Skip to content

fix: refresh scanner worker trust dependencies #4012

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
joshavant merged 1 commit into from
Oct 21, 2026
Merged

fix: refresh scanner worker trust dependencies #4012

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions scripts/security/aig-worker-requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,8 @@ annotated-types==0.8.0 \
--hash=sha256:f072f4d804ea359e4eaf198b1af7a8b0943881a87f31bb764f8bf219bb9419e0
anyio==4.15.0 \
--hash=sha256:7ecd9937369ffce8bba0b5ccb9b3a9507b101b0ed50256aecfbab27e6c2acb99
certifi==2026.7.22 \
--hash=sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775
certifi==2026.10.19 \
--hash=sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b
chardet==5.2.0 \
--hash=sha256:e1cf59446890a00105fe7b7912492ea04b6e6f06d4b742b2c788469e34c82970
distro==1.9.0 \
Expand Down
2 changes: 1 addition & 1 deletion scripts/security/install-clawscan-scanners.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ git -C "$source_dir" checkout --quiet --detach FETCH_HEAD
git -C "$source_dir" apply --check "$runtime_dir/patches/$scanner-responses.patch"
git -C "$source_dir" apply "$runtime_dir/patches/$scanner-responses.patch"
# Pin the existing maintained resolver; SkillSpector ships an upstream uv.lock.
python -m pip install "uv==0.12.5"
python -m pip install "uv==0.13.4"
if [ "$scanner" = skillspector ]; then
uv sync --locked --no-dev --project "$source_dir"
venv="$source_dir/.venv"
Expand Down
2 changes: 1 addition & 1 deletion scripts/security/install-clawscan.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ git -C "$source_dir" remote add origin https://github.com/openclaw/clawscan.git
git -C "$source_dir" fetch --quiet --depth 1 origin "$source_commit"
git -C "$source_dir" checkout --quiet --detach FETCH_HEAD
[ "$(git -C "$source_dir" rev-parse HEAD)" = "$source_commit" ]
export GOTOOLCHAIN=go1.27.2
export GOTOOLCHAIN=go1.27.3
bin_dir="$RUNNER_TEMP/clawscan-bin"
mkdir -p "$bin_dir"
(cd "$source_dir" && go build -trimpath -o "$bin_dir/clawscan" ./cmd/clawscan)
Expand Down
4 changes: 2 additions & 2 deletions specs/security-consumer-model-policy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ Sol function/tool calls require Responses rather than Chat Completions.
`clawscan-source-commit.txt` pins merged ClawScan commit
`5be7f8e97fa474f0aa9eb443f38d9e3d5f51226b` (upstream PR #68). The
workflow installer fetches that exact commit, verifies HEAD, builds its Go CLI
with Go 1.27.2, and retains the matching source tree for host scanner installation.
with Go 1.27.3, and retains the matching source tree for host scanner installation.
No mutable `main`, `latest`, or unapproved public ClawScan release is consumed.

Codex 0.160 normalizes its explicit `service_tier="default"` configuration by
Expand All @@ -64,7 +64,7 @@ real-adapter tests as that ClawScan revision's runtime image:
- The source pins are read from the reviewed ClawScan Dockerfile and checked as
full commit IDs, so host/image implementations cannot silently drift. Patch
applicability and the real installed adapter tests are mandatory install gates.
- The maintained resolver is pinned to uv 0.12.5. Pytest 9.0.2 is test-only. Source
- The maintained resolver is pinned to uv 0.13.4. Pytest 9.0.2 is test-only. Source
revisions and runtime dependencies are pinned; Python isolated-build backend
dependencies are not claimed to be fully hash-reproducible. The AIG hash lock
additionally admits the published macOS arm64 CPython 3.12 wheels for `jiter`
Expand Down
Loading