Repository navigation
sshole: fixes from the independent review of the Sensei port - #7
Merged
Merged
Conversation
- Base images are read only when a stage installs an OpenSSH server, at most 32 per scan, and only their first layer (OpenBaseLayer), under a time and size limit; a glibc os-release stops the read early. - A base lookup that may succeed later is reported (Result.Transient, an incomplete target) instead of becoming a not-checked note, and the error text stays out of the finding's message so titles do not churn. - New files: every path is checked before anything is written, .git is refused, identical content already in place is success, and writes go through a temporary file linked into place, so parallel fixes of sibling defconfigs in one external tree no longer race. - Find follows a finding whose line moved instead of calling it fixed. - A pull request's Yocto change is judged with the tree's other Yocto files (TCLIBC, bbappends). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… themselves Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…line, is not checked, never not Alpine Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes from the independent adversarial review of the Sensei port (DefectDojo-Inc/defectdojo-scan-and-fix#338), which copies this detector's
internal/packages.image.OpenBaseLayer) under a 90 s and 512 MiB limit; a glibcos-releasestops the read early. Before, every unidentifiedFROMwas read to the end (node:22was 389 MB).Result.Transient(the repo target is marked incomplete) instead of turning an error into a not-checked note, and the error text no longer goes into the message, so titles and fingerprints stay stable..gitis refused; identical content already in place is success; writes go through a temporary file linked into place. Parallel fixes of several defconfigs in one Buildroot external tree no longer fail or leave partial changes.repo.Findfollows a finding whose line moved instead of reporting it fixed.Tests: new cases for each;
go test -race ./..., fuzzing, andparity/sshole.py(10/10) pass.🤖 Generated with Claude Code