Repository navigation
RHEL-LAB-001: establish governed local research foundation - #1
Conversation
|
Sorry @EmergentMonk, you've used your own review budget of 250,000 diff characters for the last 7 days. You can request another review in 3 hours and 26 minutes by commenting |
Reviewer's GuideAPIReview the evidence utility’s command-line interface and its seal/verify behavior as the user-facing contract.
ImplementationReview the evidence inventory, path-safety checks, and manifest operations that implement the utility’s contract.
ConfigurationReview the source-check workflow and repository ignore rules that govern CI and local artifacts.
DocumentationReview the repository-wide authorization, containment, engineering, evidence, and disclosure policy alongside the research and security guidance.
Review the README’s project status, boundaries, tooling instructions, and roadmap summary against the detailed policies.
TestsReview the standard-library tests that check deterministic inventories, manifest protections, mutations, and traversal failures.
Other changesFiles not grouped.
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 71795a9f3b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| """List relative regular files in stable order; reject symlinks and special files.""" | ||
| root = _root(input_dir) | ||
| files = [] | ||
| for path in sorted(root.rglob("*"), key=lambda p: p.relative_to(root).as_posix()): |
There was a problem hiding this comment.
When an evidence subdirectory cannot be enumerated, Path.rglob() suppresses the scan error and silently omits its contents. Consequently, seal() can successfully write an incomplete manifest, and verify() can subsequently accept changes inside that same unreadable subtree. On Python 3.14, simulating a PermissionError from os.scandir() reproduced both outcomes, including successful verification after modifying the omitted log. Use traversal that propagates directory-enumeration errors so inaccessible evidence causes failure rather than a misleading PASS. This also violates the repository's prohibition on silently ignored errors.
AGENTS.md reference: AGENTS.md:L24-L24
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Addressed in commits 8091769693863624b040d363e459c5354e7e328c and 94b992e71d56d17cc8cbdb6be761cd1da6c803a7. Replaced Path.rglob() with explicit os.scandir() directory traversal that propagates enumeration failures; maintains deterministic manifest ordering and symlink/special-file rejection. Added regression tests for unreadable subtree on seal/verify, unreadable root, and symlinked directory. GitHub Actions Source checks run #2 (43169421973) completed successfully: Python compilation and unit tests passed. No RHEL VM/security testing was executed.
|
@codex security review |
|
Codex Review: Didn't find any major issues. Delightful! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Summary
Establishes the first auditable RHEL-LAB research foundation without performing or claiming any live RHEL security test.
Verification
Owner-review gates
Follow-up
RHEL-LAB-002 will cover a specifically authorized local RHEL guest, actual isolation verification, baseline environment receipts and snapshots. This PR does not treat the developer subscription or Rex's reply as unrestricted testing authorization.
Summary by Sourcery
Establish the auditable RHEL-LAB repository foundation for safe, authorized, and reproducible local research without conducting live RHEL security testing.
New Features:
Enhancements:
CI:
Documentation:
Tests:
Chores: