release: include portable M0 hardening - #145
Conversation
Use a canonical private temporary scratch root for the direct OCM lab, retain explicit override controls, and prove the lifecycle under a symlinked TMPDIR. Strengthen the OCI Kind contract to decode its version payload and correct the associated operator evidence. GSTACK-Checkpoint: 2026-07-14/release-hardening#1 Signed-off-by: Gnani Rahul <gnani.nutakki@gmail.com>
…rdening fix(e2): harden portable M0 release checks
📝 WalkthroughWalkthroughChangesRelease hardening
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (2)
hack/experiments/m0-ocm-falsification.sh (2)
172-179: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low value
mkdir -p -m 0700only applies mode to the deepest directory (SC2174).Intermediate components of
SCRATCH_PARENTcreated via-pget0777 & ~umaskrather than the explicit-m. This is currently safe only becauseumask 077is set immediately beforehand, so intermediates also land at0700— but that's an implicit coupling, not an explicit guarantee.🛡️ More defensive alternative
prepare_default_scratch_parent() { [[ "${SCRATCH_ROOT}" == "${DEFAULT_SCRATCH_ROOT}" ]] || return 0 [[ ! -e "${SCRATCH_PARENT}" && ! -L "${SCRATCH_PARENT}" ]] || return 0 umask 077 - mkdir -p -m 0700 -- "${SCRATCH_PARENT}" + mkdir -p -- "${SCRATCH_PARENT}" + chmod 0700 -- "${SCRATCH_PARENT}" }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@hack/experiments/m0-ocm-falsification.sh` around lines 172 - 179, Update prepare_default_scratch_parent so every directory created under SCRATCH_PARENT is explicitly guaranteed to use mode 0700, rather than relying on mkdir -p’s interaction with the preceding umask 077. Preserve the existing no-op conditions and scratch-parent creation behavior while removing the implicit mode coupling.Source: Linters/SAST tools
35-44: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winDefault scratch-root path is computed twice, independently, and must stay byte-for-byte identical.
Makefileand the script both derivesith-m0-<uid>/labunder the canonicalTMPDIR, but the script'svalidate_scratch_roothard-requires an exact string match against its own default unless the operator opts intoSITH_M0_ALLOW_NON_EXTENDED=1. This is fragile: any drift (differentpython3onPATHvs${PYTHON_BIN}, oros.getuid()real-uid vs bash$EUIDeffective-uid) makesmake e2e-ocmfail closed withdie "scratch must use the private default...".
hack/experiments/m0-ocm-falsification.sh#L35-L44: add aprint-default-scratch-root(or similar) subcommand/flag that outputsDEFAULT_SCRATCH_ROOTso it becomes the single source of truth.Makefile#L15-L15: replace the inline python3 computation with$(shell hack/experiments/m0-ocm-falsification.sh print-default-scratch-root)(or equivalent) instead of recomputing it.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@hack/experiments/m0-ocm-falsification.sh` around lines 35 - 44, Make hack/experiments/m0-ocm-falsification.sh expose a print-default-scratch-root subcommand or equivalent that outputs DEFAULT_SCRATCH_ROOT, preserving the existing canonical path calculation. Update Makefile’s scratch-root definition to invoke that script command instead of independently recomputing the path, making the script’s value the single source of truth; apply these changes at hack/experiments/m0-ocm-falsification.sh:35-44 and Makefile:15.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@hack/experiments/m0-ocm-falsification.sh`:
- Around line 172-179: Update prepare_default_scratch_parent so every directory
created under SCRATCH_PARENT is explicitly guaranteed to use mode 0700, rather
than relying on mkdir -p’s interaction with the preceding umask 077. Preserve
the existing no-op conditions and scratch-parent creation behavior while
removing the implicit mode coupling.
- Around line 35-44: Make hack/experiments/m0-ocm-falsification.sh expose a
print-default-scratch-root subcommand or equivalent that outputs
DEFAULT_SCRATCH_ROOT, preserving the existing canonical path calculation. Update
Makefile’s scratch-root definition to invoke that script command instead of
independently recomputing the path, making the script’s value the single source
of truth; apply these changes at hack/experiments/m0-ocm-falsification.sh:35-44
and Makefile:15.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: fc4a1ab6-4827-4437-8f30-a78468698823
📒 Files selected for processing (7)
Makefiledocs/experiments/M0-ocm-falsification.mdhack/experiments/m0-ocm-falsification.shsessions/2026-07-13-e2-direct-konnectivity-transport.mdsessions/2026-07-14-release-hardening.mdtests/e2e/oci_image_kind_test.gotests/scripts/m0_ocm_falsification_safety_test.sh
|
Reviewed the two nitpicks against the merged dev implementation. The generated default parent is created immediately under The Makefile and script intentionally use the same canonical TMPDIR-plus-UID contract. Any future divergence is fail-closed and requires the explicit non-default override. Turning the script into a Makefile parse-time dependency would add a new bootstrap surface without reducing the current security boundary. No release-blocking correctness, privacy, or security issue was found. The release proceeds with the green validation evidence. |
1 participant
Release scope
Promotes the current governed-read integration tip, including the release-hardening correction from #143 / #144:
Evidence before promotion
devpost-merge CI 29347313112 passed, including the real two-cluster fan-out.devpost-merge CodeQL 29347310921 passed all analyses.devremains the durable integration branch and must not be deleted.Summary by CodeRabbit
New Features
Bug Fixes
Documentation