fix(supply-chain): correct Demucs release evidence on current develop - #1184
fix(supply-chain): correct Demucs release evidence on current develop#1184seonghobae wants to merge 11 commits into
Conversation
…ks with O(1) dictionary key deduplication in chart export
Restack the one-file metadata correction onto the current protected develop tip without changing runtime/model authority. Preserve checksum inventory while stating that the profile is unused by the current Demucs runtime and lacks runtime checksum verification. Signed-off-by: Seongho Bae <me@seonghobae.me>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthrough모델 아티팩트의 Changes공급망 인벤토리 설명
Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk: ⚪ Minimal · up to This updates supply-chain inventory descriptions to match the current audio-separation implementation without changing runtime behavior, artifact identity, or deployment configuration. No concrete merge-blocking risk remains. Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review Please review exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== checked-out revision and ancestry =='
git rev-parse HEAD
git status --short
git merge-base HEAD origin/develop
git rev-list --left-right --count origin/develop...HEAD
git diff --check origin/develop...HEAD
git diff --stat origin/develop...HEAD
git diff --name-status origin/develop...HEAD
echo '== inventory change =='
git diff --no-ext-diff --unified=80 origin/develop...HEAD -- supply-chain/supplemental-component-inventory.json
echo '== inventory entry =='
python3 - <<'PY'
import json
p = "supply-chain/supplemental-component-inventory.json"
with open(p, encoding="utf-8") as f:
data = json.load(f)
def visit(x):
if isinstance(x, dict):
if x.get("name") == "bandsplit-v1-profile" or x.get("component") == "bandsplit-v1-profile":
print(json.dumps(x, indent=2, sort_keys=True))
for v in x.values():
visit(v)
elif isinstance(x, list):
for v in x:
visit(v)
visit(data)
PY
echo '== profile references outside the inventory =='
rg -n -i -C 4 'bandsplit-v1-profile|bandsplit' -g '!supply-chain/supplemental-component-inventory.json' .
echo '== separation runtime candidates =='
rg -n -i -C 5 'Demucs|AudioStemSeparator|stem.?separat|separat' -g '!supply-chain/supplemental-component-inventory.json' .
echo '== PR metadata, checks, and reviews =='
gh pr view 1184 --repo ContextualWisdomLab/bandscope \
--json number,state,isDraft,headRefName,headRefOid,baseRefName,baseRefOid,mergeStateStatus,reviews,statusCheckRollup \
--jq '{number,state,isDraft,headRefName,headRefOid,baseRefName,baseRefOid,mergeStateStatus,reviews,statusCheckRollup}'Length of output: 202185 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='314ddeae7b775a4957594b599358c8255617eb2e'
head='df7bfdd02f9eef5bf9bb9036e6220e33343564f2'
file='supply-chain/supplemental-component-inventory.json'
echo '== exact identity =='
printf 'HEAD: '; git rev-parse HEAD
printf 'merge-base: '; git merge-base "$base" "$head"
printf 'ahead/behind: '; git rev-list --left-right --count "$base...$head"
printf 'changed paths: '; git diff --name-only "$base...$head"
printf 'diff check: '; git diff --check "$base...$head" && echo PASS
printf 'base blob: '; git rev-parse "$base:$file"
printf 'head blob: '; git rev-parse "$head:$file"
printf 'checked-out blob: '; git rev-parse "HEAD:$file"
echo '== exact inventory delta =='
git diff --no-ext-diff --unified=12 "$base...$head" -- "$file"
echo '== full matching inventory object: base and head =='
for rev in "$base" "$head"; do
echo "-- $rev --"
git show "$rev:$file" | awk '
BEGIN { RS="}[[:space:]]*,?[[:space:]]*{" }
/bandsplit-v1-profile/ { print }
'
done
echo '== exact repository references and checksum-verifier candidates =='
rg -n -i -C 3 \
'bandsplit-v1-profile|bandsplit|_load_model_profile|sha256|hashlib|checksum|verify.*(model|profile)|(model|profile).*verify' \
services supply-chain scripts \
-g '!supply-chain/supplemental-component-inventory.json' \
-g '!**/*.lock' \
-g '!**/test*/**' || true
echo '== AudioStemSeparator model-loading implementation =='
sed -n '116,180p' services/analysis-engine/src/bandscope_analysis/separation/audio_separator.py
echo '== static contents of stated verification scripts =='
for path in \
scripts/checks/verify_supply_chain.py \
scripts/checks/verify_docs.py \
scripts/checks/verify_security_notes.py
do
echo "-- $path --"
sed -n '1,260p' "$path"
done
echo '== predecessor corrected blob =='
git cat-file -e '2c8931491c9eaf72c37688cb35b12727a72c09f5:supply-chain/supplemental-component-inventory.json'
printf 'predecessor blob: '; git rev-parse '2c8931491c9eaf72c37688cb35b12727a72c09f5:supply-chain/supplemental-component-inventory.json'Length of output: 33336
The change preserves the profile version, source URL, license, SHA-256 value, and storage path. It changes only the inaccurate Static runtime inspection confirms that I inspected the stated verification scripts but did not execute repository scripts in this sandbox. Current-head CI is still incomplete. Several applicable security, SBOM, build, and review checks are queued or running. The PR remains Draft and has no reviews. Do not treat the static review as a replacement for those gates. ✅ Action performedReview finished.
|
seonghobae
added
bug
ChatGPT Codex Connector
Remove the false claim that current protected runtime only loads bundled/checksum-tracked Demucs weights. Record the actual upstream get_model/torch.load boundary, keep commercial release fail closed, and point immutable artifact/rights work to #1180/#1181. Signed-off-by: Seongho Bae <me@seonghobae.me>
seonghobae
changed the title
|
@coderabbitai review Please review current exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='314ddeae7b775a4957594b599358c8255617eb2e'
head='dcdf3fc08f26fea324be06c6242292942553258f'
previous='df7bfdd02f9eef5bf9bb9036e6220e33343564f2'
echo '== exact revision and ancestry =='
printf 'checked-out HEAD: '; git rev-parse HEAD
printf 'requested head: '; git rev-parse "$head"
printf 'merge-base: '; git merge-base "$base" "$head"
printf 'ahead/behind: '; git rev-list --left-right --count "$base...$head"
printf 'predecessor ancestor: '; git merge-base --is-ancestor "$previous" "$head" && echo yes || echo no
git status --short
git diff --check "$base...$head"
git diff --name-status "$base...$head"
git diff --stat "$base...$head"
echo '== exact diff =='
git diff --no-ext-diff --unified=35 "$base...$head"
echo '== supply-chain inventory entries at base and head =='
for rev in "$base" "$head"; do
echo "-- $rev --"
git show "$rev:supply-chain/supplemental-component-inventory.json" |
jq '.. | objects | select(.name? == "bandsplit-v1-profile" or .component? == "bandsplit-v1-profile")'
done
echo '== advisory and exception references in changed tree =='
rg -n -i -C 6 \
'GHSA-53q9-r3pm-6pq6|Demucs|torch|exception|waiver|allowlist|release.?gate|release.?truth|`#970`|`#1180`|`#1181`' \
supply-chain scripts services .github \
-g '!supply-chain/supplemental-component-inventory.json' \
-g '!**/*.lock' || true
echo '== bandsplit references and checksum verification candidates =='
rg -n -i -C 5 \
'bandsplit-v1-profile|bandsplit|_load_model_profile|sha256|hashlib|checksum|verify.*(model|profile)|(model|profile).*verify' \
services supply-chain scripts .github \
-g '!supply-chain/supplemental-component-inventory.json' \
-g '!**/*.lock' -g '!**/test*/**' || true
echo '== separation implementation outline and relevant source =='
candidate=$(fd -a '^audio_separator\.py$' services | head -n 1 || true)
if [ -n "$candidate" ]; then
ast-grep outline "$candidate" --items all
rg -n -C 12 '_load_model|demucs|torch|checksum|verify' "$candidate" || true
fi
echo '== changed supply-chain and gate file outlines =='
git diff --name-only "$base...$head" | while IFS= read -r path; do
case "$path" in
*.py|*.js|*.ts) ast-grep outline "$path" --items all ;;
esac
done
echo '== referenced GitHub items and PR checks =='
gh issue view 970 --repo ContextualWisdomLab/bandscope \
--json number,state,title,url,body --jq '{number,state,title,url,body}' || true
gh pr view 1180 --repo ContextualWisdomLab/bandscope \
--json number,state,isDraft,title,url,headRefOid,baseRefOid,body --jq '{number,state,isDraft,title,url,headRefOid,baseRefOid,body}' || true
gh pr view 1181 --repo ContextualWisdomLab/bandscope \
--json number,state,isDraft,title,url,headRefOid,baseRefOid,body --jq '{number,state,isDraft,title,url,headRefOid,baseRefOid,body}' || true
gh pr view 1184 --repo ContextualWisdomLab/bandscope \
--json number,state,isDraft,headRefOid,baseRefOid,mergeStateStatus,reviews,statusCheckRollup \
--jq '{number,state,isDraft,headRefOid,baseRefOid,mergeStateStatus,reviews,statusCheckRollup}' || trueLength of output: 203591 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='314ddeae7b775a4957594b599358c8255617eb2e'
head='dcdf3fc08f26fea324be06c6242292942553258f'
echo '== identity and paths =='
git rev-parse HEAD
git merge-base "$base" "$head"
git rev-list --left-right --count "$base...$head"
git diff --check "$base...$head" && echo 'diff-check: PASS'
git diff --name-status "$base...$head"
echo '== exact changed lines =='
git diff --no-ext-diff --unified=18 "$base...$head"
echo '== matching inventory records: base =='
git show "$base:supply-chain/supplemental-component-inventory.json" |
jq -c '.. | objects | select(.name? == "bandsplit-v1-profile" or .component? == "bandsplit-v1-profile")'
echo '== matching inventory records: head =='
git show "$head:supply-chain/supplemental-component-inventory.json" |
jq -c '.. | objects | select(.name? == "bandsplit-v1-profile" or .component? == "bandsplit-v1-profile")'
echo '== exact GHSA references in head =='
rg -n -i -C 12 'GHSA-53q9-r3pm-6pq6' \
supply-chain scripts .github docs \
-g '!**/*.lock' || true
echo '== advisory policy implementation candidates =='
rg -n -i -C 8 \
'53q9|demucs.*torch|torch.*demucs|pytorch|advisory.*exception|exception.*advisory|ignore.*GHSA' \
scripts/checks supply-chain .github \
-g '!**/*.lock' || true
echo '== dependency declarations and platform markers =='
rg -n -i -C 5 '(^|\s)(demucs|torch)(\[|=|>|<|~|\s)|platform_system|sys_platform' \
-g 'pyproject.toml' -g 'requirements*.txt' -g 'poetry.lock' -g 'uv.lock' -g 'Pipfile*' . || true
echo '== runtime profile references only =='
rg -n -i -C 5 'bandsplit-v1-profile|_load_model_profile|bandsplit-v1' \
services/analysis-engine/src supply-chain \
-g '!supply-chain/supplemental-component-inventory.json' || true
echo '== referenced work-item records =='
for number in 970 1180 1181; do
echo "-- issue-or-pr #$number --"
gh issue view "$number" --repo ContextualWisdomLab/bandscope \
--json number,state,title,url,body \
--jq '{number,state,title,url,body}' || true
doneLength of output: 59814 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='314ddeae7b775a4957594b599358c8255617eb2e'
head='dcdf3fc08f26fea324be06c6242292942553258f'
echo '== GHSA configuration and enforcement =='
rg -n -i -C 16 'GHSA-53q9-r3pm-6pq6|53q9-r3pm-6pq6|torch 2\.2\.2|torch.*2\.2\.2' \
.github services/analysis-engine scripts/checks \
-g '!**/*.lock' || true
echo '== exact torch and Demucs lock records at protected base =='
git show "$base:services/analysis-engine/uv.lock" |
awk 'BEGIN { RS="\\[\\[package\\]\\]" } /^[[:space:]]*name = "(torch|demucs)"/ { print "[[package]]" $0 }'
echo '== exact torch and Demucs lock records at requested head =='
git show "$head:services/analysis-engine/uv.lock" |
awk 'BEGIN { RS="\\[\\[package\\]\\]" } /^[[:space:]]*name = "(torch|demucs)"/ { print "[[package]]" $0 }'
echo '== dependency-review workflow and OSV configuration excerpts =='
for path in .github/workflows/dependency-review.yml services/analysis-engine/osv-scanner.toml; do
if [ -f "$path" ]; then
echo "-- $path --"
rg -n -C 16 'GHSA|torch|demucs|ignore|allow' "$path" || true
fi
done
echo '== exact platform-specific dependency metadata =='
sed -n '1,45p' services/analysis-engine/pyproject.toml
rg -n -C 10 'name = "demucs"|name = "torch"' services/analysis-engine/uv.lockLength of output: 24209
I found one actionable issue.
The The new text correctly does not treat
|
Adopt canonical #1176 as an ordinary second parent while preserving this PR's Demucs supply-chain evidence corrections. The resulting tree contains #1176's sole Ruff formatting repair rather than copying a competing implementation; that prerequisite diff disappears once #1176 becomes protected ancestry. Signed-off-by: Seongho Bae <me@seonghobae.me>
|
@coderabbitai review Please review the new exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='314ddeae7b775a4957594b599358c8255617eb2e'
head='23edfd8cde3ceeed82d5743712c3c0d9587d0987'
repo='ContextualWisdomLab/bandscope'
echo '== exact identity and ancestry =='
printf 'checked-out HEAD: '; git rev-parse HEAD
printf 'requested HEAD: '; git rev-parse "$head"
printf 'merge-base: '; git merge-base "$base" "$head"
printf 'ahead/behind: '; git rev-list --left-right --count "$base...$head"
printf 'parents: '; git show -s --format='%P' "$head"
git status --short
git diff --check "$base...$head" && echo 'diff-check: PASS'
echo '== changed paths against protected develop =='
git diff --name-status "$base...$head"
git diff --stat "$base...$head"
echo '== full patch against protected develop =='
git diff --no-ext-diff --unified=40 "$base...$head"
echo '== head commit and each parent delta =='
git show -s --format='commit=%H%nparents=%P%nsubject=%s%n%n%b' "$head"
for parent in $(git show -s --format='%P' "$head"); do
echo "-- parent $parent --"
git diff --check "$parent" "$head" && echo 'diff-check: PASS'
git diff --name-status "$parent" "$head"
git diff --no-ext-diff --unified=30 "$parent" "$head"
done
echo '== PR `#1176` metadata and commit list =='
gh pr view 1176 --repo "$repo" \
--json number,state,isDraft,title,url,baseRefOid,headRefOid,commits,files \
--jq '{number,state,isDraft,title,url,baseRefOid,headRefOid,commits:[.commits[]|{oid:.oid,messageHeadline:.messageHeadline}],files:[.files[]|{path:.path,additions:.additions,deletions:.deletions}]}' || true
echo '== locate canonical `#1176` commit in graph =='
git log --all --oneline --decorate --grep='`#1176`\|Ruff' -n 30 || true
echo '== current supply-chain records and policy claims =='
for path in supply-chain/supplemental-component-inventory.json docs/security/dependency-policy.md; do
if [ -f "$path" ]; then
echo "-- $path outline/content --"
case "$path" in
*.json) jq '.. | objects | select(.name? == "bandsplit-v1-profile" or .component? == "bandsplit-v1-profile")' "$path" ;;
*) rg -n -C 18 'GHSA-53q9-r3pm-6pq6|torch|Demucs|exception|release|gate|`#970`|`#1180`|`#1181`' "$path" || true ;;
esac
fi
done
echo '== protected-base and head dependency/gate evidence =='
for rev in "$base" "$head"; do
echo "-- $rev torch/demucs resolved versions --"
git show "$rev:services/analysis-engine/uv.lock" 2>/dev/null |
awk 'BEGIN { RS="\\[\\[package\\]\\]" } /^[[:space:]]*name = "(torch|demucs)"/ { print "[[package]]" $0 }' || true
done
rg -n -i -C 10 \
'GHSA-53q9-r3pm-6pq6|53q9-r3pm-6pq6|torch 2\.2\.2|bandsplit-v1-profile|_load_model_profile|checksum|sha256|release.?gate|release.?truth|`#970`|`#1180`|`#1181`' \
supply-chain scripts .github docs services \
-g '!**/*.lock' -g '!supply-chain/supplemental-component-inventory.json' || true
echo '== separation runtime implementation =='
candidate=$(fd -a '^audio_separator\.py$' services | head -n 1 || true)
if [ -n "$candidate" ]; then
ast-grep outline "$candidate" --items all
rg -n -C 12 '_load_model|demucs|bandsplit|checksum|verify' "$candidate" || true
fi
echo '== referenced work-item states and current PR checks =='
for number in 970 1180 1181 1184; do
gh issue view "$number" --repo "$repo" \
--json number,state,title,url,body \
--jq '{number,state,title,url,body}' || true
done
gh pr view 1184 --repo "$repo" \
--json number,state,isDraft,headRefOid,baseRefOid,mergeStateStatus,reviews,statusCheckRollup \
--jq '{number,state,isDraft,headRefOid,baseRefOid,mergeStateStatus,reviews,statusCheckRollup}' || trueLength of output: 215205
I found one actionable issue.
The second-parent reconciliation is correct.
The The release claims remain fail closed. The text identifies You are interacting with an AI system. |
The local dependency-review and analysis-engine OSV exception paths cited by the policy no longer exist after workflow consolidation. Record GHSA-53q9-r3pm-6pq6 as an unresolved compatibility risk, preserve strict pip-audit fail-closed behavior, and keep release acceptance blocked on the model/security/rights owners. Signed-off-by: Seongho Bae <me@seonghobae.me>
|
@coderabbitai review Current exact head is now |
|
Primary-source TRACEABILITY for current
These sources support the evidence correction only. They do not establish commercial rights for pretrained weights, nor do they substitute for #1180 immutable artifact/provenance or #1181 rights acceptance. |
|
Oops, something went wrong! Please try again later. 🐰 💔 |
1 participant
Repair findings
Protected
develop@314ddeae7b775a4957594b599358c8255617eb2econtains a coupled source-separation supply-chain evidence defect.supply-chain/supplemental-component-inventory.jsonsaysbandsplit-v1-profileis consumed by runtime stem separation and SHA256-verified by nonexistentAudioStemSeparator._load_model_profile. Current protected runtime uses Demucs and does not consume that profile.docs/security/dependency-policy.mdsays theGHSA-53q9-r3pm-6pq6torch 2.2.2 risk is acceptable because protected runtime only loads bundled/checksum-tracked pinned Demucs weights. Protected runtime actually resolveshtdemucsthrough upstreamget_model, whose first load can acquire weights, and the checkpoint path reaches the code-bearingtorch.loadboundary..github/workflows/dependency-review.ymlandservices/analysis-engine/osv-scanner.toml. Neither file exists on current protecteddevelopafter workflow consolidation. The retained.github/workflows/security-audit.ymlrunspip-audit --local --strictwithout a targeted ignore. The torch advisory is therefore an unresolved compatibility risk, not an active repository exception.The repair keeps security fail closed; it does not manufacture an ignore, restore a duplicate dependency-review workflow, weaken audits, or move Distribution authority into Signal/MIR.
Exact current identity
develop@314ddeae7b775a4957594b599358c8255617eb2e.75e767945a07d610ad03b78f5cafbb3fba86b6b4.fix/supply-chain-bandsplit-inventory-current-develop.ahead 11 / behind 0; merge base exactly current protecteddevelop.services/analysis-engine/tests/test_supply_chain_policy.pyinherited from prerequisite repair(ci): format consolidated supply-chain policy test #1176.8fe6b6d99c009527ef0bcba419e6f6debdb23c23to this head isahead 4 / behind 0and exactly two changed files:docs/security/dependency-policy.mdandsupply-chain/supplemental-component-inventory.json. This proves the supply-chain lane has not modified repair(ci): format consolidated supply-chain policy test #1176's formatter repair.Repair lineage and succession
df7bfdd02f9eef5bf9bb9036e6220e33343564f2restacked stale-base #1054's valid inventory correction onto current protecteddevelop. Its corrected inventory blob10b1961798d969f400d7e73f086bdfadd7f56e75is byte-identical to #1054. #1054 was closed unmerged only after the successor identity and verification contract were recorded.dcdf3fc08f26fea324be06c6242292942553258fremoved the false bundled/checksum-tracked runtime claim while keeping the actual macOS Intel compatibility constraint explicit.23edfd8cde3ceeed82d5743712c3c0d9587d0987then adopted #1176 exact8fe6b6d…as an ordinary second parent and used its exact formatted test blob. No competing formatter edit was copied.75e767945a07d610ad03b78f5cafbb3fba86b6b4completed the evidence repair by removing the stale assertion that a Python vulnerability exception is still encoded in files that no longer exist. Current security-backstop behavior remains strict rather than silently excepted.Current supply-chain truth
The repository-tracked
bandsplit-v1profile remains inventoried with its checksum/storage path, but current separation runtime does not consume it and no runtime checksum verifier for it exists.GHSA-53q9-r3pm-6pq6remains an unresolved torch 2.2.2 compatibility/security risk. It is not an active Python exception. Draft #970 narrows its compatibility loader to an already-present bounded local checkpoint snapshot with checksum-prefix validation and remote resolution disabled, but Draft evidence is not protected/released truth.Distribution remains canonical:
htdemucsweights without an explicit rights basis or commercially admissible replacement.No claim here makes either blocker GREEN.
Review and verification evidence
CodeRabbit's successful review at
df7bfdd…covered only the predecessor one-file inventory correction. Later manual review requests atdcdf3fc…and23edfd8…predate this exact head. None transfers to75e7679…; current-head review is required.Current exact
75e7679…must reacquire all hosted evidence. Focused repository checks include:python3 -m json.tool supply-chain/supplemental-component-inventory.jsonpython3 scripts/checks/verify_supply_chain.pypython3 scripts/checks/verify_docs.pypython3 scripts/checks/verify_security_notes.pygit diff --checkNo predecessor workflow/review result is current-head GREEN.
Security Notes
Merge gate
Keep Draft until unchanged exact
75e767945a07d610ad03b78f5cafbb3fba86b6b4has all applicable repository/central CI, security/SAST, SBOM/supply-chain, cross-platform build and review gates terminal-success, zero valid unresolved findings, a qualifying independent non-author last-push approval, and ordinary protected-branch acceptance. #1176 remains an explicit prerequisite until protected ancestry absorbs its third-file diff. No self-approval, force-push, destructive rebase, synthetic status, bypass, duplicate local scanner, vulnerability ignore, or gate weakening.