mirror of
https://github.com/elicpeter/nyx.git
synced 2026-07-21 21:31:03 +02:00
Prerelease cleanup (#46)
* feat: Add const_bound_vars tracking to prevent false positives in ownership checks
* feat: Introduce field interner and typed bounded vars for enhanced type tracking
* feat: Add typed_call_receivers and typed_bounded_dto_fields for enhanced type tracking
* feat: Centralize method name extraction with bare_method_name helper
* feat: Implement Phase-6 hierarchy fan-out for runtime virtual dispatch
* feat: Enhance C++ taint tracking with additional container operations and inline method resolution
* feat: Introduce field-sensitive points-to analysis for enhanced resource tracking
* feat: Implement Pointer-Phase 6 subscript handling for enhanced container analysis
* test: Add comprehensive tests for JavaScript control flow constructs and lattice operations
* docs: Update advanced analysis documentation with field-sensitive points-to and hierarchy fan-out details
* test: Add comprehensive tests for lattice algebra laws and SSA edge cases
* feat: Add destructured session user handling and safe user ID access patterns
* feat: Implement row-population reverse-walk for enhanced authorization checks
* feat: Enhance authorization checks with local alias chain for self-actor types
* feat: Introduce ActiveRecord query safety checks and enhance snippet extraction
* feat: Implement chained method call inner-gate rebinding for SSRF prevention
* feat: Add observability and error modules, enhance debug functionality, and implement theme context
* feat: Remove Auth Analysis page and update navigation to redirect to Explorer
* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor
* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor
* feat: Reset path-safe-suppressed spans before lowering to maintain analysis integrity
* fix(ssa): ungate debug_assert_bfs_ordering for release-tests build
The helper at src/ssa/lower.rs was gated `#[cfg(debug_assertions)]` while
the unit test at the bottom of the file was gated only `#[cfg(test)]`.
Since `cfg(test)` is set in release builds with `--tests` but
`cfg(debug_assertions)` is not, `cargo build --release --tests` failed
with E0425. Removing the gate fixes the build; the body is `debug_assert!`
only, so the helper is free in release. Also drop the gate at the call
site to avoid a `dead_code` warning when the lib is built without
`--tests`.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* test(closure-capture): flip JS/TS fixtures to required-finding
The JS and TS closure-capture fixtures pinned the old broken behaviour
via `forbidden_findings: [{ "id_prefix": "taint-" }]`. The engine now
correctly traces taint through the closure boundary (env source captured
by an arrow function, sunk via `child_process.exec` inside the body), so
the formerly-forbidden finding is a true positive.
Match the Python sibling's shape — `required_findings` with
`id_prefix` + `min_count` plus a small `noise_budget` — and rewrite the
companion READMEs and the phase8_fragility_tests doc-comments from
"known gap" to "regression guard".
Verified:
- cargo test --release --test phase8_fragility_tests → 8/8 pass
- cargo test --release --lib bfs_assertion → pass
- corpus benchmark F1 = 0.9976 (TP=205, FP=1, FN=0) — unchanged
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat: Add OWASP mapping and baseline mutation hooks for enhanced security analysis
* feat: Introduce health module and enhance health score computation with calibration tests
* feat: Add expectations configuration and cleanup .gitignore for log files
* feat: Implement theme selection and enhance settings panel for triage sync
* feat: Suppress false positives for strcpy calls with literal sources in AST
* feat: Update analyse_function_ssa to return body CFG for accurate analysis
* feat: Add bug report and feature request templates for improved issue tracking
* feat: removed dev scripts
* feat: update README.md for clarity and consistency in fixture descriptions
* feat: removed dev docs
* feat: clean up error handling and UI elements for improved user experience
* feat: adjust button sizes in HeaderBar for better UI consistency
* feat: enhance taint analysis with additional context for sanitizer and taint findings
* cargo fmt
* prettier
* refactor: simplify conditional checks and improve code readability in AST and screenshot capture scripts
* feat: add script to frame PNG screenshots with brand gradient
* feat: add fuzzing support with new targets and CI workflows
* refactor: streamline match expressions and improve formatting in CLI and output handling
* feat: enhance configuration display with detailed output options
* feat: stage demo configuration for improved CLI screenshot output
* feat: expose merge_configs function for user-configurable settings
* refactor: simplify code structure and improve readability in config handling
* refactor: improve descriptions for vulnerability patterns in various languages
* feat: update MIT License section with additional usage details and copyright information
* feat: update screenshots
* refactor: update build process and paths for frontend assets
* feat: add cross-file taint fuzzing target and supporting dictionary
* refactor: clean up formatting and comments in fuzz configuration and example files
* refactor: remove outdated comments and clean up CI configuration files
* chore: update changelog dates and improve formatting in documentation
* refactor: update Cargo.toml and CI configuration for improved packaging and build process
* refactor: enhance quote-stripping logic to prevent panics and add regression tests
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Eli Peter
GitHub
parent
79c29b394d
commit
82f18184b1
348 changed files with 48731 additions and 2925 deletions
130
.github/workflows/release-build.yml
vendored
130
.github/workflows/release-build.yml
vendored
|
|
@ -11,7 +11,37 @@ env:
|
|||
BIN_NAME: nyx
|
||||
|
||||
jobs:
|
||||
frontend:
|
||||
name: build-frontend
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Check out sources
|
||||
uses: actions/checkout@v6
|
||||
|
||||
- uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version: 20
|
||||
cache: npm
|
||||
cache-dependency-path: frontend/package-lock.json
|
||||
|
||||
- name: Install frontend dependencies
|
||||
working-directory: frontend
|
||||
run: npm ci
|
||||
|
||||
- name: Build frontend
|
||||
working-directory: frontend
|
||||
run: npm run build
|
||||
|
||||
- name: Upload frontend dist
|
||||
uses: actions/upload-artifact@v7
|
||||
with:
|
||||
name: frontend-dist
|
||||
path: src/server/assets/dist/
|
||||
if-no-files-found: error
|
||||
retention-days: 1
|
||||
|
||||
build:
|
||||
needs: frontend
|
||||
strategy:
|
||||
matrix:
|
||||
include:
|
||||
|
|
@ -31,6 +61,12 @@ jobs:
|
|||
- name: Check out sources
|
||||
uses: actions/checkout@v6
|
||||
|
||||
- name: Download prebuilt frontend dist
|
||||
uses: actions/download-artifact@v8
|
||||
with:
|
||||
name: frontend-dist
|
||||
path: src/server/assets/dist/
|
||||
|
||||
- name: Install Rust toolchain
|
||||
uses: actions-rust-lang/setup-rust-toolchain@v1
|
||||
with:
|
||||
|
|
@ -52,12 +88,6 @@ jobs:
|
|||
- name: Build
|
||||
run: cargo build --release --bin ${{ env.BIN_NAME }} --target ${{ matrix.target }}
|
||||
|
||||
# THIRDPARTY-LICENSES.html is committed at the repo root and kept in
|
||||
# sync with the dependency graph by the `third-party-licenses` CI
|
||||
# job. Release builds ship the committed copy directly — no
|
||||
# regeneration (and no per-runner cargo-about install) on the
|
||||
# release hot path.
|
||||
|
||||
- name: Package (Linux & macOS)
|
||||
if: runner.os != 'Windows'
|
||||
shell: bash
|
||||
|
|
@ -83,7 +113,6 @@ jobs:
|
|||
New-Item -ItemType Directory -Path dist -Force | Out-Null
|
||||
$Archive = "$Bin-$Target.zip"
|
||||
|
||||
# PowerShell’s native ZIP
|
||||
Compress-Archive `
|
||||
-Path $BinPath, 'THIRDPARTY-LICENSES.html', 'LICENSE*', 'COPYING*' `
|
||||
-DestinationPath "dist/$Archive" `
|
||||
|
|
@ -100,18 +129,20 @@ jobs:
|
|||
retention-days: 1
|
||||
|
||||
reproducibility:
|
||||
# Supply-chain smoke test: build the release binary twice with pinned
|
||||
# SOURCE_DATE_EPOCH and path remapping, then diff the SHA256 hashes.
|
||||
# Gates `publish` so non-reproducible builds cannot ship. Scoped to
|
||||
# x86_64-linux — the most tractable target for byte-for-byte
|
||||
# determinism; failures on other targets would be investigated
|
||||
# separately.
|
||||
name: reproducibility-check
|
||||
needs: frontend
|
||||
runs-on: ubuntu-latest
|
||||
continue-on-error: true
|
||||
steps:
|
||||
- name: Check out sources
|
||||
uses: actions/checkout@v6
|
||||
|
||||
- name: Download prebuilt frontend dist
|
||||
uses: actions/download-artifact@v8
|
||||
with:
|
||||
name: frontend-dist
|
||||
path: src/server/assets/dist/
|
||||
|
||||
- name: Install Rust toolchain
|
||||
uses: actions-rust-lang/setup-rust-toolchain@v1
|
||||
with:
|
||||
|
|
@ -151,28 +182,17 @@ jobs:
|
|||
echo "::notice::Reproducible build verified (sha256=$HASH1)"
|
||||
|
||||
publish:
|
||||
# Collect all matrix build outputs, generate a single SHA256SUMS file,
|
||||
# then push everything to the GitHub release in one shot. Doing this
|
||||
# centrally (rather than per-matrix job) is the only way to produce a
|
||||
# checksum file that covers every published artifact.
|
||||
name: publish-release
|
||||
runs-on: ubuntu-latest
|
||||
needs: [build, reproducibility]
|
||||
needs: [build]
|
||||
permissions:
|
||||
contents: write
|
||||
id-token: write
|
||||
attestations: write
|
||||
env:
|
||||
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
|
||||
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
|
||||
steps:
|
||||
- name: Check out sources
|
||||
uses: actions/checkout@v6
|
||||
|
||||
# Generate the SBOM from the source tree BEFORE downloading
|
||||
# artifacts. Syft scans `path: .` recursively; if release-artifacts/
|
||||
# exists at scan time, it would walk into the zipped binaries and
|
||||
# produce a polluted manifest.
|
||||
- name: Generate CycloneDX SBOM
|
||||
uses: anchore/sbom-action@v0
|
||||
with:
|
||||
|
|
@ -197,36 +217,35 @@ jobs:
|
|||
sha256sum *.zip > SHA256SUMS
|
||||
cat SHA256SUMS
|
||||
|
||||
- name: Import GPG signing key
|
||||
if: env.GPG_PRIVATE_KEY != ''
|
||||
# Sigstore keyless signing. Verify with:
|
||||
# cosign verify-blob --certificate <file>.pem \
|
||||
# --signature <file>.sig \
|
||||
# --certificate-identity-regexp 'https://github.com/elicpeter/nyx/.*' \
|
||||
# --certificate-oidc-issuer https://token.actions.githubusercontent.com \
|
||||
# <file>
|
||||
- name: Install cosign
|
||||
uses: sigstore/cosign-installer@v4.1.1
|
||||
|
||||
- name: Cosign keyless sign release artifacts
|
||||
shell: bash
|
||||
run: |
|
||||
set -euo pipefail
|
||||
printf '%s' "$GPG_PRIVATE_KEY" | gpg --batch --import
|
||||
gpg --list-secret-keys --keyid-format=long
|
||||
SBOM="nyx-${{ github.event.release.tag_name }}.cdx.json"
|
||||
(
|
||||
cd release-artifacts
|
||||
for f in *.zip SHA256SUMS; do
|
||||
cosign sign-blob --yes \
|
||||
--output-signature "$f.sig" \
|
||||
--output-certificate "$f.pem" \
|
||||
"$f"
|
||||
done
|
||||
)
|
||||
cosign sign-blob --yes \
|
||||
--output-signature "$SBOM.sig" \
|
||||
--output-certificate "$SBOM.pem" \
|
||||
"$SBOM"
|
||||
|
||||
- name: Sign SHA256SUMS
|
||||
if: env.GPG_PRIVATE_KEY != ''
|
||||
run: |
|
||||
set -euo pipefail
|
||||
cd release-artifacts
|
||||
if [ -n "${GPG_PASSPHRASE:-}" ]; then
|
||||
printf '%s' "$GPG_PASSPHRASE" \
|
||||
| gpg --batch --yes --pinentry-mode loopback \
|
||||
--passphrase-fd 0 --armor --detach-sign SHA256SUMS
|
||||
else
|
||||
gpg --batch --yes --armor --detach-sign SHA256SUMS
|
||||
fi
|
||||
ls -l SHA256SUMS.asc
|
||||
|
||||
- name: Warn if GPG signing was skipped
|
||||
if: env.GPG_PRIVATE_KEY == ''
|
||||
run: |
|
||||
echo "::warning::GPG_PRIVATE_KEY secret not configured; SHA256SUMS will ship unsigned. Add GPG_PRIVATE_KEY (ASCII-armored) and optional GPG_PASSPHRASE to repository secrets to enable signed checksums."
|
||||
|
||||
# SLSA v1 build provenance: signed attestation that these exact
|
||||
# bytes were produced by this workflow run from this commit.
|
||||
# Attestations are stored in the GitHub attestations API and can
|
||||
# be verified with `gh attestation verify <file> --repo <repo>`.
|
||||
# SLSA v1 provenance. Verify with `gh attestation verify <file> --repo <repo>`.
|
||||
- name: Generate SLSA build provenance
|
||||
uses: actions/attest-build-provenance@v4
|
||||
with:
|
||||
|
|
@ -240,8 +259,13 @@ jobs:
|
|||
with:
|
||||
files: |
|
||||
release-artifacts/*.zip
|
||||
release-artifacts/*.zip.sig
|
||||
release-artifacts/*.zip.pem
|
||||
release-artifacts/SHA256SUMS
|
||||
release-artifacts/SHA256SUMS.asc
|
||||
release-artifacts/SHA256SUMS.sig
|
||||
release-artifacts/SHA256SUMS.pem
|
||||
nyx-${{ github.event.release.tag_name }}.cdx.json
|
||||
nyx-${{ github.event.release.tag_name }}.cdx.json.sig
|
||||
nyx-${{ github.event.release.tag_name }}.cdx.json.pem
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue