fix(release): require canonical lowercase source SHA - #443
Conversation
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
📝 WalkthroughWalkthrough배포 및 릴리스 증거 검증이 소문자 canonical SHA와 digest를 요구하도록 변경되었습니다. 입력의 공백과 대문자를 더 이상 정규화하지 않습니다. timestamp 검증은 ISO 형식과 실제 달력 날짜를 확인합니다. 관련 실패 테스트가 추가되었습니다. ChangesCanonical 증거 검증
Estimated code review effort: 3 (Moderate) | ~20 minutes ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| function requireTimestamp(value, label) { | ||
| const timestamp = requireString(value, label); | ||
| if (Number.isNaN(Date.parse(timestamp))) { | ||
| fail(`${label} must be an ISO-compatible timestamp`); | ||
| const calendar = timestamp.match(isoCalendarPrefixPattern); | ||
| const timestampMilliseconds = Date.parse(timestamp); | ||
| if (timestamp !== value || !calendar || !Number.isFinite(timestampMilliseconds)) { | ||
| fail(`${label} must be a canonical ISO-compatible timestamp with a valid calendar date`); | ||
| } | ||
| const year = Number(calendar[1]); | ||
| const month = Number(calendar[2]); | ||
| const day = Number(calendar[3]); | ||
| const leapYear = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0); | ||
| const daysPerMonth = [31, leapYear ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31]; | ||
| if (month < 1 || month > 12 || day < 1 || day > daysPerMonth[month - 1]) { | ||
| fail(`${label} must be a canonical ISO-compatible timestamp with a valid calendar date`); | ||
| } | ||
| return timestamp; | ||
| } |
There was a problem hiding this comment.
🔍 Timestamp validation broadened beyond commit-SHA scope
requireTimestamp (scripts/deployment-evidence.mjs:47-63) now rejects any timestamp lacking the YYYY-MM-DDT prefix, differing from its trimmed form, or naming an impossible calendar date. It runs on externally sourced values: the Wrangler deploy timestamp (scripts/deployment-evidence.mjs:237) and Cloudflare created_on (scripts/deployment-evidence.mjs:256). Both emit RFC3339/ISO today, so no regression is expected, but a space-separated or offset variant would now fail closed.
Was this helpful? React with 👍 or 👎 to provide feedback.
1 participant
Scope
Tighten buyer-verifiable release/deployment evidence so commit and digest identities are accepted only in their canonical byte/string representation rather than being case-folded or whitespace-normalized before persistence.
Test-first repairs
Release source SHA
5f4c34dc93abf56244e604e5459014d9875e1359: uppercase 40-hex SHA with a matching archive name reaches the real release-evidence entrypoint and must fail closed.f95d748821948b51de27314cb6b3772f1f1dd509: require lowercase 40-hex.98dcf9739a1293b0a467daf8c1e2a9651e0ef23f: whitespace-wrapped environment SHA with a canonical archive filename demonstrates thatrequireString()can otherwise normalize authority before validation.1bd0e36b29a923d86e41caf5cfadda76d42d2d87: compare the validated SHA with its original environment value and reject normalization.Deployment source SHA and evidence digests
45f13ba31387983749f408244dd70728a600378c: uppercase deployment/release-evidence SHA pair must fail rather than be accepted and lowercased in the buyer receipt.a9a4377b0c3aeb7ec7ca2a360111c03ec808a4a1: require lowercase deployment SHA.56357923bcf11d446de22e73ffe9633073037b8e: uppercase external SHA-256 evidence digest must fail rather than be silently lowercased.5d0802ecead4071acfbbbf9534c0fcd5f4aae414: require lowercase digest and stop case-folding it.2a2a21381a85250358ceb1792556d7d1fc363d30: whitespace-wrapped deployment SHA or release-evidence digest must fail rather than be trimmed into authority.141d48b831c353aa99f0736f81945c6f35d801db: require exact original-string equality for deployment SHA and SHA-256 digest; persist the already-canonical SHA without normalization.Existing SBOM, stable-file, timestamp, tag/ref, immutable-release, smoke/KPI, deployment-target and attestation contracts are unchanged.
Current identity and fresh evidence
80925420bb14c673510e0ed206257befa55da7a9141d48b831c353aa99f0736f81945c6f35d801dbscripts/release-evidence.mjs,test/release-evidence.test.ts,scripts/deployment-evidence.mjs,test/deployment-evidence.test.ts32501920201: queued32501920200: queued32501920295: queuedMerge boundary
Draft. Do not merge until application CI, reviewer-ci and the eligible central Security Scan are terminal-success on this unchanged exact head, review/thread state is freshly clean, and protected base plus current central scanner authority are revalidated. Pending/predecessor evidence is non-passing.
Summary by CodeRabbit
버그 수정
테스트