Skip to content

fix(law): cite d.lgs. 138/2024 art. 24, and name the source that answered - #70

Merged
maksimtech merged 2 commits into
mainfrom
fix/legal-citations
Oct 23, 2026
Merged

maksimtech merged 2 commits into
mainfrom
fix/legal-citations

Conversation

@maksimtech

Copy link
Copy Markdown
Owner

What

  • A critical CVE with no patch cites art. 24 of d.lgs. 138/2024 instead of art. 21 of the NIS2 directive. The directive binds the Member States; in Italy the duty of essential and important entities to take security measures is art. 24 of the decree ("Obblighi in materia di misure di gestione dei rischi per la sicurezza informatica"), fetched from Normattiva. The scope note points to art. 3 of the decree, and the note on CVEs NVD has not analysed names the decree. Open item of the 2026-10-17 audit.
  • A verified text names the source that answered: Cellar, EUR-Lex (fallback) or Normattiva, instead of "EUR-Lex" whichever answered.
  • docs/nis2-compliance.md: www.normattiva.it is now contacted by scan when a critical CVE has no patch; test_nis2_evidence checks it against the mapping.

Same change as maksimtech/mailradar#63; law_fetcher.py is again identical to mailradar's apart from the name. law_cache and the cache format are untouched.

Tests (TDD, seen failing first)

  • tests/test_law_italian_sources.py, no mocks: Normattiva's art. 24 page recorded byte for byte on 2026-10-23 (sha256 3a2ace83…ee76), served by httpx.MockTransport at the HTTP boundary with the GDPR page already used; Cellar, EUR-Lex fallback, Normattiva and cache.
  • Existing law tests adapted; their fakes now replace fetch_provisions_from.
  • Hand mutants on every changed line, document included: all killed. Full suite: 2255 passed (release-script tests excluded on Windows); ruff and mypy clean.

🤖 Generated with Claude Code

…ered

The NIS2 directive binds the Member States: in Italy the duty of essential
and important entities to take security measures is art. 24 of d.lgs.
138/2024. A critical CVE with no patch now cites that article, downloaded
from Normattiva; the scope note and the note on CVEs not yet analysed name
the decree, and docs/nis2-compliance.md says when Normattiva is contacted
(open item of the 2026-10-17 audit).

A verified text said "verified against EUR-Lex" even though EU acts come
from Cellar, with EUR-Lex only as the fallback. fetch_provisions_from
returns the source that served the page, ActStatus carries it as
`origin`, and the report prints it. law_checker.check takes an optional
HTTP client, tested on recorded answers. law_fetcher.py is again the same
as mailradar's apart from the name.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@codspeed

codspeed Bot commented Oct 23, 2026 •

Copy link
Copy Markdown

Merging this PR will not alter performance

1 warning

⚠️ 11 benchmarks are dominated by system calls

System calls cannot be simulated consistently and are left out of the measure. The reported value understates the real cost. Switch to the Walltime instrument to measure them.

Learn more about system calls

See affected benchmarks

✅ 17 untouched benchmarks


Comparing fix/legal-citations (3cd1330) with main (e96aa60)

Open in CodSpeed

@codecov

codecov Bot commented Oct 23, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@sonarqubecloud

Copy link
Copy Markdown

@maksimtech
maksimtech merged commit 10c13ff into main Oct 23, 2026
25 checks passed
@maksimtech
maksimtech deleted the fix/legal-citations branch October 23, 2026 17:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant