security: reconstruct scalar integer sealing on integrated main - #159
security: reconstruct scalar integer sealing on integrated main#159seonghobae wants to merge 15 commits into
Conversation
|
Warning Review limit reached
Next review available in: 15 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review |
|
|
@coderabbitai review Please review the unchanged exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='c1a6ee1e437b44a9f8c06adb0fc91d4f1be9ff68'
head='d30ffac67c480b68d09c8e1264b6926c77f5f352'
git status --short
git cat-file -e "${base}^{commit}"
git cat-file -e "${head}^{commit}"
printf '\n=== Commit range ===\n'
git diff --stat "$base" "$head"
printf '\n=== Changed files ===\n'
git diff --name-status "$base" "$head"
printf '\n=== Diff ===\n'
git diff --find-renames --find-copies --unified=80 "$base" "$head"
printf '\n=== Changed Python structure ===\n'
git diff --name-only "$base" "$head" -- '*.py' |
while IFS= read -r file; do
[ -n "$file" ] || continue
printf '\n--- %s ---\n' "$file"
ast-grep outline "$file" --items all --type function,class 2>/dev/null || true
done
printf '\n=== Normalization-related definitions and call sites on head ===\n'
rg -n -i -C 4 \
'(normalize|normaliz|allowed.port|dns.*count|positive.*count|positive.*byte|isinstance\s*\(.*int|type\s*\(.*\)\s+is\s+int)' \
--glob '*.py' .Length of output: 193993 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='c1a6ee1e437b44a9f8c06adb0fc91d4f1be9ff68'
head='d30ffac67c480b68d09c8e1264b6926c77f5f352'
printf '%s\n' '=== Range ancestry ==='
git merge-base --is-ancestor "$base" "$head" && echo 'base is an ancestor of head'
git merge-base "$base" "$head"
git rev-parse "$head^{tree}"
printf '%s\n' '=== EgressPolicy constructors and normalization ==='
sed -n '72,470p' src/egressweave/policy.py
sed -n '1,290p' src/egressweave/_policy_normalization.py
printf '%s\n' '=== Existing policy integer and constructor tests ==='
rg -n -C 5 \
'(EgressPolicy\(|from_hosts\(|from_authorities\(|_normalize_(allowed_port|max_resolved_addresses|positive_count|positive_byte_count)|integer subclass|int subclass)' \
tests --glob '*.py'
printf '%s\n' '=== Public integer configuration annotations and normalizers ==='
rg -n -C 3 \
'(int \| str|Iterable\[int \| str\]|def _normalize_.*(count|bytes|port|address)|isinstance\(value, int\)|type\(value\) is int)' \
src/egressweave --glob '*.py'
printf '%s\n' '=== Documentation entry points and references ==='
fd -HI -t f '^(README|CONTRIBUTING|DOCUMENTATION|index)\.(md|rst)$|^mkdocs\.ya?ml$|^conf\.py$' . \
| sort \
| xargs -r rg -n -i -C 2 '(docs/research|policy.configuration.integrity|configuration integrity|operator migration|EgressPolicy)' || trueLength of output: 146122 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '=== Research index headings and guide links ==='
rg -n -C 3 \
'^\s*#|^\s*##|\]\([^)]*\.md\)|policy-configuration-integrity|integer' \
docs/research/README.md
printf '%s\n' '=== Root README research section ==='
sed -n '345,370p' README.md
printf '%s\n' '=== References to the new guide on the requested head ==='
rg -n -C 2 'policy-configuration-integrity\.md|Trusted policy configuration value integrity' \
. \
-g '!docs/research/policy-configuration-integrity.md'Length of output: 9334
The shared
|
# Conflicts: # CHANGELOG.md
|
Superseded by current-tree PR #178, which reconstructs the same scalar-integer sealing issue directly from protected main. This historical branch is not being merged; its prior checks/reviews are not being transferred. |
1 participant
Superseded by #178 on exact current protected main
Closed as superseded after fresh exact comparison against replacement PR #178 at head
2730ef688cff5a2e9d253374121061f8aae2dd4aon protectedmaina7fe3a82bc5f502d417436ecc8fc0c592bffc06c.The replacement preserves the complete unique four-file semantic delta from this PR:
src/egressweave/_policy_normalization.py,tests/test_policy_integer_value_types.py,docs/research/policy-configuration-integrity.md, andCHANGELOG.mdhave the same intended patches, while #178 reconstructs them directly on current protected main. Exact #178 CI, SAST, and the executed OSV/Trivy/Scorecard lanes are green; its actual pinnedDependency reviewaction is still skipped, so #178 remains Draft and blocked on the separately governed central repair. No checks, reviews, approvals, base identity, or mergeability from this historical PR transfer to #178.This PR remains historical RED/GREEN evidence only. Issue #122 continues on #178.
Historical purpose and evidence
This PR reconstructed issue #122 / historical PR #153 on an earlier integrated protected-main tree. Its historical RED/GREEN/check evidence is retained in the immutable commit and workflow history, but is not current acceptance evidence.