[Supply chain] Remove tracked opaque Zipkin binary and unpinned Replit bootstrap execution

[seonghobae]

Buyer / acquisition risk

Protected develop@622e5e6c3d534f230c390f10e3832efadfc01825 contains a tracked root zipkin.jar (blob 393f714acd372e42b838df917fa8bdb3399e3839; current Trivy logs report the file at roughly 82 MB) even though .gitignore excludes *.jar. The protected .replit then executes that checked-in binary from multiple workflows and also contains an unpinned remote bootstrap command:

curl -sSL https://zipkin.io/quickstart.sh | bash -s && java -jar zipkin.jar

Other .replit paths run java -jar zipkin.jar directly, including one ad-hoc --server.port=9412 invocation. The same file exposes both 9411 and 9412, so it also carries a second, inconsistent observability topology beside the repository's supported Docker Compose stack.

Status: active_pr via Draft PR #169. Nothing in #169 is implemented_on_develop until protected integration.

Active remediation — PR #169

PR #169 (fix/supply-chain: retire unsafe Replit Zipkin bootstrap) is the active bounded implementation from exact protected base develop@622e5e6c3d534f230c390f10e3832efadfc01825; its live source head is 71c3ea4813075905b796b59f73ee0cf46cf8513d at this dated evidence point.

The branch has already established fail-first repository-runtime tests and removed from .replit:

• every java -jar zipkin.jar execution path;
• the mutable curl ... | bash Zipkin bootstrap;
• obsolete Replit-only Zipkin workflows and 9411/9412 port publication;
• overlapping top-level Replit service-topology delegation that would otherwise launch the same microservice topology more than once in parallel.

The first RED (45d9a5ac09c791ab4ac87ec24e659e86547b0815) produced the intended two hosted runtime-policy failures before the unsafe Zipkin launch paths were removed. A later test-first increment (5333bbb12a21746a480cc89a86ffbdabe4b85064) added the one-topology invariant before current GREEN candidate 71c3ea4813075905b796b59f73ee0cf46cf8513d removed the duplicate top-level service delegations. Current hosted workflows for that final head must still be evaluated by exact run/source identity; queued or in-progress evidence is not passing.

This is intentionally partial closure. The tracked root zipkin.jar is not yet deleted because protected README.md still instructs operators to execute it and README is concurrently owned by active canonical-documentation PR #149. Deleting the artifact while that authoritative documentation lane is moving would knowingly leave a broken documented startup path and race its writer. After #149 stabilizes, #169 or a safe successor must remove the JAR, reconcile supported operability/provenance documentation, and add a checked repository contract preventing opaque executable reintroduction.

RCA

• Immediate cause: a third-party executable server binary is committed in the application source tree and is used as an executable runtime dependency by legacy Replit workflows.
• Technical root cause: observability bootstrapping was vendored as an opaque binary / remote shell convenience path instead of being bound to a reproducible, independently verifiable dependency mechanism.
• Supply-chain cause: curl | bash executes mutable network content without an immutable version or checksum boundary; the committed JAR similarly has no source/version/checksum provenance contract in the repository.
• Control failure: .gitignore prevents new JARs but cannot remove already-tracked artifacts, and there is no machine-checkable policy preventing tracked runtime binaries or unpinned remote-shell bootstraps from reappearing.
• Operability drift: Replit independently modeled Zipkin on both ports 9411 and 9412 while issue [Operability] Restore bundled Zipkin tracing transport to the standard collector port #166 / PR fix(ops): restore bundled Zipkin tracing transport #167 repair the supported Compose collector path. Multiple ungoverned launch surfaces make monitoring behavior difficult to reason about and acquire.
• Additional runtime drift found during remediation: the Replit Project workflow delegated multiple overlapping service-start workflows in parallel. PR fix(supply-chain): retire unsafe Replit Zipkin bootstrap #169 now carries a test-first single-topology invariant and the smallest configuration correction.

Distinct bounded remedies

Preferred — remove the vendored executable and retire the unsafe legacy Replit launch path

Delete tracked zipkin.jar. Remove every .replit command that executes it and every curl ... | bash bootstrap. Keep the supported, testable observability runtime in Docker Compose rather than maintaining an opaque second Zipkin installation mechanism.

If Replit remains a supported developer environment, its replacement must delegate to a reproducible repository-owned command whose external dependency is version/digest/checksum pinned and independently verifiable. Do not invent a digest or checksum without authoritative registry/release evidence.

Alternative — verified release download

A setup path may download an explicit maintained Zipkin release only when the exact upstream artifact URL, version, digest/checksum, and verification procedure are pinned and testable. Network failure or checksum mismatch must fail closed. This has higher lifecycle burden than using the existing Compose profile.

Reject

• retain the checked-in JAR merely because it is already in history;
• run curl | bash from a mutable URL;
• replace the JAR with another unpinned binary or mutable latest URL;
• suppress scanner visibility for the file;
• claim provenance from filename alone;
• add a fake local collector so development commands stay green.

Test-first acceptance

RED must reach the repository packaging/runtime-authority boundary before deletion. Final acceptance requires:

• root zipkin.jar is absent from the candidate tree and cannot be reintroduced by the checked repository contract;
• .replit contains no java -jar zipkin.jar, curl ... | bash, or equivalent unverified remote-shell execution;
• no supported source/script/documentation path requires the removed JAR;
• the supported Zipkin startup path is explicit and agrees with the repaired 9411 container collector contract from [Operability] Restore bundled Zipkin tracing transport to the standard collector port #166/fix(ops): restore bundled Zipkin tracing transport #167 when that change integrates;
• any retained third-party Zipkin image/artifact identity has a separately documented version/digest lifecycle rather than being silently called reproducible;
• secret/token/PII material is not introduced into observability startup or test logs;
• deterministic repository tests prevent tracked runtime JAR/bootstrap regressions and overlapping developer-runtime service launch authorities;
• full reactor, dependency/SBOM/SAST/security, non-vacuous coverage, packaging and review gates remain intact;
• authoritative operability/release/provenance documentation records the supported path and rollback/upgrade boundary once the documentation writer lane is stable.

Sequencing / writer safety

This cleanup is independent of the durable-job stack and direct service authentication. PR #149 documentation is under another active writer and must not be raced. PR #167 owns docker-compose.yml; avoid modifying that file from this slice while #167 remains active. The current #169 implementation remains limited to .replit plus a path-disjoint repository policy test while those writers are active.

Issue #165 remains the broader exact-head release/provenance program. This issue is a concrete source-tree supply-chain defect and should be repaired independently rather than waiting for full release automation.