fix(security-insights): make the insights file parseable and unset the image exec bit - #331
mesutoezdil wants to merge 1 commit into
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: mesutoezdil The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review. 📝 WalkthroughWalkthroughThe security insights configuration updates its schema metadata and review dates. It also replaces structured vulnerability scope fields with a security-policy URL and a prose comment. ChangesSecurity insights configuration
Priority: ⬇️ Low Estimated code review effort: 1 (Trivial) | ~5 minutes Change: Bug fix Merge Risk: ⚪ Minimal · up to The configuration parses successfully and the permission-only image change does not alter behavior; this PR is mergeable. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. A rabbit checks the policy page Comment |
…e image exec bit The OpenSSF Security Insights reader (ossf/si-tooling, used by LFX Insights through ossf/pvtr-github-repo-scanner) rejected the whole file, so every Baseline check that reads it fell back to a failure or a manual review, including OSPS-QA-04.01 "Insights does not contain a list of repositories" even though the repositories are listed. Two problems, both from targeting the unreleased 2.2.0 spec: in-scope and out-of-scope are declared as string lists in the spec but the generated Go type annotates them as a single URL, so a list fails to unmarshal and aborts the load. The scope text moves into the neighbouring comment, which carries the same information. policy only exists on the spec's unreleased main branch. 2.1.0 is the latest tag, so the file now declares 2.1.0 and uses security-policy, which the reader maps onto the same field. The file now passes both cue vet against the 2.1.0 schema and si.Load. docs/images/sample_nvidia-smi.png was committed as 100755. The scanner flags a binary blob carrying an execute bit as a generated executable artifact, which is why that PNG tripped OSPS-QA-05.01 and docs/images/hami-core-arch.png, the same format at 100644, did not. Content is unchanged. Signed-off-by: mesutoezdil <mesudozdil@gmail.com>
47aa194 to
b6d2102
Compare
1 participant
security-insights.ymltargeted the unreleased 2.2.0 spec, wherein-scopeandout-of-scopeare declared as string lists but generated as a single*URL, sosi.Loadrejected the whole file and every Baseline check reading it degraded, including OSPS-QA-04.01 reporting no repository list when both are present; it now declares 2.1.0, usessecurity-policyin place ofpolicy, folds the scope text into the neighbouring comment, and passes bothcue vetagainst the v2.1.0 schema andsi.Load.docs/images/sample_nvidia-smi.pngwas committed as mode 100755 and the scanner treats a binary blob carrying an execute bit as a generated executable artifact, which is why it tripped OSPS-QA-05.01 whiledocs/images/hami-core-arch.pngat 100644 did not, so the mode is now 100644 with the content byte-identical.