base-layer/releasekit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 5 Wiki Activity

Record accepted audit remediation decisions

Browse Source
This commit is contained in:
Eric Rakestraw
2026-11-02 02:23:58 +00:00
parent 6f7e43b097
commit b5b3f09599
1 changed files with 28 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
docs/roadmap/audit.md
View File

@@ -1,11 +1,11 @@
# Consolidated audit recommendations # Audit remediation roadmap
Reviewed against `91f25c4` on `main`. All eleven reports under Reviewed against `91f25c4` on `main`. All eleven reports under
[`audit/`](audit/) were reviewed, with selected implementation and contract [`audit/`](audit/) were reviewed, with selected implementation and contract
checks. Changes since their earliest baseline affect audit documents only; checks. Changes since their earliest baseline affect audit documents only;
the recorded implementation findings remain pending. This document owns the the recorded implementation findings remain pending. This document owns the
consolidated recommendations. The individual reports retain detailed evidence accepted remediation priorities and approaches. The individual reports retain
and reproduction limits. detailed evidence and reproduction limits.
The 27 findings across the reports consolidate into 20 work items. Missing The 27 findings across the reports consolidate into 20 work items. Missing
regressions accompany the defects they should protect. Repeated reports of regressions accompany the defects they should protect. Repeated reports of
@@ -13,15 +13,30 @@ subprocess shutdown and Git inspection duplication each become one work item.
Temporary-storage fixes and unused-helper removals are grouped by ownership, Temporary-storage fixes and unused-helper removals are grouped by ownership,
with their distinct cases identified below. with their distinct cases identified below.
## Accepted decisions and status
The approaches and priorities for A01–A20 are accepted. Implementation remains
pending. Each recommendation below records the accepted approach;
alternatives are retained as decision rationale.
- A01–A04 are the first implementation priorities.
- A08 uses an internal limit of ten followed redirects per asset request.
- A10 retains a 1 MiB diagnostic tail for status-only Go commands while
forwarding complete output and preserving full `Tool.Output` results.
- A11 response caps and A17 exclusion indexing remain deferred pending the
sizing and benchmark evidence described in those items.
- Internal consolidation and refactoring follow the timing stated in their
accepted approaches, alongside related repairs or maintenance.
## Priorities ## Priorities
Priority indicates recommended work order, independent of the original audits' Priority indicates accepted work order, independent of the original audits'
severity labels. P1 addresses release integrity, credential confidentiality, severity labels. P1 addresses release integrity, credential confidentiality,
and cancellation guarantees. P2 improves recovery, completed-output contracts, and cancellation guarantees. P2 improves recovery, completed-output contracts,
cleanup, and bounded asset inspection. P3 covers focused internal improvements. cleanup, and bounded asset inspection. P3 covers focused internal improvements.
P4 defers implementation pending sizing or performance evidence. P4 defers implementation pending sizing or performance evidence.
| ID | Priority | Work and recommended disposition | | ID | Priority | Accepted work and disposition |
| --- | --- | --- | | --- | --- | --- |
| A01 | P1 | Force the intended tag push to include the repository itself. | | A01 | P1 | Force the intended tag push to include the repository itself. |
| A02 | P1 | Use original Git objects consistently for release evidence. | | A02 | P1 | Use original Git objects consistently for release evidence. |
@@ -199,11 +214,11 @@ requiring hostile filesystem actors or power-loss guarantees.
Source: [security §2](audit/07-security.md#2-medium-unique-asset-redirects-bypass-the-http-clients-finite-redirect-limit), Source: [security §2](audit/07-security.md#2-medium-unique-asset-redirects-bypass-the-http-clients-finite-redirect-limit),
also referenced by the resource audit. also referenced by the resource audit.
**Recommendation:** Propose ten followed redirects per asset request as the **Recommendation:** Allow up to ten followed redirects per asset request as
initial internal default, matching the ordinary Go client convention, and the initial internal default, matching the ordinary Go client convention, and
report exhaustion as unverifiable content. Preserve exact-cycle detection, report exhaustion as unverifiable content. Preserve exact-cycle detection,
body closure, and per-origin authorization checks. This bounds both request body closure, and per-origin authorization checks. This bounds both request
count and retained URL history. It is an explicit proposed policy choice; count and retained URL history. The ten-redirect budget is accepted;
assess a longer-chain override only for demonstrated consumer requirements. assess a longer-chain override only for demonstrated consumer requirements.
**Alternative:** Rely on an operation deadline. It preserves arbitrary chain **Alternative:** Rely on an operation deadline. It preserves arbitrary chain
@@ -237,9 +252,9 @@ Source: [resources §1](audit/05-resources.md#1-go-command-output-is-retained-fo
**Recommendation:** For status-only `Tool.Run` and dependency preparation, **Recommendation:** For status-only `Tool.Run` and dependency preparation,
forward the complete stream while retaining a bounded diagnostic tail for forward the complete stream while retaining a bounded diagnostic tail for
failure reporting. Start with a proposed 1 MiB internal tail and an explicit failure reporting. Retain up to 1 MiB internally with an explicit truncation
truncation notice; keep full output for `Tool.Output` consumers. This is a notice; keep full output for `Tool.Output` consumers. This accepted change to
deliberate change to diagnostic retention, to be documented with implementation. diagnostic retention will be documented with implementation.
It bounds memory without adding consumer configuration or disk lifecycle work. It bounds memory without adding consumer configuration or disk lifecycle work.
**Alternative:** Spool full diagnostics to owned temporary storage. This retains **Alternative:** Spool full diagnostics to owned temporary storage. This retains
@@ -434,7 +449,7 @@ other audits supply supporting context rather than additional work items.
## Verification and scope of follow-up ## Verification and scope of follow-up
This consolidation adds recommendations and changes no production behavior. This roadmap records accepted work; production behavior remains unchanged.
Original reproductions, source inspection findings, coverage figures, and Original reproductions, source inspection findings, coverage figures, and
scanner results retain their stated limits. Existing passing tests establish scanner results retain their stated limits. Existing passing tests establish
a useful baseline; regressions should demonstrate the behavior of each repaired a useful baseline; regressions should demonstrate the behavior of each repaired
@@ -444,5 +459,5 @@ implementation changes warrant them.
Keep the two public facades, explicit forge selection, caller ownership of Keep the two public facades, explicit forge selection, caller ownership of
prebuilt artifacts, original credential origin checks, and additive delivery prebuilt artifacts, original credential origin checks, and additive delivery
semantics. The proposed diagnostic/redirect budgets are deliberate recommendations; semantics. The diagnostic and redirect budgets above are accepted decisions;
JSON limits and exclusion indexing remain deferred as explained above. JSON limits and exclusion indexing remain deferred as explained above.