Feat/v2.5.0 go127 - #113
Merged
Merged
Conversation
…feWriteFile/ReadFile); zero os.ReadFile+nosec outside
…s); zero Fprintf(os.Stderr) in pkg/*
… accept forwarders; wire cmd.Context()
…+ deprecated facade; move ConfigHash->internal/cpl, ReadReport->pkg/report; replace bubble-sorts with slices.SortFunc
…n main/evaluate entry points EvaluationPipeline runs the root wardex flow (config, correlation, gap analysis, gate, snapshot, report, exit code) without os.Exit or direct os.Stderr writes, logging through an injected *slog.Logger. RunGate owns the cmd/evaluate flow, returning the exit code for the caller to apply. main.go runWardex (28 lines) and cmd/evaluate runEvaluate (26 lines) now delegate all orchestration. config.ApplyProfile accepts io.Writer; forward syslog windows stub implements the ctx-based Send signature.
…ngci-lint clean - pkg/orchestrator coverage 83.5%: evaluation pipeline tests (basic flow, gate blocked, compliance fail, snapshot delta, missing config, invalid framework, min-confidence filter), gate pipeline tests (allow/block, strict unsealed, missing-EPSS, dry-run, csv/json output, sealed wexstate config, state store + trend, Article 14 active exploitation), and helper unit tests (gateLabel, riskColor, dryRunGate, hintMissingEPSS, overrides, formatDuration, isCI). - Fix collectCLIOverrides to not treat the zero-value gate mode as override. - Fuzz tests with property invariants: ingestion (id/name/maturity/layer/ context-weight invariants; caught and fixed unvalidated layer coercion in validateControl), pathguard (no workspace escape, null/overlong and pseudo-fs paths always rejected), verify (sign/verify round-trip, tamper and wrong-key rejection, corrupted batch signatures). - go test -race ./... passes; golangci-lint v2.13.1 (built with go1.27) clean. - CI pins golangci-lint v2.13.1 for the Go 1.27 module.
- CHANGELOG: add [2.5.0] entry covering Go 1.27 migration, orchestrator, safefile, slog, context propagation, pkg/accept decomposition, sorting, fuzzing, and lint/race hardening. - README (pt/en): document Go >= 1.27 requirement; Go badge to 1.27. - main.go: Version 2.5.0. - wardex-config.yaml: provenance node_id wardex-release-v2.5.0.
- pkg/ingestion: benchmarks for LoadYAML/LoadJSON/LoadCSV/LoadMany with 100-control fixtures; fixture setup excluded from the measured loop. - pkg/epss: benchmarks for Sign/Verify over 100-enrichment payloads. - doc/benchmarks/wardex-v2.5.0.md: baseline table satisfying the spec's no-regression comparison reference. - .golangci.yml: enable gomodguard_v2 (gomodguard deprecated in v2.12.0); lint now runs warning-free with 0 issues. - .gitignore: anchor benchmarks/ to repo root so doc/benchmarks can be tracked.
Critical fixes: 1. PathGuard symlink bypass (CVE-class): Fixed validatePath to check symlinks in parent directories of non-existent output files. Added resolveWithSymlinkCheck that walks path components and validates each existing component for symlink escapes. Added TestValidateOutputPath_SymlinkParentEscape. 2. Trust Store metadata manipulation: Enhanced VerifyRootSig to verify each KeyEntry.AddedSig against AddedBy signer, and each Revocation.Sig against RevokedBy admin signer. Previously only RootSig was verified, allowing role escalation via metadata modification. 3. Risk Acceptance hash validation: Added ConfigHash field to model.Acceptance and updated VerifyAll to check ReportHash and ConfigHash against current values. Set ReportMismatch and Stale flags appropriately. 4. NaN/Inf fail-open in risk engine: Added isValidScore validation in CalculateRisk for CVSSBase, EPSSScore, Criticality, and Effectiveness. Returns maximum risk (BLOCK) on NaN/Inf/out-of-range. 5. Arbitrary file write via os.WriteFile: Migrated 10 commands (art14, chain/seal, convert/grype/kev/sbom, policy, simulate, provenance/seal) to use cli.SafeWriteFile/cli.SafeOutputPath. 6. Atomic write symlink attack: Updated atomicwrite.Write to use os.CreateTemp with O_EXCL instead of path + '.tmp'. Tests: All fuzz tests pass (pathguard, ingestion, accept/verify), race detector clean, golangci-lint 0 issues.
- pkg/cli/pathguard.go: use strings.SplitSeq and range over iterator - pkg/epss/epss_benchmark_test.go: use range over int - pkg/ingestion/ingestion_benchmark_test.go: use range over int
The v1.1.4 crashes with panic when running on Go 1.27. v1.6.0 is the latest stable version compatible with Go 1.27.
Will re-enable when gosec releases a compatible version.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Related Issue
Closes #
Type of Change
How Has This Been Tested?
go build ./...go test ./... -count=1go vet ./...Checklist
UX por Perfil