Phase 3 — Targets & registries - #5

…8xmikc

fix(security): resolve Phase 3 review findings #2 (git auth off-argv) and #5 (admin-only credential lists)

Phase 3 — Targets & registries

Finding #2 — generic-host git credential no longer rides in the process
argv. Trivy clones with go-git, which ignores GIT_ASKPASS/.netrc/credential
helpers, so generic (non-GitHub/GitLab) private repos previously embedded
username:token in the clone URL passed to `trivy repo` — visible via
/proc/<pid>/cmdline. Generic HTTPS hosts are now cloned into tmpfs with the
system `git` binary via a transient GIT_ASKPASS helper (mode 0700; echoes the
credential from the clone subprocess's own environment, never argv, never the
parent env, never the script file, never persisted), the requested ref is
checked out, and Trivy then scans the local checkout. The helper and checkout
are shredded/removed in a finally block on success, failure, or cancellation.
`git` is added to the runtime image. GitHub/GitLab keep Trivy's native
GITHUB_TOKEN/GITLAB_TOKEN env path (already off-argv).

Finding #5 — registry and git-credential list endpoints (full metadata) are
now admin-only; operators previously had read access to host/username/provider.
Two new operator endpoints (GET /registries/options, GET /git-credentials/
options) return only {id, name} for scan-launch selection, exposing no
credential metadata. The New Scan page uses these option endpoints.

Implements docs/reviews/phase3-finding2-resolution.md (Option 1). See
docs/PLAN.md §14 for both dated deviation entries and the two spec adaptations
(askpass 0700 not 0600 since git execs it; async run_command on the existing
tmpfs seam instead of sync subprocess).

…8xmikc

fix(security): resolve Phase 3 review findings #2 (git auth off-argv) and #5 (admin-only credential lists)

Phase 3 — Targets & registries

Finding #2 — generic-host git credential no longer rides in the process
argv. Trivy clones with go-git, which ignores GIT_ASKPASS/.netrc/credential
helpers, so generic (non-GitHub/GitLab) private repos previously embedded
username:token in the clone URL passed to `trivy repo` — visible via
/proc/<pid>/cmdline. Generic HTTPS hosts are now cloned into tmpfs with the
system `git` binary via a transient GIT_ASKPASS helper (mode 0700; echoes the
credential from the clone subprocess's own environment, never argv, never the
parent env, never the script file, never persisted), the requested ref is
checked out, and Trivy then scans the local checkout. The helper and checkout
are shredded/removed in a finally block on success, failure, or cancellation.
`git` is added to the runtime image. GitHub/GitLab keep Trivy's native
GITHUB_TOKEN/GITLAB_TOKEN env path (already off-argv).

Finding #5 — registry and git-credential list endpoints (full metadata) are
now admin-only; operators previously had read access to host/username/provider.
Two new operator endpoints (GET /registries/options, GET /git-credentials/
options) return only {id, name} for scan-launch selection, exposing no
credential metadata. The New Scan page uses these option endpoints.

Implements docs/reviews/phase3-finding2-resolution.md (Option 1). See
docs/PLAN.md §14 for both dated deviation entries and the two spec adaptations
(askpass 0700 not 0600 since git execs it; async run_command on the existing
tmpfs seam instead of sync subprocess).

…8xmikc

fix(security): resolve Phase 3 review findings #2 (git auth off-argv) and #5 (admin-only credential lists)

Phase 3 — Targets & registries

Finding #2 — generic-host git credential no longer rides in the process
argv. Trivy clones with go-git, which ignores GIT_ASKPASS/.netrc/credential
helpers, so generic (non-GitHub/GitLab) private repos previously embedded
username:token in the clone URL passed to `trivy repo` — visible via
/proc/<pid>/cmdline. Generic HTTPS hosts are now cloned into tmpfs with the
system `git` binary via a transient GIT_ASKPASS helper (mode 0700; echoes the
credential from the clone subprocess's own environment, never argv, never the
parent env, never the script file, never persisted), the requested ref is
checked out, and Trivy then scans the local checkout. The helper and checkout
are shredded/removed in a finally block on success, failure, or cancellation.
`git` is added to the runtime image. GitHub/GitLab keep Trivy's native
GITHUB_TOKEN/GITLAB_TOKEN env path (already off-argv).

Finding #5 — registry and git-credential list endpoints (full metadata) are
now admin-only; operators previously had read access to host/username/provider.
Two new operator endpoints (GET /registries/options, GET /git-credentials/
options) return only {id, name} for scan-launch selection, exposing no
credential metadata. The New Scan page uses these option endpoints.

Implements docs/reviews/phase3-finding2-resolution.md (Option 1). See
docs/PLAN.md §14 for both dated deviation entries and the two spec adaptations
(askpass 0700 not 0600 since git execs it; async run_command on the existing
tmpfs seam instead of sync subprocess).

…8xmikc

fix(security): resolve Phase 3 review findings #2 (git auth off-argv) and #5 (admin-only credential lists)