feat(assail): downgrade flake.lock-only SupplyChain to Severity::Low (mechanical fix)#73
Merged
Merged
Conversation
…ty::Low When `flake.nix` declares inputs without inline narHash, without rev pinning, and without a sibling `flake.lock`, the standard remediation is a single `nix flake update` invocation that generates the lockfile with narHash for every transitive input. Because the fix is trivial and mechanical, this finding does not belong in the same severity tier as e.g. an unsigned binary fetch or a tamperable URL. Downgrade from High to Low and embed the fix command directly in the description. The detector still triggers — the finding is real and worth noting — but it no longer dominates noise tiers in scan reports. Estate context: the Nix-mirror campaign closure (standards#149, hypatia#289) confirmed flake.lock generation is the canonical mechanical fix. Regression tests verify (a) the Low severity, (b) the suggestion text, (c) that flakes with narHash or rev pinning remain finding-free. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
hyperpolymath
force-pushed
the
rule/flake-lock-supplychain-severity
branch
from
3527988 to
a9664a1
Compare
3 tasks
hyperpolymath
added a commit
that referenced
this pull request
May 27, 2026
…ansitive (#75) (#78) ## Summary Two layered refinements on top of #76 (phantom-declared / phantom-transitive split). Same three-way Mitigable/Unmitigable/Informational output, but the Informational tier now produces an accurate \`action\` field for two cohorts where the generic message was misleading. Closes #74 in part (build-script-only / vendored-pin name-list portion). Closes #75. ## Cohort E-3 — build-script-only / vendored-pin (#74, partial) A naive \`cargo machete --fix\` strip of certain phantom-declared crates breaks the build inscrutably (cross-compile TLS, native-lib resolution, build-time codegen). New \`is_build_script_only_or_vendored_pin(name)\` predicate covers crates that **have no \`use\` site by design**: - Build-script side-effect crates: \`pkg-config\`, \`cc\`, \`bindgen\`, \`cmake\`, \`autocfg\`, \`vcpkg\`, \`winres\`, \`embed-resource\` - Canonical vendored-pin: \`openssl-src\` When a phantom-declared crate matches, the action flips from \"Strip from Cargo.toml\" to \"DO NOT STRIP — load-bearing via build.rs side-effects or native-lib linkage\". **Future follow-up**: feature-based detection (e.g. \`openssl-sys = { features = [\"vendored\"] }\`) needs feature-set plumbing through \`ReachabilityEvidence\` — left out of scope. ## Cohort E-2 — Dioxus/GTK transitive (#75) Phantom-transitive advisories where the parent is in the Dioxus desktop family (\`wry\`, \`dioxus-desktop\`, \`dioxus\`) and the affected crate is in the GTK/webkit family now get a Cohort E-2 message naming the no-local-fix path (wait for parent release, or swap the desktop renderer). Sub-rule covers \`printpdf\`→\`kuchiki\`. GTK/webkit family matched: \`atk*\`, \`gdk*\`, \`gtk*\`, \`glib\`, \`glib-sys\`, \`gio\`, \`gio-sys\`, \`gobject-sys\`, \`gtk3-macros\`, \`proc-macro-error\`, \`paste\`, \`fxhash\`, \`webkit2gtk\`, \`webkit2gtk-sys\`. ## Bonus repair: src/assail/analyzer.rs test-module corruption The squash-merge sequence of PRs #71 (Julia) → #77 (refile of #72 vendored-snapshot) → #73 (flake.lock) left \`src/assail/analyzer.rs\` with an unclosed-delimiter at line 7962: - \`count_julia_dce\` had \`flake_findings\` body - \`julia_ext_jl_dce_is_exempt\` was missing closing braces - Two flake tests (\`flake_without_lock_is_low_severity\`, \`flake_with_narhash_has_no_finding\`) had landed inside the Julia section \`cargo test --lib\` was failing to compile on main as a result. This PR reassembles each section in its intended location; no test logic changed. ## Test plan - [x] \`cargo test --features http --lib bridge::classify::\` — 14/14 pass (5 new + 9 existing) - [x] \`cargo test --features http --lib\` — 343 lib tests pass (was previously failing to compile) - [x] \`cargo check --features http\` — green ## Changes - \`src/bridge/classify.rs\`: +268 / -29 lines (3 predicate fns + 2 cohort override branches + 5 regression tests) - \`src/assail/analyzer.rs\`: +/-109 lines, net wash (reassemble corrupted test sections) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
When `flake.nix` declares inputs without inline `narHash`, without `rev` pinning, and without a sibling `flake.lock`, the standard remediation is a single `nix flake update` invocation that generates the lockfile with narHash for every transitive input.
The fix is mechanical, so the finding does not belong in the same severity tier as e.g. an unsigned binary fetch or a tamperable URL. Downgrade from `Severity::High` to `Severity::Low` and embed the fix command directly in the description.
The detector still triggers — the finding is real and worth surfacing — but it no longer dominates High-severity noise in scan reports.
Motivation
Across the 51 Track C panic-attack issues, missing `flake.lock` accounts for ~45 findings (e.g. `julia-ecosystem#6` carries 45 of these in the vendored monorepo). All are mechanically closable. Estate context: the Nix-mirror campaign closure (`standards#149`, `hypatia#289`) confirmed `flake.lock` generation is the canonical fix.
Changes
Test plan
🤖 Generated with Claude Code