CsoKit security hardening v7 - #3
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f5644a729c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| <Version>$(CsoKitVersion)</Version> | ||
| <PackageVersion>$(CsoKitVersion)</PackageVersion> | ||
| <InformationalVersion>$(CsoKitVersion)</InformationalVersion> |
There was a problem hiding this comment.
The version fields now exist only in Directory.Build.props, but Assert-ProjectVersion in both scripts/Run-FinalReleaseGate.ps1 and scripts/Run-OfficialReleaseGate.ps1 still reads Version, PackageVersion, and InformationalVersion directly from each .csproj. Since the renamed project files contain none of those elements, every final or official release-gate invocation fails its version checks before any build starts; inspect the centralized properties or query evaluated MSBuild properties instead.
Useful? React with 👍 / 👎.
| NativeCsoRuntimeInfo info = NativeCsoRuntime.GetInfo(); | ||
| Assert.True(info.IsAvailable, info.FailureReason ?? "Native backend was not available."); |
There was a problem hiding this comment.
In the inspected scripts/Run-ReleaseGate.ps1 flow, Build-Native.ps1 leaves the DLL under artifacts/native-build, then dotnet test runs without copying it into tests/CsoKit.Tests/bin/<configuration>/net10.0. Because the hardened resolver searches only AppContext.BaseDirectory unless development search is explicitly enabled, this new mandatory assertion fails whenever the consolidated/final release gate runs; stage the DLL as CI and Verify-Hardening.ps1 already do.
Useful? React with 👍 / 👎.
| version->major = CSOKIT_VERSION_MAJOR; | ||
| version->minor = CSOKIT_VERSION_MINOR; | ||
| version->patch = CSOKIT_VERSION_PATCH; |
There was a problem hiding this comment.
The inspected Assert-NativeVersion in scripts/Run-OfficialReleaseGate.ps1 requires literal assignments matching version->major = <number>; (and minor/patch), but these changed lines now assign CSOKIT_VERSION_* macros generated by CMake. Consequently the official release gate always reports a native version mismatch even when VERSION and the generated header agree; validate the CMake/generated values rather than searching this source for numeric literals.
Useful? React with 👍 / 👎.
1 participant
Summary
Verification