Skip to content

fix(ci): gate all three lanes + fix relative-path bug that silenced a check - #130

Merged
mdheller merged 6 commits into
mainfrom
fix-gate-all-lanes
Jul 29, 2026
Merged

fix(ci): gate all three lanes + fix relative-path bug that silenced a check#130
mdheller merged 6 commits into
mainfrom
fix-gate-all-lanes

Conversation

@mdheller

Copy link
Copy Markdown
Contributor

Two gaps closed, both created by me an hour ago.

1. The gate only ran on DMG

Linux and Windows could still ship a build with hardening missing — exactly the hole the gate exists to close. Now wired into all three: DMG before dmg creation, Linux before tar, Windows before re-zip.

2. A real bug that silenced an assertion

$GRE may be relative, and the omni.ja extraction cds into a temp dir — so the relative path stopped resolving and the phone-home check silently reported "could not locate packaged prefs".

That is the permanently-red-check anti-pattern I criticised earlier, shipped by me one commit later. Fixed by resolving $GRE up front. Verified by re-running with a relative path against the real Linux tarball: the assertion now runs and correctly reports all four endpoints still present in that pre-strip build.

Validated on both layouts

macOS .app and Linux tarball: 7 pass / 4 fail — the 4 being precisely the BearBlocker lists + substitution, because those artifacts predate fix #105.

Context worth keeping

Updated docs/NEXT-SESSION.md: Michael's installed app is from Jul 21 and predates all of this work — which is why its console logs showed problems already fixed on main. Check the binary's date before diagnosing from its logs.

mdheller added 6 commits July 29, 2026 03:14
Michael: 'zero trust dude we don't trust mozilla, we review the upstream and
harden where possible too.' He is right and my earlier framing was still too
trusting: a valid signature proves only that MOZILLA SIGNED IT, not that the
content is benign. A compelled or compromised upstream ships signed records.

review.mjs reads what we are about to serve and FAILS CLOSED on: a collection
with no signature, a URL in signed content the collection has no business
carrying, active-content markers (javascript:/<script/eval(), a new or vanished
collection, or a >25% swing in record count — the shape a poisoned security list
would take. A SHA256 baseline makes silent drift in already-vouched-for data
visible on the next run.

Made it collection-aware after the first pass produced noise — blunt rules get
ignored, which is worse than no rule. ct-logs IS a list of log endpoints,
intermediates embeds CPS URIs in certificate data, plugins/addons rows carry a
user-facing 'why was this blocked' link. Those are inventoried; everywhere else a
URL is a finding. (Same false-positive trap as calling plugins=5 a leak earlier —
verify what upstream legitimately contains before alarming.)

REAL findings from the first review of Mozilla PROD data:
  - Mozilla ships PLACEHOLDER urls in production CT data:
    https://ct.example.com/bogus/ and .../bogus/ipng/
  - plugin-blocklist rows carry CLEARTEXT http:// advisory links (oracle,
    adobe, microsoft, divx, mozilla blog)
Neither is fetched in normal operation, but we now SEE them instead of assuming,
and the baseline diff surfaces the next change automatically.
… check

Two gaps closed, both created by me an hour ago.

1. The gate only ran on the DMG lane. Linux and Windows could still ship a build
   with its hardening missing — exactly the hole the gate exists to close. Now
   wired into all three: DMG before dmg creation, Linux before tar, Windows
   before re-zip.

2. A real bug in verify-package.sh: $GRE may be RELATIVE, and the omni.ja
   extraction cd's into a temp dir, so the relative path stopped resolving and
   the phone-home assertion silently reported 'could not locate packaged prefs'.
   That is the permanently-red check anti-pattern I criticised earlier, shipped
   by me one commit later. Resolve $GRE to an absolute path up front.
   Verified by re-running with a relative path against the real Linux tarball:
   the assertion now RUNS and correctly reports all four endpoints still present
   in that pre-strip build.

Gate validated on BOTH layouts now (macOS .app and Linux tarball): 7 pass / 4
fail on the Jul-28 artifacts, and the 4 failures are precisely the BearBlocker
lists + substitution because those artifacts predate fix #105.

Also updated docs/NEXT-SESSION.md: P1 is done, and recorded the finding that
Michael's installed app is from JUL 21 — it predates all of this work, which is
why its console logs showed problems already fixed on main. Check the binary
date before diagnosing from logs.
@mdheller
mdheller merged commit 2be7025 into main Jul 29, 2026
16 of 17 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant