fix(evidence): refuse record on unborn HEAD, atomic artifact writes - #183
Merged
Merged
Conversation
…cally An unborn-HEAD repository produced a signed artifact with an empty head_oid that verify can never accept (the schema requires a 40/64-hex commit). Record now fails closed with GDS_SESSION_EVIDENCE_BASELINE_UNAVAILABLE before signing, so no unverifiable artifact enters the hash chain. Artifact writes now go through a 0600 temporary file plus rename, so a crash cannot leave a truncated artifact at the final path. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Code-review findings on the session-evidence implementation (released in gds-v0.9.10):
gds evidence recordon a repository with zero commits signed and wrote an artifact whosehead_oidis empty — the schema requires a 40/64-hex commit, soverifypermanently rejects it, and its digest still entered the local hash chain. Record now fails closed withGDS_SESSION_EVIDENCE_BASELINE_UNAVAILABLEbefore signing.os.WriteFilecould leave a truncated artifact at the final path on crash. Writes now go through a0600temporary file in the same directory plus rename.Test plan
TestEvidenceRecordRefusesUnbornHead: record on an unborn repo refuses with the expected finding and writes no artifactgo test ./core/app ./core/cli ./core/sessionevidence— all passgo vet,gofmt— cleanscripts/validate_gds_schemas.py— succeededGDS_SESSION_EVIDENCE_BASELINE_UNAVAILABLEwithhead_mode: unborn; normal record still succeeds, artifact mode0600, hash chain intact, no temp-file leftoversop_01M2Y3AR3BM7642DQT57YST6BS(verified)Generated with Devin