🛡️ Sentinel: Hardened SSH security in build workflow

.Jules/sentinel.md

@@ -0,0 +1,4 @@
+## 2025-05-15 - Insecure SSH credentials in build workflow
+**Vulnerability:** The `kiba.yml` workflow was using `sshpass -p "$SF_PASS"` and `StrictHostKeyChecking=no`.
+**Learning:** Hardcoding passwords in command lines, even via variables, can expose them in process lists. Disabling host key verification invites MITM attacks.
+**Prevention:** Use `sshpass -e` with the `SSHPASS` environment variable and use `ssh-keyscan` to populate `known_hosts` instead of disabling verification.

.github/workflows/kiba.yml

@@ -35,18 +35,19 @@ jobs:
         if: github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main'
         env:
           SF_USER: ${{ secrets.SF_USER }}
-          SF_PASS: ${{ secrets.SF_PASS }}
+          SSHPASS: ${{ secrets.SF_PASS }}
         run: |
-          if [ -z "$SF_USER" ] || [ -z "$SF_PASS" ]; then
+          if [ -z "$SF_USER" ] || [ -z "$SSHPASS" ]; then
             echo "SourceForge credentials not configured. Skipping upload."
             exit 0
           fi
           sudo apt-get update && sudo apt-get install -y sshpass rsync
+          mkdir -p ~/.ssh
+          ssh-keyscan -H frs.sourceforge.net >> ~/.ssh/known_hosts
           for iso_file in *.iso; do
             [ -f "$iso_file" ] || continue
             echo "Uploading $iso_file to SourceForge..."
-            sshpass -p "$SF_PASS" rsync -avP \
-              -e "ssh -o StrictHostKeyChecking=no" \
+            sshpass -e rsync -avP \
               "$iso_file" \
               "$SF_USER@frs.sourceforge.net:/home/frs/project/kibaos/"
           done

WORKFLOWS.md

@@ -1,5 +1,5 @@
 # GitHub Workflows Manual
-Generated on Tue May 26 02:15:18 UTC 2026
+Generated on Tue May 26 06:47:56 UTC 2026
 
 | Workflow Name | File Path |
 |---------------|-----------|