Skip to content

security: reconstruct exact TLS boundary on current protected main - #172

Merged
seonghobae merged 25 commits into
mainfrom
security/reconstruct-exact-tls-88c81a
Aug 12, 2026
Merged

security: reconstruct exact TLS boundary on current protected main#172
seonghobae merged 25 commits into
mainfrom
security/reconstruct-exact-tls-88c81a

Conversation

@seonghobae

@seonghobae seonghobae commented Aug 11, 2026

Copy link
Copy Markdown
Contributor

Purpose

Reconstruct the TLSConfiguration exact-type boundary directly on the current protected main. Historical predecessor evidence does not transfer.

Exact current identity

  • protected/live base: 632bb83bb2cfa86cbcb389ef8d544abaeb0403ef;
  • exact current head: 3114545b1566e027c362b40c7ee2e190697eea86;
  • current-tree refresh: merged protected main into the existing PR branch without force-push or destructive rebase;
  • state: open / Ready, with fresh hosted Checks queued.

Security boundary

create_egress_ssl_context() rejects every non-exact TLSConfiguration value before subclass-controlled create_ssl_context() dispatch. Exact configurations retain private trust roots, mTLS, deferred key-password support, and explicit TLS 1.2 compatibility; authority, SNI, and hostname verification remain unchanged.

Exact current-head local proof

The predecessor proof for ebc0db1… is superseded. Fresh exact-head validation and hosted security evidence are required after the current-main merge. The central dependency-review prerequisite remains separately governed.

Do not self-approve, Admin-merge, bypass, or auto-merge.

@coderabbitai

coderabbitai Bot commented Aug 11, 2026

Copy link
Copy Markdown

Review Change Stack

📝 Walkthrough

Walkthrough

create_egress_ssl_context가 정확한 TLSConfiguration 인스턴스만 허용하도록 변경되었습니다. 서브클래스 거부 테스트와 문서 계약 테스트가 추가되었습니다. TLS 설정 경계와 지원 설정을 가이드와 변경 로그에 기록했습니다.

Changes

TLS 설정 정확한 타입 경계

Layer / File(s) Summary
정확한 타입 검사와 실행 전 거부
src/egressweave/tls.py, tests/test_tls_configuration_exact_type.py
create_egress_ssl_contextTLSConfiguration 서브클래스를 create_ssl_context 호출 전에 거부합니다. TypeError 메시지와 실행 순서를 테스트합니다.
문서 및 계약 테스트 반영
docs/research/tls-configuration.md, CHANGELOG.md, tests/test_tls_configuration_exact_type_documentation.py
정확한 타입 검사와 서브클래스의 검증 정책 대체 가능성을 문서화했습니다. 사설 trust store, mTLS, 지연형 키 비밀번호, 명시적 TLS 1.2 호환 설정을 계속 지원한다고 기록했습니다. 관련 문서 내용을 테스트합니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed 제목은 보호된 main에서 정확한 TLSConfiguration 타입 경계를 복원하는 핵심 변경을 명확하게 설명합니다.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch security/reconstruct-exact-tls-88c81a

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@seonghobae
seonghobae marked this pull request as ready for review August 11, 2026 05:54

Copy link
Copy Markdown
Contributor Author

@coderabbitai review

Please review the unchanged exact current head 500e96048a0b8c6f3f921006071d777f0242875a against live main c1a6ee1e437b44a9f8c06adb0fc91d4f1be9ff68. Focus on the exact TLSConfiguration type boundary, preserved TLS behavior, regression scope, and directly affected documentation. Report only current-head actionable findings. The separately skipped dependency-review action remains a distinct blocked gate.

@coderabbitai

coderabbitai Bot commented Aug 11, 2026

Copy link
Copy Markdown

@seonghobae I will review the specified current head against live main. I will report only actionable findings in the requested TLS and documentation scope. I will treat the skipped dependency-review action as a separate blocked gate.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@seonghobae
seonghobae marked this pull request as draft August 11, 2026 12:09
@seonghobae
seonghobae marked this pull request as ready for review August 11, 2026 12:34

Copy link
Copy Markdown
Contributor Author

@opencode-agent @cwl-noema-review

Formal review-only request for exact current head 3b87e14b72ea22cb9933e5333f7db490013b3bdd. All listed current-head Checks are terminal-success or expected skip, including Python 3.10–3.14, CodeQL, Semgrep, Trivy, OSV, coverage evidence, Strix, OpenCode, and Noema. Please review this exact head; merge only after independent approval and a final exact-head Checks recheck.

Copy link
Copy Markdown
Contributor Author

@coderabbitai review

Please review exact current head 3b87e14b72ea22cb9933e5333f7db490013b3bdd over live protected main 52a5c6a0862e0d035b0698b79a0e8556269e0b00. There is no current formal review or inline review thread on this exact head. Validate only the exact current diff; do not transfer predecessor-head review/check evidence.

@coderabbitai

coderabbitai Bot commented Aug 11, 2026

Copy link
Copy Markdown

@seonghobae I will review only head 3b87e14b72ea22cb9933e5333f7db490013b3bdd against main at 52a5c6a0862e0d035b0698b79a0e8556269e0b00. I will not use review threads or check evidence from predecessor heads.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Copy link
Copy Markdown
Contributor Author

@coderabbitai review

Please review exact current head 3b87e14b72ea22cb9933e5333f7db490013b3bdd against protected main 52a5c6a0862e0d035b0698b79a0e8556269e0b00. Focus on rejecting non-exact TLSConfiguration before subclass dispatch, preservation of private trust stores/mTLS/deferred key passwords and explicit TLS 1.2 compatibility, authority/SNI/TLS identity binding, fail-closed behavior, documentation parity, and public API compatibility. Do not transfer historical #157 review evidence.

@coderabbitai

coderabbitai Bot commented Aug 12, 2026

Copy link
Copy Markdown

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

head_commit='3b87e14b72ea22cb9933e5333f7db490013b3bdd'
base_commit='52a5c6a0862e0d035b0698b79a0e8556269e0b00'

git cat-file -e "${head_commit}^{commit}"
git cat-file -e "${base_commit}^{commit}"

printf '%s\n' '=== exact commit-range diff ==='
git diff --no-ext-diff --unified=80 "$base_commit" "$head_commit" -- \
  CHANGELOG.md \
  docs/research/tls-configuration.md \
  src/egressweave/tls.py \
  tests/test_tls_configuration_exact_type.py \
  tests/test_tls_configuration_exact_type_documentation.py

printf '%s\n' '=== changed paths ==='
git diff --name-status "$base_commit" "$head_commit"

printf '%s\n' '=== TLS module outline ==='
ast-grep outline src/egressweave/tls.py --items all || true

printf '%s\n' '=== TLSConfiguration definitions and helper call sites ==='
rg -n -C 5 --glob '*.py' \
  '^(class\s+TLSConfiguration\b|def\s+create_egress_ssl_context\b)|\bcreate_egress_ssl_context\s*\(' \
  src tests

printf '%s\n' '=== changed test and documentation files ==='
for f in \
  tests/test_tls_configuration_exact_type.py \
  tests/test_tls_configuration_exact_type_documentation.py \
  docs/research/tls-configuration.md \
  CHANGELOG.md
do
  if [ -f "$f" ]; then
    printf '\n=== %s ===\n' "$f"
    cat -n "$f"
  fi
done

Length of output: 77834


🏁 Script executed:

#!/bin/bash
set -euo pipefail

head_commit='3b87e14b72ea22cb9933e5333f7db490013b3bdd'
base_commit='52a5c6a0862e0d035b0698b79a0e8556269e0b00'

printf '%s\n' '=== exact range ancestry ==='
git merge-base --is-ancestor "$base_commit" "$head_commit" && echo 'base-is-ancestor-of-head: yes'
git show -s --format='head=%H%nparents=%P%nsubject=%s' "$head_commit"
git show -s --format='base=%H%nparents=%P%nsubject=%s' "$base_commit"

printf '%s\n' '=== public builder definitions and TLS argument forwarding ==='
rg -n -U -C 8 --glob '*.py' \
  '^(def|async def)\s+(build_[A-Za-z0-9_]*|create_[A-Za-z0-9_]*)\s*\(|tls_configuration\s*[:=]' \
  src/egressweave

printf '%s\n' '=== direct TLS context creation and TLS helper uses ==='
rg -n -C 5 --glob '*.py' \
  '\.create_ssl_context\s*\(|\bcreate_egress_ssl_context\s*\(|\bTLSConfiguration\b' \
  src/egressweave

printf '%s\n' '=== package exports ==='
for f in $(fd -t f -g '__init__.py' src); do
  printf '\n=== %s ===\n' "$f"
  cat -n "$f"
done

printf '%s\n' '=== complete TLS configuration tests ==='
cat -n tests/test_tls_configuration.py

printf '%s\n' '=== TLS-related builder/transport tests ==='
rg -n -C 6 --glob 'test*.py' \
  '(tls_configuration|TLSConfiguration|sni_hostname|check_hostname|verify_mode|TLSv1_2|client_private_key_password|client_certificate_file|include_default_trust_store)' \
  tests

printf '%s\n' '=== static type and API surface declarations ==='
rg -n -C 4 --glob '*.{py,pyi,md,toml}' \
  '(TLSConfiguration|tls_configuration|create_egress_ssl_context)' \
  pyproject.toml README.md docs src

Length of output: 107570


@seonghobae No current-head actionable findings.

I reviewed 3b87e14b72ea22cb9933e5333f7db490013b3bdd against ancestor 52a5c6a0862e0d035b0698b79a0e8556269e0b00.

  • create_egress_ssl_context() now requires type(configuration) is TLSConfiguration before it invokes create_ssl_context().
  • The regression test proves that a subclass override cannot run.
  • All synchronous and asynchronous public builder paths reach this helper before connection-pool construction.
  • Exact TLSConfiguration instances retain private trust configuration, mTLS, deferred key-password callbacks, and explicit TLS 1.2 compatibility.
  • Existing authority, SNI, and hostname-validation paths remain separate from TLS configuration and remain unchanged.
  • The public builder signatures and package export remain unchanged. Rejecting TLSConfiguration subclasses is the documented security tightening.
  • The TLS guide and changelog describe the boundary, migration requirement, and preserved supported configuration paths.

This review used only the specified current head and base. I did not use predecessor review evidence.

You are interacting with an AI system.

@seonghobae
seonghobae marked this pull request as draft August 12, 2026 01:12

Copy link
Copy Markdown
Contributor Author

Current-head refresh complete: protected main 1d2e19049354115776804c66b9366fad2ea5b6c5 was merged into ebc0db1cffb466fa2129dad83cc3544196dd5859 without force-push. Python 3.14 proof: 933 passed, 100% production statement/branch coverage (1704/1704, 576/576), Ruff, product-guard self-test, compileall, and CodeGraph sync. Draft remains pending fresh hosted evidence and the central fail-closed dependency-review repair; no self/Admin/bypass merge.

@seonghobae
seonghobae marked this pull request as ready for review August 12, 2026 02:29

Copy link
Copy Markdown
Contributor Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Aug 12, 2026

Copy link
Copy Markdown
⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Copy link
Copy Markdown
Contributor Author

@coderabbitai review

Please review the unchanged exact current head ebc0db1cffb466fa2129dad83cc3544196dd5859. Validate findings only against this head; predecessor-head evidence does not transfer.

@coderabbitai

coderabbitai Bot commented Aug 12, 2026

Copy link
Copy Markdown

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

head_commit='ebc0db1cffb466fa2129dad83cc3544196dd5859'
main_refresh_commit='1d2e19049354115776804c66b9366fad2ea5b6c5'

git cat-file -e "${head_commit}^{commit}"
git cat-file -e "${main_refresh_commit}^{commit}"

printf '%s\n' '=== requested head ==='
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head_commit"

printf '%s\n' '=== stated main refresh commit ==='
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$main_refresh_commit"

printf '%s\n' '=== head parent topology ==='
git show -s --format='%P' "$head_commit" | tr ' ' '\n' | while read -r parent; do
  git show -s --format='parent=%H%nsubject=%s' "$parent"
done

printf '%s\n' '=== exact diff from each head parent ==='
git show -s --format='%P' "$head_commit" | tr ' ' '\n' | while read -r parent; do
  printf '\n--- parent %s ---\n' "$parent"
  git diff --name-status "$parent" "$head_commit"
done

printf '%s\n' '=== exact target files at requested head ==='
git show --no-ext-diff --format= --unified=100 "$head_commit" -- \
  CHANGELOG.md \
  docs/research/tls-configuration.md \
  src/egressweave/tls.py \
  tests/test_tls_configuration_exact_type.py \
  tests/test_tls_configuration_exact_type_documentation.py

printf '%s\n' '=== TLS module outline ==='
ast-grep outline src/egressweave/tls.py --items all

printf '%s\n' '=== TLS helper declarations and call sites ==='
rg -n -C 6 --glob '*.py' \
  '^(class\s+TLSConfiguration\b|def\s+create_egress_ssl_context\b)|\bcreate_egress_ssl_context\s*\(|\.create_ssl_context\s*\(' \
  src tests

printf '%s\n' '=== focused TLS configuration implementation ==='
rg -n -C 16 --glob '*.py' \
  '^(class\s+TLSConfiguration\b|def\s+create_egress_ssl_context\b)|def\s+create_ssl_context\b|client_private_key_password|include_default_trust_store|TLSv1_2' \
  src/egressweave/tls.py

printf '%s\n' '=== exact-type test files ==='
for path in \
  tests/test_tls_configuration_exact_type.py \
  tests/test_tls_configuration_exact_type_documentation.py \
  docs/research/tls-configuration.md \
  CHANGELOG.md
do
  printf '\n--- %s ---\n' "$path"
  cat -n "$path"
done

Length of output: 81208


🏁 Script executed:

#!/bin/bash
set -euo pipefail

head_commit='ebc0db1cffb466fa2129dad83cc3544196dd5859'
main_parent='1d2e19049354115776804c66b9366fad2ea5b6c5'
branch_parent='3b87e14b72ea22cb9933e5333f7db490013b3bdd'

printf '%s\n' '=== exact review diff: protected-main parent to requested head ==='
git diff --no-ext-diff --unified=60 "$main_parent" "$head_commit" -- \
  CHANGELOG.md \
  docs/research/tls-configuration.md \
  src/egressweave/tls.py \
  tests/test_tls_configuration_exact_type.py \
  tests/test_tls_configuration_exact_type_documentation.py

printf '%s\n' '=== TLS changes preserved across the merge ==='
git diff --no-ext-diff --exit-code "$branch_parent" "$head_commit" -- \
  src/egressweave/tls.py \
  tests/test_tls_configuration_exact_type.py \
  tests/test_tls_configuration_exact_type_documentation.py \
  docs/research/tls-configuration.md || true

printf '%s\n' '=== public builder definitions and TLS forwarding ==='
rg -n -U -C 12 --glob '*.py' \
  '^(def|async def)\s+(build_[A-Za-z0-9_]*|create_[A-Za-z0-9_]*)\s*\([\s\S]{0,1000}?tls_configuration|tls_configuration\s*[:=]' \
  src/egressweave

printf '%s\n' '=== transport constructors and helper boundary ==='
ast-grep outline src/egressweave/transport.py --items all
ast-grep outline src/egressweave/sync_transport.py --items all
rg -n -U -C 10 --glob '*.py' \
  'class\s+(PinnedHTTPSAsyncTransport|PinnedHTTPSTransport)\b[\s\S]{0,1600}?create_egress_ssl_context\s*\(' \
  src/egressweave

printf '%s\n' '=== all direct SSL-context configuration dispatches ==='
rg -n -C 6 --glob '*.py' \
  '\bcreate_egress_ssl_context\s*\(|\.create_ssl_context\s*\(' \
  src tests

printf '%s\n' '=== public exports and TLS API declarations ==='
for path in $(fd -t f '__init__.py' src); do
  printf '\n--- %s ---\n' "$path"
  rg -n -C 4 'TLSConfiguration|tls_configuration|create_egress_ssl_context' "$path" || true
done
rg -n -C 5 --glob '*.{py,pyi,md,toml}' \
  'TLSConfiguration|tls_configuration|create_egress_ssl_context' \
  pyproject.toml README.md docs src

Length of output: 43786


@seonghobae No current-head actionable findings.

I reviewed ebc0db1cffb466fa2129dad83cc3544196dd5859 against its protected-main parent 1d2e19049354115776804c66b9366fad2ea5b6c5.

  • create_egress_ssl_context() rejects every non-exact TLSConfiguration value before it calls create_ssl_context().
  • The new regression test proves that a subclass override cannot execute.
  • The synchronous and asynchronous public builders forward tls_configuration to the pinned transports. Each transport reaches the guarded helper before connection-pool construction.
  • Exact TLSConfiguration instances retain private trust roots, mTLS, deferred private-key passwords, and explicit TLS 1.2 compatibility.
  • The default None path remains unchanged.
  • The exact diff does not change authority validation, SNI binding, hostname verification, or public builder signatures.
  • The TLS guide and changelog describe the exact-type requirement, subclass migration, and supported configuration paths.

The TLS changes are also preserved unchanged across the merge result. I did not use predecessor-head review evidence.

You are interacting with an AI system.

Copy link
Copy Markdown
Contributor Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Aug 12, 2026

Copy link
Copy Markdown
⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Copy link
Copy Markdown
Contributor Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Aug 12, 2026

Copy link
Copy Markdown
⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Copy link
Copy Markdown
Contributor Author

Exact-head refresh for ec15fb784a0469ffe54390f6324a1839917a0c88 over current protected main 29773ef81203c65878c14aeb66bb1dc2284cb331:

  • Python 3.14: 953 passed; Python 3.10: 953 passed;
  • coverage: 1713/1713 statements and 578/578 branches, 100%, zero misses/partials;
  • Ruff, compileall, hourly product guard self-test, uv build wheel/sdist, CodeGraph sync, and git diff --check passed;
  • predecessor review/check evidence is superseded; fresh hosted exact-head Checks are queued.

The exact TLSConfiguration boundary and preserved trust-store/mTLS/TLS 1.2 behavior remain unchanged by the main refresh. No self-approval, Admin merge, bypass, or auto-merge was used.

Copy link
Copy Markdown
Contributor Author

Exact-head evidence after normal current-main refresh:

  • base: 632bb83bb2cfa86cbcb389ef8d544abaeb0403ef
  • head: 3114545b1566e027c362b40c7ee2e190697eea86
  • refresh: merge commit 3114545b1566e027c362b40c7ee2e190697eea86; no force-push or destructive rebase
  • Python 3.14: 967 passed
  • Python 3.10: 967 passed
  • coverage: 1713/1713 statements, 578/578 branches, 100%, zero misses/partials
  • Ruff, compileall, hourly product guard self-test, and uv build wheel/sdist: passed
  • review state: no submitted reviews and no unresolved inline review threads at this exact head

Fresh hosted Checks and security review are now required for this exact head. No self-approval, Admin merge, bypass, or auto-merge.

@seonghobae
seonghobae merged commit db3b0c5 into main Aug 12, 2026
36 checks passed
@seonghobae
seonghobae deleted the security/reconstruct-exact-tls-88c81a branch August 12, 2026 07:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant