Repository navigation
security: hash-lock what ships (image, release and audit tooling) - #23
Merged
Merged
Conversation
The container image, the release tooling and the dependency audit installed whatever PyPI served at build time, with no hash check (11 OpenSSF Scorecard "pipCommand not pinned by hash" alerts). - requirements/ holds hash-locked files made by `make lock` (uv pip compile --universal --generate-hashes): runtime.txt (what the image ships), audit.txt (every optional extra), build.txt (setuptools, wheel) and tools.txt (build, cyclonedx-bom, pip-audit). - The image installs runtime.txt and build.txt with --require-hashes and builds the project with --no-deps --no-build-isolation, so nothing unpinned is downloaded; .dockerignore admits exactly those two files. - The Security workflow audits the locked set, and `pip check` fails the job when the lock no longer satisfies pyproject.toml. - CI test jobs keep installing the newest versions on purpose (IronFlow is also a library); a comment in ci.yml says why. - Dependabot waits 7 days before proposing a new release (cooldown); security updates are not delayed. zizmor: no findings. - New hygiene tests: the image installs only hash-locked packages, the build context admits the locks, and every locked requirement carries hashes. Verified locally: hash-checked install of audit.txt plus `pip check`, pip-audit of all four locks (no known vulnerabilities), 50 hygiene tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
OpenSSF Scorecard reported 11
pipCommand not pinned by hashalerts: the container image, the release tooling and the dependency audit installed whatever PyPI served at build time, with no hash check. A package replaced or tampered with on the index would have entered the image.requirements/: hash-locked files made bymake lock(uv pip compile --universal --generate-hashes):runtime.txt: what the image ships;audit.txt: every optional extra;build.txt: setuptools and wheel;tools.txt: build, cyclonedx-bom and pip-audit.runtime.txtandbuild.txtwith--require-hashes, then builds the project with--no-deps --no-build-isolation, so nothing unpinned is downloaded..dockerignoreadmits exactly those two files.pip checkfails the job when the lock no longer satisfiespyproject.toml.buildandcyclonedx-bomcome fromtools.txt.dependabot.yml);ci.ymlnow says so. Their 4 Scorecard alerts will be dismissed with that reason.Verification
audit.txtinto a clean venv, thenpip check: no broken requirements.tests/test_repo_hygiene.py: 50 passed. ruff clean. zizmor: no findings.Security impact
Supply chain only; no application code changes.
🤖 Generated with Claude Code