fix: v0.5.45 — audit-pack.zip missing dotfile artifacts listed in manifest - #68
Merged
Conversation
…ifest zip -j "$output" * used a shell glob that doesn't match dotfiles, so .fusa.json and .fusa-reqs.json were correctly hashed into manifest.json but silently excluded from the actual archive. Fixed by building an explicit list of the exact basenames staged during the artifact loop and passing that to zip instead of relying on glob expansion. Closes #67 Signed-off-by: Matt Jones <47545907+SoundMatt@users.noreply.github.com>
Mirrors the same requirement already noted in cmd/cfusa/cmd_audit_pack.c. Strict-C99 Linux toolchains (clang/gcc on ubuntu-22.04 in CI) don't expose popen/pclose without it, which broke the new audit-pack regression test on Linux while passing on macOS. Signed-off-by: Matt Jones <47545907+SoundMatt@users.noreply.github.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
- Replace shell-based `unzip -l` verification (popen) with a direct
byte-scan of the archive, removing a CWE-78 (non-literal command
execution) flag entirely and the CI dependency on `unzip`/POSIX
popen declarations.
- Create the test .fusa-reqs.json via open()+fdopen() with mode 0600
instead of fopen(path, "w"), matching the existing convention in
tests/test_hlr_llr.c and other test files, to avoid a
world-writable-file-creation alert.
- Drop the access()-before-fopen() check (CWE-362 TOCTOU) in favor of
asserting cmd_init's own return code.
- Split `char *argv[] = {..., "--flag", ...}` declarations onto
separate assignment lines: the combination of the array's `*` and
a `--flag` string literal on the same source line was tripping the
CFUSA-A006 pointer-arithmetic heuristic, which is a plain textual
match unrelated to the actual (harmless) code.
- Rename the test function so it no longer contains the substring
"des_" (from "includes_dotfile"), which was matching the CS-7
weak-crypto-DES heuristic.
None of this changes what issue #67's fix or its regression test
actually verify -- it only removes false positives / true-but-benign
findings so c-FuSa's own dogfooding scan of its test suite stays
clean, matching this repo's existing code-scanning gate.
Signed-off-by: Matt Jones <47545907+SoundMatt@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
cmd_audit_packstaged and hashed.fusa.json/.fusa-reqs.jsoncorrectly intomanifest.json, but built the final archive withzip -j "$output" *— a shell glob that does not match dotfiles by default, so both files were silently dropped from the actual zip while still being claimed (with valid hashes) in the manifest.zip -jinstead of relying on any glob expansion.test_audit_pack_includes_dotfile_artifacts, which runs a realaudit-packinvocation and asserts every dotfile artifact is actually present in the resulting archive (not just referenced in the manifest).Closes #67
Test plan
cmake --build build— clean buildctest --test-dir build --output-on-failure— 38/38 test binaries pass, 0 failurescfusa audit-packand confirmed.fusa.json/.fusa-reqs.jsonnow appear inunzip -loutput alongside the manifest