coulomb/railiance-forge
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Batch small receive inputs within the unchanged scan budget
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a14bfc-9643-7872-aa12-98326dcf25e7
This commit is contained in:
tegwick 2026-10-18 13:25:08 +02:00
parent b42206e52b
commit ea65606c12
6 changed files with 995 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

29
docs/receive-secret-detection.md
View file

@ -9,7 +9,8 @@ The source adapter is not evidence of installed server enforcement.
The forge-owned, standalone Linux adapter composes with Forgejo's generated
pre-receive dispatcher. It uses pinned Gitleaks 8.30.1 Linux amd64
(SHA256 `88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509`).
It requires `/usr/bin/git` and `/proc` but no Python runtime, issuer credential,
It requires `/usr/bin/git`, `/proc`, a private writable tmpfs at `/dev/shm`,
and Linux pidfd support (5.3+ on amd64/arm64) but no Python runtime, issuer credential,
network access, source checkout, or repository-controlled workflow. The current
Forgejo 11.0.3 image has no Python interpreter; this keeps the runtime change to
two reviewed executables and a hook fragment, subject to native admission.
@ -67,6 +68,26 @@ bytes are checked before scanning payloads. Limits reject rather
than skip. Large imports need an admitted path; do not disable the gate to pass
an unreviewed import. Git/scanner versions and limits require native load testing.
FORGE-WP-0010 corrects per-small-input scanner startup overhead without changing
these limits. It reuses Repo Manager's bounded profile: at most 64 inputs of at
most 4096 bytes per directory invocation. Larger inputs retain the existing stdin
reader and fragment behavior. Raw inputs use 0700 private tmpfs directories and
0600 files with safe object/ref identifiers; no source path controls a filename.
Missing or nonvolatile storage refuses instead of falling back to ordinary disk.
A separately supervised child pins its receiver with pidfd, acknowledges readiness
before payload writes, and cleans up on pipe EOF. A 180-second backstop terminates
the exact stalled receiver before cleanup. Git/scanner children die when their
creating receiver thread dies; it is pinned to its OS thread during each child.
Normal cleanup and failed cleanup are checked. Directory identity replacement
refuses deletion. This is not protection against a hostile same-UID host process.
Directory scans use the same pinned scanner/default config and explicit empty
ignore file. Bounded reports contain only known safe payload identifiers. Missing,
malformed, oversized or inconsistent reports, unknown diagnostics and scanner or
watchdog failures refuse. Only the exact pinned scanner's positive-finding summary
is accepted as a warning. The original stdin route is otherwise unchanged.
The adapter does not rescan objects already reachable before the push, scan
unreachable extra pack objects, LFS payloads, other repositories, runtime logs,
artifacts or credentials outside Git. It is not an authorization boundary against
@ -82,8 +103,10 @@ wikis, archives, mirrors and new-repository lifecycle before claiming DSM covera
## Build and disposable acceptance
Use the admitted Go toolchain (the current candidate uses official Go 1.26.9,
verified against the SHA256 from go.dev release metadata). No third-party Go
Use an admitted Go toolchain. The original deployed revision used Go 1.26.9,
verified against the SHA256 from go.dev release metadata. The FORGE-WP-0010
source candidate is separately tested with installed Go 1.26.7; its new source,
compiler and exact executable still require native admission. No third-party Go
modules are required. Keep binaries and logs outside the repository:
```sh