feat(bridge): cohort overrides for vendored-pin (#74) + Dioxus/GTK transitive (#75)#78
Merged
Merged
Conversation
…ansitive (#75) Bridge classifier still produces the three-way Mitigable/Unmitigable/ Informational output, but now distinguishes two further cases inside the Informational tier so the suggested action matches reality: PhantomDeclared cohort override (closes #74 in part): - New `is_build_script_only_or_vendored_pin(name)` predicate covers pkg-config, cc, bindgen, cmake, autocfg, vcpkg, winres, embed-resource, openssl-src. - When a phantom-declared crate matches, the action flips from "Strip from Cargo.toml" to "DO NOT STRIP — load-bearing via build.rs side-effects or native-lib linkage". Same Informational class, different recommendation. Stops `cargo machete --fix` from breaking cross-compile TLS / native-lib resolution. - Feature-based detection (e.g. openssl-sys with `vendored` feature) remains future work — it needs feature-set plumbing into evidence that the bridge doesn't have today. PhantomTransitive cohort override (closes #75): - New `is_dioxus_gui_parent(parent)` matches wry, dioxus-desktop, dioxus. - New `is_gtk_webkit_family(name)` matches the atk*/gdk*/gtk*/glib/ gio*/gobject-sys/gtk3-macros/proc-macro-error/paste/fxhash/ webkit2gtk* surface observed in presswerk. - When (parent is Dioxus GUI) AND (crate is GTK/webkit family), emit the Cohort E-2 message naming the no-local-fix path + tracker. - printpdf+kuchiki sub-rule covers the printpdf-internal HTML→PDF parser path. Five new regression tests in `bridge::classify::tests` (14 total in the module). Full lib suite: 343 passed. Also restores the test module corruption in src/assail/analyzer.rs: the squash-merge sequence for PRs #71 / #77 (refile of #72) / #73 left the file with an unclosed delimiter at line 7962 (count_julia_dce helper had flake_findings body, julia_ext_jl_dce_is_exempt was missing its closing braces, two flake tests landed inside the Julia section). Reassembles each section in its intended location; no test logic changed. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two layered refinements on top of #76 (phantom-declared / phantom-transitive split). Same three-way Mitigable/Unmitigable/Informational output, but the Informational tier now produces an accurate `action` field for two cohorts where the generic message was misleading.
Closes #74 in part (build-script-only / vendored-pin name-list portion).
Closes #75.
Cohort E-3 — build-script-only / vendored-pin (#74, partial)
A naive `cargo machete --fix` strip of certain phantom-declared crates breaks the build inscrutably (cross-compile TLS, native-lib resolution, build-time codegen). New `is_build_script_only_or_vendored_pin(name)` predicate covers crates that have no `use` site by design:
When a phantom-declared crate matches, the action flips from "Strip from Cargo.toml" to "DO NOT STRIP — load-bearing via build.rs side-effects or native-lib linkage".
Future follow-up: feature-based detection (e.g. `openssl-sys = { features = ["vendored"] }`) needs feature-set plumbing through `ReachabilityEvidence` — left out of scope.
Cohort E-2 — Dioxus/GTK transitive (#75)
Phantom-transitive advisories where the parent is in the Dioxus desktop family (`wry`, `dioxus-desktop`, `dioxus`) and the affected crate is in the GTK/webkit family now get a Cohort E-2 message naming the no-local-fix path (wait for parent release, or swap the desktop renderer). Sub-rule covers `printpdf`→`kuchiki`.
GTK/webkit family matched: `atk*`, `gdk*`, `gtk*`, `glib`, `glib-sys`, `gio`, `gio-sys`, `gobject-sys`, `gtk3-macros`, `proc-macro-error`, `paste`, `fxhash`, `webkit2gtk`, `webkit2gtk-sys`.
Bonus repair: src/assail/analyzer.rs test-module corruption
The squash-merge sequence of PRs #71 (Julia) → #77 (refile of #72 vendored-snapshot) → #73 (flake.lock) left `src/assail/analyzer.rs` with an unclosed-delimiter at line 7962:
`cargo test --lib` was failing to compile on main as a result. This PR reassembles each section in its intended location; no test logic changed.
Test plan
Changes
🤖 Generated with Claude Code