feat: v2.5.0 — Go 1.27 migration & codebase hardening - #114
Open
had-nu wants to merge 19 commits into
Open
Conversation
…feWriteFile/ReadFile); zero os.ReadFile+nosec outside
…s); zero Fprintf(os.Stderr) in pkg/*
… accept forwarders; wire cmd.Context()
…+ deprecated facade; move ConfigHash->internal/cpl, ReadReport->pkg/report; replace bubble-sorts with slices.SortFunc
…n main/evaluate entry points EvaluationPipeline runs the root wardex flow (config, correlation, gap analysis, gate, snapshot, report, exit code) without os.Exit or direct os.Stderr writes, logging through an injected *slog.Logger. RunGate owns the cmd/evaluate flow, returning the exit code for the caller to apply. main.go runWardex (28 lines) and cmd/evaluate runEvaluate (26 lines) now delegate all orchestration. config.ApplyProfile accepts io.Writer; forward syslog windows stub implements the ctx-based Send signature.
…ngci-lint clean - pkg/orchestrator coverage 83.5%: evaluation pipeline tests (basic flow, gate blocked, compliance fail, snapshot delta, missing config, invalid framework, min-confidence filter), gate pipeline tests (allow/block, strict unsealed, missing-EPSS, dry-run, csv/json output, sealed wexstate config, state store + trend, Article 14 active exploitation), and helper unit tests (gateLabel, riskColor, dryRunGate, hintMissingEPSS, overrides, formatDuration, isCI). - Fix collectCLIOverrides to not treat the zero-value gate mode as override. - Fuzz tests with property invariants: ingestion (id/name/maturity/layer/ context-weight invariants; caught and fixed unvalidated layer coercion in validateControl), pathguard (no workspace escape, null/overlong and pseudo-fs paths always rejected), verify (sign/verify round-trip, tamper and wrong-key rejection, corrupted batch signatures). - go test -race ./... passes; golangci-lint v2.13.1 (built with go1.27) clean. - CI pins golangci-lint v2.13.1 for the Go 1.27 module.
- CHANGELOG: add [2.5.0] entry covering Go 1.27 migration, orchestrator, safefile, slog, context propagation, pkg/accept decomposition, sorting, fuzzing, and lint/race hardening. - README (pt/en): document Go >= 1.27 requirement; Go badge to 1.27. - main.go: Version 2.5.0. - wardex-config.yaml: provenance node_id wardex-release-v2.5.0.
- pkg/ingestion: benchmarks for LoadYAML/LoadJSON/LoadCSV/LoadMany with 100-control fixtures; fixture setup excluded from the measured loop. - pkg/epss: benchmarks for Sign/Verify over 100-enrichment payloads. - doc/benchmarks/wardex-v2.5.0.md: baseline table satisfying the spec's no-regression comparison reference. - .golangci.yml: enable gomodguard_v2 (gomodguard deprecated in v2.12.0); lint now runs warning-free with 0 issues. - .gitignore: anchor benchmarks/ to repo root so doc/benchmarks can be tracked.
Critical fixes: 1. PathGuard symlink bypass (CVE-class): Fixed validatePath to check symlinks in parent directories of non-existent output files. Added resolveWithSymlinkCheck that walks path components and validates each existing component for symlink escapes. Added TestValidateOutputPath_SymlinkParentEscape. 2. Trust Store metadata manipulation: Enhanced VerifyRootSig to verify each KeyEntry.AddedSig against AddedBy signer, and each Revocation.Sig against RevokedBy admin signer. Previously only RootSig was verified, allowing role escalation via metadata modification. 3. Risk Acceptance hash validation: Added ConfigHash field to model.Acceptance and updated VerifyAll to check ReportHash and ConfigHash against current values. Set ReportMismatch and Stale flags appropriately. 4. NaN/Inf fail-open in risk engine: Added isValidScore validation in CalculateRisk for CVSSBase, EPSSScore, Criticality, and Effectiveness. Returns maximum risk (BLOCK) on NaN/Inf/out-of-range. 5. Arbitrary file write via os.WriteFile: Migrated 10 commands (art14, chain/seal, convert/grype/kev/sbom, policy, simulate, provenance/seal) to use cli.SafeWriteFile/cli.SafeOutputPath. 6. Atomic write symlink attack: Updated atomicwrite.Write to use os.CreateTemp with O_EXCL instead of path + '.tmp'. Tests: All fuzz tests pass (pathguard, ingestion, accept/verify), race detector clean, golangci-lint 0 issues.
- pkg/cli/pathguard.go: use strings.SplitSeq and range over iterator - pkg/epss/epss_benchmark_test.go: use range over int - pkg/ingestion/ingestion_benchmark_test.go: use range over int
The v1.1.4 crashes with panic when running on Go 1.27. v1.6.0 is the latest stable version compatible with Go 1.27.
Will re-enable when gosec releases a compatible version.
- CHANGELOG: comprehensive v2.5.0 entry covering all 12 critical security fixes, architecture hardening, tests/fuzzing, and breaking changes. - README.md / README-en.md: added v2.5.0 security hardening section with all 12 critical fixes, architecture hardening, tests/fuzzing; added Security badge.
- pkg/atomicwrite: 14 unit tests + 2 fuzz tests covering basic ops, atomicity, symlink attacks, overwrite, context cancellation, large data, permissions, directory sync, and concurrent writes. Fuzz tests find 5+ interesting inputs. - pkg/accept/store: 18 unit tests + 2 fuzz tests covering Load (empty, valid, tampered, expired, report/config hash mismatch, empty hashes), Append (new file, append, atomicity, concurrent), UpdateStatus (revoked, not found), AuditLog integration, LogsRejections. Fixed race in Append with file-path mutex. Fixed audit consistency check to only apply when auditPath provided. - pkg/atomicwrite: fixed ineffassign lint in test. All tests pass with -race, golangci-lint 0 issues.
- pkg/accept/forward: 18 unit tests + 3 fuzz tests covering ForwardMultiplexer (block/warn/best_effort policies, multiple backends), NotifyMultiplexer, WebhookNotifier (success, template error, HTTP error, timeout, unconfigured event), ENISABackend. Fuzz tests cover multiplexer dispatch, webhook notify, ENISA backend send. - pkg/accept/audit: 11 unit tests + 2 fuzz tests covering AuditLog (basic, UTC timestamp, zero timestamp, thread-safe, new file, permissions, invalid JSON), AuditCountCreated (empty, nonexistent, counts created, ignores other events, malformed line, empty lines). Fuzz tests cover log and count functions. All tests pass with -race, golangci-lint 0 issues.
- pkg/trust/fetch_test.go: Add context.Context to all FetchTrustStore calls - pkg/trust/trust_test.go: Add context.Context to SealConfig call - Both files: Add context import
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR implements the Wardex v2.5.0 specification: Go 1.27 migration and structural hardening.
Eixo A — Go 1.27 Migration
go.modtogo 1.27.0.github/workflows/ci.yml,docker.yml,release.yml)go fix ./...and resolved modernizationsEixo B — Architecture & Hardening
pkg/orchestrator— Extracted orchestration logic frommain.goandcmd/evaluate(God objects)pkg/cli/safefile.go— CentralizedSafeReadFile/SafeWriteFile(was duplicated in ~15 files)log/slogmigration — Replaced ad-hocfmt.Fprintf(os.Stderr, ...)logging acrosspkg/*andcmd/*context.Contextpropagation — Inpkg/epss,pkg/provenance,internal/notificationpkg/acceptrefactor — Split intostore,verify,audit,cli,rules,forwardsub-packagesslices.SortFuncTesting
All tests pass:
Breaking Changes
trust.FetchTrustStore(ctx, path)andtrust.SealConfig(ctx, ...)now requirecontext.Contextas first parameterpkg/acceptinternal structure changed (public API preserved)Closes: #v2.5.0-tracking