mirror of
https://github.com/PR0M3TH3AN/SeedPass.git
synced 2026-10-28 16:32:06 +00:00
thePR0M3TH3ANandClaude Opus 5
7047a5dfed
L5: dependency-audit.yml now generates a CycloneDX SBOM from requirements.lock and uploads it. pip-audit answers "are there known CVEs today"; an SBOM answers "which exact versions were in this build", which is the question that arises when something is disclosed later against a release already in the wild. Verified against the real tool rather than written from memory -- the first flag spelling (--output-format / --outfile) does not exist in cyclonedx-py and would have failed in CI. The working form is `--of json --output-reproducible -o <file>`, which emits CycloneDX 1.6 with 96 components and records [email protected], [email protected], [email protected], [email protected], [email protected], [email protected] and [email protected].0 at exact versions. L4: torch/services/memory/index.js built its temp filename from Date.now() plus Math.random() before an atomic rename -- predictable enough to pre-create or symlink between the write and the rename. Now randomBytes(8). Also renames the Math.random-derived value in relay-health.mjs from `nonce` to `probeSuffix` and draws it from randomBytes(6). It is a public probe tag used to correlate a publish with its readback, not a cryptographic nonce, and nothing was wrong with it -- but the name invited someone to copy the pattern somewhere it would matter. torch has no test/ directory in the repo, so there is no suite to run for these two files; both were syntax-checked and confirmed to import cleanly. The SeedPass determinism gate is green (84 tests). Not done, and recorded as a decision in TODO.md instead: torch/_backups/ holds 5240 tracked files across six dated snapshots. Untracking them is a large deletion and not something to do as a side effect of an entropy audit. They currently duplicate every security-relevant grep hit, and bare `node --test` in torch/ discovers them and fails 18 tests from stale snapshot code. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01HtNMsKzzFTPURemX7tT19u
44 lines
1.4 KiB
YAML
44 lines
1.4 KiB
YAML
name: Dependency Audit
|
|
|
|
on:
|
|
schedule:
|
|
- cron: '0 0 * * 0'
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
audit:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: '3.11'
|
|
- name: Install dependencies
|
|
run: |
|
|
python -m pip install --upgrade pip
|
|
pip install pip-tools pip-audit
|
|
pip-compile --generate-hashes --output-file=requirements.lock src/requirements.txt
|
|
git diff --exit-code requirements.lock
|
|
pip install --require-hashes -r requirements.lock
|
|
- name: Run pip-audit
|
|
run: pip-audit -r requirements.lock --ignore-vuln GHSA-wj6h-64fc-37mp --ignore-vuln CVE-2025-62727
|
|
# Entropy audit L5: pip-audit answers "are there known CVEs today". An
|
|
# SBOM answers "which exact versions were in this build", which is the
|
|
# question that arises when a vulnerability is disclosed later against a
|
|
# release already in the wild.
|
|
- name: Generate CycloneDX SBOM
|
|
run: |
|
|
python -m pip install cyclonedx-bom
|
|
mkdir -p security-artifacts
|
|
cyclonedx-py requirements requirements.lock \
|
|
--of json --output-reproducible \
|
|
-o security-artifacts/sbom.cdx.json
|
|
- uses: actions/upload-artifact@v4
|
|
with:
|
|
name: seedpass-sbom
|
|
path: security-artifacts/
|
|
if-no-files-found: error
|