Wave 3: Supply Chain & Build Hardening (GRA-79)#171
Open
Conversation
- H-1: Require commit SHA for git deps; archive_sha256 in lockfile - H-2: Harden ZIP extractor (symlinks, path traversal) - M-1: Package name regex validation - M-6: cargo-deny in CI, weekly cargo-audit - M-7: reqwest 0.12 with rustls, drop OpenSSL - L-2: SHA256SUMS generation in install.sh
…ff136) - H-1: Enforce commit SHA in git dependencies - H-2: ZIP extraction hardening (symlink rejection, path traversal protection) - M-1: Package name validation with regex - M-5: Replace system() with spawn() builtin - M-6: cargo-deny + cargo-audit in CI - M-7: reqwest 0.12 + rustls - L-2: SHA256SUMS for release artifacts All 58 tests passing, builds clean.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Wave 3 — Supply Chain & Build Hardening
This PR implements Wave 3 of the security remediation initiative (GRA-79).
Changes
H-1: Dependency Pinning by Commit SHA
revfield for all git dependencies ingradient.tomlarchive_sha256field to lockfile for downloaded archivesH-2: ZIP Extractor Security
M-1: Package Name Validation
[package].nameagainst^[a-zA-Z][a-zA-Z0-9_-]{0,63}$-M-6: Supply Chain Guardrails
deny.tomlwith license, advisory, and ban checkscargo-denyto CI security jobcargo auditworkflow (Sundays)M-7: Reqwest Upgrade (OpenSSL Removal)
rustls-tlsinstead of OpenSSLL-2: Release Artifact Integrity
SHA256SUMSfor release binaries ininstall.shChangelog
Updated CHANGELOG.md with Wave 3 entries and backfilled Wave 2 entries (C-1, C-2).
Testing
cargo tree -i openssl)Fixes security findings: H-1, H-2, M-1, M-6, M-7, L-2