Make the triage baseline use the same fingerprint the scanner compares - #95
Merged
ParzivalHack merged 1 commit intoAug 25, 2026
Merged
Conversation
create_fingerprint() in triage.py hashes with SHA-256 while the scanner computes get_fingerprint() with SHA-1 in _rust_core/src/issues.rs, over the identical rule_id|file_path|line_number|code string. The TUI writes its SHA-256 digests into .pyspector_baseline.json and cli.py then compares them against SHA-1 values, so nothing ever matches and a baseline saved from the triage view suppresses nothing. Switch triage.py to SHA-1 so the two agree. No existing baseline written by the TUI can regress, since none of them were ever matched. Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
ParzivalHack
approved these changes
Aug 25, 2026
ParzivalHack
left a comment
ParzivalHack
left a comment
Owner
There was a problem hiding this comment.
Thanks again for the PR, i obviously require no changes for this one, merging :)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Second of the two you invited on GHSA-7875-p889-5wvx, and independent of #94.
create_fingerprint()intriage.py:16hashes with SHA-256, while the scanner computesget_fingerprint()with SHA-1 in_rust_core/src/issues.rs:69, over the identicalrule_id|file_path|line_number|codestring. The TUI writes its SHA-256 digests into.pyspector_baseline.json, andcli.py:903then compares them against SHA-1 values, so nothing ever matches and a baseline saved from the triage view suppresses nothing.I hit this by accident: a hand-built SHA-1 baseline dropped a finding while a SHA-256 one over the same string did not, which is what pointed at the mismatch.
Switching
triage.pyto SHA-1 makes the two agree. Going the other way and moving the Rust side to SHA-256 would work equally well, but it invalidates any baseline anyone has, whereas nothing can regress here since no TUI-written baseline was ever matched in the first place. Happy to do it that way instead if you prefer SHA-256.I used AI assistance while working on this. I confirmed the two now agree over the same string rather than assuming it.