fix(security): update the central Strix dependency closure - #776
fix(security): update the central Strix dependency closure#776seonghobae wants to merge 3 commits into
Conversation
Add a failing contract for the current vulnerable aiohttp and cryptography pins before updating the reviewed hash-locked central Strix toolchain.
Add a permanent read-only exact-head workflow for the dependency security floor and hash-locked install contract. The current vulnerable base is expected to fail before the closure update.
|
Warning Review limit reached
Next review available in: 33 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
Comment |
Replace the advisory-affected aiohttp and cryptography pins with the reviewed fixed versions, install the complete generated hash lock atomically, and add changelog and APA 7 trust-boundary evidence.
|
@opencode-agent @cwl-noema-review @coderabbitai review Review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== HEAD =='
git rev-parse HEAD
git status --short
echo '== DIFF STAT VS BASE =='
git diff --stat "$(git merge-base HEAD origin/main)" HEAD
echo '== CHANGED FILES VS BASE =='
git diff --name-status "$(git merge-base HEAD origin/main)" HEAD
echo '== CANDIDATE FILES =='
fd -HI -t f . | rg '(requirements-strix-ci|strix.*(security|closure)|central-strix|doctoring|changelog|\.github/workflows)'
echo '== WORKFLOW / TEST / DOCUMENTATION OUTLINES =='
fd -HI -t f . | rg '(strix.*(security|closure)|central-strix|requirements-strix-ci|doctoring)' | while IFS= read -r f; do
echo "--- $f"
sed -n '1,260p' "$f"
done
echo '== LOCKED PACKAGE ENTRIES =='
rg -n -A12 -B2 '^(aiohttp|cryptography|pyOpenSSL)==|aiohttp==|cryptography==|pyOpenSSL==' -g '*requirements*' -g '*.txt' .
echo '== ADVISORY SUPPRESSION / IGNORE CONFIGURATION =='
rg -n -i -C2 '(ignore|suppress|exclude|allowlist|advisory|osv|pip-audit|safety)' \
-g '!**/.git/**' -g '!**/node_modules/**' .
echo '== WORKFLOW PERMISSIONS AND CREDENTIAL REFERENCES =='
rg -n -C3 '^\s*permissions:|^\s*[A-Za-z_-]+:\s*(read|write|none)\s*$|secrets\.|token|credential|NVIDIA|OpenCode|Noema' \
-g '*.yml' -g '*.yaml' .github 2>/dev/null || true
echo '== PR `#763` REFERENCES =='
rg -n -C2 '(`#763`|763|coverage|native.fuzz|native-fuzz)' \
-g '!**/.git/**' -g '!**/node_modules/**' .Length of output: 201885 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="$(git merge-base HEAD origin/main)"
echo "HEAD=$(git rev-parse HEAD)"
echo "BASE=$base"
echo '== CHANGED FILES =='
git diff --name-status "$base" HEAD
echo '== COMPLETE DIFF (REVIEW SCOPE) =='
git diff --no-ext-diff --unified=60 "$base" HEAD -- \
'requirements-strix-ci.txt' \
'requirements-strix-ci-hashes.txt' \
'.github/workflows/*strix*' \
'tests/*strix*' \
'docs/doctoring/central-strix-security-closure.md' \
'CHANGELOG*' \
'changelog*'
echo '== PACKAGE CONSTRAINTS AND LOCK ENTRIES =='
for f in requirements-strix-ci.txt requirements-strix-ci-hashes.txt; do
if [ -f "$f" ]; then
echo "--- $f"
rg -n -A8 -B2 '^(aiohttp|cryptography|pyOpenSSL)==' "$f"
fi
done
echo '== LOCK FORMAT VALIDATION =='
python3 - <<'PY'
from pathlib import Path
import re
p = Path("requirements-strix-ci-hashes.txt")
text = p.read_text(encoding="utf-8")
entries = re.findall(r"(?m)^([A-Za-z0-9_.-]+)==([^\s\\]+)\s*\\\n((?:\s+--hash=sha256:[0-9a-f]{64}\s*\\\n?)+)", text)
print(f"parsed_hashed_entries={len(entries)}")
for name, version, hashes in entries:
if name.lower() in {"aiohttp", "cryptography", "pyopenssl"}:
print(f"{name}=={version} hash_count={hashes.count('--hash=sha256:')}")
print("unhashed_requirement_lines=")
for n, line in enumerate(text.splitlines(), 1):
if re.match(r"^[A-Za-z0-9_.-]+==", line) and not re.search(r"\\\s*$", line):
print(f"{n}:{line}")
PY
echo '== NEW SUPPRESSIONS / IGNORES IN DIFF =='
git diff --no-ext-diff --unified=8 "$base" HEAD | rg -n -i -C2 '^\+.*(ignore|suppress|exclude|allowlist|advisory|osv|pip-audit|safety)' || true
echo '== NEW CREDENTIALS / PERMISSIONS IN DIFF =='
git diff --no-ext-diff --unified=8 "$base" HEAD -- '.github/workflows/**' | \
rg -n -C2 '^\+.*(permissions:|secrets\.|token|credential|contents:\s*write|pull-requests:\s*write|id-token:\s*write)' || true
echo '== PR METADATA AND EXACT-HEAD CHECKS =='
gh pr view 776 --repo ContextualWisdomLab/.github --json number,headRefOid,baseRefName,changedFiles,files,statusCheckRollup \
--jq '{number,headRefOid,baseRefName,changedFiles,files:[.files[].path],checks:[.statusCheckRollup[]|{name,conclusion,status}]}'Length of output: 72103
I found no actionable source finding.
Do not merge yet.
|
Pull request was converted to draft
|
@opencode-agent @cwl-noema-review @coderabbitai Please review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected='08d83dd2c2e4ba3ff577c9c8e53442260b3b0ff9'
actual="$(git rev-parse HEAD)"
base="$(git merge-base HEAD origin/main)"
printf 'expected_head=%s\nactual_head=%s\nbase=%s\n' "$expected" "$actual" "$base"
echo '== changed files vs base =='
git diff --name-status "$base" HEAD
printf 'changed_file_count='
git diff --name-only "$base" HEAD | wc -l
echo '== relevant file outlines =='
for f in \
requirements-strix-ci.txt \
requirements-strix-ci-hashes.txt \
.github/workflows/strix-security-closure.yml \
tests/test_central_strix_security_closure.py \
docs/doctoring/central-strix-security-closure.md \
CHANGELOG.md
do
if [ -f "$f" ]; then
echo "--- $f"
case "$f" in
*.py) ast-grep outline "$f" --items all || true ;;
*) sed -n '1,260p' "$f" ;;
esac
fi
done
echo '== exact diff =='
git diff --no-ext-diff --unified=30 "$base" HEAD
echo '== lock entry validation =='
python3 - <<'PY'
from pathlib import Path
import re, sys
p = Path("requirements-strix-ci-hashes.txt")
text = p.read_text(encoding="utf-8")
names = ("aiohttp", "cryptography", "pyopenssl")
blocks = re.findall(
r'(?ms)^([A-Za-z0-9_.-]+)==([^\s\\]+)\s*\\\n((?:\s+--hash=sha256:[0-9a-f]{64}\s*\\\n?)+)',
text,
)
by_name = {name.lower(): (version, hashes.count("--hash=sha256:")) for name, version, hashes in blocks}
print("hashed_entry_count=", len(blocks))
for name in names:
print(f"{name}=", by_name.get(name))
bad = []
for i, line in enumerate(text.splitlines(), 1):
if re.match(r'^[A-Za-z0-9_.-]+==', line) and not line.rstrip().endswith("\\"):
bad.append(f"{i}:{line}")
print("unhashed_pinned_lines=", bad)
if actual := False:
sys.exit(1)
PY
echo '== suppression and workflow privilege changes =='
git diff --no-ext-diff --unified=8 "$base" HEAD | \
rg -n -i -C2 '^\+.*(ignore|suppress|exclude|allowlist|advisory.*(ignore|allow)|osv.*ignore|pip-audit.*ignore|permissions:|secrets\.|token|credential|persist-credentials|contents:\s*write|pull-requests:\s*write|id-token:\s*write|reviewer|provider)' || true
echo '== PR head and check runs =='
gh pr view 776 --repo ContextualWisdomLab/.github \
--json number,headRefOid,baseRefName,changedFiles,files,statusCheckRollup \
--jq '{number,headRefOid,baseRefName,changedFiles,files:[.files[].path],checks:[.statusCheckRollup[]|{name,status,conclusion,detailsUrl}]}'Length of output: 85856 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
sha='08d83dd2c2e4ba3ff577c9c8e53442260b3b0ff9'
echo '== closure test source =='
nl -ba tests/test_strix_security_closure.py
echo '== lockfile block validation =='
python3 - <<'PY'
from pathlib import Path
import re, sys
path = Path("requirements-strix-ci-hashes.txt")
lines = path.read_text(encoding="utf-8").splitlines()
starts = [(i, re.match(r"^([A-Za-z0-9_.-]+)==([^\s\\]+)\s*\\?$", line))
for i, line in enumerate(lines) if re.match(r"^[A-Za-z0-9_.-]+==", line)]
errors = []
records = []
for index, (start, match) in enumerate(starts):
end = starts[index + 1][0] if index + 1 < len(starts) else len(lines)
block = lines[start:end]
hashes = [line.strip() for line in block if re.fullmatch(r"--hash=sha256:[0-9a-f]{64}\s*\\?", line.strip())]
records.append((match.group(1).lower(), match.group(2), len(hashes)))
if not hashes:
errors.append(f"no hash: {match.group(1)}=={match.group(2)}")
print(f"package_blocks={len(records)}")
print(f"blocks_without_hash={errors}")
for name in ("aiohttp", "cryptography", "pyopenssl"):
print(name, [record for record in records if record[0] == name])
if errors:
sys.exit(1)
PY
echo '== check runs on exact head =='
gh api "repos/$repo/commits/$sha/check-runs?per_page=100" \
--jq '.check_runs | map({name, status, conclusion, app: .app.slug, details_url})'
echo '== workflow runs on exact head =='
gh api "repos/$repo/actions/runs?head_sha=$sha&per_page=100" \
--jq '.workflow_runs | map({name, status, conclusion, event, head_sha, html_url})'
echo '== requested security check summary =='
gh api "repos/$repo/commits/$sha/check-runs?per_page=100" \
--jq '
.check_runs
| map(select(.name | test("closure-contract|strix|pip-audit|dependency-review|osv|CodeQL|Semgrep|gitleaks|generate-sbom|Scorecard|scorecard"; "i")))
| map({name,status,conclusion,details_url})'Length of output: 2309 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
sha='08d83dd2c2e4ba3ff577c9c8e53442260b3b0ff9'
echo '== closure test source =='
cat -n tests/test_strix_security_closure.py
echo '== lockfile block validation =='
python3 - <<'PY'
from pathlib import Path
import re, sys
lines = Path("requirements-strix-ci-hashes.txt").read_text(encoding="utf-8").splitlines()
starts = [
(i, re.match(r"^([A-Za-z0-9_.-]+)==([^\s\\]+)\s*\\?$", line))
for i, line in enumerate(lines)
if re.match(r"^[A-Za-z0-9_.-]+==", line)
]
errors, records = [], []
for index, (start, match) in enumerate(starts):
end = starts[index + 1][0] if index + 1 < len(starts) else len(lines)
hashes = [
line.strip() for line in lines[start:end]
if re.fullmatch(r"--hash=sha256:[0-9a-f]{64}\s*\\?", line.strip())
]
records.append((match.group(1).lower(), match.group(2), len(hashes)))
if not hashes:
errors.append(f"{match.group(1)}=={match.group(2)}")
print(f"package_blocks={len(records)}")
print(f"blocks_without_hash={errors}")
for name in ("aiohttp", "cryptography", "pyopenssl"):
print(f"{name}={[record for record in records if record[0] == name]}")
if errors:
sys.exit(1)
PY
echo '== requested check summary on exact head =='
gh api "repos/$repo/commits/$sha/check-runs?per_page=100" \
--jq '
.check_runs
| map(select(.name | test("closure-contract|strix|pip-audit|dependency-review|osv|CodeQL|Semgrep|gitleaks|generate-sbom|Scorecard|scorecard"; "i")))
| map({name,status,conclusion,app:.app.slug,details_url})'
echo '== workflow runs on exact head =='
gh api "repos/$repo/actions/runs?head_sha=$sha&per_page=100" \
--jq '.workflow_runs | map({name,status,conclusion,event,head_sha,html_url})'Length of output: 11590
I found no actionable source finding.
Do not merge yet. The exact-head You are interacting with an AI system. |
|
PR #776 is now Ready on exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='776'
sha='08d83dd2c2e4ba3ff577c9c8e53442260b3b0ff9'
echo '== PR metadata and head =='
gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,headRefOid,baseRefName,mergeStateStatus,reviewDecision,autoMergeRequest,changedFiles,files \
--jq '{
number,state,isDraft,headRefOid,baseRefName,mergeStateStatus,reviewDecision,
autoMergeEnabled:(.autoMergeRequest != null),
changedFiles,
files:[.files[].path]
}'
echo '== Exact-head check runs =='
gh api "repos/$repo/commits/$sha/check-runs?per_page=100" --paginate \
--jq '.check_runs[] | {
name,status,conclusion,
app:.app.slug,
details_url
}'
echo '== Exact-head workflow runs =='
gh api "repos/$repo/actions/runs?head_sha=$sha&per_page=100" --paginate \
--jq '.workflow_runs[] | {
name,status,conclusion,event,head_sha,html_url
}'
echo '== Unresolved PR review threads =='
gh api graphql \
-F owner='ContextualWisdomLab' \
-F name='.github' \
-F number="$pr" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 1) {
nodes { author { login } body path }
}
}
}
}
}
}' \
--jq '.data.repository.pullRequest.reviewThreads.nodes
| map(select(.isResolved == false))
| map({
outdated:.isOutdated,
author:.comments.nodes[0].author.login,
path:.comments.nodes[0].path,
body:.comments.nodes[0].body
})'Length of output: 27834
I found no actionable source finding. The PR has the declared six-file dependency-lifecycle scope. No unresolved review threads exist. The following exact-head workflows succeeded: Strix Security Closure, Python Security, Security Scan, OSV-Scanner PR, CodeQL PR, SAST Semgrep, Secret Scan, SBOM Generation, and Scorecard PR. I cannot submit a merge-ready outcome yet. The current Wait for the current Strix workflow to succeed and for the remaining required review or branch-protection condition to clear. You are interacting with an AI system. |
|
@opencode-agent @cwl-noema-review Please independently review exact current head Verify the reviewed security floors ( |
|
Closing as superseded by #759. Exact head |
Pull request was closed
|
@coderabbitai review Please review exact current head @opencode-agent Review the same exact head after all current-head checks are complete. Approve only with complete coverage/docstring and security evidence. @cwl-noema-review Independently review the same exact head; do not reuse predecessor-head evidence. |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='776'
expected_sha='08d83dd2c2e4ba3ff577c9c8e53442260b3b0ff9'
echo '== EXACT HEAD =='
actual_sha="$(git rev-parse HEAD)"
printf 'expected=%s\nactual=%s\n' "$expected_sha" "$actual_sha"
base="$(git merge-base HEAD origin/main)"
printf 'base=%s\n' "$base"
echo '== CHANGED FILES =='
git diff --name-status "$base" HEAD
printf 'changed_file_count='
git diff --name-only "$base" HEAD | wc -l
echo '== FOCUSED DIFF =='
git diff --no-ext-diff --unified=20 "$base" HEAD -- \
requirements-strix-ci.txt \
requirements-strix-ci-hashes.txt \
.github/workflows/strix-security-closure.yml \
tests/test_strix_security_closure.py \
docs/doctoring/central-strix-security-closure.md \
CHANGELOG.md
echo '== RELEVANT FILE CONTENT =='
for f in \
requirements-strix-ci.txt \
requirements-strix-ci-hashes.txt \
.github/workflows/strix-security-closure.yml \
tests/test_strix_security_closure.py \
docs/doctoring/central-strix-security-closure.md \
CHANGELOG.md
do
if [ -f "$f" ]; then
echo "--- $f"
grep -nE '^(aiohttp|cryptography|pyOpenSSL)==|pyOpenSSL|aiohttp|cryptography|require-hashes|persist-credentials|permissions:|contents:|secrets\.|NVIDIA|OpenCode|reviewer|APA|References|08d83dd2' "$f" || true
fi
done
echo '== LOCK STRUCTURE =='
awk '
/^[[:alnum:]_.-]+==[^[:space:]\\]+[[:space:]]*\\$/ {
if (in_block && hash_count == 0) print "MISSING_HASH " pkg
pkg=$1; in_block=1; hash_count=0; block_count++
if (pkg ~ /^(aiohttp|cryptography|pyOpenSSL)==/) print "TARGET " pkg
next
}
/^[[:space:]]+--hash=sha256:[0-9a-f]{64}[[:space:]]*\\?$/ {
if (in_block) hash_count++
next
}
END {
if (in_block && hash_count == 0) print "MISSING_HASH " pkg
print "PACKAGE_BLOCKS " block_count
}
' requirements-strix-ci-hashes.txt
echo 'UNHASHED_PINNED_LINES'
grep -nE '^[[:alnum:]_.-]+==[^[:space:]\\]+[[:space:]]*$' requirements-strix-ci-hashes.txt || true
echo '== ADDED SUPPRESSION OR PRIVILEGE CHANGES =='
git diff --no-ext-diff --unified=5 "$base" HEAD | \
grep -Ein -C2 '^\+.*(ignore|suppress|allowlist|exclude|advisory.*(ignore|allow)|pip-audit.*ignore|osv.*ignore|permissions:|secrets\.|token|credential|persist-credentials|contents:[[:space:]]*write|pull-requests:[[:space:]]*write|id-token:[[:space:]]*write|NVIDIA|OpenCode|reviewer)' \
|| true
echo '== PR AND EXACT-HEAD STATUS =='
gh pr view "$pr" --repo "$repo" \
--json number,state,headRefOid,mergeStateStatus,reviewDecision,autoMergeRequest,changedFiles,files \
--jq '{number,state,headRefOid,mergeStateStatus,reviewDecision,autoMergeEnabled:(.autoMergeRequest != null),changedFiles,files:[.files[].path]}'
echo '== SECURITY-RELATED CHECK RUNS =='
gh api "repos/$repo/commits/$expected_sha/check-runs?per_page=100" --paginate \
--jq '.check_runs
| map(select(.name | test("Strix|Python Security|Security Scan|OSV|CodeQL|Semgrep|Secret|SBOM|Scorecard|closure-contract"; "i")))
| map({name,status,conclusion,app:.app.slug})'
echo '== WORKFLOW RUNS ON EXACT HEAD =='
gh api "repos/$repo/actions/runs?head_sha=$expected_sha&per_page=100" \
--jq '.workflow_runs | map({name,status,conclusion,head_sha})'
echo '== UNRESOLVED REVIEW THREADS =='
gh api graphql \
-F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 1) { nodes { author { login } path body } }
}
}
}
}
}' \
--jq '.data.repository.pullRequest.reviewThreads.nodes
| map(select(.isResolved == false))
| map({outdated:.isOutdated,author:.comments.nodes[0].author.login,path:.comments.nodes[0].path,body:.comments.nodes[0].body})'Length of output: 62733
I found no actionable source finding in the focused Strix closure.
I cannot submit a merge-ready approval. Pull request
|
1 participant
Purpose
Repair the central Strix scanner dependency closure after the hard Python Security gate identified advisory-affected releases already present on
main:aiohttp==3.14.1is replaced by the reviewed fixed release3.14.3;cryptography==49.0.0is replaced by50.0.0;pyOpenSSL==26.4.0transitive release.This is a prerequisite for the focused coverage/native-fuzz boundary PR #763. The two changes remain separate so dependency lifecycle and coverage policy can be reviewed, rejected, merged, or rolled back independently.
TDD evidence
Current exact head:
08d83dd2c2e4ba3ff577c9c8e53442260b3b0ff9.The first two commits added only the executable security-floor regression and its permanent read-only workflow. Exact head
768cc63e58ff6b2c3900585258d5e873c3755e1dfailed in run30987543342at the expected assertion because currentmainstill selectedaiohttp==3.14.1; the hash-locked install step was consequently skipped.The implementation commit atomically replaced the direct input and complete generated hash lock. Exact-head run
30987735072now passes both:python -m pip install --require-hashes -r requirements-strix-ci-hashes.txtinstallation.Scope boundary
Security and documentation
docs/doctoring/central-strix-security-closure.mdrecords the triggering advisory evidence, exact red/green heads, generated-lock trust boundary, scope separation, verification requirements, rollback prohibition, and APA 7 references.Acceptance
Merge only after the exact current head passes Strix Security Closure, Python Security, Security Scan, OSV, CodeQL, Semgrep, Secret Scan, SBOM, Scorecard, central tests, CodeRabbit/OpenCode/Noema current-head review, independent approval, and every branch-protection rule.