Repository navigation
security: resolve Oneleet gosec findings - #172
Merged
Merged
Conversation
- G402: annotate InsecureSkipVerify in docker client; it mirrors the SkipTLSVerify setting of the user's own docker context - G401/G501: annotate md5 in S3 zip upload; it feeds the Content-MD5 integrity header required by object-lock buckets - G304: annotate every os.Open/Create/ReadFile with the reason the path is trusted (caller-provided source, enumerated from baseDir, or a well-known docker config file) - G301: download dirs created 0750 instead of 0755 - Add a traversal guard to the four directory downloaders (S3, Azure Blob, GCS, Composer) so an object key containing ".." can never write outside localDir
ssickles
approved these changes
Oct 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
First PR of the Oneleet code-security sweep (plan:
design-documents/oneleet-code-security-remediation.mdin the monorepo root). Libraries go first so enigma and the CLI pick this up on re-vendor.What changed
Annotations (no behaviour change) — every
#noseccarries the reason:docker/docker_cli.goG402:InsecureSkipVerifymirrors theSkipTLSVerifyflag of the user's own docker context, same as the docker CLI.aws/s3/upload_zip_artifact.goG401/G501: MD5 feeds the S3Content-MD5integrity header required by object-lock buckets.baseDir, or well-known files under the docker config dir.Hardening
0750instead of0755(4 sites).localDir. Keys come from our own buckets so this is belt-and-braces, but it makes the G304 annotation on theos.Createhonest. Flagging it because it is the one change beyond annotate-and-tighten.Verification
go build,go vet(theslices.Compactvet error inaws/ecs/get_all_deployment_tasks.gois pre-existing and untouched here),go test ./...green withGOTOOLCHAIN=go1.26.6.#noseccomments. If the annotated findings stay open after the rescan, the comments stay as in-code justification and the findings get per-issue Ignore in the Oneleet UI.