Repository navigation
difftastic: pkgscan-allow the 0.72.0 sample-file .npmrc findings - #1263
Conversation
difftastic 0.72.0 adds sample_files/flat_{1,2}.json, two revisions of
Forgejo's es-ES locale file used as flat-JSON diff inputs (upstream
a2d6628cc739). Line 401 of each is the npm-registry help string, which
names `.npmrc` as text. pkgscan scored it High CredentialAccess and
withheld the 0.72.0 mirror. Nothing reads these files at build or run
time: they are outside Cargo.toml's include list, and build.sh only
compiles the release binary and installs difft.
Both entries are pinned to the files' sha256, recomputed from the 0.72.0
tag; they match the hashes the gate printed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Warning Review limit reached
This review includes 1 billable file and costs up to $0.25.
Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing. Or wait 12 minutes for your next included review. View limit details
|
mitodrummer
left a comment
There was a problem hiding this comment.
I downloaded the upstream 0.72.0 tag archive. sample_files/flat_1.json and flat_2.json hash to the two pinned sha256 values. Both are Forgejo es-ES locale JSON, and line 401 of each is a UI string that mentions .npmrc. Both files came in with Wilfred's commit a2d6628. They sit outside Cargo.toml's include list, nothing in build.rs or src/ reads them, and build.sh ships only target/release/difft. Each entry is one file and one pattern, pinned by hash, and passes the parser rules.
Adds
packages/difftastic/pkgscan-allow.tomlso that the 0.71.0 -> 0.72.0 bot update can ship. Today's run (2026-11-02T17:14Z,updater_mirror_withheld, reasonpkgscan-high) withheld the gs:// mirror because of two HighCredentialAccessfindings. Both are sample data.Evidence
Every flagged file was read in full from the upstream
0.72.0tag (gh api repos/Wilfred/difftastic/tarball/0.72.0), and each introducing commit was checked incompare/0.71.0...0.72.0.sample_files/flat_1.json:401.npmrc_commentkey cites forgejo commit 8eb34c58). Line 401 is"packages.npm.registry": "Configura este registro en tu proyecto <code>.npmrc</code> archivo:". No URLs other than the forgejo/pagure references, no encoded blobs, no non-printable bytes. Added by the maintainer (Wilfred) in a2d6628, "Improve unchanged heuristics for flat sequences", together withsrc/diff/unchanged.rssample_files/flat_2.json:401.npmrctests/cli.rs:57.gitconfig.arg("sample_files/cli_tests/gitconfig_1.gitconfig"): the path of a diff input in anassert_cmdintegration test. Added in e2e1e3b (DivvyCr, committed by Wilfred; fix for difftastic#978). The two fixtures are 8-line gitconfigs (alice@example.com,editor = vim/emacs, aurl.insteadOf)tests/cli.rs:58.gitconfiggitconfig_2.gitconfig)Not part of the build or the shipped package.
Cargo.toml'sincludelist isbuild.rs,src/, the vendored parsers, LICENSE and README, sosample_files/andtests/are not even in the crate.build.rsandsrc/never referencesample_files.packages/difftastic/build.shbuilds only the release binary, which does not compile or run the tests, and the only output isusr/bin/difft.Hashes.
shasum -a 256on the extracted 0.72.0 files givesa7097adf…3000fd(flat_1) andb21ce6e6…e7b59f(flat_2). Both match the hashes the gate printed. Each entry also satisfies the parser rules: all five fields are present, the hash is 64 lowercase hex characters, and the reason is at least 20 characters and cites a URL.Why only two stanzas. Only findings at High or above gate: the mirror is withheld at High, and the PR becomes a draft at High. The two
tests/cli.rsfindings are Medium, so they would only appear in the PR body.stanzas()prints entries for gating findings only, and pinningtests/cli.rs, a file that changes often, would buy nothing.After merge
The bot update has to be re-triggered (the next nightly run, or
/pkgsfrom Slack). The allowlist is read when the gate runs, so the next run re-scans and regrades these two findings to Info. If either file changes, its hash stops matching and the finding gates again.The CODEOWNERS change for
pkgscan-allow.toml(#1113) is still open. If it merges with@bryan-minimalas the only owner, then this PR, which is opened from that account, cannot be approved; #1113 describes that deadlock.The agent did not merge or approve this PR.
🤖 Generated with Claude Code