fix(security): refresh reviewed Semgrep audit checksum #68

Merged

gitchegumi merged 1 commit from kiyi/refresh-semgrep-audit into main

2026-09-30 20:01:28 -05:00

kiyi commented

2026-09-30 19:40:55 -05:00

Member

Failure

Renovate PR #6's image run 21 and source run 23 both fail with Semgrep rules changed upstream; review/update rules.lock.json: 0 blocking findings, 0 mitigations, 1 scanner error. Image compilation did not start. v1.25.0 is still the latest release and contains the prior rule-pack checksum.

Change and review

Refresh only the downloaded official p/security-audit pack checksum and record the dated review in docs/security.md. Two downloads (PowerShell and Python urllib, matching CI's client) agreed on SHA256 5509b33efc0c08e2134ccb76f2c7172065f7ba4a89f28799661029e274c306c7. The pack has 225 unique community rules: 48 ERROR, 172 WARNING, 5 INFO; 206 search rules and 19 taint rules. Reviewed the inventory and representative Dockerfile, Python and JavaScript/TypeScript security patterns. The prior payload was not retained, so identical detection behavior is not claimed.

This checksum verifies scanner input. Mitigations continue to use stable CVE/GHSA or scanner rule IDs plus affected scope; no mitigation or suppression is added. Future rule-pack changes still fail checksum verification. Licensed rule payloads are not committed or redistributed.

Validation

37 source-only security-policy tests pass, including stable matching across source-line movement and image rebuilds.
JSON lock / YAML parse, SHA256 and 225 unique rule IDs validate. git diff --check passes.
Broader local suite: 229 tests run, 3 skipped; 2 errors and 4 failed assertions are Windows environment limitations involving Linux /tmp and Bash canary execution. No local Docker build or real scanner/container test was run. Hosted Linux Library checks and Repository security must pass before merge/release.

Adoption

After review and passing hosted checks, merge and publish the next unused patch version (v1.25.1 is currently unused) through the protected Publish workflow release Action. Then update Renovate's paired workflow/library pins and rerun source/image checks. Renovate PR #6 remains WIP; patched compilation, compatibility, final-image findings and deployment remain unresolved.

Commit: 3b931de93b. Tracks Renovate #2.

## Failure [Renovate PR #6](https://git.gitchegumi.com/Homelab/renovate/pulls/6)'s [image run 21](https://git.gitchegumi.com/Homelab/renovate/actions/runs/21/jobs/0/attempt/1) and [source run 23](https://git.gitchegumi.com/Homelab/renovate/actions/runs/23/jobs/1/attempt/1) both fail with Semgrep rules changed upstream; review/update rules.lock.json: 0 blocking findings, 0 mitigations, 1 scanner error. Image compilation did not start. v1.25.0 is still the latest release and contains the prior rule-pack checksum. ## Change and review Refresh only the downloaded official p/security-audit pack checksum and record the dated review in docs/security.md. Two downloads (PowerShell and Python urllib, matching CI's client) agreed on SHA256 5509b33efc0c08e2134ccb76f2c7172065f7ba4a89f28799661029e274c306c7. The pack has 225 unique community rules: 48 ERROR, 172 WARNING, 5 INFO; 206 search rules and 19 taint rules. Reviewed the inventory and representative Dockerfile, Python and JavaScript/TypeScript security patterns. The prior payload was not retained, so identical detection behavior is not claimed. This checksum verifies scanner input. Mitigations continue to use stable CVE/GHSA or scanner rule IDs plus affected scope; no mitigation or suppression is added. Future rule-pack changes still fail checksum verification. Licensed rule payloads are not committed or redistributed. ## Validation - 37 source-only security-policy tests pass, including stable matching across source-line movement and image rebuilds. - JSON lock / YAML parse, SHA256 and 225 unique rule IDs validate. git diff --check passes. - Broader local suite: 229 tests run, 3 skipped; 2 errors and 4 failed assertions are Windows environment limitations involving Linux /tmp and Bash canary execution. No local Docker build or real scanner/container test was run. Hosted Linux Library checks and Repository security must pass before merge/release. ## Adoption After review and passing hosted checks, merge and publish the next unused patch version (v1.25.1 is currently unused) through the protected Publish workflow release Action. Then update Renovate's paired workflow/library pins and rerun source/image checks. [Renovate PR #6](https://git.gitchegumi.com/Homelab/renovate/pulls/6) remains WIP; patched compilation, compatibility, final-image findings and deployment remain unresolved. Commit: 3b931de93bde011f8f533db5775f420d75aa93db. Tracks [Renovate #2](https://git.gitchegumi.com/Homelab/renovate/issues/2).

kiyi added 1 commit

2026-09-30 19:40:55 -05:00

fix(security): refresh reviewed Semgrep audit checksum

Workflow acceptance / acceptance (pull_request) Successful in 1m37s

Details

Repository security / security-1 (pull_request) Successful in 6m43s

Details

Library checks / tests (pull_request) Successful in 7m4s

Details

3b931de93b