Add versioned public corpus generation and verification via xtask#372
Add versioned public corpus generation and verification via xtask#372EffortlessSteven wants to merge 2 commits intomainfrom
Conversation
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 29312746 | Triggered | JSON Web Token | 7f52eca | corpus/v0.5.1/tokens/jwt_hs256_basic/authorization_header.txt | View secret |
| 29312745 | Triggered | Generic High Entropy Secret | 7f52eca | xtask/src/corpus.rs | View secret |
| 29312746 | Triggered | JSON Web Token | 7f52eca | corpus/v0.5.1/tokens/jwt_hs256_basic/token.txt | View secret |
| 29312744 | Triggered | Generic Private Key | 7f52eca | corpus/v0.5.1/x509/x509_chain_good_default/leaf_key.pk8.pem | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secrets safely. Learn here the best practices.
- Revoke and rotate these secrets.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 5 minutes and 6 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: ⛔ Files ignored due to path filters (13)
📒 Files selected for processing (15)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 94d0dcfd3c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| id: "jwt_hs256_basic", | ||
| category: "tokens", | ||
| description: "OAuth/JWT-shape HS256 access token fixture.", |
There was a problem hiding this comment.
corpus_cases labels this fixture as jwt_hs256_basic/"HS256", but the token bytes come from TokenSpec::oauth_access_token() (line 174), which emits a JWT header with "alg":"RS256". Downstream consumers using the case ID/description to drive HS256 verification tests will get false failures against a mislabeled corpus artifact. Please make the metadata and emitted token algorithm consistent (either rename to RS256-shaped or generate a real HS256 fixture).
Useful? React with 👍 / 👎.
EffortlessSteven
force-pushed
the
codex/add-versioned-fixture-corpus
branch
from
94d0dcf to
beccbf0
Compare
1 participant
Motivation
Description
cargo xtask corpuscommand group withBuildandVerifysubcommands and wire the CLI to callcorpus::build()andcorpus::verify()inxtask/src/main.rs.xtask/src/corpus.rs, including deterministic fixture creation from a stable seed, per-casecase.jsonmetadata, a top-levelmanifest.json, BLAKE3 file hashes, and README emission.corpus/v{version}/with semantic case IDs and families (x509/,jwks/,tokens/,negative/), and include an initial minimal corpus atcorpus/v0.5.1/.blake3,tempfile, and theuselesskeyfacade) inxtask/Cargo.tomland the rootCargo.tomlso the xtask can instantiate fixtures and compute hashes, and add unit tests covering build/verify invariants.Testing
cargo test -p xtask, which completed successfully (106 passed, 0 failed).cargo xtask corpus build, which producedcorpus/v0.5.1successfully.cargo xtask corpus verify, which passed.no-blobcheck viacargo xtask no-blob, which completed successfully.Codex Task