admin/felhom-controller
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

R-1303: every pin names its security-notice source (upstream.txt, # upstream: above each FROM); gate upstream + decoys. No runtime change.
gates / gates (push) Successful in 55s
Details

Browse Source
This commit is contained in:
authentik Default Admin
2026-10-26 23:23:36 +01:00
parent 37f7e40b18
commit e01eb64b25
6 changed files with 80 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
controller/scripts/test_gate_decoys.py
+54
View File
@@ -55,6 +55,10 @@ COVERS = {
"second secret on another line of an accepted file still listed; a called govulncheck "
"finding listed, an imported-only one not; no tool is NOT CHECKED out loud), run from here; "
"plus the gate on THIS repo: exit 0 and its summary line (warn-first)"),
"upstream": ("R-1303: a scratch controller tree - a NEW *Image const with no upstream.txt line, the line "
"only in a COMMENT, a Dockerfile `# upstream:` comment one line too high (not directly above "
"its FROM), a new FROM with none; controls: a FROM of an earlier STAGE needs no line, and the "
"real repo passes"),
"offbox-rename": "R-425: NAS branding in a NEW backups*.html, and in a bundle value an offbox Go file "
"names; control: the same token in the network-storage feature's copy is accepted",
"docker-v": "R-426: an unallowlisted `-v /etc:/x` in a NEW .go file two directories down "
@@ -533,6 +537,56 @@ def security_cases():
security_cases()
def upstream_cases():
"""R-1303: the shared upstream rule (felhom.eu scripts/security_watch_inventory.py --gate=controller) on a SCRATCH
controller tree, then on this repo."""
global ran
inv = os.path.join(SHARED, "security_watch_inventory.py")
if not os.path.isfile(inv):
fails.append("shared %s is MISSING beside this clone - a failure, never a skip" % inv)
return
GO = 'package infra\nconst (\n\tTraefikImage = "traefik:v3.7.13"\n\tFooImage = "foo/foo:1.0"\n)\n'
TABLE = "# header\nTraefikImage github:traefik/traefik\nFooImage github:foo/foo\n"
DOCKER = ("# upstream: osv:Go/stdlib\nFROM golang:1.27.3 AS builder\nRUN go build\n"
"# upstream: gap:Debian fixes are DSAs the watch does not read\nFROM debian:13.7-slim\n"
"COPY --from=builder /x /x\nFROM builder AS again\n")
ws = tempfile.mkdtemp(prefix="ctrl-upstream-")
try:
def run(name, go, table, docker, expect, must):
global ran
root = os.path.join(ws, "repo")
shutil.rmtree(root, ignore_errors=True)
os.makedirs(os.path.join(root, "controller", "internal", "infra"))
for rel, body in (("controller/internal/infra/infra.go", go), ("controller/internal/infra/upstream.txt", table),
("controller/Dockerfile", docker)):
io.open(os.path.join(root, rel), "w", encoding="utf-8").write(body)
ran += 1
rc, out = _run([sys.executable, inv, "--gate=controller", root], REPO)
if rc != expect or must not in out:
fails.append("upstream: %s: rc=%d (want %d), %r missing\n%s" % (name, rc, expect, must, out[-500:]))
else:
print(" ok upstream: %s" % name)
run("GENUINE: every const and FROM named (a stage FROM needs none)", GO, TABLE, DOCKER, 0, "upstream gate OK")
run("FACT: a new *Image const with no table line", GO.replace(")", '\tBarImage = "bar/bar:2.0"\n)'), TABLE, DOCKER,
1, "BarImage")
run("FACT: the table line only in a COMMENT", GO, TABLE.replace("FooImage ", "# FooImage "), DOCKER, 1, "FooImage")
run("FACT: the upstream comment one line too high", GO, TABLE,
DOCKER.replace("# upstream: osv:Go/stdlib\nFROM golang", "# upstream: osv:Go/stdlib\n# builder\nFROM golang"),
1, "golang:1.27.3")
run("FACT: a new FROM with no upstream comment", GO, TABLE, DOCKER + "FROM alpine:3.24.2\n", 1, "alpine:3.24.2")
ran += 1
rc, out = _run([sys.executable, inv, "--gate=controller", REPO], REPO)
if rc != 0 or "upstream gate OK" not in out:
fails.append("upstream: GENUINE: this repo: rc=%d\n%s" % (rc, out[-500:]))
else:
print(" ok upstream: GENUINE: this repo")
finally:
shutil.rmtree(ws, ignore_errors=True)
upstream_cases()
print()
if fails:
for f in fails: