Conversation
…anch-health job (#1878) After 5.9.6, `main` and `develop` were each red only because of the other (#1877): `develop`'s push run failed only on `branch health (main)`, `main`'s only on `branch health (develop)`, and a re-run of either reads the other's red. `check-branch-conclusion.sh` decided on the other run's overall `conclusion`, which includes that run's own branch-health job. On `failure` it now fetches the run's jobs and drops those named `branch health …`: - nothing left: the branch's own work passed, exit 0, naming the branch-health jobs that were red; - anything left: stay red, and the error now names the failed jobs; - jobs unreadable: stay red. `cancelled`, `skipped` and anything else keep their verdict. **Tests:** every case reaching `failure` gets a planted jobs answer. New cases: red only on branch health passes; branch health plus a real failure fails and names the real job; empty jobs answer fails; cancelled still fails; three failed jobs list as `a, b, c` (`paste -sd ', '` alternates its separators and printed `a,b c`). **Sabotage:** no branch-health filter, filter everything, empty-answer-as-pass, and the `paste` join each fail their case. **Known gap:** the test stub always exits 0, so the branch where the jobs call itself fails is reached in tests only through an empty answer. Both end red. **When this takes effect:** `develop` gets it on merge; `main` only through the next release PR. Until then `main` stays red on `branch health (develop)` alone. Closes #1877 Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com>
`sensitive_bind_mount` flagged `/etc/shadow`, `/proc` and the runtime sockets, but not `/:/host`, which exposes all of them at once (#1880). `/` was in neither list, and the normaliser stripped it to an empty string the check then skipped. - The root is an **exact** entry: it fires on `/` and never on a path under it. `/home`, `/srv`, `/tmp` stay silent as before. - The normaliser folds `/`, `//`, `/.`, `/./` to `/`, and collapses duplicate leading slashes elsewhere, so `//etc` now reaches the `/etc` entry it used to slip past. - `$HOME` is **not** added: the audit runs on whatever machine invokes it, whose home is not the deploy host's, so the verdict would change with who runs the gate. | mount | before (5.9.6) | after | |---|---|---| | `/:/host:ro` | 0 | 1 | | `//:/h`, `/.:/h` | 0 | 1 | | `//etc:/e` | 0 | 1 | | `/tmp:/t`, `/home:/h` | 0 | 0 | **Sabotage** (`--no-fail-fast`): no root entry, 5 tests fail; root as a prefix, the 8 that require paths under it to stay silent fail. Closes #1880 Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com>
The `_FILE` exemption shipped in 5.9.6 looked at the key alone, so `POSTGRES_PASSWORD_FILE: hunter2-real-password` passed clean while the same value under `POSTGRES_PASSWORD` was flagged (#1879). The exemption rests on the value being a path, so it now requires one: the value must start with `/`, `./` or `../`. Anything else under a `_FILE` key is flagged like any other secret-bearing key. Where the path points is still not checked. The value judged is the one interpolation resolves to. | `POSTGRES_PASSWORD_FILE` | flagged | |---|---| | `/run/secrets/pg`, `./secrets/pg` | no | | `hunter2-real-password`, `a/b` | yes | | `${VAR}` set to a path | no | | `${VAR}` set to a non-path, or unset | yes | Measured on the built binary; the `${VAR}` rows are pinned by a new test in `tests/audit_exit_codes.rs`. **Sabotage** (`--no-fail-fast`): exempting every `_FILE` key again, 4 fail; accepting any value with a slash, the 2 that pin `a/b` fail. Closes #1879 Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com>
) Adds `port_published_on_wildcard`, **off by default**, enabled with `podup audit --wildcard-binds` (#1881). It fires on host IP `0.0.0.0` or `::` in the short and long forms, and never on a specific address. `--strict` is unchanged, so a CI running `audit --strict` today sees no new finding on upgrade. | port | default | `--wildcard-binds` | |---|---|---| | `5432:5432` | `…all_interfaces` | `…all_interfaces` | | `0.0.0.0:5432:5432`, `[::]:5432:5432`, `host_ip: "::"` | — | `…on_wildcard` | | `127.0.0.1`, `192.168.1.10`, `[::1]` | — | — | Measured on the built binary. **Registry and `--list-checks`.** The registry can mark a check opt-in. JSON gains an `opt_in` field (`null` elsewhere). The table keeps `id<TAB>description` for every always-on row, the shape 5.9.6 printed, and the opt-in row appends `<TAB>opt-in: --wildcard-binds`. The first version of this branch inserted a middle column in every row, which would have broken any reader using `cut -f2`; a test now requires the two-column shape. `--wildcard-binds --list-checks` is refused at parse time, like `--strict`. The registry drift tests run with every opt-in enabled, so an opt-in check whose id drifts is still caught. **Sabotage** (`--no-fail-fast`): middle column back, 2 fail; check runs without the flag, 3 fail; flag accepted with `--list-checks`, the refusal test fails. Note: `internal/main.rs` goes from 485 to 495 code lines, under the 500 hard limit but close. Closes #1881 Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com>
Bumps the three version stamps together, as `release.yml` requires: `Cargo.toml`, `Cargo.lock` and a new `debian/changelog` entry covering the four commits since 5.9.6. Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release 5.9.7: the four commits on
developsince 5.9.6, described in thedebian/changelogentry added in #1885.auditflags a bind mount of the host root (fix(audit): flag a bind mount of the host root #1882)._FILEexemption insecret_in_environmentneeds a path-shaped value (fix(audit): exempt a _FILE key only when its value is a path #1883).audit --wildcard-binds: opt-in check for ports bound to0.0.0.0or::(feat(audit): opt-in check for ports bound to an explicit wildcard #1884).It also carries #1878 to
main: branch health judges the other branch on its own jobs, which takesmainout of the red it has held since 5.9.5.