- Read bounds (
crates/registry-evidencectl/src/source_import/files.rs and mod.rs): the snapshot reads each project file under the 64 MiB project bound before the aggregate check, the destination check reads up to 512 MiB, and state reads use a 256 MiB bound, while a project file is bounded at 1 MiB and an export at 16 MiB. Bound each read at the size its content can legitimately have.
- Five
let _ = sites in crates/registry-evidencectl/src/authoring.rs discard the result of set_bundle_modes and fs::set_permissions on the sealing path of compile_local_project_with_target_inputs and in the Drop cleanup of CompiledFixtureProject and the test Fixture. A failed seal should at least be reported.
evidencectl source diff with --target (diff in crates/registry-evidencectl/src/source_cli.rs) runs a not-yet-accepted export's adapter Rhai through the fixtures to produce the comparison. Decide whether diffing should execute the incoming adapter before acceptance, and if so say so in the command's help.
Origin: review of PR #865.
crates/registry-evidencectl/src/source_import/files.rsandmod.rs): the snapshot reads each project file under the 64 MiB project bound before the aggregate check, the destination check reads up to 512 MiB, and state reads use a 256 MiB bound, while a project file is bounded at 1 MiB and an export at 16 MiB. Bound each read at the size its content can legitimately have.let _ =sites incrates/registry-evidencectl/src/authoring.rsdiscard the result ofset_bundle_modesandfs::set_permissionson the sealing path ofcompile_local_project_with_target_inputsand in theDropcleanup ofCompiledFixtureProjectand the testFixture. A failed seal should at least be reported.evidencectl source diffwith--target(diffincrates/registry-evidencectl/src/source_cli.rs) runs a not-yet-accepted export's adapter Rhai through the fixtures to produce the comparison. Decide whether diffing should execute the incoming adapter before acceptance, and if so say so in the command's help.Origin: review of PR #865.