Repository navigation
test(ci): cache, artifact and release security matrix runner (P7-CACHE-11) - #553
Merged
Merged
Conversation
…its drill (P7-CACHE-11) TestCacheSecMatrix runs every matrix.yaml case against the real stores and engines, compares outcome, code, reason key and audit row with the expected row and writes testdata/results.json. scripts/drill/cache-security/run runs it and checks the case to threat-model mapping.
…le limit, miss note
Contributor
Author
|
Folded into #543 (land/p7f-plugins) to land in one CI run. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
P7-CACHE-11: cache, artifact and release security matrix runner, results file and drill.
Base: land/p7f-plugins. Not for merge from this PR alone; findings below are filed against the owning tickets.
Measured on mm4 (darwin/arm64),
go test -tags cachesec -run TestCacheSecMatrix ./test/cachesec/, 41 cases mapped to TM-12..TM-24: 21 match, 20 differ. Results:free/ci/test/cachesec/testdata/results.json. Nothing was relaxed to make a case pass; every difference is reported as observed.Differences (all real component behaviour):
secret-snapshot(TM-12) andpartial-local(TM-15). Both return a clean cache miss (hit=false, 0 bytes restored): no refusal, no audit row.corrupt-localis E710 digest_mismatch (matrix: E711 blob_invalid);release-no-depsis reason deps_invalid (matrix: deps_failing).Rig fixes needed to run at all (test scaffolding, no check weakened): the remote-write rig made a second attempt on a job (a retry that admission refuses, E604) and now uses its own job; the transfer receiver rig set no per-file limit (zero refuses everything, E714 size_cap) and now sets 1 MiB.
Linux: not run (no workflow covers the cachesec tag; mm4 has no docker). Drill:
scripts/drill/cache-security/run --check-mapping.