Conversation
|
This PR is so big! Please, split it 😊 |
|
This PR is so big! Please, split it 😊 |
Kyber PQ KEM is still being worked on and has an active draft: https://datatracker.ietf.org/doc/html/draft-cfrg-schwabe-kyber-04. Additionally, the hybrid scheme that combines X25519 and Kyber is also in the drafting phase: https://www.ietf.org/archive/id/draft-tls-westerbaan-xyber768d00-02.html Given this, it makes no sense for us to provide support for Kyber-based KEMs.
|
This PR is so big! Please, split it 😊 |
instant is no longer maintained the recommended alternative is web-time.
|
This PR is so big! Please, split it 😊 |
They're just too big and overflow the stack when they run.
|
This PR is so big! Please, split it 😊 |
…lsGroup`" This reverts commit 4215403.
|
This PR is so big! Please, split it 😊 |
This allows creating a commit from proposals without sending the proposals over the wire first.
Previously, the tree shrink function would be called eagerly after each remove proposal. If the shrink threshold was reached, the blanked out nodes were removed from the diff tree. If there were additional add proposals in a commit that triggered the tree to grow again, this resulted in incorrect state if there were FEWER add proposals than remove proposals. That's because the blanked out nodes removed during shrinking were not re-added during growing. To fix this, we don't shrink/trim the tree eagerly after each remove proposal, but after remove and add proposals have been processed.
This proves that we don't suffer from the bug fixed in openmls/openmls@26eaa4d0e
|
|
It's been broken for a long time.
This is long overdue.
We're going to need the Generate trait.
(cherry picked from commit f24eb69)
It was dropped in upstream commit 6d36342, and prior to that it was commented out.
(cherry picked from commit ad36084)
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 3 to 4. - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@v3...v4) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
![semgrep-code-wireapp[bot]](https://avatars.githubusercontent.com/u/16047324?s=60&v=4){kind=small}
|
|
||
| - name: Upload to codecov.io | ||
| uses: codecov/codecov-action@v3 | ||
| uses: codecov/codecov-action@v4 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
The coverage-upload step runs codecov/codecov-action@v4, a mutable tag that can be silently repointed to malicious code. A compromised action could execute on the CI runner and access the checked-out repository, coverage files, environment variables, and available CI credentials.
More details about this
check runs codecov/codecov-action@v4 in the Upload to codecov.io step. Because v4 is a mutable tag rather than an immutable commit reference, the action owner—or an attacker who gains control of that repository—can silently repoint it to malicious workflow code.
A plausible attack is:
- An attacker compromises the
codecov/codecov-actionrepository and moves thev4tag to a malicious commit. - A subsequent run of this workflow resolves
codecov/codecov-action@v4to that commit. - The malicious action executes on the
ubuntu-latestrunner after the repository has been checked out and coverage data has been created byRun profiling testsandRun grcov. - It can read the workspace, including the generated
target/debug/coverage/lcov, inspect environment variables and availableGITHUB_TOKENpermissions, and exfiltrate source code, credentials, or other CI data before uploading the coverage file.
The same mutable-reference risk is also present in the nearby actions/checkout@v3, dtolnay/rust-toolchain@nightly, and Swatinem/rust-cache@v2 steps, but this finding is for codecov/codecov-action@v4.
To resolve this comment:
✨ Commit fix suggestion
- Replace the mutable
v4tag with the full 40-character commit SHA for the intendedcodecov/codecov-actionv4 release, for example:uses: codecov/codecov-action@<40-character-commit-sha>. - Verify that the SHA belongs to the expected
codecov/codecov-actionv4 release before applying it. - Keep the existing
withconfiguration unchanged, includingfiles: target/debug/coverage/lcov.
Pinning the commit SHA prevents the action reference from changing silently if the tag is moved.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
You can view more details about this finding in the Semgrep AppSec Platform.
8 participants
No description provided.