ounce100m-code / probes /p1_credential_path.py

add p1 credential-path probe (read-only) + param_count

dc56217 verified about 1 month ago

4.58 kB

# Phase 1 CPU probe -- can a Kaggle session act as its own credential store?
#
# Why this matters (D-002): §2 permits the HF token to come "from the environment or a secret store",
# and forbids it reaching a public artifact -- including job logs and any code mirrored to the Hub.
# The obvious fallback (paste the token into the kernel source) puts it in a Kaggle-held revision and
# in anything that later mirrors the kernel, so it is the last option, not the first.
#
# Kaggle already injects KAGGLE_API_V1_TOKEN / KAGGLE_DATA_PROXY_TOKEN / KAGGLE_USER_SECRETS_TOKEN into
# internet-enabled sessions (observed in probe p0_cpu_probe). If the Kaggle API is usable *inside* a
# job, a **private** Kaggle dataset can hold the HF token and be mounted as a data source, which is a
# genuine secret store: the token then never appears in kernel source, logs, or the public code repo.
#
# This probe is READ-ONLY. It lists and reports; it creates nothing and writes no secret. Zero GPU quota.
# No credentials in this file.

import json
import os
import subprocess
import sys
import time

R = {}


def run(cmd, timeout=180):
    try:
        p = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)
        return {"rc": p.returncode, "out": p.stdout[:1500], "err": p.stderr[:900]}
    except Exception as e:
        return {"error": f"{type(e).__name__}: {e}"[:200]}


def present_and_nonempty(name):
    v = os.environ.get(name)
    return {"present": v is not None, "length": len(v) if v else 0}


# Never print a token value -- report only that it exists and how long it is.
R["injected_tokens"] = {n: present_and_nonempty(n) for n in [
    "KAGGLE_API_V1_TOKEN", "KAGGLE_DATA_PROXY_TOKEN", "KAGGLE_USER_SECRETS_TOKEN",
    "KAGGLE_DATA_PROXY_URL", "KAGGLE_GRPC_DATA_PROXY_URL", "KAGGLE_KERNEL_INTEGRATIONS",
    "HF_TOKEN", "HUGGING_FACE_HUB_TOKEN"]}

R["whoami_env"] = run("env | sed 's/=.*/=<redacted>/' | sort | head -60", 60)

# 1. Is the Kaggle API reachable from inside the container at all?
R["kaggle_cli_preinstalled"] = run("python -m pip show kaggle 2>/dev/null | head -3", 60)
t = time.monotonic()
R["kaggle_cli_install"] = run(
    "python -m pip install --quiet --disable-pip-version-check --no-input kaggle 2>&1 | tail -5", 300)
R["kaggle_cli_install"]["seconds"] = round(time.monotonic() - t, 1)

# Does it authenticate off the injected credentials, with no ~/.kaggle/kaggle.json written?
# Redacted through sed on purpose: any credential-shaped run of characters is scrubbed before it can
# reach stdout, because stdout here becomes a retained kernel log.
REDACT = " | sed -E 's/[A-Za-z0-9_-]{16,}/<redacted>/g'"
R["kaggle_auth_status"] = run(f"kaggle --version {REDACT}", 60)
R["kaggle_whoami"] = run(f"kaggle config view 2>&1 {REDACT}", 60)

# A read that requires a real authenticated principal. If these return rows, the in-job API works.
R["kaggle_datasets_list"] = run("kaggle datasets list -v --page-size 5 2>&1", 180)
R["kaggle_kernels_mine"] = run("kaggle kernels list --mine --page-size 5 2>&1", 180)

# 2. The user-secrets harness, if Kaggle exposes it here, is the cleaner store of the two.
R["secrets_dir"] = run("ls -la /kaggle/input/ 2>&1 | head -20", 60)
R["secrets_harness"] = {
    "exists": os.path.exists("/kaggle/input/.secrets/harness_util.py"),
    "listing": run("ls -la /kaggle/input/.secrets/ 2>&1 | head", 60)}

# 3. Can a job write to the Hub anonymously at all? (It should not be able to.)
def hub_write_probe():
    import urllib.request
    import urllib.error

    url = "https://huggingface.co/api/models/Cion-lab/ounce100m-code/commit/main"
    req = urllib.request.Request(url, data=b"{}", method="POST",
                                 headers={"Content-Type": "application/json"})
    try:
        with urllib.request.urlopen(req, timeout=30) as r:
            return {"unexpectedly_ok": True, "status": r.status}
    except urllib.error.HTTPError as e:
        return {"expected_denied": True, "status": e.code, "reason": e.reason}
    except Exception as e:
        return {"error": f"{type(e).__name__}: {e}"[:200]}


R["anonymous_hub_write"] = hub_write_probe()

# 4. Does the image already carry an HF credential path we could populate without a token in source?
R["hf_cache_state"] = {
    "HF_HOME": os.environ.get("HF_HOME"),
    "token_file_exists": os.path.exists(os.path.expanduser("~/.cache/huggingface/token")),
    "listing": run("ls -la /root/.cache/huggingface/ 2>&1 | head", 60)}

print("PROBE_JSON_BEGIN")
print(json.dumps(R, indent=1, default=str))
print("PROBE_JSON_END")

	# Phase 1 CPU probe -- can a Kaggle session act as its own credential store?
	#
	# Why this matters (D-002): §2 permits the HF token to come "from the environment or a secret store",
	# and forbids it reaching a public artifact -- including job logs and any code mirrored to the Hub.
	# The obvious fallback (paste the token into the kernel source) puts it in a Kaggle-held revision and
	# in anything that later mirrors the kernel, so it is the last option, not the first.
	#
	# Kaggle already injects KAGGLE_API_V1_TOKEN / KAGGLE_DATA_PROXY_TOKEN / KAGGLE_USER_SECRETS_TOKEN into
	# internet-enabled sessions (observed in probe p0_cpu_probe). If the Kaggle API is usable inside a
	# job, a private Kaggle dataset can hold the HF token and be mounted as a data source, which is a
	# genuine secret store: the token then never appears in kernel source, logs, or the public code repo.
	#
	# This probe is READ-ONLY. It lists and reports; it creates nothing and writes no secret. Zero GPU quota.
	# No credentials in this file.

	import json
	import os
	import subprocess
	import sys
	import time

	R = {}


	def run(cmd, timeout=180):
	try:
	p = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)
	return {"rc": p.returncode, "out": p.stdout[:1500], "err": p.stderr[:900]}
	except Exception as e:
	return {"error": f"{type(e).__name__}: {e}"[:200]}


	def present_and_nonempty(name):
	v = os.environ.get(name)
	return {"present": v is not None, "length": len(v) if v else 0}


	# Never print a token value -- report only that it exists and how long it is.
	R["injected_tokens"] = {n: present_and_nonempty(n) for n in [
	"KAGGLE_API_V1_TOKEN", "KAGGLE_DATA_PROXY_TOKEN", "KAGGLE_USER_SECRETS_TOKEN",
	"KAGGLE_DATA_PROXY_URL", "KAGGLE_GRPC_DATA_PROXY_URL", "KAGGLE_KERNEL_INTEGRATIONS",
	"HF_TOKEN", "HUGGING_FACE_HUB_TOKEN"]}

	R["whoami_env"] = run("env \| sed 's/=.*/=<redacted>/' \| sort \| head -60", 60)

	# 1. Is the Kaggle API reachable from inside the container at all?
	R["kaggle_cli_preinstalled"] = run("python -m pip show kaggle 2>/dev/null \| head -3", 60)
	t = time.monotonic()
	R["kaggle_cli_install"] = run(
	"python -m pip install --quiet --disable-pip-version-check --no-input kaggle 2>&1 \| tail -5", 300)
	R["kaggle_cli_install"]["seconds"] = round(time.monotonic() - t, 1)

	# Does it authenticate off the injected credentials, with no ~/.kaggle/kaggle.json written?
	# Redacted through sed on purpose: any credential-shaped run of characters is scrubbed before it can
	# reach stdout, because stdout here becomes a retained kernel log.
	REDACT = " \| sed -E 's/[A-Za-z0-9_-]{16,}/<redacted>/g'"
	R["kaggle_auth_status"] = run(f"kaggle --version {REDACT}", 60)
	R["kaggle_whoami"] = run(f"kaggle config view 2>&1 {REDACT}", 60)

	# A read that requires a real authenticated principal. If these return rows, the in-job API works.
	R["kaggle_datasets_list"] = run("kaggle datasets list -v --page-size 5 2>&1", 180)
	R["kaggle_kernels_mine"] = run("kaggle kernels list --mine --page-size 5 2>&1", 180)

	# 2. The user-secrets harness, if Kaggle exposes it here, is the cleaner store of the two.
	R["secrets_dir"] = run("ls -la /kaggle/input/ 2>&1 \| head -20", 60)
	R["secrets_harness"] = {
	"exists": os.path.exists("/kaggle/input/.secrets/harness_util.py"),
	"listing": run("ls -la /kaggle/input/.secrets/ 2>&1 \| head", 60)}

	# 3. Can a job write to the Hub anonymously at all? (It should not be able to.)
	def hub_write_probe():
	import urllib.request
	import urllib.error

	url = "https://huggingface.co/api/models/Cion-lab/ounce100m-code/commit/main"
	req = urllib.request.Request(url, data=b"{}", method="POST",
	headers={"Content-Type": "application/json"})
	try:
	with urllib.request.urlopen(req, timeout=30) as r:
	return {"unexpectedly_ok": True, "status": r.status}
	except urllib.error.HTTPError as e:
	return {"expected_denied": True, "status": e.code, "reason": e.reason}
	except Exception as e:
	return {"error": f"{type(e).__name__}: {e}"[:200]}


	R["anonymous_hub_write"] = hub_write_probe()

	# 4. Does the image already carry an HF credential path we could populate without a token in source?
	R["hf_cache_state"] = {
	"HF_HOME": os.environ.get("HF_HOME"),
	"token_file_exists": os.path.exists(os.path.expanduser("~/.cache/huggingface/token")),
	"listing": run("ls -la /root/.cache/huggingface/ 2>&1 \| head", 60)}

	print("PROBE_JSON_BEGIN")
	print(json.dumps(R, indent=1, default=str))
	print("PROBE_JSON_END")