eric/notarius
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Complete run state hardening audit

Browse Source
This commit is contained in:
Eric Rakestraw
2026-07-18 14:36:47 +00:00
parent e4ec521bed
commit 3c35124db4
7 changed files with 38 additions and 424 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
internal/core/debugbundle/bundle_test.go
View File

@@ -137,15 +137,15 @@ func TestSummaryWriterWritesEverySummaryArtifact(t *testing.T) {
}
}
}
func TestSummaryWriterConfinesArtifacts(t *testing.T) {
func TestSummaryWriterInternalWritesConfineArtifacts(t *testing.T) {
bundle, err := Allocate(t.TempDir(), testBundleRunID, time.Unix(0, 42))
if err != nil {
t.Fatal(err)
}
if err := bundle.Summary().WriteJSON("../outside.json", map[string]any{}); err == nil {
if err := bundle.Summary().writeJSON("../outside.json", map[string]any{}); err == nil {
t.Fatal("accepted traversal")
}
if err := bundle.Summary().WriteBytes(`trace\\x`, []byte("x")); err == nil {
if err := bundle.Summary().writeBytes(`trace\\x`, []byte("x")); err == nil {
t.Fatal("accepted backslash")
}
}

28
internal/core/debugbundle/summary.go
View File

@@ -67,40 +67,40 @@ func (w *SummaryWriter) WriteInvocation(payload Invocation) error {
if payload.StartedAt.IsZero() {
payload.StartedAt = w.createdAt
}
return w.WriteJSON(ArtifactInvocationMetadata, payload)
return w.writeJSON(ArtifactInvocationMetadata, payload)
}
func (w *SummaryWriter) WriteRedactedEffectiveConfig(payload RedactedSummaryPayload) error {
if payload == nil {
return fmt.Errorf("redacted summary payload must not be nil")
}
return w.WriteJSON(ArtifactEffectiveConfig, payload.RedactedSummaryPayload())
return w.writeJSON(ArtifactEffectiveConfig, payload.RedactedSummaryPayload())
}
func (w *SummaryWriter) WriteResolvedPipeline(payload RedactedResolvedPipelinePayload) error {
if payload == nil {
return fmt.Errorf("redacted resolved pipeline payload must not be nil")
}
return w.WriteJSON(ArtifactResolvedPipeline, payload.RedactedResolvedPipelinePayload())
return w.writeJSON(ArtifactResolvedPipeline, payload.RedactedResolvedPipelinePayload())
}
func (w *SummaryWriter) WriteResolvedReferences(v any) error {
return w.WriteJSON(ArtifactResolvedReferences, v)
func (w *SummaryWriter) WriteResolvedReferences(v []artifacts.ReferenceProvenance) error {
return w.writeJSON(ArtifactResolvedReferences, v)
}
func (w *SummaryWriter) WriteCheckpointEvents(v any) error {
return w.WriteJSON(ArtifactCheckpointEvents, v)
func (w *SummaryWriter) WriteCheckpointEvents(v []pipeline.CheckpointEvent) error {
return w.writeJSON(ArtifactCheckpointEvents, v)
}
func (w *SummaryWriter) WriteRunManifest(v artifacts.RunManifest) error {
return w.WriteJSON(ArtifactRunManifest, v)
return w.writeJSON(ArtifactRunManifest, v)
}
func (w *SummaryWriter) WriteChunkPlan(v artifacts.ChunkPlanSummary) error {
return w.WriteJSON(ArtifactChunkPlan, v)
return w.writeJSON(ArtifactChunkPlan, v)
}
func (w *SummaryWriter) WriteRunReport(v RunReport) error { return w.WriteJSON(ArtifactRunReport, v) }
func (w *SummaryWriter) WriteRunReport(v RunReport) error { return w.writeJSON(ArtifactRunReport, v) }
func (w *SummaryWriter) WriteWarnings(v []contracts.Warning) error {
return w.WriteJSON(ArtifactWarnings, v)
return w.writeJSON(ArtifactWarnings, v)
}
func (w *SummaryWriter) WriteError(message string) error {
return w.WriteBytes(ArtifactErrorLog, []byte(message+"\n"))
return w.writeBytes(ArtifactErrorLog, []byte(message+"\n"))
}
func (w *SummaryWriter) WriteJSON(name string, v any) error {
func (w *SummaryWriter) writeJSON(name string, v any) error {
if w == nil {
return fmt.Errorf("debug summary writer must not be nil")
}
@@ -109,7 +109,7 @@ func (w *SummaryWriter) WriteJSON(name string, v any) error {
}
return nil
}
func (w *SummaryWriter) WriteBytes(name string, v []byte) error {
func (w *SummaryWriter) writeBytes(name string, v []byte) error {
if w == nil {
return fmt.Errorf("debug summary writer must not be nil")
}