature, expiry, and revocation."""
     result = svc.verify_credential(credential_id)
     if isinstance(result, dict) and "error" in result:
+        # nosemgrep: python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure -- logs credential_id + service error string only; no credential body/signature/key
         logger.warning("Credential verification failed for %s: %s", credential_id, result["error"])
         raise HTTPException(status_code=400, detail="Credential verification failed")
     return result
@@ -142,6 +146,7 @@ def revoke_credential(
     result = svc.revoke_credential(credential_id, reason=reason)
     if isinstance(result, dict) and "error" in result:
         error_msg = result["error"]
+        # nosemgrep: python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure -- logs credential_id + service error string only; no credential body/signature/key
         logger.warning("Credential revocation failed for %s: %s", credential_id, error_msg)
         if "not found" in error_msg.lower():
             raise HTTPException(status_code=404, detail="Credential not found")

attestix/auth/token_parser.py

@@ -39,7 +39,10 @@ def detect_token_type(token: str) -> TokenType:
     if JWT_PATTERN.match(token):
         # Verify it's actually parseable as JWT
         try:
-            jwt.decode(token, options={"verify_signature": False})
+            # Token-shape detection only; no auth decision is made on this decode.
+            # Real signature verification happens in attestix/services/delegation_service.py
+            # (jwt.decode with EdDSA + server public key) and attestix/auth/crypto.py.
+            jwt.decode(token, options={"verify_signature": False})  # nosemgrep: python.jwt.security.unverified-jwt-decode.unverified-jwt-decode
             return TokenType.JWT
         except jwt.DecodeError:
             pass
@@ -59,10 +62,13 @@ def parse_jwt_claims(token: str) -> Optional[dict]:
     Returns None if the token is not a valid JWT.
     """
     try:
+        # Claim extraction for identity bridging only; no auth decision is made here.
+        # Real signature verification happens in attestix/services/delegation_service.py
+        # (jwt.decode with EdDSA + server public key) and attestix/auth/crypto.py.
         claims = jwt.decode(
             token,
             options={
-                "verify_signature": False,
+                "verify_signature": False,  # nosemgrep: python.jwt.security.unverified-jwt-decode.unverified-jwt-decode
                 "verify_exp": False,
                 "verify_aud": False,
             },

simulate_users.py

@@ -1002,7 +1002,7 @@ def sim_enterprise_architect():
     api_agent = call("create_agent_identity",
                      display_name="Partner-API-Agent",
                      source_protocol="api_key",
-                     identity_token="sk-partner-integration-key-abc123",
+                     identity_token="sk-FAKE-fixture-partner-integration",  # synthetic fixture, not a real key
                      capabilities="data_exchange",
                      issuer_name="PartnerCo")
     did_agent = call("create_agent_identity",

tests/e2e/test_advanced_personas.py

@@ -806,7 +806,7 @@ def test_multi_system_integration_workflow(self):
             "create_agent_identity",
             display_name="External-API-Agent",
             source_protocol="api_key",
-            identity_token="sk-enterprise-abc123-partner",
+            identity_token="sk-FAKE-fixture-enterprise-partner",  # synthetic test fixture, not a real key
             capabilities="partner_api,data_exchange",
             description="Partner integration agent",
             issuer_name="PartnerCo",

tests/unit/test_identity.py

@@ -31,14 +31,15 @@ def test_creates_with_all_fields(self, identity_service):
         assert result["issuer"]["name"] == "TestIssuer"
 
     def test_masks_identity_token(self, identity_service):
+        # Obviously-synthetic fixture: avoids gitleaks generic-api-key false positive.
         result = identity_service.create_identity(
             display_name="TokenBot",
             source_protocol="api_key",
-            identity_token="sk-very-secret-api-key-1234567890",
+            identity_token="sk-FAKE-fixture-do-not-use-7890",
         )
         token = result["identity_token"]
-        assert "very-secret" not in token
-        assert token.startswith("sk-v")
+        assert "fixture-do-not-use" not in token
+        assert token.startswith("sk-F")
         assert token.endswith("7890")