From bc6d5cc05bbf1a545890cb220e4cef6b797caef7 Mon Sep 17 00:00:00 2001
From: Michael Heller <21163552+mdheller@users.noreply.github.com>
Date: Wed, 29 Jul 2026 03:14:37 -0400
Subject: [PATCH 1/2] =?UTF-8?q?feat(rs-mirror):=20zero-trust=20review=20?=
 =?UTF-8?q?=E2=80=94=20we=20do=20not=20relay=20Mozilla=20blind?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Michael: 'zero trust dude we don't trust mozilla, we review the upstream and
harden where possible too.' He is right and my earlier framing was still too
trusting: a valid signature proves only that MOZILLA SIGNED IT, not that the
content is benign. A compelled or compromised upstream ships signed records.

review.mjs reads what we are about to serve and FAILS CLOSED on: a collection
with no signature, a URL in signed content the collection has no business
carrying, active-content markers (javascript:/<script/eval(), a new or vanished
collection, or a >25% swing in record count — the shape a poisoned security list
would take. A SHA256 baseline makes silent drift in already-vouched-for data
visible on the next run.

Made it collection-aware after the first pass produced noise — blunt rules get
ignored, which is worse than no rule. ct-logs IS a list of log endpoints,
intermediates embeds CPS URIs in certificate data, plugins/addons rows carry a
user-facing 'why was this blocked' link. Those are inventoried; everywhere else a
URL is a finding. (Same false-positive trap as calling plugins=5 a leak earlier —
verify what upstream legitimately contains before alarming.)

REAL findings from the first review of Mozilla PROD data:
  - Mozilla ships PLACEHOLDER urls in production CT data:
    https://ct.example.com/bogus/ and .../bogus/ipng/
  - plugin-blocklist rows carry CLEARTEXT http:// advisory links (oracle,
    adobe, microsoft, divx, mozilla blog)
Neither is fetched in normal operation, but we now SEE them instead of assuming,
and the baseline diff surfaces the next change automatically.
---
 scripts/rs-mirror/README.md  |  31 +++++++
 scripts/rs-mirror/review.mjs | 159 +++++++++++++++++++++++++++++++++++
 2 files changed, 190 insertions(+)
 create mode 100644 scripts/rs-mirror/review.mjs

diff --git a/scripts/rs-mirror/README.md b/scripts/rs-mirror/README.md
index fcd2f23..a4a665e 100644
--- a/scripts/rs-mirror/README.md
+++ b/scripts/rs-mirror/README.md
@@ -46,3 +46,34 @@ turns a safe relay into a real attack surface. A failing signature must FAIL.
 Re-run on a schedule (CRLite updates several times a day). The output is static
 files — any HTTPS host works; no application server. Verify signature
 validation against the mirror **before** repointing `services.settings.server`.
+
+## Zero trust: we review what we relay
+
+A valid signature proves only that **Mozilla signed it** — not that the content
+is benign. A compelled, compromised or simply careless upstream ships *signed*
+records. So the mirror does not relay blind:
+
+    node scripts/rs-mirror/review.mjs --dir ./mirror \
+      --baseline prev.json --write-baseline next.json
+
+It fails closed (non-zero exit) on: a collection with **no signature**, a URL in
+signed content that the collection has no business carrying, active-content
+markers (`javascript:`, `<script`, `eval(`), a **new or vanished** collection, or
+a **>25% swing in record count** — the shape a poisoned security list would take.
+
+Collection-aware, because blunt rules produce noise that gets ignored:
+`ct-logs` *is* a list of log endpoints, `intermediates` embeds CPS URIs inside
+certificate data, and `plugins`/`addons` blocklist rows carry a user-facing
+"why was this blocked" link. Those are inventoried, not failed on. Everywhere
+else, a URL in signed content is a finding.
+
+### Findings from the first real review (2026-07-29)
+Not blockers, but they are exactly why we look:
+- Mozilla ships **placeholder URLs in production CT data**:
+  `https://ct.example.com/bogus/` and `.../bogus/ipng/`.
+- Plugin-blocklist rows still carry **cleartext `http://`** advisory links
+  (oracle.com, adobe, microsoft, divx, mozilla blog).
+
+Neither is fetched by the browser in normal operation, but both are upstream
+hygiene problems we now *see* rather than assume away — and the baseline diff
+means the next change to them will surface automatically.
diff --git a/scripts/rs-mirror/review.mjs b/scripts/rs-mirror/review.mjs
new file mode 100644
index 0000000..4e1206f
--- /dev/null
+++ b/scripts/rs-mirror/review.mjs
@@ -0,0 +1,159 @@
+#!/usr/bin/env node
+/**
+ * Zero-trust review of a mirrored RemoteSettings tree.
+ *
+ * The content signature proves only that MOZILLA SIGNED IT. It does not prove
+ * the content is benign — a signed record is exactly what a compelled,
+ * compromised or simply bad-policy upstream would ship. So we do not relay
+ * blind: we read what we are about to serve.
+ *
+ *   node scripts/rs-mirror/review.mjs --dir ./mirror [--baseline prev.json]
+ *
+ * Exits non-zero if anything needs a human. Fail closed: an unreviewed change
+ * does not reach users.
+ */
+import fs from "node:fs/promises";
+import path from "node:path";
+import crypto from "node:crypto";
+
+const args = process.argv.slice(2);
+const argOf = (n, d) => { const i = args.indexOf(n); return i >= 0 ? args[i + 1] : d; };
+const DIR = path.resolve(argOf("--dir", "./mirror"));
+const BASELINE = argOf("--baseline", "");
+const WRITE = argOf("--write-baseline", "");
+
+// Hosts a security/anti-tracking record may legitimately reference. Anything
+// else in mirrored content is a finding, signed or not.
+const URL_ALLOW = [
+  /^https:\/\/firefox-settings-attachments\.cdn\.mozilla\.net\//,
+  /^https:\/\/content-signature-2\.cdn\.mozilla\.net\//,
+  // our own repointed signing chain — we put it there
+  /\/chains\/[^/]+\.chain$/,
+  // JSON-schema and documentation references carried in metadata. These are
+  // descriptive, never fetched by the client. Verified by reading the records:
+  // they appear in `schema`/`filter_expression` help text, not in any field the
+  // browser dereferences.
+  /^https:\/\/remote-settings\.readthedocs\.io\//,
+  /^https:\/\/developer\.mozilla\.org\/[^ ]*Match_patterns/,
+];
+const URL_RE = /(https?|wss?):\/\/[^\s"'\\)]+/g;
+
+const findings = [];   // fail closed
+const notes = [];      // worth a human glance, not a blocker
+const inventory = {};  // urls in collections that legitimately carry them
+const summary = {};
+
+async function walk(d) {
+  const out = [];
+  for (const e of await fs.readdir(d, { withFileTypes: true })) {
+    const p = path.join(d, e.name);
+    if (e.isDirectory()) out.push(...await walk(p));
+    else out.push(p);
+  }
+  return out;
+}
+
+const files = await walk(DIR);
+const changesets = files.filter(f => f.endsWith("changeset.json"));
+
+for (const f of changesets) {
+  const rel = path.relative(DIR, f);
+  const raw = await fs.readFile(f, "utf8");
+  const cs = JSON.parse(raw);
+  const name = rel.replace(/^buckets\//, "").replace(/\/changeset\.json$/, "");
+
+  // 1. Integrity anchor: hash exactly what we will serve.
+  const sha = crypto.createHash("sha256").update(raw).digest("hex");
+
+  // 2. A collection with no signature must never be served.
+  const sig = cs.metadata?.signature;
+  if (!sig?.signature && !rel.includes("monitor/")) {
+    findings.push(`${name}: NO SIGNATURE — refusing to vouch for this`);
+  }
+
+  // 3. Read the content. Any URL we did not expect is a finding, signed or not.
+  //    Collection-aware: some collections legitimately CONTAIN urls —
+  //      ct-logs      IS a list of Certificate Transparency log endpoints
+  //      intermediates embeds CPS/repository URIs inside certificate data
+  //    For those, URLs are inventoried for human eyes rather than failed on;
+  //    everywhere else a URL in signed content is a real finding.
+  //   ct-logs        IS a list of Certificate Transparency log endpoints
+  //   intermediates  embeds CPS/repository URIs inside certificate data
+  //   plugins/addons blocklist entries carry a user-facing "why was this
+  //                  blocked" link (bugzilla / vendor advisory)
+  const URL_EXPECTED = /(ct-logs|intermediates|plugins|addons-bloomfilters)$/;
+  const urls = new Set();
+  for (const m of raw.matchAll(URL_RE)) {
+    const u = m[0];
+    if (!URL_ALLOW.some(re => re.test(u))) urls.add(u);
+  }
+  if (URL_EXPECTED.test(name)) {
+    inventory[name] = [...urls].sort();
+    // Even here, non-HTTPS or obvious placeholders deserve a shout.
+    for (const u of urls) {
+      if (u.startsWith("http://")) {
+        notes.push(`${name}: cleartext URL in signed content -> ${u.slice(0, 90)}`);
+      }
+      if (/example\.(com|org)|bogus|test\./i.test(u)) {
+        notes.push(`${name}: PLACEHOLDER url shipped by upstream -> ${u.slice(0, 90)}`);
+      }
+    }
+  } else {
+    for (const u of urls) {
+      findings.push(`${name}: UNEXPECTED URL in signed content -> ${u.slice(0, 110)}`);
+    }
+  }
+
+  // 4. Records that can execute or redirect are never expected in these
+  //    collections; call them out explicitly.
+  for (const bad of ["javascript:", "data:text/html", "<script", "eval("]) {
+    if (raw.includes(bad)) findings.push(`${name}: ACTIVE CONTENT marker '${bad}'`);
+  }
+
+  summary[name] = { sha256: sha, records: (cs.changes || []).length, bytes: raw.length };
+}
+
+// 5. Diff against the last reviewed state — a silent change to data we already
+//    vouched for is the thing we most want to see.
+if (BASELINE) {
+  try {
+    const prev = JSON.parse(await fs.readFile(BASELINE, "utf8"));
+    for (const [name, cur] of Object.entries(summary)) {
+      const old = prev[name];
+      if (!old) { findings.push(`${name}: NEW collection since last review`); continue; }
+      if (old.sha256 !== cur.sha256) {
+        const d = cur.records - old.records;
+        console.log(`  changed: ${name}  records ${old.records} -> ${cur.records} (${d >= 0 ? "+" : ""}${d})`);
+        // A large swing in a security list deserves eyes before it ships.
+        if (old.records && Math.abs(d) / old.records > 0.25) {
+          findings.push(`${name}: RECORD COUNT MOVED ${((d / old.records) * 100).toFixed(0)}% — review before serving`);
+        }
+      }
+    }
+    for (const name of Object.keys(prev)) {
+      if (!summary[name]) findings.push(`${name}: DISAPPEARED upstream`);
+    }
+  } catch (e) { console.log(`  (no usable baseline: ${e.message})`); }
+}
+
+console.log(`\nreviewed ${changesets.length} collections in ${DIR}`);
+for (const [n, s] of Object.entries(summary)) {
+  console.log(`  ${n.padEnd(46)} ${String(s.records).padStart(5)} rec  ${s.sha256.slice(0, 12)}`);
+}
+if (WRITE) {
+  await fs.writeFile(WRITE, JSON.stringify(summary, null, 1));
+  console.log(`\nbaseline written: ${WRITE}`);
+}
+for (const [n, us] of Object.entries(inventory)) {
+  console.log(`  inventory ${n}: ${us.length} url(s) (expected for this collection)`);
+}
+if (notes.length) {
+  console.log(`\n⚠️  ${notes.length} note(s) — not blocking, but look:`);
+  notes.forEach(n => console.log("   " + n));
+}
+if (findings.length) {
+  console.log(`\n🔴 ${findings.length} FINDING(S) — do not serve until reviewed:`);
+  findings.forEach(f => console.log("   " + f));
+  process.exit(1);
+}
+console.log("\n✅ clean: signed, no unexpected URLs, no active content, no silent drift.");

From 70106b27306496331aaaa5449059b0b5117d1f71 Mon Sep 17 00:00:00 2001
From: Michael Heller <21163552+mdheller@users.noreply.github.com>
Date: Wed, 29 Jul 2026 09:14:22 -0400
Subject: [PATCH 2/2] =?UTF-8?q?fix(bearblocker):=20stage=20lists=20from=20?=
 =?UTF-8?q?settings/filter-lists=20=E2=80=94=20#105=20pointed=20at=20the?=
 =?UTF-8?q?=20wrong=20dir?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The package gate earned itself on its first real run. It failed the ubuntu
nightly with:
  🔴 bearblocker-ads.txt MISSING — the ad/tracker blocker will load NOTHING
  PACKAGE VERIFICATION FAILED — do not ship this build.

My #105 'fix' for the dead ad-blocker DID NOT WORK. I pointed stage-bearnet.sh
at settings/bearblocker/, which holds only the actor .mjs files. The filter
lists live in settings/filter-lists/ — which patches.py has always known
(_lists_src = Path('../settings/filter-lists')). I misread a two-command AGENTS.md
BRANCH_TRIAGE.tsv
Brewfile
LICENSE
README.md
SECURITY.md
TRUST_SURFACE.yaml
agent-sidecar
agentplane
automation
branding
build
capture-sidecar
ci
credential-broker
deploy
docs
examples
flake.nix
gecko-patches
install.sh
iot-sidecar
lib
manifests
mounts
mozconfig
native
node_modules
package-lock.json
package.json
packaging
patches
policy
profiles
prophet-workspace
runtime
schemas
scripts
settings
when writing #105 and never verified the staging actually produced files.

So the browser would have shipped its headline ad/tracker blocker with ZERO
rules for a SECOND time, and the only reason it didn't is the gate.

Fixed and TESTED this time, not assumed:
  stage-bearnet: bearblocker lists → (2 files)
  bearblocker-ads.txt: 229 rules
  bearblocker-privacy.txt: 254 rules
  gate: 🔴 MISSING -> ✅ staged (229 rules) / ✅ staged (254 rules)

Fourth time today that executing instead of parse-checking found the real defect.
That is the lesson of this session, and this commit is the proof it was worth
building the gate.
---
 scripts/stage-bearnet.sh | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/scripts/stage-bearnet.sh b/scripts/stage-bearnet.sh
index 4b303ad..7777c38 100755
--- a/scripts/stage-bearnet.sh
+++ b/scripts/stage-bearnet.sh
@@ -38,10 +38,13 @@ echo "stage-bearnet: pages → $bs ($(ls "$bs" | wc -l | tr -d ' ') files)"
 #     so the C++ ContentClassifierService was loading resource:///bearblocker/…
 #     and 404ing — shipping the ad/tracker blocker with NO lists. Stage them here
 #     for the resource://bearblocker/ substitution the autoconfig registers.
+#     SOURCE IS settings/filter-lists/ — NOT settings/bearblocker/ (that holds
+#     only the actor .mjs files). I got this wrong in #105 and the lists went on
+#     shipping empty; the package gate is what caught it.
 bb="$GRE/browser/bearblocker"
 mkdir -p "$bb"
 for f in bearblocker-ads.txt bearblocker-privacy.txt; do
-  [ -f "$REPO/settings/bearblocker/$f" ] && cp "$REPO/settings/bearblocker/$f" "$bb/"
+  [ -f "$REPO/settings/filter-lists/$f" ] && cp "$REPO/settings/filter-lists/$f" "$bb/"
 done
 echo "stage-bearnet: bearblocker lists → $bb ($(ls "$bb" | wc -l | tr -d ' ') files)"