SNAPSHOT

emudhra-scan HEAD f28a25d, working-tree diff sha256 dfb3697578f4, untracked internal/detect/gofunc.go sha256 8ec0d4a1a142
php2shell-scan commit ebc53f1 (git archive, no working-tree changes): source/ and image/ copied into internal/, and every package except cmd/ and validation/ copied verbatim into detectors/php2shell/internal/ on 2026-10-21. Its uncommitted per-layer image refactor is not in this copy.
Engine-only changes since the copy (port these back to emudhra-scan and php2shell-scan):
- internal/archive: PyInstaller zlib entries cap the untrusted ulen hint at clen*1032+1024, and read() copies a short single chunk so a lying hint cannot keep a large allocation alive
- internal/source: readOne opens with O_NOFOLLOW|O_NONBLOCK and checks the opened file is the same regular file the walk saw
- internal/engine: a detector panic on one file is contained and reported as not scanned; the testdata/ exemption from the coverage-gap count applies only to real files on a filesystem scan, never image paths, archive members or detector crashes (emudhra-scan exempts testdata/ everywhere)
- detectors/php2shell/internal/report/report_test.go: gofmt whitespace only
- internal/refs/shell.go and yaml.go (refs moved from detectors/php2shell/internal/refs to internal/refs on 2026-10-27, unchanged, so the brotli detector can read image references too): Dockerfile and Compose variable expansion capped at 8 KiB (a chain of doubling ARGs exhausted memory and time); regression tests expansion_bomb_test.go and dotenv_bomb_test.go
- detectors/emudhra/internal/detect/detect_test.go: TestManyBeginsNoEndIsFast checks linear growth instead of a 2 s limit (flaked under -race on slow CI; same fix as defectdojo-scan-and-fix #279)
- internal/netguard (moved from detectors/php2shell/internal/netguard on 2026-11-05, unchanged, so the sshole detector reads base images through the same guarded transport)