Red team binary vault jakub - #4
Merged
Merged
Conversation
Les flags/licence ne sont plus codés en dur dans gen_secret.py (dépôt public).
Ils proviennent désormais, par priorité : variables d'env / build-args, puis
un fichier setup/challenge.env gitignoré, sinon des placeholders inoffensifs.
- gen_secret.py : résolution env > challenge.env > placeholder (+ warning)
- challenge.env.example : modèle à copier en challenge.env (gitignoré)
- Dockerfile : ARG LICENSE/FLAG1/FLAG2/XOR_KEY passés à gen_secret.py
- docker-compose.yml : build.args depuis l'environnement
- ADMIN_DEPLOYMENT.md : provisionnement des flags + rappel de rotation
- .gitignore : ignore challenge.env
Aligné avec docs/commit-plan.md ("ne pas committer les flags"). Chaîne
compile+exploit revérifiée avec des flags fournis par challenge.env.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- README : table des challenges corrigée (VAULT-9 ajouté, numérotation par équipe, statuts réels) au lieu de l'ancienne liste obsolète. - .env.example : modèle de variables (CTFd, plugin conteneurs) sans secrets, mentionné dans docs/commit-plan.md mais absent jusqu'ici. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR updates the VAULT-9 (Red Team) challenge to avoid storing sensitive values (license/flags) in the repository by generating them at Docker build time from environment/build args or a gitignored challenge.env, and documents the new workflow.
Changes:
- Replace hardcoded license/flags in
gen_secret.pywith resolution from env vars /setup/challenge.env/ safe placeholders. - Wire Docker build + compose to pass optional build args for secrets and add an example
challenge.env.example. - Update documentation and top-level README to reflect the new challenge inventory and secret-provisioning steps.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| README.md | Updates the challenges list to include the Binary Vault challenge and folder naming scheme. |
| challenges/3-Red-Team-Binary-Vault/setup/gen_secret.py | Loads license/flags from env or challenge.env, falling back to placeholders and generating build artifacts. |
| challenges/3-Red-Team-Binary-Vault/setup/challenge.env.example | Adds a template file for providing per-challenge secrets outside git. |
| challenges/3-Red-Team-Binary-Vault/docs/ADMIN_DEPLOYMENT.md | Documents how to provide/rotate secrets for builds without committing them. |
| challenges/3-Red-Team-Binary-Vault/Dockerfile | Adds ARGs and runs secret generation from setup/ during image build. |
| challenges/3-Red-Team-Binary-Vault/docker-compose.yml | Adds build args wiring from the shell environment for local builds. |
| challenges/3-Red-Team-Binary-Vault/.gitignore | Attempts to ignore the secrets file and build artifacts for this challenge. |
| .env.example | Adds a repository-level environment template and notes per-challenge secret handling. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+1
to
+3
| # Secrets reels du challenge -- ne JAMAIS committer (voir challenge.env.example) | ||
| challenge.env | ||
|
|
| build: | ||
| context: . | ||
| # Optionnel : surcharge les secrets via l'environnement du shell. | ||
| # Sinon, gen_secret.py lit setup/challenge.env (voir .env.example). |
|
|
||
| # --- Plugin conteneurs (CTFdDockerContainersPlugin) --- | ||
| # Hote Docker expose aux instances de challenges | ||
| DOCKER_HOSTNAME=100.118.132.76 |
Jacob-dot-bit
added a commit
that referenced
this pull request
Jul 20, 2026
Red team binary vault jakub
Jacob-dot-bit
added a commit
that referenced
this pull request
Jul 20, 2026
Red team binary vault jakub
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.