Track libsodium upstream in NOTES.md instead of filing issues#152
Merged
Conversation
The first real run of the nightly libsodium check found 1.0.22 (vendored is 1.0.20) but reported green without filing its tracking issue: creation failed on a missing 'dependencies' label and a '|| echo' fallback masked it. Rather than fix issue-filing, drop it — the record belongs in sodium/NOTES.md. - scheduled.yml: the check now compares the latest upstream release to a "Last reviewed upstream release" marker in NOTES.md and fails (no issue) if a newer, unreviewed release exists. Failing self-clears when NOTES.md is updated. - sodium/NOTES.md: add the marker (1.0.22) and a review log. Reviewing 1.0.21/1.0.22 found most changes are outside the included slice, but the AEAD post-MAC-verification memory fence (speculative-access hardening) from 1.0.20-stable/1.0.21 does touch the ChaCha20-Poly1305 decrypt path and is noted as pending incorporation on the next re-vendor. It is a defense-in-depth hardening, not a functional or interop change, so vendored 1.0.20 stays correct meanwhile. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
gafferongames
force-pushed
the
fix-sodium-watch
branch
from
9d24226 to
6eadf67
Compare
gafferongames
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What happened
The manual first run of the nightly
scheduled.ymlsurfaced a real finding — libsodium 1.0.22 is out, vendored subset is 1.0.20 — which is what thelibsodium upstream checkjob is for. But it reported green without opening the tracking issue (creation failed on a missingdependencieslabel; a|| echofallback masked the failure).Per direction, the fix is not to repair issue-filing but to drop it — the record lives in
sodium/NOTES.md.Change
scheduled.yml: the check now compares the latest upstream release to aLast reviewed upstream release:marker insodium/NOTES.mdand fails (no issues, no labels, noissues: write) if a newer, unreviewed release exists. The failure self-clears when NOTES.md is updated.sodium/NOTES.md: adds the marker (1.0.22) and a review log.The review
Checking 1.0.21 + 1.0.22 against the included slice (ChaCha20 / Poly1305 / the two AEADs):
Marker set to 1.0.22, so the job is green now and will fire again only on 1.0.23+.
Verified
scheduled.ymlvalid YAML; marker parse + comparison simulated locally against the real NOTES.md (reviewed1.0.22== latest1.0.22→ green).🤖 Generated with Claude Code