Skip to content

Enforce canonical SOURCE_MANIFEST, reject symlinks/sensitive files, and add CI linting & verification - #8

Open
victorsteele wants to merge 1 commit into
mainfrom
codex/conduct-forensic-audit-for-project
Open

Enforce canonical SOURCE_MANIFEST, reject symlinks/sensitive files, and add CI linting & verification#8
victorsteele wants to merge 1 commit into
mainfrom
codex/conduct-forensic-audit-for-project

Conversation

@victorsteele

Copy link
Copy Markdown
Contributor

Motivation

  • Prevent unexpected or sensitive files from being included in source releases by making the committed manifest the single canonical inventory.
  • Eliminate symlink dereference and other release-integrity weaknesses that could leak private browser/profile data into archives.
  • Improve static-quality and dependency checks in CI to catch regressions earlier and ensure consistent test configuration.

Description

  • Replace ad-hoc file lists with a manifest-driven builder by adding read_source_manifest, enforcing deterministic ordering, checksum verification, path validation, and rejection of symlinks and case-collisions.
  • Make build_source_stage copy only manifest-listed inputs and re-verify staged checksums, and add reject_unlisted_source_files to forbid unexpected files in recursive source directories.
  • Harden copy_file to reject symbolic links, extend validate_source_stage to detect sensitive browser/account filenames and unlisted files, and add a --verify-source-only flag to package_publish_release.py for CI dry-run verification.
  • Update CI and developer tooling: add ruff to requirements-dev.txt, run Ruff and pip check in .github/workflows/ci.yml, move pytest addopts to pytest.ini, remove an unused import (tempfile), and update SOURCE_MANIFEST.sha256 and test fixtures accordingly.

Testing

  • Ran the full test suite with pytest -q, and all unit/regression tests passed (69/69 PASS).
  • Ran Ruff static analysis and it passed on the modified tree (ruff PASS).
  • Executed dependency consistency checks via python -m pip check and it passed (Installed dependency consistency: PASS).
  • Performed canonical source manifest checksum/inventory validation and clean source-stage dry-run verification via the new --verify-source-only flow and those checks passed (Canonical source manifest checksum/inventory validation: PASS, Clean source-stage dry run: PASS).

Codex Task

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant