Repository navigation
fix(registry): restore the runner bytes the execution manifests pin - #6
Merged
Merged
Conversation
The gosec change rewrote runner.go and store.go of the P1-SRC-03 acquisition runner and contract.go, plan.go, runner.go and store.go of the v3 runner. Both runners are implementation_frozen, and their embedded execution-manifest.json files pin the sha256 and size of these files, so the change broke the execution binding that verify_execution_manifest.py and TestExecutionManifestBindsExactRepositoryBytes check. The test did not show it because it stopped earlier on registry schemas that this repository does not hold. Both module directories are back to the bytes before the gosec change, together with the helper and test files that belonged to the rewrite. Every repository file the two manifests pin matches its digest again (7 of 7 in each). Their gosec findings (33 and 35) are handled by dated per-file exceptions, as for the P1-SRC-02 runner, until the runners are frozen again with fixes. Signed-off-by: lusoris <lusoris@proton.me>
5 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The gosec change in #5 rewrote files that two frozen runners pin by digest. This puts both runners back to their pinned bytes.
What broke
tools/knowledge-registry/p1-src03-acquisition-runner:runner.goandstore.gochanged.tools/knowledge-registry/source-acquisition-runner-v3:contract.go,plan.go,runner.goandstore.gochanged.implementation_frozen, and their embeddedexecution-manifest.jsonpins the sha256 and size of these files.verify_execution_manifest.pyandTestExecutionManifestBindsExactRepositoryBytescheck that binding.Change
Verification
go test -count=1 ./...: the v3 runner passes; the P1-SRC-03 runner fails on the same 3 tests as before fix: handle the gosec findings without a baseline #5 (2 read registry data that this repository does not hold, 1 reads the canonical JSON vectors).go buildpasses for both modules.