Repository navigation
Conversation
Port the remaining slice 2.3 resource-discovery change from #1262 at 122b786. Preserve the build facts already carried in #1435. Verify the three pure filesystem tests in development and release-build configurations with exact-name selection guards. CLI clippy, Rust formatting, domain lint and independent review pass.
Record Gate 1 for user approval: real A/B comparison and rebuild-check publication preserve Phase 1 identities while qualification remains closed. The narrower ordinary-release assurance claim requires explicit approval before implementation.
Port the closed producer primitives from #1262 at 122b786. Stage the manifest, error variants and fail-closed entrypoint; keep selection, signing and publication unavailable. Run 49 audited pure tests locally and wire full process tests and strict clippy into existing Linux CI jobs. Carry schemas unchanged with approved exact reference-host entries and rejection coverage. Document required shared dependency upgrades.
Record the approved merge activation, permanent companion profile contract, direct upload-action identity bridge, rerun rejection and read-only reusable-caller permissions before implementing the adapter.
Begin the separately approved Gate 1 adapter with strict observation shape, closed qualification claims and canonical/reproduction input/environment pairing. Keep the producer entrypoint closed while runtime pin, filesystem, transfer and equality stages remain pending. Verify red-green observation, root-alias and bounded-diagnostic regressions; 58 audited pure tests, strict producer clippy, formatting and domain lint pass. Independent review approves this staged unit with explicit runtime preconditions.
Extend the approved ordinary adapter with bounded full-byte equality after input pairing and observed digest/size checks. Retain bounded exact mismatch diagnostics without normalized or excluded regions; keep command assembly and qualified paths closed. Verify red-green equality coverage, custom-section and EOF differences, mutation-after-observation rejection, 62 audited pure tests and strict clippy. Independent review approves the staged comparison unit.
Reuse the reviewed ZIP32 primitive and negative fixtures from #1262 at 122b786 without moving collection authority into Phase 2. Enforce exact build/observation member sets and source-owned bounds before the original full integrity checks. Verify red-green profile admission, 71 audited pure tests, strict clippy and an exact-ID read-only probe of the current Fastly archive against its recorded GitHub digest. Independent/security review approves this structural unit; transfer authentication remains pending.
Preserve the incoming main integration, HTML EOF checks and corrected Axum bind diagnostics alongside the reviewed Phase 2 producer work. Resolve the compatibility audit by retaining the diagnostic correction and fresh-rehearsal requirement together with the approved rebuild-check profile and activation notes.
Carry the frozen inspection implementation from 122b786. Render the future recipe reference as inline code until its module lands. Keep release commands closed.
Carry the approved Phase 2 source and staged evidence-test splits from 122b786. Validate all seven ordinary cohort rows while preserving four closed controlled destination contracts. Keep qualified selectors and release execution closed.
Implement the approved Gate 1 canonical source recipe and consumed-output hashing. Use the reviewed Cargo message parser from 122b786 without constructing qualified receipts or enabling release commands.
Carry the reviewed preparation helpers from 122b786 while preserving fresh ordinary npm output. Keep the lifecycle observer unchanged at esbuild 0.27.3, document the current-lock gap, and visibly disable its full collector fixture with an enabling guard. Retain newer npm dependency versions and run subprocess fixtures only in CI.
Carry the remaining reviewed prose and formatting hunks from 122b786. Preserve current runtime changes and describe immutable release metadata without claiming a signed index. Cloudflare shell diagnostics remain identical to its pre-existing baseline.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Collaborator
Author
|
Rehearsal Implementation |
Collaborator
Author
|
Rehearsal Implementation |
Collaborator
Author
|
Rehearsal Implementation |
Collaborator
Author
|
Rehearsal First attempt and full release verification passed. Rerun-all attempt 2 passed all seven builds, the second Fastly build, real archive/current-attempt binding, byte comparison and signing. Publication then refused the existing immutable release before release mutations. This is a successful transfer/recovery check, not a second successful publication; the overall rerun ends red. Successful real comparison job. No ZIP rules, artifact names or duplicate checks were changed. A separate post-rerun online-SPDX check exposed a documentation uniqueness assumption: two valid pinned attestations now exist for the same binary; one equals the authenticated published SPDX. Their only predicate differences are creation timestamp and document namespace. Published-bundle verification remains valid. A proposed docs-only online example would accept a verified predicate exactly equal to the shipped SPDX, preserving every identity/source constraint; the docs-only correction is approved and prepared for the final documentation commit. Positive and one-byte-negative proof passed. No workflow or script change is claimed. Stack frames are omitted below; the command, record counts and assertion failure are retained. |
Collaborator
Author
|
Approved docs-only online-SBOM correction — live positive/negative proof At |
Collaborator
Author
|
Phase 2 exact-head rehearsal Implementation |
Collaborator
Author
|
Phase 2 exact-head rehearsal Implementation |
Collaborator
Author
|
Phase 2 exact-head rehearsal Implementation |
Docs-only since rehearsed 770a425 (v0.0.0-rehearsal.13).
* Add design spec and plan for separate creative click rewrite switch Spec and implementation plan for #1234: an [auction] rewrite_clicks switch that follows rewrite_creatives when unset, so click wrapping can be controlled independently of asset rewriting. Signed-off-by: dhruv8sh <dhruv8sh@proton.me> * Update spec and plan after implementation review Describe the review fixes: the extended shared-step CHANGELOG entry and the sign status change, rollback in both directions, the reworded Auction Rewrite Control docs and renderGuard note, the fuller body-less matrix fixture, the exact default-output pin, and the stronger proxied-HTML test. Signed-off-by: dhruv8sh <dhruv8sh@proton.me> * Split creative URL normalization from rewrite host policy Replace to_abs with normalize_creative_url and move exclusion policy to Rewrite::should_proxy_asset and Rewrite::should_wrap_click, sharing the case-insensitive proxy host matcher. Normalize exclude_domains at load. This is the shared step for #1231 and #1234. Signed-off-by: dhruv8sh <dhruv8sh@proton.me> * Add an auction rewrite_clicks setting that follows rewrite_creatives when unset Signed-off-by: dhruv8sh <dhruv8sh@proton.me> * Gate creative asset and click rewriting on separate switches The rewrite pass registers asset handlers only when rewrite_creatives is on and the anchor handler only when click rewriting resolves on. Base removal and TSJS injection run whenever either is on. Signed-off-by: dhruv8sh <dhruv8sh@proton.me> * Apply an explicit rewrite_clicks to HTML fetched through the first-party proxy Signed-off-by: dhruv8sh <dhruv8sh@proton.me> * Document rewrite_clicks in the example config and pin its overlay behavior Signed-off-by: dhruv8sh <dhruv8sh@proton.me> * Document the rewrite_clicks creative setting Signed-off-by: dhruv8sh <dhruv8sh@proton.me> * Address review feedback on the rewrite_clicks spec and plan Correct the renderGuard caveat for the sandboxed /auction renderer, list the operator docs that become false, keep a bidder <base target> while dropping its href, and warn on the public rewrite wrappers. Also fix citations, the shared CHANGELOG Fixed wording, red-step ordering, the Step 5 grep, rollout and staged rollback notes, and other precision items. Signed-off-by: dhruv8sh <dhruv8sh@proton.me> * Cover suffix spoofing in the rewrite policy test Restore the example2.com.fake.com style case dropped in the port of test_rewrite_is_excluded, and point the should_proxy_asset docs at is_host_allowed in code text so cargo doc stops warning about a link to a private item. Signed-off-by: dhruv8sh <dhruv8sh@proton.me> * Warn that public rewrite wrappers ignore switches rewrite_creative_html and rewrite_inline_creative_html rewrite assets and clicks unconditionally. Document that production code must use the auction processing entry points, which honor both switches. Signed-off-by: dhruv8sh <dhruv8sh@proton.me> * Keep a bidder base target when dropping its URL The rewrite pass removed every <base>, which also dropped target="_blank" so raw links opened inside the creative iframe. Drop only the href, which is what can rebase first-party URLs, and remove a <base> left without a target as before, so default output is unchanged. Signed-off-by: dhruv8sh <dhruv8sh@proton.me> * Correct operator docs for rewrite_clicks Name rewrite_clicks in the orchestration example, environment overrides and rollback note, fix the rewrite_creatives = false summary, correct the renderGuard caveat for the sandboxed renderer, and document base target handling and the inert click guard. Signed-off-by: dhruv8sh <dhruv8sh@proton.me> * Expand the CHANGELOG notes for the shared step List the CSS re-quoting, https: prefixing and sign error text changes in the Fixed entry, and note that a bidder base target is now kept. Signed-off-by: dhruv8sh <dhruv8sh@proton.me> * Align creative click switch docs and tests with review feedback Describe rewrite_clicks separately from asset rewriting across the operator guides, state the default-config <base target> change in the CHANGELOG, refresh the spec status and rollout, and correct stale exclude_domains and <base> prose. Add non-http(s) host-bearing schemes to the URL normalizer test and reuse the push helper in the existing auction overlay CLI tests. Signed-off-by: dhruv8sh <dhruv8sh@proton.me> * Format the creative click rewrite switch spec with Prettier Signed-off-by: dhruv8sh <dhruv8sh@proton.me> * Document EC ID forwarding and close remaining click switch doc gaps Add a consent and privacy section, adapter coverage and a review log to the spec. State in the operator docs and CHANGELOG that click wrapping decides where the EC ID goes, that no explicit rewrite_clicks reproduces unset when rewrite_creatives is false, and that rollback and the base target change also affect HTML fetched through /first-party/proxy. Signed-off-by: dhruv8sh <dhruv8sh@proton.me> * Cite spec EC ID forwarding lines at the stated main commit Signed-off-by: dhruv8sh <dhruv8sh@proton.me> --------- Signed-off-by: dhruv8sh <dhruv8sh@proton.me> Co-authored-by: prk-Jr <49094961+prk-Jr@users.noreply.github.com> Co-authored-by: AG <132480+aram356@users.noreply.github.com>
…rs (#1291) * Keep config permissions and hide config text in ts prebid bundle errors Move the audit atomic writer into a shared fs_util module and use it for the prebid bundle metadata patch, so the config keeps its permissions, is fsynced, and leaves no temp file behind on failure. Report TOML parse errors by byte offset instead of echoing the parser snippet, including in ts audit generate, through one shared toml_error_location helper. Closes #1202. Signed-off-by: dhruv8sh <dhruv8sh@proton.me> * Report TOML error line and column and tighten config write tests Map redacted TOML error spans to line and column, prove mode preservation with a 0640 config, cover the patch_config_metadata parse error, and narrow the atomic writer doc to the mode bits it actually keeps. Signed-off-by: dhruv8sh <dhruv8sh@proton.me> * Hide config text in remaining ts audit generate parse errors Route the dry-run diff and managed-field validation parse errors through toml_error_location, add regression tests, and gitignore .ts-write-* temp files left by an interrupted config write. Signed-off-by: dhruv8sh <dhruv8sh@proton.me> * Pin TOML parse error locations in CLI tests and note the fix in the changelog Assert the exact line and column in the prebid parse-error tests, add a no-echo test for splice_creative_slots, and pin that toml_error_location counts columns in characters. Add a Security changelog entry telling operators to restrict configs an earlier ts prebid client widened. Signed-off-by: dhruv8sh <dhruv8sh@proton.me> --------- Signed-off-by: dhruv8sh <dhruv8sh@proton.me> Co-authored-by: AG <132480+aram356@users.noreply.github.com>
…-attestations-phase2 # Conflicts: # docs/superpowers/plans/binary-attestations-phase1-compatibility.md
…binary-attestations-phase2 # Conflicts: # crates/trusted-server-cli/src/prebid_bundle.rs
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
770a425df: port the reviewed Add binary attestation contracts and release build guards #1262 producer graph and enforce ordinary Fastly A/B byte equality with approved compiler-path normalization. Qualification stays closed; GNU masking is excluded.Changes
2ed1b94 size against Phase 1 ab6e549: 263 new files (1 binary fixture), 86,814 text lines; 43 existing files +4,595/−615. Rust: 78,501 new lines +311 existing additions, including tests. Workflow/script/non-Rust test code: 4,123 new lines +2,239 existing additions. Remaining lines are docs, schemas and lockfile.
Closes
Part of #1235. Tracking issue number pending; draft text.
Spec / Plan
Spec, assignment, approved Gate 1, implementation/normalization plan, compatibility audit and rehearsal records. Frozen source: 122b786.
Test plan
5349b7c: docs-only exact-SHA record after main integration
7d551777d(054c7b777merged into Phase 2 only). Release workflows/producer/build facts/manifests/lock/tool pins are unchanged. Seven targeted filesystem tests, CLI/Fastly clippy, format/domain checks and independent review passed. GitHub’s native stack wrapper was removed; both draft PRs retain their bases and source history. This head is mergeable and full exact-head CI is running, including seven builds and Fastly A/B comparison. Phase 1 remains at green docs head20152315c, with.15verified at68eef902a. No new Phase 2 rehearsal:.13below remains exclusively at770a425dfand does not cover later application inputs.770a425: all implementation CI passed, including seven builds, full-byte comparison and hosted process/negative-canary tests; PR signing/publication skipped. One lost Intel runner was retried without source/runner/timeout changes. Rehearsal
.13and full transcript passed: 30 immutable prerelease files (not Latest), both predicates/identities online and offline, SPDX equality, companion/run/artifact joins, checksums, native checks and offline Fastly pack/validate/inspect/cmp. Reproduction took 6m18s and comparison 1m56s, overlapping native builds.3ccfe29:
.10rerun-all transfer proof passed; publication correctly refused the existing immutable release with all assets unchanged. Approved online-SBOM positive/one-byte-negative proof passed against fully verified pinned results. This recovery proof is attributed to its earlier source, not presented as a rerun of770a425df.Outside-scope CI fixes (mirrors main #1454)
886cf33: separately commit the browser job's Ubuntu 24.04 pin and exact explanatory comment from main fd2bf10. The workflow blob is byte-identical to #1454; other jobs/dependencies are unchanged.
Allowlist changes needing maintainer review
Exact approved reference hosts
json-schema.organdspdx.org, with justification and subdomain/lookalike tests. Four reviewed per-lineapi.github.comsuppressions cover Actions APIs/test assertions; no global API-host entry or wildcards.Human gates