Repository navigation
The staged secret scan refuses a token with the git shim on PATH: the shim stops warning on gitleaks's diff argv, and a gitleaks that logged an error is no longer a pass - #413
Merged
Conversation
…e_json 1.0.154 serde_json 1.0.154 (#404) depends on foldhash 0.2.0, licensed Zlib, which the allow list did not name. CI does not run cargo-deny, so main stayed green while the pre-push `uphold supply-chain` refused every push from it. Zlib is permissive and OSI approved, with no copyleft and no attribution required in the binary. Claude-Session: https://claude.ai/code/session_01HM96sKSAyDhLk9smu82u5V
… shim stops warning on gitleaks's diff argv, and a gitleaks that logged an error is no longer a pass Two defects met in `uphold supply-chain --staged` on any host where `git` is the uphold shim. The shim called `git diff -U0 --no-ext-diff --staged .` unclear and wrote that to stderr. Both readings of the unknown options find `diff`; only the noun moved, and no `match` entry names `diff` with any noun, so the noun could not decide anything. `reading` now answers `Absent` there. A verb an entry does pair with a noun keeps the doubt. gitleaks 8.30.1 treats any git stderr as a failed diff: it logs `ERR error="stderr is not empty"`, scans nothing, and exits 0. uphold read the 0 as a pass. An `ERR` line under exit 0 is now could-not-look, exit 2, naming the line, so a warning from any git on PATH no longer blinds the scan in silence. The CLI test stages a token with uphold linked in front of git and a gitleaks stub that reads the index through the real argv and answers as gitleaks does; it fails with either fix reverted. Checked live against gitleaks 8.30.1 as well: 1.35.0 passes the staged token, this refuses it. Closes #410. Claude-Session: https://claude.ai/code/session_01HM96sKSAyDhLk9smu82u5V
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 58 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #413 +/- ##
=======================================
Coverage 94.84% 94.85%
=======================================
Files 52 52
Lines 27217 27259 +42
=======================================
+ Hits 25815 25857 +42
Misses 1402 1402 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Carries #412's commit underneath, because the pre-push cargo-deny refuses any push from main without it. Rebase onto main once #412 lands.
Two defects met in
uphold supply-chain --stagedon any host wheregitis the uphold shim.
The shim called
git diff -U0 --no-ext-diff --staged .unclear and wrotethat to stderr. Both readings of the unknown options find
diff; only thenoun moved, and no
matchentry namesdiffwith any noun, so the nouncould not decide anything.
readingnow answersAbsentthere. A verb anentry does pair with a noun keeps the doubt.
gitleaks 8.30.1 treats any git stderr as a failed diff: it logs
ERR error="stderr is not empty", scans nothing, and exits 0. uphold readthe 0 as a pass. An
ERRline under exit 0 is now could-not-look, exit 2,naming the line, so a warning from any git on PATH no longer blinds the
scan in silence.
The CLI test stages a token with uphold linked in front of git and a
gitleaks stub that reads the index through the real argv and answers as
gitleaks does; it fails with either fix reverted. Checked live against
gitleaks 8.30.1 as well: 1.35.0 passes the staged token, this refuses it.
Closes #410.
https://claude.ai/code/session_01HM96sKSAyDhLk9smu82u5V