Skip to content

Commit 2ea68ba

Browse files
madeinplutofabiomadeinplutofabio
authored
Merge pull request #3 from madeinplutofabio/scaffold
v0.5.0: Protocol + Hardened Mode + Production Candidate
2 parents a1ecedc + 9227eca commit 2ea68ba

68 files changed

Lines changed: 12103 additions & 248 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/SECURITY_ADVISORY_TEMPLATE.md‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
# Security Advisory Template
2+
3+
## Summary
4+
5+
<!-- One-sentence description of the vulnerability -->
6+
7+
## Affected Versions
8+
9+
<!-- Which versions are affected? -->
10+
11+
- 0.x.y and earlier
12+
13+
## Affected Components
14+
15+
<!-- Check all that apply -->
16+
17+
- [ ] Executor (`csc_runner/executor.py`)
18+
- [ ] Sandbox (`csc_runner/sandbox.py`)
19+
- [ ] Signing (`csc_runner/signing.py`)
20+
- [ ] Approval (`csc_runner/approval.py`)
21+
- [ ] Policy (`csc_runner/policy.py`)
22+
- [ ] Path enforcement (`csc_runner/pathutil.py`)
23+
- [ ] Resource limits (`csc_runner/limits.py`)
24+
- [ ] CLI (`csc_runner/cli.py`)
25+
- [ ] Schemas
26+
- [ ] Dockerfile / container image
27+
28+
## Affected Modes
29+
30+
- [ ] Local mode
31+
- [ ] Hardened mode
32+
- [ ] Both
33+
34+
## Severity
35+
36+
<!-- Critical / High / Medium / Low — see SECURITY.md for rubric -->
37+
38+
## Bounded Production Claim Impact
39+
40+
<!-- Does this issue block or weaken the bounded production claim?
41+
High/critical issues block the claim until resolved.
42+
Medium issues require an explicit acceptance note. -->
43+
44+
- [ ] Blocks bounded production claim
45+
- [ ] Weakens claim (requires acceptance note)
46+
- [ ] No impact on claim
47+
48+
## Description
49+
50+
<!-- Detailed description of the vulnerability, including root cause -->
51+
52+
## Impact
53+
54+
<!-- What can an attacker do? What is the blast radius? -->
55+
56+
## Reproduction
57+
58+
<!-- Steps to reproduce, proof of concept, or test case -->
59+
60+
## Fix
61+
62+
<!-- Description of the fix, PR reference -->
63+
64+
## Mitigation
65+
66+
<!-- Workarounds available before applying the fix -->
67+
68+
## Regression Test
69+
70+
<!-- Reference to the regression test added for this vulnerability.
71+
Required before closing the advisory. -->
72+
73+
- Test file: <!-- e.g. tests/test_adversarial.py, tests/test_executor.py -->
74+
- Test name: <!-- e.g. test_vuln_123_path_traversal_regression -->
75+
- [ ] Regression test merged
76+
77+
## Credit
78+
79+
<!-- Reporter attribution (unless they request anonymity) -->

‎.github/SECURITY_RELEASE_TEMPLATE.md‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
# Security Release Notes Template
2+
3+
## Release vX.Y.Z — Security Fix
4+
5+
### Security
6+
7+
#### [SEVERITY] — Brief title
8+
9+
**Advisory:** GHSA-xxxx-xxxx-xxxx
10+
11+
**Affected versions:** 0.x.y and earlier
12+
13+
**Affected component(s):** <!-- e.g. sandbox, signing, executor -->
14+
15+
**Affected mode:** <!-- local / hardened / both -->
16+
17+
**Bounded production claim impact:** <!-- blocks claim / weakens claim / no impact -->
18+
19+
**Description:**
20+
21+
<!-- 2-3 sentence description of the vulnerability and its impact, suitable for public disclosure. Do not include exploitation details beyond what is needed for users to assess their exposure. -->
22+
23+
**Fix:**
24+
25+
<!-- Brief description of what was changed to fix the vulnerability. -->
26+
27+
**Mitigation for users who cannot upgrade immediately:**
28+
29+
<!-- Workarounds, if any. "No workaround; upgrade required." if none. -->
30+
31+
**Regression test:** <!-- e.g. tests/test_adversarial.py::test_vuln_123 -->
32+
33+
**Credit:** <!-- Reporter attribution, or "Reported internally" -->
34+
35+
---
36+
37+
### Other Changes
38+
39+
<!-- Non-security changes in this release, if any. -->

‎.github/dependabot.yml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
# Dependabot configuration
2+
# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates
3+
#
4+
# Notes:
5+
# - Docker entry watches root Dockerfile only. Add entries for subdirectory
6+
# Dockerfiles if needed later.
7+
# - If update noise gets high, add groups to batch minor/patch updates.
8+
9+
version: 2
10+
updates:
11+
# Python dependencies (pip)
12+
- package-ecosystem: "pip"
13+
directory: "/"
14+
schedule:
15+
interval: "weekly"
16+
day: "monday"
17+
commit-message:
18+
prefix: "deps"
19+
open-pull-requests-limit: 10
20+
labels:
21+
- "dependencies"
22+
23+
# GitHub Actions
24+
- package-ecosystem: "github-actions"
25+
directory: "/"
26+
schedule:
27+
interval: "weekly"
28+
day: "monday"
29+
commit-message:
30+
prefix: "ci"
31+
open-pull-requests-limit: 5
32+
labels:
33+
- "dependencies"
34+
- "ci"
35+
36+
# Docker
37+
- package-ecosystem: "docker"
38+
directory: "/"
39+
schedule:
40+
interval: "weekly"
41+
day: "monday"
42+
commit-message:
43+
prefix: "deps"
44+
open-pull-requests-limit: 3
45+
labels:
46+
- "dependencies"
47+
- "docker"

‎.github/workflows/hardened-tests.yml‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
name: Hardened Integration Tests
2+
3+
on:
4+
push:
5+
branches: [main, scaffold]
6+
pull_request:
7+
branches: [main, scaffold]
8+
9+
permissions:
10+
contents: read
11+
12+
# This workflow runs:
13+
# 1. Standard tests on Linux (ubuntu-latest) across Python versions.
14+
# Full platform matrix (Windows, macOS) belongs in ci.yml.
15+
# 2. Hardened integration tests inside the Docker container.
16+
# The outer container runs as root with --privileged and AppArmor
17+
# disabled so bwrap can create namespaces and configure loopback.
18+
# Running as root is a CI-only requirement — bwrap --unshare-net
19+
# needs CAP_NET_ADMIN to set up loopback in its network namespace.
20+
# The product Dockerfile runs as non-root (csc-runner).
21+
# Network isolation is enforced and tested by bwrap --unshare-net
22+
# inside the sandbox — the primary hardened-mode boundary.
23+
#
24+
# Action versions are not yet pinned to SHA — that is a Stage 3 Step C task.
25+
26+
jobs:
27+
standard-tests:
28+
name: Standard Tests (Linux)
29+
runs-on: ubuntu-latest
30+
strategy:
31+
matrix:
32+
python-version: ["3.11", "3.12", "3.13"]
33+
steps:
34+
- uses: actions/checkout@v4
35+
36+
- name: Set up Python ${{ matrix.python-version }}
37+
uses: actions/setup-python@v5
38+
with:
39+
python-version: ${{ matrix.python-version }}
40+
41+
- name: Install dependencies
42+
run: pip install -e ".[dev]"
43+
44+
- name: Lint
45+
run: |
46+
ruff check .
47+
ruff format --check .
48+
49+
- name: Run standard tests
50+
run: python -m pytest --tb=short -q --ignore=tests/test_integration_hardened.py
51+
timeout-minutes: 5
52+
53+
hardened-tests:
54+
name: Hardened Integration Tests (Docker)
55+
runs-on: ubuntu-latest
56+
needs: standard-tests
57+
steps:
58+
- uses: actions/checkout@v4
59+
60+
- name: Build hardened image
61+
run: docker build -t csc-hardened .
62+
63+
- name: Verify sandbox tools available
64+
run: |
65+
docker run --rm --entrypoint bwrap csc-hardened --version
66+
docker run --rm --entrypoint setpriv csc-hardened --version
67+
docker run --rm --entrypoint prlimit csc-hardened --version
68+
69+
- name: Run hardened integration tests
70+
run: |
71+
docker run \
72+
--rm \
73+
--privileged \
74+
--security-opt apparmor=unconfined \
75+
--user 0 \
76+
--entrypoint python \
77+
-v ${{ github.workspace }}:/repo:ro \
78+
-w /app \
79+
csc-hardened \
80+
-m pytest /repo/tests/test_integration_hardened.py -v --tb=short
81+
timeout-minutes: 10

0 commit comments

Comments
 (0)