From aac34cec8c0034998e4e511ccfb82f63bfc22626 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 13 Jun 2026 05:08:10 +0000 Subject: [PATCH] =?UTF-8?q?ci/docs:=20correct=20the=20CodeQL=20code-scanni?= =?UTF-8?q?ng=20caveat=20=E2=80=94=20repo=20is=20public?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The repo is public (confirmed: visibility=public), so CodeQL code scanning is free and available with no setup — the analyze step's SARIF upload just works. Strip the stale "needs GitHub Advanced Security / enable code scanning" caveat (that's the private-repo case) from the codeql.yml comment and the two CodeQL plan entries. Leaves untouched the separate, substantive "packet.net is private" design references (self-update feed needing a public host; the ax25-ts parity-check read token) — those are owner design decisions to revisit, not caveats to strip. https://claude.ai/code/session_01GSRLZXowGYeRieqaevEtBb --- .github/workflows/codeql.yml | 8 +++----- docs/plan.md | 4 ++-- 2 files changed, 5 insertions(+), 7 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 9d85cc3b..adbef23b 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -17,11 +17,9 @@ name: codeql # # Findings surface in the repo Security > Code scanning tab (SARIF upload), so on # top of push/PR we run a weekly scheduled sweep to re-scan main against any -# newly-shipped CodeQL queries even when the code is quiet. -# -# NB: SARIF upload requires GitHub code scanning enabled on the repo (GitHub -# Advanced Security on a private repo). Until that's on, the analyze step's -# upload will fail. +# newly-shipped CodeQL queries even when the code is quiet. This repo is public, +# so code scanning is free + available with no setup — the analyze step's SARIF +# upload just works. (On a private repo it would need GitHub Advanced Security.) on: push: diff --git a/docs/plan.md b/docs/plan.md index 0010bc88..ce9f0e45 100644 --- a/docs/plan.md +++ b/docs/plan.md @@ -1075,11 +1075,11 @@ What changed, why, where to look for details. Built the heart of the self-contained channel. **`packaging/packetnet-selfupdate`** is the helper the self-contained install ships as `/usr/lib/packetnet/packetnet-update` (the same `packetnet-update.service` unit as apt, different body): fetch `latest.json` from the configured feed → pick this arch's tarball → download → **sha256-verify** (checksum-only; a marked seam for cosign later) → unpack into `releases/` via a temp dir + atomic rename → **flip the `current` symlink** (the unit's ExecStart target) → restart → poll `/healthz` → on failure **flip back to `$prev` and restart** → GC keeping exactly `current`+`$prev`. Parses the manifest without a jq dependency; paths/restart/health are `PDN_*`-overridable so it's testable without systemd. A fixture smoke (`scripts/selfupdate-smoke.sh`, wired into `deb-smoke`) proves happy-path/checksum-mismatch-refused/rollback — and caught a real bug mid-build: GC by mtime deleted the **rollback target** (it's `$prev`, not necessarily the 2nd-newest), fixed to protect `current`+`$prev` explicitly. **API generalized:** `ISystemUpdateLauncher.StartAptUpdateAsync` → `StartUpdateAsync` (channel-agnostic — starts the one oneshot whatever the install's helper does), and `POST /api/v1/system/update` now launches for **both** apt and self-contained with a channel-aware `via`/audit; only `unknown` → 409 (self-contained stopped returning 501). `SystemUpdateApiTests` updated; full Node suite green. **Remaining (slice 2c):** `installers/install.sh` (lay out `releases`/`current` + the self-contained unit + marker + the helper + polkit + `/etc/packetnet/update.conf` + user/dirs + bootstrap), the feed URL in node config, and the available-version check feeding the UI. ### 2026-06-13 — CodeQL reworked to buildless (C# + web TS), dropping the traced Release build -Refined the `codeql.yml` from the entry below before it ever ran. Switched both languages to **`build-mode: none`** (buildless extraction) and matrixed two SHIPPED codebases — `csharp` (the .NET product) and `javascript-typescript` (`web/packetnet-ui`, the served SPA). Buildless C# skips the full Release compile entirely, so the workflow no longer needs the exclusive `flock -x /tmp/pdn-ci-heavy.lock` (it isn't the CPU-heavy compile that lock guards) — much lighter on the contended self-hosted box, at a small completeness cost vs a traced build. Kept `[self-hosted, Linux, X64]`; added `packages: read` (private query packs); bumped the action to `@v4`. The python/rust/c spec dirs stay out of scope (reference artifacts, not product). GitHub's own "Advanced setup" template was declined — it targets `ubuntu-latest`/`macos-latest` (violates the no-hosted-runners rule) and would have clobbered this file. The GHAS/code-scanning-enabled caveat below still applies. +Refined the `codeql.yml` from the entry below before it ever ran. Switched both languages to **`build-mode: none`** (buildless extraction) and matrixed two SHIPPED codebases — `csharp` (the .NET product) and `javascript-typescript` (`web/packetnet-ui`, the served SPA). Buildless C# skips the full Release compile entirely, so the workflow no longer needs the exclusive `flock -x /tmp/pdn-ci-heavy.lock` (it isn't the CPU-heavy compile that lock guards) — much lighter on the contended self-hosted box, at a small completeness cost vs a traced build. Kept `[self-hosted, Linux, X64]`; added `packages: read` (private query packs); bumped the action to `@v4`. The python/rust/c spec dirs stay out of scope (reference artifacts, not product). GitHub's own "Advanced setup" template was declined — it targets `ubuntu-latest`/`macos-latest` (violates the no-hosted-runners rule) and would have clobbered this file. **Correction to the caveat in the entry below:** the repo is *public* (confirmed via the API — `visibility: public`), so code scanning is free + available with no setup; the SARIF upload just works and there is no GHAS/enable-it step (that caveat only applies to private repos). ### 2026-06-13 — CodeQL static analysis (C#) added; WebAuthn ceremony review (no findings) -Two follow-on security tracks after the #405 hardening pass. **(1) CodeQL** — new `.github/workflows/codeql.yml` runs the C# CodeQL analysis on `[self-hosted, Linux, X64]` (zero hosted-runner minutes, per the project rule) on push/PR to main + a weekly cron + dispatch; `build-mode: manual` (CPM + the `.slnx` solution defeat autobuild) with the Release build wrapped in the exclusive `flock -x /tmp/pdn-ci-heavy.lock` like `fuzz.yml`. NB: SARIF upload to the Security tab needs GitHub code scanning enabled on the repo (GHAS on a private repo) — flagged for the owner; the workflow itself is correct regardless. **(2) WebAuthn / passkey ceremony review** — read the registration + assertion path (`PdnWebAuthnApi`, `WebAuthnFido2Builder`, `WebAuthnChallengeCache`, the credential store) end to end: **no exploitable findings.** Challenge is single-use (atomic `TryRemove`) + TTL'd off the injected clock + user-bound; RP-id/origins are pinned from config (a spoofed Host can't widen them); sign-count clone-detection is checked and persisted; credential↔user binding is enforced with a constant-time compare and global credential-id uniqueness; everything fails closed behind a single generic 401. Four non-defect observations recorded (UV=`Preferred` vs `Required` is a policy knob; the username-scoped `assert/begin` is an inherent passkey-existence oracle in the non-discoverable flow; an unused store method; clone-vs-generic log classification keys off an exception substring). Full write-up in [`docs/webauthn-review-2026-06-13.md`](webauthn-review-2026-06-13.md); the session's earlier tracks are in [`docs/security-review-2026-06-13.md`](security-review-2026-06-13.md). +Two follow-on security tracks after the #405 hardening pass. **(1) CodeQL** — new `.github/workflows/codeql.yml` runs the C# CodeQL analysis on `[self-hosted, Linux, X64]` (zero hosted-runner minutes, per the project rule) on push/PR to main + a weekly cron + dispatch; `build-mode: manual` (CPM + the `.slnx` solution defeat autobuild) with the Release build wrapped in the exclusive `flock -x /tmp/pdn-ci-heavy.lock` like `fuzz.yml`. (Reworked to buildless in the entry above; this manual-build form never ran.) SARIF upload surfaces in the Security > Code scanning tab — the repo is public, so that's free + available with no setup (no GHAS step; that caveat is private-repo-only). **(2) WebAuthn / passkey ceremony review** — read the registration + assertion path (`PdnWebAuthnApi`, `WebAuthnFido2Builder`, `WebAuthnChallengeCache`, the credential store) end to end: **no exploitable findings.** Challenge is single-use (atomic `TryRemove`) + TTL'd off the injected clock + user-bound; RP-id/origins are pinned from config (a spoofed Host can't widen them); sign-count clone-detection is checked and persisted; credential↔user binding is enforced with a constant-time compare and global credential-id uniqueness; everything fails closed behind a single generic 401. Four non-defect observations recorded (UV=`Preferred` vs `Required` is a policy knob; the username-scoped `assert/begin` is an inherent passkey-existence oracle in the non-discoverable flow; an unused store method; clone-vs-generic log classification keys off an exception substring). Full write-up in [`docs/webauthn-review-2026-06-13.md`](webauthn-review-2026-06-13.md); the session's earlier tracks are in [`docs/security-review-2026-06-13.md`](security-review-2026-06-13.md). ### 2026-06-13 — Web auth core security review (no findings) — written up