Repository navigation
Conversation
…ot created here (D-1322) Local source trust read every rewrite (rebase step, commit --amend, cherry-pick) as a commit created on this machine, so rebasing or amending a stranger's pull request, or cherry-picking one of its commits, classified the run owner. - A rewritten commit is a replay when its patch (added and removed lines, whitespace and hunk positions ignored, file order free) equals a commit that arrived here: reachable from a remote-tracking ref, refs/pull/*, a FETCH_HEAD line or a reflog arrival entry, off the default branch, and not made here. - A cherry-pick counts as made here only when its patch equals a commit made here (not itself a cherry-pick) or one on the default branch, which covers a source commit nothing refers to any more. - A replay keeps the owner path closed and is reported as local.replayed_arrived_patch; patches that could not be compared close it too. - Red team D01-D03 run as regular tests; real-git fixtures cover the stranger's replays and the operator's own rebased, amended and cherry-picked commits (pushed or not), which stay owner.
…fts never raise trust (D-1322, D-1431) - A rebase step, amend or cherry-pick counts as created here only when its patch equals a commit made here (or on the default branch), or, for an amend, the commit it amended counts (older reflog neighbour, same parents). A rewrite of a stranger's commit no longer reads as owner when nothing refers to the original any more. Reason: local.rewrite_not_made_here. - D04: a fetch refspec destination with a glob anywhere (gh-pr/*/head) is excluded up to its first glob, so a mapped pull request is not an origin branch. - D06: a grafts file (info/grafts or $GIT_GRAFT_FILE) makes the history unknown: untrusted with local.history_grafted, before the reachability path. - Red team D04 and D06 run as regular tests; new fixtures cover a rebased or amended stranger commit with its original gone, own amends chained into a rebase, the mid-path glob and both grafts sources.
acamarata
changed the title
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes D-1322 (high) and D-1431 (medium, D01-D04 and D06) in TRUST local source trust. Both block P7-TRUST-99.
D-1322: rewrites of someone else's commit
Root cause: every rebase step,
commit --amendandcherry-pickcounted as a commit created on this machine. A stranger's pull request that was rebased, amended or cherry-picked therefore classified asowner.Fix (
internal/run/trust_git_patch.go,internal/trust/source/local.go): a rewrite counts as created here only when its change has a source made here. That means one of two things:A rewrite of a stranger's commit never counts, even when nothing refers to the original any more (branch deleted, FETCH_HEAD overwritten, reflog entries gone). Reason:
local.rewrite_not_made_here. If the patches cannot be compared, the owner path stays closed for rewritten commits.These cases fail closed and need
--trust owner: a rebase step where you resolved conflicts, a squash or fixup, your own commits rewritten on another machine, and an amend whose original reflog entry has expired.D-1431: D04 and D06
refs/heads/*is now excluded up to the first glob in its destination.refs/remotes/origin/gh-pr/*/headis no longer read as an origin branch.info/graftsor$GIT_GRAFT_FILE) makes the history unknown. The checkout is classifieduntrusted(local.history_grafted), and this check runs before reachability.Tests (mm4, darwin/arm64)
TestD01-TestD04andTestD06(-tags security) are now regular tests. On origin/main 3d7da3f, D01-D03 give owner [local.created_here], D04 gives collaborator [local.on_origin_ref], and D06 gives owner [local.reachable_from_default].replay_test.go: pure tests, plus real-git fixtures for these cases:owner.go test ./...and-tags security ./test/security/...: all new and touched tests pass. The remaining failures also fail on pristine origin/main on mm4: attest TestProfile_, gates/truth TestDrill, nodes/registry, cloudvm, run TestInfraPostsError, test/security TestApproval*/TestCotenancy*/TestRecordedForkPR*, and redteam C37, C38 and D13. Architecture checks pass.The trust guide is updated. The Epic D17 amendment and the debt rows are in nself-org/hq#36.