Repository navigation
Prepare v0.1.8: correct the self-reported version and guard it - #12
Merged
Merged
Conversation
v0.1.7 shipped a single file that reported "Zero Breach 0.1.6": the version was hardcoded in build/bundle.py and had drifted from scan/adint_scan/__init__.py, which was itself never bumped. Someone who updated to get the security fix saw 0.1.6 and could not tell the fix was present. - Bump the package version to 0.1.8. - bundle.py now derives the single-file version from the package instead of repeating it, so the two can never disagree again. - build.py gains --expect-version, which fails the build unless the package version matches the release being cut. - Add a regression test asserting the bundle reports the package version. - Update README and SIGNING.md to v0.1.8 and the new zero-breach.py hash.
|
Thank you for releasing v0.1.7 and for crediting my report. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
v0.1.7 shipped a single-file build that reported
Zero Breach 0.1.6. The version was hardcoded inbuild/bundle.pyand had drifted fromscan/adint_scan/__init__.py(which was never bumped), so someone who updated to get the PowerShell security fix saw0.1.6and could not tell the fix was present.Changes
scan/adint_scan/__init__.py: version →0.1.8.build/bundle.py: derives the single-file version from the package instead of repeating it — the two can no longer disagree.build/build.py: new--expect-version X.Y.Zfails the build unless the package version matches the release being cut.test_bundle_release.py: asserts the bundle reports the package version.README.md,SIGNING.md: updated to v0.1.8 and the newzero-breach.pySHA-256 (74740af20f609f82dc6e50d66f234d0c39a20f516caa35731c2d19c11684ef44).Notes for the release
--iocs/--jsonnetwork-path guard for the single file (Refuse network paths for --iocs and --json in the single-file download #10).Testing
--checkclean;--expect-versionpasses on 0.1.8 and fails on a mismatch.