Make Semgrep finding fingerprints independent of report directories #40

New issue

Closed

opened 2026-09-18 11:55:06 -05:00 by kiyi · 1 comment

kiyi commented

2026-09-18 11:55:06 -05:00

Member

ComfyUI publisher run 40 failed on the same reviewed source audit that passes the PR gate. In v1.9.0/v1.10.0, pipeline/security.py downloads the pinned Semgrep pack beneath the scan output directory and hashes the returned check_id unchanged. Semgrep prefixes rule IDs with the config path by default.

The same scripts/source_http.py:28 finding (scanner semgrep, subject source, severity WARNING, rule suffix python.lang.security.audit.httpsconnection-detected.httpsconnection-detected) therefore differs only by its job directory:

Scan	Rule prefix	Fingerprint
PR	`tmp.reports.raw.`	`b15598f8611c539f329c41b22cec09e3ab5a291778f424f78f726e76a91079ad`
Publisher	`tmp.image-build.source-scans.raw.`	`f8900833243b96d2e56225bb55d25db11d59b8d6bbcf76f7d2522b8cbd0a8a1e`
Bundle	`tmp.built.scans.raw.`	`bf9afdf2ae5569cd8b820bcaaeea9c43d2b9175be0e12b2ece703f712b8e254d`

The first two hashes reproduce the recorded findings using the shared evaluator; the bundle variant is derived from the pinned bundle workflow directory, not a live bundle scan. Comfy-UI PR #5 proposes a narrow interim mapping with identical controls and October 18 expiry.

Acceptance:

Use stable Semgrep rule IDs independent of temporary output paths (evaluate --no-rewrite-rule-ids against the pinned scanner).
Prove the same finding has the same fingerprint across PR, publisher and bundle output directories, while distinct rules/files/locations remain distinct.
Explicitly migrate affected repository mitigations with review; preserve owner, controls, expiry and fail-closed behavior. Do not silently broaden fingerprint matching.
Release the shared correction and document caller adoption/removal of redundant directory-specific entries.

Follow-up defect to the completed baseline in #4. This issue records planned work; no shared scanner change or deployment has been performed.

ComfyUI [publisher run 40](https://git.gitchegumi.com/Homelab/Comfy-UI/actions/runs/40/jobs/2/attempt/1) failed on the same reviewed source audit that passes the PR gate. In v1.9.0/v1.10.0, `pipeline/security.py` downloads the pinned Semgrep pack beneath the scan output directory and hashes the returned `check_id` unchanged. Semgrep prefixes rule IDs with the config path by default. The same `scripts/source_http.py:28` finding (scanner `semgrep`, subject `source`, severity `WARNING`, rule suffix `python.lang.security.audit.httpsconnection-detected.httpsconnection-detected`) therefore differs only by its job directory: | Scan | Rule prefix | Fingerprint | |---|---|---| | PR | `tmp.reports.raw.` | `b15598f8611c539f329c41b22cec09e3ab5a291778f424f78f726e76a91079ad` | | Publisher | `tmp.image-build.source-scans.raw.` | `f8900833243b96d2e56225bb55d25db11d59b8d6bbcf76f7d2522b8cbd0a8a1e` | | Bundle | `tmp.built.scans.raw.` | `bf9afdf2ae5569cd8b820bcaaeea9c43d2b9175be0e12b2ece703f712b8e254d` | The first two hashes reproduce the recorded findings using the shared evaluator; the bundle variant is derived from the pinned bundle workflow directory, not a live bundle scan. [Comfy-UI PR #5](https://git.gitchegumi.com/Homelab/Comfy-UI/pulls/5) proposes a narrow interim mapping with identical controls and October 18 expiry. Acceptance: - [ ] Use stable Semgrep rule IDs independent of temporary output paths (evaluate `--no-rewrite-rule-ids` against the pinned scanner). - [ ] Prove the same finding has the same fingerprint across PR, publisher and bundle output directories, while distinct rules/files/locations remain distinct. - [ ] Explicitly migrate affected repository mitigations with review; preserve owner, controls, expiry and fail-closed behavior. Do not silently broaden fingerprint matching. - [ ] Release the shared correction and document caller adoption/removal of redundant directory-specific entries. Follow-up defect to the completed baseline in #4. This issue records planned work; no shared scanner change or deployment has been performed.

kiyi added this to the Homelab Roadmap project

2026-09-18 11:55:06 -05:00