Repository navigation
security: resolve Oneleet gosec findings - #694
Merged
Merged
Conversation
- Profile dir, config, API key, org file and the Terraform credentials file are now created 0700/0600; existing files from older versions are tightened on next load (config.TightenPerms) - HashArchiveContents caps the uncompressed bytes it will read at 512 MiB (identical change in oracle/manifest/checksum.go; pinned digest unchanged) - Manifest and backend dirs created 0750; generated files 0600 - G204/G304 sites annotated with why the binary or path is trusted; .gitignore append stays 0644 by design - io/ioutil replaced with os in the touched files
Picks up deployment-sdk#172 (cd49c268).
ssickles
previously approved these changes
Oct 7, 2026
Generated app modules use the ns_env_layout, ns_env_values and ns_env_platform_data data sources, which shipped in provider 0.13.0. TestGenerate_App already asserted the pin; the scaffold never emitted it.
Generated modules deliberately leave the ns provider unpinned. The test now asserts the provider source is present and no version constraint is emitted, which is what the generator has produced since #693.
ssickles
approved these changes
Oct 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of the Oneleet code-security sweep (plan:
design-documents/oneleet-code-security-remediation.mdin the monorepo root). Clears all 29 open findings in this repo.Behaviour changes
0700; the profile config, API key, org file and the Terraformcredentials.tfrcare written0600. Files created by older CLI versions are tightened in place on next load viaconfig.TightenPerms(best-effort, silent). CHANGELOG0.0.208entry added.HashArchiveContentsstops after 512 MiB of uncompressed content (CWE-409). The pinned digest test is unchanged; oracle carries the identical change so the two stay byte-for-byte in sync.0750, generated files0600..gitignoreappend deliberately stays0644.Annotations (no behaviour change)
session-manager-plugin,az,terraformresolved from PATH with CLI-built args;mcp/executor.gore-executesos.Args[0]..gitignore) or a well-known config file.io/ioutilswapped forosin the touched files.Deps
Verification
go build ./...,go vetand tests on the touched packages pass withGOTOOLCHAIN=go1.26.6.TestGenerate_Appwas failing on master: it expected the scaffold to pinnsto~> 0.13.0, but generated modules deliberately leave the provider unpinned. The test now asserts the provider source is present and noversion =is emitted;go test ./modules/is green. No generator change.