C4 Support bundle
- Area
- C — Trust & correctness
- Audience
- operator
- Kind
- feature
- Status
- accepted
- Maturity
- built
- Labels
- verification, security
The feature in the specification · Read at
Requirements
A support bundle MUST be produced by a single command into a single local file.
Redaction MUST use an allow-list; any field not explicitly allowed MUST be redacted.
Redacted values MUST be replaced by a stable placeholder derived from the value, so identical secrets are identifiable as identical.
- locked by
- 0.7.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/bundle.rscrates/lemonfiber-core/src/lib.rs
- cited by
- lemonfiber@71f8bd3109
The bundle MUST be scanned for residual credentials before writing.
If verification finds a residual credential, the bundle MUST NOT be written, and the source MUST be named.
- locked by
- 0.7.0 met
- recorded done
- lemonfibercrates/lemonfiber-adapters/src/filesystem.rscrates/lemonfiber-adapters/src/http.rscrates/lemonfiber-core/src/bundle/allowed.rscrates/lemonfiber-core/src/bundle/prose.rs
- cited by
- lemonfiber@8027d73edblemonfiber@0d1ac4ec57lemonfiber@e203245c61lemonfiber@71f8bd3109
The bundle MUST NOT be transmitted anywhere automatically.
Bundle contents MUST be listable and readable by the operator before sharing.
Revealing a redacted field MUST require explicit per-field consent and MUST be marked in the bundle.
- locked by
- 0.7.0 met
- recorded done
- lemonfibercrates/lemonfiber-api/src/actions/asked.rs
- cited by
- lemonfiber@b00845f85dlemonfiber@0d1ac4ec57
Log inclusion MUST be bounded to a stated recent window.
Bundle size MUST be reported before writing.
The bundle MUST be producible when diagnostics cannot fully run, noting what is missing.
The bundle MUST record lemonfiber version, stack version and creation time.
- locked by
- 0.7.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/app.rscrates/lemonfiber-core/src/bundle.rs
- cited by
- lemonfiber@f2c1d6cb36
Media filename redaction MUST be offered.
Insufficient disk space MUST be detected before collection begins.
A bundle MUST record which plugins are installed, with origin, version and whether each was reviewed. It MUST NOT collect a plugin's own configuration, and MUST say that it was withheld and why, naming the plugin.
- locked by
- 0.18.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/bundle/plugins.rscrates/lemonfiber-core/src/bundle/run.rscrates/lemonfiber-core/src/bundle/plugins/tests.rs::each_plugin_is_named_with_its_version_origin_and_review_and_its_configuration_withheldcrates/lemonfiber-core/src/bundle/plugins/tests.rs::a_plugins_settings_are_left_out_of_the_configuration_and_the_stacks_keptcrates/lemonfiber-core/tests/integration/bundle.rs::a_bundle_names_each_installed_plugin_and_withholds_its_own_configurationcrates/lemonfiber-core/tests/integration/bundle.rs::a_bundle_whose_plugin_record_will_not_read_says_so
- cited by
- lemonfiber@e2005b9828
The diagnosis a bundle holds MUST give each finding's code beside the finding, wherever the finding carries one.