Repository navigation
Fix governed Cargo compilation and diagnostics for 0.31.3 - #14
Merged
Merged
Conversation
Port the governed replacement compilation correction from PR #9 to current main. Respect compiler-generated test and standard-macro lint scopes without allowing written source suppressions; retain source deny/forbid as compiler errors. Real Cargo regression tests, source-attribute rejection and the scoped source check pass. This is a local tooling milestone, not a versioned or published release; semantic Rust coverage and native acceptance remain open.
Trivy 0.74.0 is built with Go 1.26.6, which lacks the GO-2026-6809 public-key denylist. The source image's bundle trusts emSign ECC Root CA - G3, which cross-signed the issuer of the compromised eMudhra TLS CAs. Ship that bundle without the three roots Mozilla removed on 2026-10-20, keeping every other certificate byte-identical. CVE-2026-111943 stays unassessed because undisclosed cross-certificates remain possible without Go's denylist. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Run pinned cargo check with clippy-driver as RUSTC_WRAPPER so path replacements outside the workspace receive Clippy, while Cargo's lint cap keeps registry and Git dependencies silent. Restore --force-warn so source and macro-emitted allow/expect attributes cannot hide governed lints, and document compiler-generated test-harness and pin! diagnostics as unresolved. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Forced lint levels bypass rustc's external-macro suppression, so std::pin::pin! of an async block reported library-internal unreachable code at the user's call site. Omit a warning only when every span is macro-expanded text outside the repository; macro input, local macro bodies, repository causes and errors remain findings. Record why the binary test-harness dead-code diagnostics remain unresolved. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The official Trivy 0.74.0 image is built with Go 1.26.6, whose certificate verifier accepts the compromised eMudhra intermediates (GO-2026-6809) during the scanner's database download. The policy-tool installers now build the same official module, pinned by its checksum-database sum, with the pinned Go 1.26.10 and the official build settings, and verify the result's module and toolchain identity. Releases carry the host architecture's Linux binary and its license, and release installation refuses a mismatched version. The scanner runtime copies the carried binary through a named build context instead of pulling the Trivy image, and refuses a Docker platform the release does not carry. Scanner policy moves to version 3 and reports to version 2 without the source-image field. The standard-library OpenVEX statements no longer match any finding and are removed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Release manifest version 9 records the carried Trivy version, and version 8 manifests remain readable with their exact smaller tool inventory. The release SBOM lists Trivy with every Go module its build information names and refuses a carried binary without build information or a module without a license notice. The tool installers copy each linked module's license, copying, notice, and patent files from the checksum-verified module cache. Record the scanner's Go advisories below the HIGH gate against their exact preconditions and the three enabled Trivy operations, including the HTTP/2 configurers, the containerd daemon-only path, and the March 2026 Trivy release compromise. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Root-only notice copying omitted licenses of forked code compiled inside modules, such as klauspost/compress's xxhash, OPA's AWS provider, and Kubernetes' forked Go and govalidator sources. Both installers now copy every license, copying, notice, and patent file in each linked module with its relative path, reading build information once and failing on missing, malformed, or empty evidence. The release SBOM records nested notices and still requires a root license per module. Release installation and the Windows release build now require the carried binary's exact Go 1.26.10 jsonv2 toolchain, Trivy module, version, and checksum, and its module notices, instead of the module version alone. Name the linked OpenTelemetry SDK and gRPC exporter importers in the GO-2026-6505 assessment. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Prefix-only names missed compiled modules' notices such as gocsaf's LICENSES directory and 3rdpartylicenses.md, sergi/go-diff's APACHE-LICENSE-2.0, and shibumi/go-pathspec's GO-LICENSE. The copiers now take every file under a LICENSES directory and every name containing license, licence, copying, notice, or patents, except source, configuration, and test-data formats, which also cannot satisfy a module's root license. The copiers record code-polishy-trivy-notices-v2 only after a complete copy. The installer's reuse check, release installation, the Windows release build, and the release SBOM refuse a missing or earlier layout, so carriers copied under earlier rules are rebuilt rather than reused. Carrier identity now also requires CGO_ENABLED=0, the expected GOARCH, GOOS=linux, and -trimpath=true, so a same-module build for another platform is refused. The install contract exercises the copier's naming forms and failures and the stale-layout and wrong-architecture refusals. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
When the policy-owned store lacked a package index, pnpm licenses list returned an error document and the flattener failed with "packages is not iterable", hiding the cause. Fail with pnpm's error code and message, and reject any license entry that is not a package list. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Record the verified cold arm64 scanner reproduction and the exact release scope. Formatting and installer admission passed. Native release CI and publication remain pending; no tag or consumer lock is changed.
The release gate found the new permanent guide missing from docs/catalog.json. Register the topic without changing the document contract. The focused documentation suite and formatting pass.
Preserve main changes, reconcile changelog and assessment conflicts, and adapt scanner ownership diagnostics and their boundary fixture to the carried runtime. Artifact-security, release-unit and release-preflight checks pass; formatting passes. Native CI owns the final gate and remains pending.
Keep main 0.31.1 scanner, provenance, assessments and release tooling unchanged. Retain consumer-bound Cargo compilation and forced-lint diagnostics, plus pnpm license error reporting. Rust facts and release preflight checks pass; quality and refreshed JavaScript checks are pending. Native CI owns the final gate.
A real Git dependency fixture reproduced a forced unreachable-code warning wholly inside Cargo home. Classify that cache as external under both repository root spellings, retain caller spans and all errors, and document local path dependency lint scope. The Rust facts suite fails on the old filter and passes with the correction; final verification remains CI-owned.
JeffMusgrave
changed the title
…ve-rust-acceptance
Preserve main 0.31.2 implementation and release notes. Resolve the changelog conflict by recording the Cargo corrections as 0.31.3. Focused release-preflight and formatting pass; native CI owns the final gate.
JeffMusgrave
changed the title
Trace both exact lockfile occurrences to generated string-path configuration and disabled plugins. Retain visible high-severity findings under expiring not-affected assessments through November 11, without dependency or threshold changes. Formatting and doctor pass; native CI owns the final gate.
Retain main a6e3993 security configuration and evidence verbatim, removing duplicate Zod assessments and preserving its November 6 review deadline. Keep the Cargo corrections and 0.31.3 release notes. Formatting and configuration validation pass; native CI owns the final gate.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Governed Cargo replacement packages now compile through their consumer, so their libraries receive Clippy and compiler diagnostics under the consumer's reviewed lock and enabled configuration. Forced lint collection remains active; warnings entirely inside external macro bodies, including downloaded Cargo-cache sources, are omitted while project-code warnings and all compiler errors remain visible. JavaScript license checks now report pnpm's original error when listing fails.
This prepares 0.31.3 on main's 0.31.2 security-verification changes and 0.31.1 scanner security fix. Scanner, runtime, installer, provenance, CI configuration, dependency versions and security assessments remain identical to main. Main's latest assessment refresh is merged without duplicate records: it removes the withdrawn braces advisory and records Zod non-exposure in both generated Knip configurations, with review due November 6.
Validation:
Replacement development targets are outside the consumer build. Binary test-harness dead-code false positives, complete Rust macro/semantic coverage, WGSL coverage and Cloud Devbox native UI acceptance remain unresolved. Publication and verified consumer adoption follow passing native CI.