Skip to content

v4.169.47 - fail-closed security and exec lifecycle

Choose a tag to compare

View all tags
@IvanSkainet IvanSkainet released this 15 Aug 20:34
· 136 commits to master since this release
v4.169.47
7995541
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Skainet Bridge v4.169.47 — fail-closed security and exec lifecycle

This release combines security scanner hardening, remote execution lifecycle cleanup, and release-test stabilization.

Security scanners now fail closed

The Security workflow no longer turns scanner execution failures into green checks. TruffleHog, OSV, Syft/Grype, Socket Firewall, DevSkim, Bandit, Semgrep, and pip-audit now use explicit exit/report contracts: missing, empty, malformed, incomplete, or unexpected reports block the gate. Finding thresholds remain explicit and separate from scanner health.

The first real fail-closed DevSkim run exposed a genuine defect: the public tunnel probe in scripts/check_bridge.py disabled TLS verification unconditionally. Public probes now use the shared strict TLS context by default; the operator's explicit insecure-TLS opt-out remains narrow and visible.

Remote exec follows the HTTP client lifetime

Buffered /v1/exec, raw /v1/exec/script, and silent waits in /v1/exec/stream now watch the underlying HTTP transport. If the remote client or proxy disconnects, the handler cancels and awaits the runner, which kills and reaps the complete process tree on Windows and POSIX. Semaphore slots, ACTIVE_PROCESSES, stream generators, and temporary scripts are cleaned on the same path.

This closes the class that previously left cmd → powershell → gh run watch alive after a tunnel-side failure.

Ship-smoke test isolation

The ship-smoke test no longer assumes an empty flight-record directory. It measures before/after history, requires an exact one-record delta, and checks that the only new record is the returned report path.

Acceptance evidence

  • T40 merged-head manual Security run: all scanner jobs and Security required passed.
  • T44 new lifecycle module: 0/54 surviving mutants.
  • Bilateral sabotage: disabling transport-close detection made the watcher test fail with TimeoutError; restoring it returned green.
  • Exact PR-head Windows Python 3.14 acceptance: 19 focused client-abort/tree-kill tests passed; no time.sleep(30) child remained.
  • Full local preflight and fail-closed local security gates passed.
  • Release ZIP pair and Android APK are built from one exact candidate commit, independently attested with provenance and SPDX SBOM, accepted on Windows before publication, then signed and anonymously verified after publication.
Assets 14
Loading