Make the three-build comparison of decision 0010 runnable by anyone #11
No reviewers
Labels
No labels
accessibility
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
Keel-Linux/buildtasks!11
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "feat/layer-measure"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Closes #10. Paired with Keel-Linux/handbook#8, which amends decision 0010 to name
this command and reports what a recount of the two merged extractions found
with it.
Handbook decision 0010 accepts the component split on one condition, stated in
step 3 of its order of work: components move one at a time, "re-running this
three-build comparison for each, including the control-vs-control run".
Nothing in this organization ran it. The capture half was
/root/measure/build.shon the build host, a scratch file in root's homedirectory on one machine; the comparison half, the part that turns captures
into the number a pull request quotes, was ad hoc shell that was never
committed at all. Keel-Linux/keel-mariadb#11 and Keel-Linux/keel-postgresql#7
were both approved on a count only their author could produce.
--diris required by every subcommand and defaults to nothing, so thedirectory holding the measurement is part of the command and a second person
re-runs the same command against the same directory. No state in a home
directory on one machine.
capturetakes/run/lock/keel-build.lockwith abounded wait. A tag is never overwritten. The full procedure is in
docs/layer-measure.md.Why this repository and not
.github.github/liblends shell to the organization's reusable workflows; this is notthat. The capture half runs
bt-layerand reads the rootfs it leaves in$BT_BUILDS/layers, so it is written againstbin/layer-lib's own vocabularyof layers, parents, manifests and units. The build host already has this
repository at
/turnkey/buildtasks-keel, which is where the three buildshappen, and
.githubis not checked out there at all. This repository alsoalready has the gate the work needs,
tests/coverage.shunder kcov at a 99percent floor, and decision 0010 step 1, making
bt-layerunit-aware, landedhere in #8.
What the hand-run measurement got wrong
It counted paths it could not key on. The capture wrote
sha256sum'sdefault
<hash>plus two spaces plus<path>and the comparison split onwhitespace. A Debian rootfs holds
setuptools/_vendor/jaraco/text/Lorem ipsum.txt, which becomes two fields andnever matches itself, so the LAMP measurement of 2026-09-27 reported 199 and
183 differing files where the true counts were 198 and 182 (
docs/traps.md,"A path with a space in it"). Every record here is
path<TAB>...with the pathin field 1, and a path carrying a tab, a newline or a backslash is refused at
capture time rather than mis-counted.
It was blind where it mattered most. For mariadb 173 of the 179 files in
the floor are
./var/lib/mysql/**, which holdsmysql/global_privandmysql/user.*, and the component's build-time job includes deleting accounts.A path is put inside the floor by its name; whether its difference is noise is
a question about its bytes.
It treated a file it could not read as a file that did not change.
The rework after review
Review of the first push found two ways this failed in the same direction as
the defect it exists to correct. Both are closed.
The signature compared positions and threw the content away
o<n>/n<n>,@<n>and a barelenare positions. Two unrelated changes atone line number or one byte offset annihilated, and the evidence block was
suppressed for anything called noise, so the one mistake the scheme could make
was the one nobody could see. Four cases came back
noise, exit 0, withnothing printed:
/etc/shadowat the line number the control pair alsoappends at,
The controls are now the model and the model carries content. At each position
the controls vary at, the longest common prefix and suffix of their variants is
the shape of that variation, and the unit is admitted only if its line has
that shape.
# written 1790475089against# written 1790475323gives# written ..., which# written 1790475511fits androot:$y$hash:...doesnot. A mask with neither a prefix nor a suffix is what two unrelated lines have
in common, which is no evidence about a third, so it never yields noise. Bytes
carry no shape at all, so a binary is never noise: the most that can be said is
that it coincides in position, in size delta and in how much differs, which is
the new verdict
overlapping, and it fails until somebody reads the bytes andsays so in
--cleared. The evidence is printed for every verdict,noiseincluded.
noiseoverlappingrealnot sampledunchangedtests/compareis that list of four, one case each. They come outoverlapping,real,overlapping,real.The blindness could be switched off at attribute time
MEASURE_STATE_PATHSwas read whenattributeran, so a one-line substitutedlist turned
FAIL (167 not sampled)intoPASSon the real captures while theblock still printed a digest.
capturenow copies the list into the capture,attributereads that copy and never the variable, and it refuses unless everycapture carries the same list and the digest each one recorded matches it.
The rest of the review
--control-againis repeatable and the floor is the union over everycontrol pair. One pair is not a floor: mariadb differs by 179 files in one
pair and 182 in another, and the residue is 3 against the first and 0 against
the second. The block prints what each single pair would have said.
attributerefuses unless the captures sharelayer,parentandSOURCE_DATE_EPOCH, were built with an epoch at all,carry the same state path list, and are distinct.
--control X --unit Xisrefused.
share/layer-state-pathsgains./etc/mysql/**,./etc/postgresql/**,./etc/redis/**,./root/.my.cnf,./root/.pgpass,./root/.netrc,./etc/machine-idand./var/lib/dbus/machine-id. The postgresql residuelived in the second of those and was caught only because it fell outside the
floor.
is named rather than counted, and any whose name looks like state
(
share/layer-state-suspect) fails the run, with two committed ways out: addit to the list, or clear it with a reason.
8 KiB, or a control byte other than tab, newline and carriage return is a
blob and is compared as bytes.
is fatal rather than uncounted.
0700; retention is in the doc.tests/layer,tests/aplinfoandtests/signaturesetpipefail, whichthe scripts they test already did. One assertion changed with it:
tests/signaturepipedgenerate-signature --helpintogrepand usageexits non-zero.
docs/layer-measure.mdexportsBT_BUILDS, and the layers directory isderived from it through
config/common.cfgthe waybt-layerderives it.overlappingwithoutmaterialising the offsets:
ib_logfile0is 100 MiB.The second rework, after re-review
The re-review found the first fix incomplete in the same direction, and it was
right twice.
The mask pinned only the two ends of a line
It constrained the common prefix and the common suffix and left the region
between them free: no length, no character class, no resemblance to anything a
control put there. So wherever the controls vary at random the mask degenerates
to the line's fixed framing, and any value carrying that framing was admitted
as
noise:ssh_host_ed25519_key.pubssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI/root@keelnoiseroot:$y$j9T$/:20000:0:99999:7:::noisetoken=/ emptynoisetimestamp=0001790574 OR 1=1; GRANT ALL ON *.* TO evil@localhost, on the realmysql/user.frmof the gate runtimestamp=0001790574/ emptynoiseThe fix is the rule already written in the file applied to the other branch.
bin/layer-compare-libargues that bytes carry no shape, so a binarycoincidence is never
noise. A per-build random text field carries no moreshape than a random byte field. So
noisenow requires the controls to pinthe free region: they must agree on its length, it must be no longer than
MEASURE_FREE_MAX(24), and every character must be in the class they usedthere, which may only be digits and the punctuation of a date. A line a
control itself produced is admitted whatever its shape, because that is a
value the recipe makes on its own. All five cases above now fail.
This also removes the dependence you named on when the gate ran. The
user.frmmask is 21 characters of prefix only because four builds landedinside the same thousand seconds, and across a digit carry it collapses to 9.
tests/compareruns exactly that: at either prefix length the clock isnoiseand the payload is not, because the criterion is now the field's widthand class rather than how much framing happened to survive.
A cleared path printed no verdict line and no evidence
The waiver branch returned before both. A cleared path now prints its verdict,
the rule and justification that cleared it, and its bytes, always and not
subject to the abbreviation cap. It is the one place a person overrides the
instrument, so it is the last place to withhold the evidence.
The waiver was unbounded and unrecorded
A rule is now five tab separated fields, and
share/layer-waivers.exampleisthe template, committed:
rule*matches./etc/shadowcountmax-positionjustified-againstreasonThe block prints the file's digest, every rule, how many paths each covered
against how many it was written for, and every cleared path with its bytes.
Your composition, as a regression test
tests/measurebuilds it: three controls with a random host key each, a unitwith a hardcoded one, and a waiver naming only
./var/lib/mysql/**. It fails,the key is named as
overlapping, and the waiver covers only the two databasepaths it was written for:
The third rework, after the third review
Two findings, one of them a line I had written to be helpful that inverted the
property the tool exists to have.
The control-produced exemption
measure_mask_admitsadmitted a unit line identical to any control's lineat that position, ahead of every pin. The base capture is the first control, so
a value copied from the second or third differs from the base, is flagged as a
differing position, and was then waved through:
noiseoverlapping/etc/machine-idcontrol 3 producednoiseoverlapping/etc/shadowreplaying control 2's root hashnoiseoverlappingoverlappingoverlappingThe last row was the finding: the safe case was the one that failed. My
rationale, "a value this recipe makes on its own", was true and did not support
the conclusion. What makes a generated secret safe is that it is different
every build, so matching a control is evidence of pinning, not of freshness,
and
docs/traps.mdalready records the instance: "Every appliance built fromcorehas the same machine-id".The early return is deleted. It cost nothing: a genuinely pinned field still
passes on length and class, and two independent random values do not collide,
so the branch only ever admitted replays.
tests/comparecarries the threereplays and the fresh-key control.
Glob breadth is not a character count
./etc/ss*had exactly the eight literal characters the old check wanted, andcovered an SSH host key and a TLS private key under one sentence.
./var/lib/*had ten and covered every state tree.
A rule is now an exact path, or a named directory and its subtree written
DIR/**with at least two components below./, and the paths it actuallycovers must sit under one immediate child of that directory. Verified
against the current tree:
A directory is a thing somebody chose; a character count is not. One sentence
now justifies one subtree.
The three MEDIUM
justified-againstis enforced. The capture directory it names iscompared with
--dirand the run fails when they differ. On the realcaptures, rewriting the template's directory gives
THIS RULE NAMES OTHER CAPTURESand a FAIL.carries real observed maxima, 16384 for the
.MADand 76 for the.frm, onerule per file shape, and a
max-positionat or past the sample cap is nowrefused outright.
overlappingis abbreviated.noisepasses, so the one remainingroute to a bad
noisewas landing where no bytes were printed. In the gaterun the block now prints bytes for 145 of 167 paths, up from 52, with 22
abbreviated and all of them
overlapping.shellcheck -S styleexits 0, which it did not when I checked that box:SC2115 and SC2086 in
tests/measure.The waiver cannot reach PASS, and the correction is yours
Confirmed by running the shipped template against the real captures. It clears
the two paths it names, with rule, justification and bytes printed, and the run
is still FAIL:
So it is more control captures and then a waiver, not one or the other.
docs/layer-measure.mdsays so now, and the earlier claim that either would dois removed.
The fourth rework, and why this merges with its first subject failing
The waiver vocabulary is now the state list's vocabulary
Two measures of glob breadth had been tried and both were wrong the same way.
Counting literal characters let
./etc/ss*through. Counting components below./let./var/lib/**through, and./var/libis the common parent of the sixsubtrees
share/layer-state-pathsdeclares separately, so one sentenceabout MariaDB accounts could clear PostgreSQL state in a later run whose count
coincided. The counts coinciding is not luck: the same component shape produces
the same number of state files.
A glob rule's directory must now be a directory the capture's own
state-paths.txtdeclares, or below one../var/lib/mysql/**allowed,./var/lib/**refused,./etc/ssh/**still allowed because./etc/ssh/ssh_host_*names that directory. A glob with no wildcard in its lastcomponent declares a file and no directory, so
./etc/shadowdoes not license./etc/**, and./etc/ssl/**is refused where./etc/ssl/private/**is thedeclaration.
./var/cache/**,./usr/share/**and./etc/webmin/**arerefused too.
MEASURE_WAIVER_MIN_DEPTHis gone. The list is already comparedbyte for byte across the captures with its digest checked, so this adds nothing
new to trust.
justified-againstwas a substring test and acceptedmariadb-gate2for a runon
mariadb-gate; its first comma separated component is compared for equalitynow.
What this cannot see, now written down
docs/layer-measure.mdgains a section on it. State identical in every captureis invisible to a differential measurement by construction, including a secret
copied out of the base control's own build tree, and
share/layer-state-suspectdoes not cover that either, because such a pathnever differs and so is never subtracted. A PASS means "nothing the change did
shows up as a difference from the control". It does not mean the layer ships no
secret it should not.
The 32 are an open item, not a waiver, and more captures cannot clear them
Keel-Linux/buildtasks#13. The field was decoded from the captures: bytes 180 to
183 of the Aria index header are a four byte big endian wall clock Unix
second,
SOURCE_DATE_EPOCHdoes not touch it, and1790574106902134 / 10^6is exactly
user.frm's microsecond timestamp in the same directory. The unitcrossed into byte 181 where three controls had not.
Byte 181 carries every 18.2 hours and builds are 160 s apart, so an expected
single crossing needs on the order of 410 consecutive control builds; byte
180 carries every 194 days. For any finite control set there is always a higher
byte that did not carry, and the spread required grows by 256 per byte. So
more control captures cannot fix this and the build host should not be asked
for them. That reverses what an earlier revision of this description said.
The fix is the pin this tool already has for text, applied to a binary field,
and it is not in this pull request: issue #13 carries the four conditions.
Landing a new inference rule in the same change as the instrument, in order to
make the instrument's first subject pass, is how the defect this pull request
exists to fix came about. So the 32 are published as they are, recorded against
#13, with no waiver over them, which the tool refuses anyway because a waiver
only ever clears
overlapping.Merging the instrument while its first subject fails
That is deliberate and it is the point. The alternative is to hold the tool
until mariadb passes, which means the first thing anybody does with it is tune
it until it agrees with a conclusion already reached. That is precisely how the
measurement this replaces came to be trusted: a number was produced, it said
zero, and nothing that could have contradicted it was ever run. A FAIL that
names 32 paths, decodes the field they differ in and points at the issue that
would resolve it is worth more than a PASS arranged by adjusting the
instrument.
The fifth rework: the list is anchored to the repository
The licensing rule made
state-paths.txtload bearing twice. It decides whichbytes a capture keeps, and, since a waiver rule's directory has to be one the
list declares, it now also decides which waivers are legal. The preconditions
checked that every capture carried a byte identical list whose recorded digest
matched, which says the operator was consistent with themselves and nothing
more: four captures taken against a list with
./var/lib/**added agree witheach other, the block says they agree, the waiver is licensed, and one sentence
about MariaDB accounts clears PostgreSQL state.
share/layer-state-suspectcannot catch it and reports
0 subtracted but state shapedthroughout, becausewidening the list makes more paths state paths so nothing new is subtracted.
What changed is that widening the list used to be harmless. It only ever
increased what was compared by content. The same knob now points both ways.
attributecompares the capture's copy with the committedshare/layer-state-pathsand refuses on mismatch. A run against anotherlist declares a reason with
--state-paths-override, printed in the block asOVERRIDE, and both digests are printed in any case.Refusal rather than a printed warning, which was the alternative offered.
Every other precondition here refuses, and the defect being closed is a field
that was recorded and never read; a warning relies on somebody noticing, which
is the failure mode itself. The digests are printed regardless, so the weaker
remedy is there too.
The anchor has no environment override.
MEASURE_STATE_PATHSis a capturetime knob and
attributeignores it entirely, including as a way of moving theanchor, so the property that pointing it at a narrower file changes nothing
after the fact survives and is still tested.
tests/measurenow takes itscaptures against the committed list rather than a fixture list, which removes a
difference between the suite and a real run.
The two LOW
./home/**/.ssh/**declares./home/**/.ssh, compared literally, which nowildcard-free rule can sit below, so that declaration licenses nothing. That is
intended and the doc says so: it fails closed, an exact-path waiver is the route
for those paths, and matching a glob against a glob here would put back the
breadth ambiguity the rule exists to remove.
The sentence "a PASS does not mean the layer ships no secret it should not" is
now repeated in the section about what a pull request quotes, because the person
over-reading a PASS is reading the block.
What the coverage number does and does not say
Recorded in
COVERAGE.mdrather than left as a bare 100 percent. Of the sixbranches added with the licensing rule, three fail the suite when removed: the
wildcard-in-last-component guard in
measure_state_dirs, the equality clause inmeasure_dir_at_or_below, and loosening that function's path boundary to aprefix match. Two survive because they are redundant, the licensing loop
refusing the same inputs without them, so they are defence in depth and a
surviving mutant is the right result. The sixth, the
*/*guard that skips amalformed entry with no slash, was executing untested and now has
state-dirs-noslashbehind it.The two LOW from the sixth review
The
OVERRIDEline is printed only when the anchor check actually failed. Areason given on captures that do carry the committed list is printed on an
overrideline as declared and not needed, so the block never asserts amismatch its own two digests contradict. And
tests/measureasserts whichfixture paths were sampled rather than how many, so adding a state path to the
committed list no longer breaks the suite; checked by adding
./etc/keel/**and
./var/lib/dpkg/**.The gate block below predates the fifth rework and these two; neither changes a
verdict, and the header of a run today also prints the
committeddigest line.The merge gate: mariadb, four captures
Run on the build host,
SOURCE_DATE_EPOCH=1700000000,coreas parent, threecontrols and one unit, lock taken with a bounded wait, nothing else built and
nothing published. Captures in
/mnt/builds/measure/mariadb-gate, 590 MiB.Abridged: the full 676 lines are
/root/gate-block.txton the build host.Zero attributable, which is the conclusion decision 0010 reached, now
against the union of three control pairs and also against each pair alone. What
is new is the 167 state paths, which that measurement subtracted by name
without opening.
The four, confirmed against the bytes
global_priv.MADoverlappingcontrolvscontrol-thirddiffers at. The strings showpassword_last_changedmoving 1790574121 to 1790574610, a clock, and the account set is identical:adminat127.0.0.1,::1,localhost. So it is a clock, and bytes cannot prove that, which is why it must be cleared rather than assumed.global_priv.MAIrealglobal_priv.frmoverlappingcontrolvscontrol-third; no string differs..frmcreate and update timestamps.user.frmnoisemysql.useris aTYPE=VIEWoverglobal_priv, the.frmis ASCII with newlines, and its only difference is one line,timestamp=0001790574106902134against...596687502, which the mask the three controls establish there admits.Why 32 came out
realAlmost all of them are
*.MAI. The Aria index header carries a Unix timestamp,and in 30 of the 32 it increases strictly in capture order. Three control
builds moved only its low bytes; the unit build, four minutes later, carried
into the byte above. The evidence now prints the bytes from every capture at
the first differing offset, in capture order, which is what makes that readable
rather than a list of offsets:
The other 33, the
overlappingones, are almost all*.frm, whose timestampssit at fixed offsets every build moves together.
So this FAIL is the honest state of the measurement and not a defect in the
component. Neither a waiver nor more captures clears it: a waiver is consulted
only for
overlappingand these arereal, and the field is a wall clocksecond whose higher bytes carry on scales of 18.2 hours and 194 days, so no
finite set of controls spans them. The resolution is the binary pin in
Keel-Linux/buildtasks#13, deliberately not in this pull request. See "The 32 are
an open item" above.
Coverage
Split three ways under decision 0004:
bin/layer-measure-lib(capture and theformats),
bin/layer-compare-lib(whether a difference is noise),bin/layer-report-lib(the blocks and the preconditions), withbt-layer-measurea thin main. Measured withtests/coverage.sh 99:All four new files at 100 percent line and branch: every subcommand, every exit
code, every verdict and every error path, including the two guards that must
never fire, which
tests/measurereaches by replacingmeasure_verdictwith astub. The gate stays at 99, the lowest file rounded down.
shellcheckis clean at-S style, which closes the four info-level notes inthe review (SC2016, SC2015, SC2086 twice) and the ones the rework introduced.
Test plan
tests/measureandtests/comparepass; so dotests/layer,tests/aplinfoandtests/signaturewithpipefailaddedtests/coverage.sh 99exits 0, numbers above and inCOVERAGE.mdshellcheck -S styleexits 0 on all seven touched shell filestests/compareMEASURE_STATE_PATHSsubstitution and the identical-tag run, bothnow refused, both cases in
tests/measurenothing else built, nothing published
global_priv/user.frmverdicts confirmed against the bytesone at a time, table above
tests/compare,and the clock they hid behind still
noiseat both prefix lengthstests/measuretests/comparetests/comparepaths, prints their bytes, and the run stays FAIL on the 32
realincluding
./var/lib/**, cases intests/compareprefix, a case in
tests/measureand the variable cannot move the anchor, cases in
tests/measurein
COVERAGE.mdtests / coveragegreen on this pull requestReview
I reproduced the three recount claims independently from
/root/tree-{m,p}-*.sha256, with my own script and not with this tool, and then again through this tool. All three hold exactly: mariadb 182 / 179 / 182 (173 of them./var/lib/mysql/**), postgresql 17 / 13 / 16 (6 of them./var/lib/postgresql/**); the mariadb residue against the first control pair is exactly the three files named and is zero against the union;./etc/postgresql/17/main/postgresql.confsurvives every control pair and the union. All four ofglobal_priv.MAD,.MAI,.frmanduser.frmdiffer in the control-unit pair and sit inside all three control floors, so all four were subtracted unexamined. I also reproducedtests/measure,shellcheckandtests/coverage.sh 99(379/379 and 64/64, exit 0).The design is right and the diagnosis is right. Two things in the implementation fail in the same direction as the defect this exists to fix, which is why this is a Block and not a Warning. Both are cheap to fix.
CRITICAL 1. The signature cancels a real difference against a coincidental one at the same position, and prints nothing when it does
bin/layer-measure-lib:309-331(measure_signature),:370-395(measure_state_verdict),:721(the evidence guard).A token is a position with the content thrown away:
o<n>/n<n>fromdiffat :316,@<n>fromcmp -l | awk '{print "@" $1}'at :325, and a barelenat :326.measure_set_minusthen cancels position against position, so two unrelated changes at one line number or one byte offset annihilate.Run against this branch, a unit build that adds an account to
/etc/shadow:exit 0. The unit file contains
mallory:$y$REALPASSWORDHASH:20000:::. It is reported as noise because the control pair happened to append a different line at the same line number. Three more, all verified by running:noisenoise, all eight tokens cancelledlencarries no magnitude: floor +1 byte against unit -3584 bytes →noiseThe bite is not hypothetical.
global_priv.MAD,.MAI,.frmanduser.frmdiffer in both pairs in the captures on the build host today, and those are exactly the files an account deletion lands in. The next mariadb extraction gets fournoiselines and a count.What makes it unrecoverable is
:721:if [[ "$verdict" != noise ]]suppresses the evidence block, so the one error this scheme can make is the one error nobody can see. Minimum fix: print the three-way evidence for every state path with a non-empty control-unit signature, not only for non-noise ones, and say how many tokens cancelled. Better: givelenboth sizes, and make "cancelled at the same position but with different content" a verdict of its own that a person has to clear.CRITICAL 2.
unsampledcan be configured away at attribute time, and the pasted block still looks provenancedbt-layer-measure:95-96and:174:state_paths_file()reads$MEASURE_STATE_PATHSwhenattributeruns, not from the captures.exit 0, on the real mariadb captures, with a one-line substituted list.
capturewritesstate_pathsandstate_paths_sha256intometa.tsvat:151-152for precisely this purpose and nothing ever reads either field: the onlymeasure_meta_getcalls in the tree are layer, parent, epoch and captured (bin/layer-measure-lib:576-579). The header prints the digest of whatever list was substituted, so the block a pull request pastes carries a digest that proves nothing.Fix:
attributereadsstate_paths_sha256from all three captures, requires they agree with each other and with the list in hand, and refuses otherwise. The field is already there.HIGH 3.
attributeimplements the defect the paired handbook change writes intotraps.mdbin/layer-measure-lib:542: one--control-again, no way to pass a second. The new trap entry's Fix says "capture a third control and subtract the union of both control pairs"; this command cannot do that.Run on the real captures, changing only which pair is the floor:
So the first real run against mariadb prints
FAIL (3 attributable)for a component the handbook concludes is at zero, and the reviewer is invited to wave it through by hand. That istraps.md, "A reproducibility reference that cannot match is worse than none". Make--control-againrepeatable, subtract the union, and report which floors each residue survived.HIGH 4. Nothing enforces the precondition the whole measurement rests on
docs/layer-measure.md:36-37and the amended 0010 both say the three captures must shareSOURCE_DATE_EPOCH, onecommoncommit and one parent "or nothing the comparison prints means anything".epoch,layerandparentare recorded and printed (bin/layer-measure-lib:574-580) and never compared.epoch noneis accepted. A mismatched epoch inflates both pairs, grows the floor and still reports PASS.Related, same line of defence:
--control X --unit X --control-again Xgivesattributable differences: 0,verdict: PASS, exit 0. Verified. Three tags, no distinctness check.HIGH 5.
share/layer-state-pathsomits credential paths for the two components already in flightshare/layer-state-paths:18-46. Absent:./etc/mysql/**, which holdsdebian.cnfand thedebian-sys-maintpassword;./etc/postgresql/**, which is where the one real postgresql residue actually lived and was caught only because it fell outside the floor;./root/.my.cnf;./root/.pgpass;./etc/redis/**;./etc/machine-id(traps.md, "Every appliance built from core has the same machine-id").The answer to "what happens when a future component puts state somewhere not on this list" is: if the control pair also differs there, it is subtracted by name and leaves no trace. That is the original defect, relocated. It is made worse by the report never naming what it subtracted (for mariadb, 176 paths leave the report as a single count).
measure_print_setalready caps long lists; printing the subtracted set would let a reviewer eyeball it for anything credential-shaped.MEDIUM 6. Any NUL-free file is treated as text
bin/layer-measure-lib:287-298. A NUL-free, newline-free blob is one line, so its whole signature degenerates too1 n1, which cancels against any other difference at all. Verified with three mutually different 1500-byte blobs:noise.MEDIUM 7. A state path can be examined and counted in no total
bin/layer-measure-lib:713reads the verdict through< <(measure_state_verdict ...)and discards the function's return value; an empty verdict increments none of the three counters, and:730fails the run onattributable + real + unsampledonly. Unreachable today because the missing-file case is pre-checked at:377-383, but it is the same shape as thepipefailbug you found. One cheap invariant closes it: assert the three counters sum to the number of paths examined.MEDIUM 8. Captures keep long-lived copies of shadow, private keys and database bytes
bin/layer-measure-lib:207-225. A tag is never overwritten and nothing is cleaned up, by design.cpdoes preserve the file modes (I checked: 600 and 640 survive), so this is not a plain leak, but the directories it creates are 755 where/etc/ssl/privateis 710 upstream, and--diritself is created at the ambient umask.chmod 700on the capture root and a retention line in the doc.MEDIUM 9. The same shell-option divergence is still live in the three older suites
tests/measuresetspipefailandtests/layer,tests/aplinfoandtests/signaturedo not, whilebt-layer,bt-aplinfoandbin/generate-signatureall do. Out of scope for this diff, butbt-layeris what produces every capture this tool reads.LOW 10. The documented procedure does not run as written
docs/layer-measure.md:42-45exports seven variables and omitsBT_BUILDS, whichbt-layer:91treats as fatal and which is unset in root's environment on the build host (checked).bt-layer-measure:109hardcodes/mnt/builds/layersrather than deriving it fromBT_BUILDS, so the two can also disagree silently until:124reports no rootfs. Loud rather than silent, butdocs/layer-measure.mdis the reproducibility claim, and this is the first thing a second person hits.LOW 11.
shellcheckExits 0, so "clean" holds, but there are four info-level notes: SC2016 at
bin/layer-measure-lib:160, SC2015 attests/measure:49, SC2086 attests/measure:443and:445.On the unchecked box
Leaving "a real three-build run" unchecked is the honest call, and it should gate the merge rather than follow it. Suggested gate for the first real use: run it against mariadb with four captures, publish the block, and confirm by hand that the four
global_priv/user.frmverdicts say what the bytes say. Those four files are the ones this tool exists for and the ones finding 1 will mis-report.I verified by running: the recount (both families, all pairs), the three residues, the four blind files, four false-negative cases end to end, the
MEASURE_STATE_PATHSsubstitution, the identical-tag run, the per-floor attributable swing,tests/measure,shellcheck, andtests/coverage.sh 99. I inferred, without running: thetraps.mdcross-references and the severity of finding 8 on a multi-user host.Block, on findings 1 and 2 only. Everything else can follow. This is much better than what it replaces and the recount behind it is sound; it is blocked because an instrument that reports PASS on an added account, and whose blindness can be switched off by an environment variable without the printed block showing it, fails in the exact direction it was built to correct.
Both CRITICALs are closed, and the gate you proposed has been run. The full
picture is in the pull request description; the short version:
1. Positions cancelled content. The controls are now the model and the
model carries content: at each position they vary at, the longest common prefix
and suffix of their variants is the shape the unit has to fit. A mask with
nothing in it proves nothing. Bytes carry no shape at all, so a binary is never
noise; it isoverlapping, which fails until it is cleared in writing with areason the block prints. The evidence is printed for every verdict including
noise, which is the part that made this unrecoverable. Your four cases arefour cases in
tests/compare; all four now come outreal,real,overlapping,real.2.
unsampledwas configurable.capturecopies the state path list intothe capture,
attributereads that copy and never the environment, and itrefuses unless every capture carries the same list and the digest each one
recorded matches it. The substitution you showed is now exit 3.
Also done:
--control-againis repeatable and the floor is the union overevery pair, with the per-pair counts printed so the 3-against-0 swing is
visible; preconditions on layer, parent, epoch and distinctness are enforced;
the six missing credential paths are on the list and
/etc/machine-idwiththem; every subtracted path is named and a state-shaped one fails the run;
text now requires a newline, no over-long line and no stray control bytes; the
counter invariant is asserted; captures are
0700with a retention line;pipefailis in the three older suites;BT_BUILDSis in the doc and derivedthrough
config/common.cfg;shellcheckis clean at-S style.The gate. Four captures of mariadb, three controls, lock taken with a
bounded wait, nothing else built, nothing published. 0 attributable, against
each single pair and against the union. 167 state paths differ: 102 noise, 33
overlapping, 32 real, 0 not sampled. Your four say what the bytes say, checked
one at a time:
global_priv.MADoverlapping, at exactly the offsetscontrolvscontrol-thirdalso moves;password_last_changed1790574121 to 1790574610and the account set identical.
global_priv.MAIrealat bytes 181 and 197.global_priv.frmoverlapping, offsets identical to the control pair's.user.frmnoise, and it really is text:mysql.useris aTYPE=VIEW, andthe only differing line is
timestamp=0001790574106902134against...596687502, which the mask admits.The 32
realare almost all*.MAI, and in 30 of them the differing valueincreases strictly in capture order: the Aria index header clock, whose carry
three controls did not span. The evidence now prints the bytes from every
capture at the first differing offset so that reads off the page:
So the FAIL is the honest state of that measurement, not a defect in the
component, and getting to PASS is a decision I have not made for you: more
control captures until the floor spans the carry, or a committed waiver saying
the Aria clock was read and accepted. I considered teaching the binary path to
recognise a run that climbs with capture time and downgrade it, and did not,
because that is the kind of unreviewed inference that got the first version
blocked.
Two things from your list I did not do. MEDIUM 9 is done rather than deferred,
since
bt-layerproduces every capture this reads. And I have left themariadb-gatecaptures on the build host, 590 MiB, because they are theevidence for the block above; they hold
/etc/shadowand database bytes, sothey should go once this is settled.
Re-review
Both blocking findings are fixed, and one of them is fixed better than I asked for. I re-ran the four false negatives, attacked the new scheme, and checked the gate run against the bytes on the build host.
Verified fixed. All four cases now fail:
overlapping,real,overlapping,real. (The body says case 1 isreal; it isoverlapping. Both fail, nothing turns on it, but the block should say what the tool says.) The state path list is now read from the captures andMEASURE_STATE_PATHSat attribute time is not refused but ignored entirely, which is stronger than the exit 3 I asked for: my substitution changed nothing, andmeasure_preconditionsalso requires all four captures to carry byte-identical lists whose recorded digests match. Also confirmed by running:--control-againis repeatable and the floor is the union, with each single pair's answer printed; distinct tags, matching layer/parent/epoch and a refusal onepoch none; the totals invariant;measure_is_textstrict; the capture directory 700 on the build host;pipefailin all five suites;BT_BUILDSdocumented and refused loudly;shellcheck -S styleclean;tests/measureandtests/comparepass; andtests/coverage.sh 99exits 0 with every number in the table matching, 204, 216, 230 and 70 all at 100 percent.The
share/layer-state-suspectnet works. I narrowed the list at capture time for all four captures, consistently, so every digest agreed: the run still failed,2 subtracted but state shaped, because./etc/shadowand the host key hit the suspect names. That is a real defence and it closes the capture-time version of the old hole.CRITICAL 1. The mask constrains the two ends of a line and nothing else, so where the controls vary at random the unit may substitute a constant and be called
noisebin/layer-compare-lib:228-235.measure_mask_admitstests four things: prefix or suffix non-empty,${#line} >= ${#prefix} + ${#suffix}, starts-with, ends-with. There is no bound on the length of the free region, no constraint on its character class, and no requirement that it resemble anything a control put there.So the rule is: wherever the controls legitimately vary at random, the mask degenerates to the line's fixed framing, and any unit value with that framing is admitted, including a constant. Verified by running, three controls in each case:
ssh_host_ed25519_key.pub, random key per control, hardcoded key in the unitssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI/root@keelnoise/etc/shadow, random root hash per control, baked-in hash in the unitroot:$y$j9T$/:20000:0:99999:7:::noise# written 1790475/by buildnoisetoken=/ emptynoiseThose two masks are the algorithm header and the comment field, and the hash format and the date fields. They are the parts that cannot vary. The scheme reads them as evidence about the part that can.
And on the gate's own bytes: I took the real
mysql/user.frmfrom/mnt/builds/measure/mariadb-gate/control, puttimestamp=0001790574 OR 1=1; GRANT ALL ON *.* TO evil@localhoston line 10, and the tool returnsnoise.The principle already in the file disposes of this.
bin/layer-compare-lib:27says bytes carry no shape, so a binary coincidence is never noise. A per-build random text field carries no more shape than a random byte field.noiseshould require the free region to be pinned, by the controls agreeing on its length and its character class and the unit matching both, and should fall tooverlappingwhen it is not. That is not new policy, it is the policy already written applied to the other branch.This is the original defect narrowed rather than closed, and it now lands on precisely the paths
share/layer-state-pathsexists to watch. It did not fire in the gate run, because every differing state path there was under./var/lib/mysql/.HIGH 2. A cleared path prints no evidence
bin/layer-report-lib:328-333: the waiver branch incrementswaivedandcontinues before the verdict line is printed and beforemeasure_evidenceis called. Verified end to end: the cleared path appears zero times in the evidence section.That contradicts the section's own header, "the evidence below is printed whatever the verdict, because the one mistake this scheme can make is to call a real difference noise", and the comment at
bin/layer-compare-lib:240, "A glob waiver is only honest because the report names every path it covered". A waiver is the one place a person overrides the instrument. It is the last place to withhold the bytes.HIGH 3. Finding 2 composed with the waiver route turns the gate green over a real defect
Verified, and this is the reason 1 and 2 are worth fixing before the waiver is granted rather than after. With a waiver naming only
./var/lib/mysql/**, which is exactly the route under discussion:exit 0, and the unit in that run ships a hardcoded SSH host key. The waiver removes the last
overlapping, and what is left is the column the mask can get wrong, with its evidence abbreviated or, for the waived path, absent.MEDIUM 4.
--clearedbreadth is unbounded and unrecordedbin/layer-compare-lib:243-256. A single rule*<TAB>reasonmatches every path, including./etc/shadowand./etc/ssh/ssh_host_key(verified);./etc/*crosses slashes and matches./etc/ssl/private/a.key. The report lists the covered paths, which is right, but capped atMEASURE_PRINT_MAX, and it never says which rule covered each path. The header atbin/layer-report-lib:250prints the waiver file's name and no digest of its contents, so a block quoting--cleared waivers.txtcannot be checked against the file that produced it.Worth crediting on the same mechanism: a waiver applies only to
overlappingand can never clear areal. I tried it; therealsurvives and the run fails.LOW 5. Doc rot
tests/measure's header comment still enumeratesmeasure_signature,measure_state_verdictandmeasure_state_evidence. None of them exist now.The gate run
Checked independently against
/root/gate-block.txt(891 lines) and the captures. The tallies are right: 102 noise, 33 overlapping, 32 real. All 167 differing state paths are under./var/lib/mysql/, and all 102noiseare.frmfiles,mysql.userplus thesysschema views, every one of them aTYPE=VIEWtext.frmwith onetimestamp=line. That is coherent.global_priv.MADis confirmed. I pulled all four copies and read the records. Six accounts in every capture,adminat127.0.0.1,::1andlocalhost, plusmariadb.sys,mysqlandrootatlocalhost, with identical access masks, plugins andauthentication_stringvalues. The only thing that moves ispassword_last_changed, 1790574121, 1790574292, 1790574458, 1790574610, climbing with capture time.overlappingis the honest verdict and the account set claim is exactly right.global_priv.MAIis confirmed and the new window evidence earns its place.b9 fe 1a,b9 fe c6,b9 ff 64,ba 00 04reads as a big-endian counter carrying into byte 181, which is whatrealat 181 and 197 means. A reviewer can settle that by eye, which was not possible before.user.frmis correct, and the tool did not establish it. The factual claim holds: it is genuinely ASCII, longest line 4718 against the 8192 cap, only line 10 differs in every pair, and the four timestamps climb monotonically. It is also safer than the note argues, becausemysql.userin 10.4+ is a view overglobal_privand holds no account rows at all, so no account file is being let through here. But the mask istimestamp=0001790574with an empty suffix, and that 21 character prefix is an accident of four builds landing inside the same thousand seconds. I checked: across a digit carry the prefix shortens, and a planted payload that keeps it is admitted. The verdict is right about these bytes and is not established by the reasoning that produced it.The 32, and what should gate the first PASS
The waiver is the right instrument, and for a stronger reason than the one given. More captures is not merely luck on the
realside: the same luck governs thenoiseside, because theuser.frmmask's strength depends on where the builds fell relative to a digit boundary. A criterion whose answer depends on the hour the gate ran is not a criterion. Declining to teach the tool to downgrade a monotone run was also right.But the waiver should not be granted before finding 2 is fixed, because finding 2 plus the waiver is finding 3. Fix 1 and 2, then waive, and make the waiver name:
overlappingat different offsets is not quietly included;Operational
The evidence directory is 590 MiB and mode 700 throughout, which settles the permissions point from the last round. The disk claim in the brief does not hold:
/mnt/buildsis on/dev/mapper/turnkey-root, 122G, 46 percent used, 64G free, not 95 percent. Nothing needs pruning on that account, though a retention line in the doc is still worth having since a tag is never overwritten.The pull request body reads correctly end to end: 280 lines, every section present, the gate block intact and matching
/root/gate-block.txt, the coverage table matching what I measured, and the test plan boxes consistent with what I could reproduce. Nothing appears to have been lost in the rewrite.History is clean: three commits on the tip of
19.x, all authored and committed by the same person, all passing the repository'scommit-msgandpre-commithooks when replayed, and no forbidden strings in the diff.Verified by running: the four original cases, four new mask attacks, the planted payload on the real
user.frm, the attribute-time substitution, a consistent capture-time narrowing, the waiver composition, waiver breadth and therealwaiver limit, the account-set comparison on all fourglobal_priv.MADcopies, the gate block tallies, both suites,shellcheck -S styleand the coverage gate. Inferred, without running: that no credential-shaped text state path will differ in a future component's gate run, which is what finding 1 would meet.Block, on findings 1 and 2, which are one function and one
continueapart. Everything I raised last round is genuinely settled, the gate run is sound and its FAIL is honest, and I would approve this the momentnoiserequires a pinned free region and a cleared path prints its bytes.Both fixed, and the argument for the first one is yours: a per-build random
text field carries no more shape than a random byte field, and this file
already refuses to call a binary coincidence noise for exactly that reason.
1.
noisenow requires a pinned free region. The controls must agree onits length, it must be no longer than 24 characters, and every character must
be in the class they used there, which may only be digits and the punctuation
of a date. A line a control itself produced is admitted whatever its shape,
because that is a value the recipe makes on its own; everything else falls to
overlapping. Your five cases are five cases intests/compareand all fivenow fail, the SSH key and the password hash on the class test, the 400
character growth on the length test, and the
user.frmpayload on both.It also answers your point about the hour the gate ran, which I think is the
better version of the argument.
tests/comparenow runs theuser.frmfieldacross a digit carry, where the prefix collapses from 21 characters to 9: the
clock is
noiseat both lengths and the payload isoverlappingat both,because the criterion is the field's width and class and no longer how much
framing happened to survive.
2. A cleared path prints its verdict, the rule and justification that
cleared it, and its bytes, always, and not subject to the abbreviation cap.
3. Your composition is a test. Three controls with a random host key each,
a unit with a hardcoded one, a waiver naming only
./var/lib/mysql/**. FAIL,the key named as
overlapping, the waiver covering the two database paths itwas written for and nothing else.
4. The waiver names the four things. Five tab separated fields: rule,
count, max-position, justified-against, reason. A rule carrying too little
literal path is refused, so
*and./etc/*are both out. A rule that coversa different number of paths than it was written against fails the run rather
than stretching. A rule justified to one offset does not cover a path
differing beyond it. The block prints the file's digest and every rule with
what it actually covered.
share/layer-waivers.exampleis the template and itis in the repository.
5.
tests/measure's header no longer lists the three removed functions.The gate re-ran with the stricter rule and the tallies are unchanged, 102
noise, 33 overlapping, 32 real, because all 102 are
TYPE=VIEW.frmfileswhose one differing line is a fixed width decimal
timestamp=. That is thecase the new rule is meant to keep, so it is a useful confirmation that it is
not merely stricter.
Corrections to my own last comment, both yours: the four original cases come
out
overlapping,real,overlapping,real, and I wroterealfor thefirst; the pull request body now says so too. And I repeated a stale 95
percent disk figure.
/mnt/buildsis 122G at 46 percent with 64G free, so theevidence directory is under no pressure; the retention line is in the doc
anyway, since a tag is never overwritten.
I have still not granted the waiver for the 32. That is the next thing and it
is yours to accept: the rule would be
./var/lib/mysql/**with its count, itsmax position, the capture directory and the recipe commit, and a reason saying
the six accounts and their
authentication_stringvalues are identical in allfour captures and only
password_last_changedmoves.share/layer-waivers.examplecarries exactly that line as the template, whichis a template and not a waiver in force.
Coverage: 204, 298, 253 and 71 lines, all four files at 100 percent, gate
unchanged at 99,
shellcheck -S styleclean.Third review
The mask fix works. I re-ran all seven of my attacks and none of them is
noiseany more: the added account, the 400 character free region and the planted clock line come backoverlapping, the root password and the 3584 byte truncation come backreal, the hardcoded host key comes backoverlapping. The free region summary is well judged too, since it reports "43 characters, not a number or a timestamp" without printing the value.Also verified by running: a cleared path now prints its verdict, its rule, its justification and its bytes, and
bin/layer-report-lib:356exempts it from the abbreviation cap; the composition regression behaves as described, with the waiver naming only./var/lib/mysql/**, the host key namedoverlappingand the run failing;*,./etc/*and./etc/s*are all refused; a stretched rule fails the run and says so by name; the waiver file's digest is printed; the dead function names are gone from the suite headers; both suites pass; andtests/coverage.sh 99exits 0 with 204, 298, 253 and 71 all at 100 percent, matching the table exactly.The carry claim holds, and for the right reason. I built the
user.frmfield at both prefix lengths. With no carry the prefix is 20 characters and the free region is 9 digits; across a carry the prefix is 19 and the free region is 10. The clock isnoiseat both and the payload isoverlappingat both. The reason is the one that matters: the verdict is decided by "all controls' free regions are the same length, all in the pinned class, and the unit's matches", which does not reference the prefix length at all. The prefix only decides where the free region starts. That is not fixture luck, and it does answer the objection.The tallies are well aimed, not vacuous. I fetched the state samples for all four captures and recomputed the verdicts myself with this branch's code. Over what I fetched, excluding the four large binaries: 102 noise, 32 overlapping, 30 real, the three missing being the ones I left out. The noise class is homogeneous, and I checked every member of it rather than sampling: all 102 are
.frm, all 102 beginTYPE=VIEW, all 102 differ at exactly one line, and in all 102 that line matches^timestamp=[0-9]{19}$. Zero exceptions. So the rule changed no verdict because the only text difference in the whole run is a fixed width decimal field, which is exactly the shape the rule is built to admit, while my attacks show it now rejects the shapes it should. Well aimed.CRITICAL 1. The control-produced exemption inverts the property it protects
bin/layer-compare-lib, inmeasure_mask_admits:A unit line identical to any control's line at that position is admitted unconditionally, ahead of every pin. The base capture is the first control, so a value copied from the second or third control differs from the base, is flagged as a differing position, and is then admitted by this branch.
Verified, three controls each:
noise/etc/machine-idcontrol 3 producednoise/etc/shadowreplaying control 2's root hashnoiseoverlappingThe last row is the whole finding. The fresh random key is the safe behaviour and it is flagged; the fixed key is the dangerous one and it passes. End to end, with a waiver naming only
./var/lib/mysql/**, the unit shipping control 2's host key gives:exit 0, and the key in that capture is byte for byte the one in
control-again.The rationale, "it is a value this recipe makes on its own", is true and does not support the conclusion. What makes a generated secret safe is that it is different every build. A unit that pins it to one previously observed instance is unsafe because it is pinned, and matching a control is evidence of pinning rather than of freshness.
docs/traps.mdrecords the instance already: the publishedcorelayer ships a populated/etc/machine-id, which was a value the recipe made on its own, and that is the entry titled "Every appliance built fromcorehas the same machine-id". This exemption is that reasoning written into the instrument that is supposed to catch it.Deleting the early return costs nothing I can find. Where the field is pinned, the normal path already admits a coincidence on length and class. Where it is not pinned, two independent random values do not collide, so the only lines the branch admits are replays. If it is kept for a reason I have not seen, it should at least yield
overlappingrather thannoise, so the bytes get printed and a person decides.HIGH 2. A rule with exactly the minimum literal path clears two unrelated secrets
MEASURE_WAIVER_MIN_LITERAL=8, andliteral=${rule//[*?]/}. The rule./etc/ss*has a literal of exactly 8 and passes every one of the five checks. It covers./etc/ssh/**and./etc/ssl/private/**together. Verified:exit 0, with a hardcoded SSH host key and a rotating TLS private key waived under one sentence.
./var/lib/*has a literal of 10 and likewise passes while covering every database and application state tree.The count check is what saves this in a single run, and it does not save it across runs: the rule stays in the repository and authorises the whole of
./etc/ss*for every future gate whose count happens to match. A length of literal characters is the wrong measure of how broad a glob is. Requiring the literal part to end at a path separator, or confining a glob to one subtree named inshare/layer-state-paths, would say what the count cannot.MEDIUM 3. The shipped waiver template sets
max-positionto a value that bounds nothingshare/layer-waivers.exampleuses16777216, the state sample cap.measure_max_positionreturns a line number for a text file and a byte offset for a binary, so that figure bounds neither: it is past the end of anything the cap let through. The gate's own maxima are about 16384 forglobal_priv.MADand 197 for the.MAI. Nothing checks that the number is plausible, and this is the line the maintainer is about to copy. The field is the right idea; the template teaches the value that disables it.MEDIUM 4.
justified-againstis printed and never checkedField 4 is only echoed, at
bin/layer-report-lib:351and:443. Nothing compares it to the run's--diror to any recipe commit, so "it cannot outlive its evidence" is documentation rather than enforcement. This is the same shape asstate_paths_sha256two rounds ago, which was recorded and unread until it was flagged. Comparing the capture directory it names against--dir, and failing when they differ, is a two line check.MEDIUM 5. The abbreviation cap still hides most of the
noisecolumnMEASURE_EVIDENCE_PATHSis 20. In the gate run 135 paths arenoiseoroverlappingand 115 print no bytes.noisepasses, so the one remaining route to a badnoise, finding 1, lands in the part of the report that prints nothing. Cleared andrealpaths are now exempt from the cap;noiseshould be too, or the cap should count onlynoisepaths whose free region was pinned by more than one control.LOW 6. The shellcheck box is checked and the command does not pass
shellcheck -S styleon the seven files exits 1: SC2115 (warning) attests/measure:521,rm -rf "$fix/$2", and SC2086 (info) at:522.The waiver: not yet, and it cannot do what it is being asked to do
Two things, and the second is the one that changes the plan.
First, it should not be granted while finding 1 stands, because a waiver over the
overlappingcolumn leavesnoiseas the only column left, and finding 1 is a hole innoise.Second, and independently: a waiver cannot reach PASS here at all.
bin/layer-report-lib:329only consults the waiver file when the verdict isoverlapping. The 32 arereal. Granting the example waiver changesFAIL (0 attributable, 32 real, 33 overlapping and uncleared)intoFAIL (0 attributable, 32 real, 0 overlapping and uncleared). It is still a FAIL, and the 32 are untouched by it. The choice in the pull request is not between more captures and a waiver; it is more captures and then a waiver. More controls until the floor spans the Aria counter's carry is what moves those 32 fromrealtooverlapping, and only then is there anything for a waiver to clear.That also resolves the objection I raised last round about spanning a carry being luck. It is luck, but it is the only lever that touches the 32, because the alternative, teaching the tool to recognise a monotone run, was correctly declined.
When it is granted, after findings 1 and 2, the five fields should read:
./var/lib/mysql/**, the exact subtree. Not a wildcard that can reach another tree, and one rule per subtree rather than one rule spanning several.overlappingpaths that rule covers in the run it was written against, taken from that run's own block rather than estimated..MADand well under 1000 for the.MAI, so one rule per file shape rather than one number covering both. Never the sample cap./mnt/builds/measure/mariadb-gateand the recipe commit, and this only becomes a real constraint once finding 4 makes it checked.authentication_stringvalues are identical in all four captures, and says onlypassword_last_changedmoves. I confirmed all of that against the bytes myself last round.History is clean: four commits on the tip of
19.x, all by the same author, all passing the repository'scommit-msgandpre-commithooks when replayed, no forbidden strings in the diff.Verified by running: the seven mask attacks, the three exemption replays and the fresh-key control, the carry fixture at both prefix lengths, an independent recount of all 167 gate verdicts from the fetched samples with a per-path check of every one of the 102
noisepaths, the waiver breadth and refusal cases, the./etc/ss*composition, the cleared-path evidence, both suites,shellcheck -S styleand the coverage gate. Inferred, without running: that more control captures would move the 32 fromrealtooverlapping, which follows from the offsets being outside the floor but which no run here demonstrates.Block, on findings 1 and 2. Finding 1 is a deleted line, and finding 2 is a stricter test than counting literal characters. Everything else from the previous two rounds is settled, the pinning rule is well aimed on evidence rather than by assertion, and the carry test does what it claims.
Both fixed, and finding 1 was the more useful of the two to have had pointed
out, because the line was mine and I had written it as a kindness.
1. The exemption is deleted. You were right that the rationale was true and
did not support the conclusion: what makes a generated secret safe is that it is
different every build, so matching a control is evidence of pinning rather than
of freshness, and
traps.mdalready had the instance. All four of your rows nowcome out
overlapping, including the fresh random key that was already right,so the safe case and the dangerous one are no longer sorted the wrong way round.
Deleting it changed nothing else: a genuinely pinned field still passes on
length and class, which is why
admits-pinned-digitintests/comparestillholds while
admits-replaynext to it does not. The three replays and thefresh-key control are cases there now.
2. Glob breadth is structural. A rule is an exact path, or a named directory
and its subtree as
DIR/**with at least two components below./, and thepaths it actually covers must sit under one immediate child of that directory.
So
*,./etc/*,./etc/ss*,./var/lib/*,./etc/**and./var/lib/my*/**are all refused, and a rule that covered two subtrees of the directory it names
fails with
SPANS 2 SUBTREES. Your phrasing is the one I took: a directory issomething somebody chose, a character count is not.
3.
justified-againstis compared with--dirand the run fails when theydiffer. On the real captures, rewriting the template's directory gives
THIS RULE NAMES OTHER CAPTURESand a FAIL.4. The template carries observed maxima, 16384 for the
.MADand 76 for the.frm, one rule per file shape, and amax-positionat or past the sample capis refused outright rather than merely discouraged.
5. Only
overlappingis abbreviated now. The gate block prints bytes for145 of 167 paths, up from 52; the 22 still abbreviated are all
overlapping, which is named in the totals and fails anyway.6.
shellcheck -S styleexits 0. You were right that I had checked that boxagainst a command that did not pass.
Your correction to the plan, confirmed by running it. I ran the shipped
template against the real captures. It clears the two paths it names, with rule,
justification and bytes printed, and the run is still FAIL:
So it is more captures and then a waiver. The pull request and
docs/layer-measure.mdboth said "either, or" and now say what you established.I have not added control captures in this round: that is a build-host decision
about how many and when, and it is the lever that moves the 32, so it should be
a deliberate run rather than something I slip in with a code fix.
The gate re-ran with all of the above and the tallies are unchanged, 102 / 33 /
32, which is the confirmation I wanted that none of this round moved a verdict
by accident.
Coverage 204, 316, 264 and 71 lines, all four files at 100 percent, gate
unchanged at 99.
Fourth review
Both blocks are closed and I could not reopen either. One new finding in the replacement glob rule, described below, and it is a HIGH rather than a block: nothing in the tree exercises it, and the block prints enough for a careful reader to catch it.
The exemption. Deleted outright, and the author's account of why it was wrong is correct. I re-ran the four rows: replaying control 2's host key, control 3's
machine-idand control 2's root hash from/etc/shadowall come backoverlapping, and a fresh random key at the same path also comes backoverlapping. That last equality is the point. Under the old code the fixed value passed and the fresh one failed, which is backwards; now they are treated alike, which is the honest answer, since a differential measurement cannot tell a new draw from a pinned one and should not pretend to.admits-pinned-digitstill holds: a fixed width digit clock is stillnoise.I went looking for another route to the same shortcut and found one place that compares the unit to a control,
bin/layer-compare-lib:521,cmp -s -- "$base" "$unit"for thenoneverdict. That one is sound and also unreachable in a real run, because a path whose hash matches the base is never in the differing set to begin with. It does imply a limit worth one line indocs/layer-measure.md: state copied out of the base control's build tree into a component is invisible to this measurement by construction, because it is not a difference from the control. That is not a defect in this scheme, it is what "differential" means, and theshare/layer-state-suspectnet does not cover it either since such a path never differs. Saying so in the doc is better than leaving a reader to assume the measurement sees all shipped state.Glob breadth. Structural now, and much better. Verified refused:
*,./etc/*,./etc/ss*,./var/lib/*,./etc/**,./var/**,./var/lib/my*/**,./home/**,./root/**. Verified allowed:./var/lib/mysql/**,./etc/ssh/**. A rule spanning two immediate children fails withSPANS 2 SUBTREES. The count check, the justification check and the subtree check all fire, and I confirmed the correctly scoped rule is refused when reused on a different run:THIS RULE HAS STRETCHED: written against 2, covers 0.The three MEDIUM and the LOW.
justified-againstis compared against--dirand fails withTHIS RULE NAMES OTHER CAPTURES. The template now carries two exact paths with observed maxima, 16384 for the.MADand 76 for the.frm, matching what I measured from the captures myself last round, andmax-positionat or past the sample cap is refused atbin/layer-compare-lib:414. Onlyoverlappingis abbreviated now, atbin/layer-report-lib:359, sonoise,realandclearedalways print bytes.shellcheck -S styleexits 0 with no output.Tallies unchanged. I recomputed every verdict from the fetched state samples with this revision's code: 102 noise, 32 overlapping, 30 real over the file set I hold, identical to what the previous revision gave over the same set. Nothing moved.
HIGH 1.
./var/lib/**satisfies the new structure and carries a justification across componentsMEASURE_WAIVER_MIN_DEPTH=2counts components below./, so the directory./var/libhas depth 2 and passes. But./var/libis the common parent of six subtrees thatshare/layer-state-pathsdeclares separately, precisely because they are different things:The "one immediate child" check only looks at what the rule covered in the run in front of it, so a rule at
./var/lib/**passes whenever a single service's state differs. Demonstrated with two runs and one rule, changing nothing but which service the differing files sit under:exit 0 both times, with a sentence about MariaDB accounts clearing PostgreSQL state. The count check does not catch it because the counts coincide, and counts coinciding is not a coincidence: the same component shape produces the same number of state files. For contrast, the correctly scoped
./var/lib/mysql/**is refused on run 2, which is the mechanism working as intended and the reason this is one rule away from closed.The fix uses data already in the capture and already digest checked. A glob rule's directory must be at or below the directory part of some glob in that capture's
state-paths.txt. Then./var/lib/mysql/**is allowed because the list declares that directory;./var/lib/**is refused because nothing declares./var/lib;./etc/ssh/**stays allowed because./etc/ssh/ssh_host_*declares that directory. That replaces an arbitrary depth with the project's own statement of what is state, so the waiver vocabulary becomes exactly the vocabulary of the thing being waived.MEASURE_WAIVER_MIN_DEPTHthen goes away.Two others are legal at depth 2 and worth a glance while that is being done:
./etc/ssl/**is broader than the declared./etc/ssl/private/**, and./var/cache/**,./usr/share/**and./etc/webmin/**are all legal. Only./var/lib/**actually bites today, because it is the only one sitting above sibling declared state.LOW 2. The
justified-againstcomparison is a substring testbin/layer-report-lib:450,[[ "$(cut -f4 <<<"$rule")" != *"$dir"* ]]. A waiver justified against/mnt/builds/measure/mariadb-gate2is accepted for a run whose--diris/mnt/builds/measure/mariadb-gate, since the shorter string is a substring of the longer. It fails the other way round, so the laxness is one directional and narrow. Comparing the field's first comma separated component for equality would close it.The 32, and whether more captures can clear them
Putting this here as well as in my report, because it bears on what the tool should promise rather than on this diff.
I decoded the field from the captures. Bytes 180 to 183, one based, are a four byte big endian integer:
and
1790574106902134 / 10^6 = 1790574106, which isuser.frm's microsecond timestamp in the same directory. So it is a wall clock Unix second, unaffected bySOURCE_DATE_EPOCH, which is why it moves in every build and why pinning the epoch cannot make it reproducible.Byte 181 is bits 16 to 23, so it carries every 2^16 seconds, 18.2 hours. Builds are about 160 seconds apart, so two consecutive controls straddle that boundary with probability about 0.24 percent, and an expected single crossing needs on the order of 410 consecutive control builds. Byte 180 is bits 24 to 31 and carries every 2^24 seconds, 194 days. So for any finite set of controls there is always a higher byte that did not carry inside the capture window, and a unit built after such a carry differs there, outside the floor, and is
real.So the number is unbounded in principle. More captures does not converge; the spread required grows by 256 per byte. Asking the build host for "a few more controls" cannot fix this and should not be asked for.
What I would do instead is the pin the tool already has for text, applied to binaries. At a run of differing offsets, read the enclosing fixed width big endian integer and admit it only when all four of these hold: the controls' values at that field increase strictly in capture order; the unit's value exceeds every control's; the unit's step over the last control lies inside the range of the controls' own steps, here 158 to 172; and the field's lower bytes are among the offsets the controls vary at. Every one of those is a measurement of the controls, not an inference about the unit, which is the same standard the free region pin already meets, and it is stricter than the "downgrade a monotone run" idea that was rightly declined. Under it this field is
noiselegitimately, 1790574596 beats 1790574436 by 160, and a planted value fails on the step range or on continuing the sequence.Until that exists, the honest position is not to chase PASS on this component. Publish the block, record the 32 and this decode as an open item, and do not write a waiver that implies they were cleared, which in any case the tool correctly refuses to let you do.
History is clean: five commits on the tip of
19.x, all by the same author, all passing the repository'scommit-msgandpre-commithooks when replayed, no forbidden strings in the diff. Both suites pass and my attacks appear as cases in them.Verified by running: the four replay rows and the pinned digit control, the
nonepath, nine glob shapes against the shape check, the two run justification transfer, the stretched rule refusal, the template maxima and the cap refusal, the justification mismatch, the abbreviation change, an independent recount of the gate verdicts,shellcheck -S style, both suites and the coverage gate. Inferred, without running: the carry probability arithmetic above, which follows from the decode but which no build demonstrates.Warning. No blocking issue. Finding 1 should land before the first waiver is written, because the first thing that happens after merge is somebody writes one, and
./var/lib/**is the natural shape to reach for.Both landed in this pull request, plus the doc line and the decision you asked
me to state in the body.
HIGH 1. Your fix, taken as proposed: a glob rule's directory must be a
directory the capture's own
state-paths.txtdeclares, or below one. A globwith no wildcard in its last component declares a file and no directory, so
./etc/shadowdoes not license./etc/**.MEASURE_WAIVER_MIN_DEPTHis gone.Refused now, all cases in
tests/compareagainst a real list:./var/lib/**,./var/**,./etc/ssl/**where./etc/ssl/private/**is the declaration,./var/cache/**,./usr/share/**,./etc/webmin/**, alongside the shapes thatwere already refused. Allowed:
./var/lib/mysql/**,./var/lib/mysql/mysql/**,./etc/ssl/private/**,./etc/ssh/**, and any exact path. You are right thatthis costs nothing to trust: the list is already compared byte for byte across
the captures with its digest checked, and the waiver vocabulary is now the
vocabulary of the thing being waived.
LOW 2. The first comma separated component, compared for equality. A
justification naming a directory that merely has the run's as a prefix is a case
in
tests/measure.The doc line.
docs/layer-measure.mdhas a "What this cannot see" section.State identical in every capture is invisible by construction, including a secret
copied out of the base control's own build tree, and the suspect net does not
cover it either because such a path never differs and so is never subtracted. A
PASS means nothing the change did shows up as a difference from the control; it
does not mean the layer ships no secret it should not. Better said there than
left to a reader, as you put it.
The decode, and the reversal. Thank you for doing that arithmetic. I had
been proposing more control captures in the body and that was wrong, so the body
now says so: the field is a wall clock second, the higher bytes carry on scales
of 18.2 hours and 194 days, and no finite control set spans them. I have taken
out the "more captures and then a waiver" line and I am not asking the build host
for anything on this account.
The binary pin is the next pull request, Keel-Linux/buildtasks#13, which
carries your four conditions and the decode. Not this one, and the reason is the
one in your third review: landing a new inference rule in the same change as the
instrument, in order to make the instrument's first subject pass, is how the
defect this whole thing exists to fix came about. So the 32 are published as
they are, recorded against #13, with no waiver over them.
And the merge-while-failing argument is in the body, in your words rather
than paraphrased, because it is the argument that decides it: holding the tool
until mariadb passes means the first thing anybody does with it is tune it until
it agrees with a conclusion already reached.
Coverage 204, 322, 264 and 71 lines, all four at 100 percent, gate unchanged at
99.
shellcheck -S styleexits 0. One thing I fixed after your review that youdid not raise: the new loop read its directory list through
done < <(measure_state_dirs ...), which kcov cannot attribute, so it tooklayer-compare-libto 99.69; it reads into an array now.Fifth review
The licensing rule is the right one and is correctly built. I could not find a hole in it. The hole is now in the thing it licenses from, which is what you would expect and is the one finding below.
Verified as reported. Refused:
./var/lib/**,./var/**,./etc/ssl/**against a declaration of./etc/ssl/private/**,./var/cache/**,./usr/share/**,./etc/webmin/**,./etc/**,./var/lib/my*/**. Allowed:./var/lib/mysql/**,./var/lib/mysql/mysql/**,./etc/ssl/private/**,./etc/ssh/**, and exact paths. Two details worth crediting because they are where this kind of check usually leaks:measure_dir_at_or_belowis[[ "$1" == "$2" ]] || [[ "$1" == "$2"/* ]], a real path boundary, so./var/lib/mysqlevil/**is refused rather than swallowed by a prefix match; andmeasure_state_dirsskips a declaration whose last component has no wildcard, so./etc/shadowlicenses nothing. The refusal message naming the directories that would be legal is a good touch.Also verified:
justified-againstnow compares the first comma separated component for equality, and a waiver namingmariadb-gate2is refused for a run onmariadb-gate; all five suites pass;shellcheck -S styleexits 0 with no output; and the tallies are unchanged for a third revision running, 102 noise, 32 overlapping, 30 real over the file set I hold.HIGH 1. The list now decides two things and is still anchored to nothing
The licensing rule makes
state-paths.txtload bearing twice: it decides which bytes are compared, and now also which waivers are legal.measure_preconditionschecks that all captures carry a byte identical list and that each capture's recorded digest matches the copy it carries. Nothing compares that list to the committedshare/layer-state-paths; grepping for it finds only the default forMEASURE_STATE_PATHS, two comments and one advice string.So the way to license a rule is to declare its directory. Four captures taken against a list with
./var/lib/**added:and the same rule, with the same MariaDB sentence, on a postgresql shaped run:
exit 0 both times.
share/layer-state-suspectdoes not catch it, and cannot: that net reads the paths the floor subtracted, and widening the list makes more paths state paths, so nothing new is subtracted. The run reports0 subtracted but state shapedthroughout.What changed with this commit is that widening the list used to be benign. It only ever increased what was compared by content, which is the safe direction. It now also widens the waiver vocabulary, so the same knob has acquired a second effect pointing the other way.
The fix is the last unfinished piece of a finding from two rounds ago, when
state_paths_sha256was recorded and never read. That was closed for consistency between captures; it is still open against the repository.attributeshould compare the capture'sstate-paths.txtwith$BT/share/layer-state-pathsand refuse on mismatch, with a deliberate override named in the block so that it is on the record rather than in somebody's environment. Short of that, print both digests side by side, because at present the block prints one digest and gives a reader nothing to check it against.Not a block: it takes an operator running captures against a list that is not the committed one, the mismatch is in principle visible in the digest, and the fix is one comparison. But it is the same shape as the defect this tool exists to correct, so I would not leave it for later.
MEDIUM 2. Three of the new guards are not pinned by a test
I mutated each of the six new branches and ran
tests/compare. Three are caught: removing the wildcard-in-last-component guard inmeasure_state_dirs, removing the equality clause inmeasure_dir_at_or_below, and loosening that function to a prefix match. Three are not: the[[ "$glob" == */* ]]guard inmeasure_state_dirs, and the no-wildcard-in-dir and empty-globs guards inmeasure_waiver_rule_shape.The last two are redundant rather than untested: remove them and the licensing loop refuses the same inputs anyway, so they are defence in depth and the mutation surviving is the correct result. The slash guard is the one with no test behind it, covering a malformed list entry with no
/in it, where${glob%/*}would otherwise declare the glob itself as a directory.Worth saying because of what it means for the number: see below.
LOW 3. A declaration with a wildcard in a non-final component licenses nothing
./home/**/.ssh/**yields the declared directory./home/**/.ssh, andmeasure_dir_at_or_belowcompares literally, so no wildcard free rule directory can ever be at or below it../home/alice/.ssh/**is refused. It fails closed, which is the right direction, but it means that one declaration cannot be waived at all, which is probably not intended. A line in the doc or a small normalisation would settle it.The coverage question
Two separate things, and the answer differs between them.
Is the array version equivalent? Yes, and by measurement rather than by reading: I reimplemented the licensing loop in the
while readform it replaced and ran both over 15 rule shapes against three different lists, 45 cases, with zero disagreements. The refactor is behaviour preserving.Is the restored 100 percent real? Yes as line coverage, and it is not a reattribution artefact: the lines execute under the tests, and three of the six new branches fail the suite when removed, which is coverage doing work. But 100 percent line coverage is not 100 percent branch behaviour, and the mutation test above says exactly which three lines a test would not miss. Two of those three are redundant guards, so the honest summary is that one new line, the slash guard, is executed without being tested. That is a small and specific gap, and saying which line it is seems better than either claiming the number means more than it does or discounting it.
Changing the loop and saying so, rather than quietly restoring the figure, was the right way to handle it.
The "What this cannot see" section
Strong enough, and written for the reader you described. It names the case that matters rather than gesturing at it, a secret copied out of the base control's own build tree; it explains why the suspect net does not cover it, that a path which does not differ was never subtracted; and it gives the two sentences somebody hunting for a larger claim cannot get round, that a PASS means nothing the change did shows up as a difference from the control and does not mean the layer ships no secret it should not. Pointing at a single image instrument and at the machine-id trap entry is the right place to send them next.
One addition. The person who over-reads a PASS is reading the block, not this section. I would repeat the second of those two sentences in the part of the doc about what a pull request quotes, so it travels with the thing being quoted.
History is clean: six commits on the tip of
19.x, all by the same author, all passing the repository'scommit-msgandpre-commithooks when replayed, no forbidden strings in the diff. Splitting the binary pin out to a separate pull request, explicitly so that a new inference rule does not land in the change whose first subject it would make pass, is the right call and the right reason.Verified by running: 14 rule shapes against the committed list and against a widened one, the declared-directory derivation, the path boundary case, the end to end list widening and the cross component justification transfer, the suspect net's silence on it, the justification prefix case, six mutations of the new branches, a 45 case equivalence test between the array and process substitution forms, an independent recount of the gate verdicts, five suites,
shellcheck -S styleand the coverage gate. Inferred, without running: that no committed list today declares a directory above sibling state, which is true of the list in this diff but is a property of the file rather than of the check.Warning. One HIGH, which is one comparison. Everything from the previous four rounds is closed and I could not reopen any of it.
Landed, and refusal rather than a printed warning.
The argument for refusing. Every other precondition here refuses: epoch,
layer, parent, distinctness, cross-capture list consistency. And the defect
being closed is the last piece of a finding about a field that was recorded
and never read, so a remedy that relies on a reader noticing a second digest
is the failure mode rather than the fix. The block prints both digests anyway,
so the weaker remedy is there as well; it just is not the thing standing
between a widened list and a PASS.
--state-paths-override REASONis the escape, printed in the block asOVERRIDEbeside both digests, so a deliberate divergence is on the recordrather than in somebody's environment.
The anchor has no environment override, which matters for the property you
credited two rounds ago.
MEASURE_STATE_PATHSstays a capture-time knob andattributeignores it entirely, including as a way of moving the anchor, sopointing it at a narrower file still changes nothing after the fact and that
test still holds.
tests/measurenow takes its captures against the committedlist instead of a fixture list, which removes a difference between the suite and
a real run and is how I noticed the anchor had to be unconditional: my first
attempt read it through
state_paths_file()and would have let the variablemove it.
I kept both things you flagged:
measure_dir_at_or_belowis still[[ "$1" == "$2" ]] || [[ "$1" == "$2"/* ]], andmeasure_state_dirsstillskips a declaration whose last component has no wildcard.
LOW 3, intended.
./home/**/.ssh/**licenses nothing and that is the rightdirection: it fails closed, an exact-path waiver is the route for those paths,
and a glob-against-glob comparison here would put back the breadth ambiguity the
rule exists to remove. Said in the doc now rather than left to be inferred.
LOW 4. The "does not mean this layer ships no secret it should not" sentence
is repeated in the section about what a pull request quotes.
The coverage gap. Tested, not excused:
state-dirs-noslashintests/comparecovers the*/*guard, with a malformed entry that has no slashin it beside a good one.
COVERAGE.mdnow records the whole mutation result,the three that kill the suite and the two that survive because they are
redundant, because a bare 100 percent with a line in it that no assertion would
miss claims more than it has. Thank you for running that; it is a better check
on the number than the number.
Merge order. Keel-Linux/handbook#8 says 0010's step 3 names
bt-layer-measureand describes the repeatable
--control-againand the union floor, none of whichis true until this lands. I have put a line at the top of that pull request
saying it merges second.
Coverage 206, 330, 270 and 77 lines, all four at 100 percent, gate unchanged at
99.
shellcheck -S styleexits 0. Five suites pass.Sixth review, scoped to the delta
The anchor holds. I attacked the three things you named and could not get past any of them; two small things below, neither blocking.
The two credited details survive verbatim.
bin/layer-compare-lib:437is still[[ "$1" == "$2" ]] || [[ "$1" == "$2"/* ]], and:429is still[[ "$last" == *[*?]* ]] || continue.1. The override
It cannot be set without appearing in the block, and it cannot be injected.
measure_parse_argszeroesMEASURE_LIST_OVERRIDEbefore it reads anything, soMEASURE_LIST_OVERRIDE=sneakyin the environment is discarded and the run is refused at exit 3. With the flag, the block carries all three of the things a reader needs, and they are consistent with each other:The two digests differ on their face, so the
OVERRIDEline is not the only signal, which is the right belt and braces given what the finding two rounds ago was about. A clean run prints both digests equal and noOVERRIDEline, so the two are distinguishable by someone reading the block and nothing else.On durability: the reason lives only in the block. Nothing is written into the capture, so a later reader of the capture directory alone cannot tell an override was ever used. That is the safe direction, because re-running
attributewithout the flag refuses rather than quietly proceeding, and the block is the artefact a pull request quotes. Worth knowing rather than worth changing. Any non-empty string is accepted as a reason; an empty one is refused.2. The anchor and the environment
Verified genuinely immovable.
attributenever callsstate_paths_file(), the only function that readsMEASURE_STATE_PATHS;grepshows that variable reaching onlydo_capture. PointingMEASURE_STATE_PATHSat the widened list duringattributedoes not move the anchor: captures taken against a non-committed list are still refused at exit 3, and captures taken against the committed list still pass with both digests equal. Splittingcommitted_paths_file()out rather than parameterisingstate_paths_file()is what makes that true by construction rather than by care, which is the better of the two.3. The suite against the committed list
The content coupling is gone and was removed the right way:
patterns-twoandpatterns-first, which asserted the list had exactly two entries and that the first was./etc/shadow, are replaced byassert_greppresence checks. Those do not rot.A count coupling remains.
tests/measure:303,assert_eq sample-count 4, counts how many fixture files match the committed list. I simulated three future additions:So adding a state path that matches something in the fixture rootfs breaks the suite. It fails loudly and names the assertion and both numbers, so it is self-announcing rather than silent, and the fix is obvious to whoever adds the path. Asserting which paths were sampled rather than how many would make it immune. Low, and I would not hold the merge for it.
4. Refusal rather than a warning
The reasoning is right and I would have argued the same. The specific point that carries it is that the defect being closed is a field recorded and never read, so a remedy whose whole weight rests on a reader noticing a second line reproduces the defect in a new place rather than closing it. Consistency with the other preconditions is the weaker half of the argument but also true:
epoch, the distinct tags, the cross-capture list comparison and the digest check all refuse, and a single precondition that only warns would be the one people learn to skim. Printing both digests unconditionally is what makes the refusal auditable afterwards rather than merely obstructive, and that is the part I would have asked for if it were missing.LOW. The
OVERRIDEline asserts a mismatch it has not checkedbin/layer-report-lib:265prints the line whenever--state-paths-overrideis non-empty, not when the anchor actually failed. Passing the flag on a run whose list does match produces:Two identical digests and a line directly beneath them saying they differ. It errs in the safe direction, since it over-reports and can never hide a real override, but in a block whose purpose is that a reader can check a claim against the evidence printed next to it, a line contradicting the two lines above it is worth one condition. Gate the print on the anchor having actually failed, or reword it to "an override was declared" and let the digests say whether it was needed.
The rest of the delta
state-dirs-noslashgenuinely pins the guard: I removed[[ "$glob" == */* ]] || continueand the suite fails, where before it passed.COVERAGE.mdrecords the whole mutation result, including that two of the six survive because they are redundant and that a surviving mutant is the correct outcome for those. Recording which branches a mutation test kills, rather than only the line percentage, is a better claim than the number alone and I would keep the habit.Both LOW items from last round are settled as described, and the
./home/**/.ssh/**case is now documented as intended with the exact-path route and the reason, which is the right call: a glob-against-glob comparison would put back exactly the ambiguity the licensing rule removed. The PASS caveat now appears in the section about what a pull request quotes, which is where the person over-reading a PASS is looking.Gates: all five suites pass,
shellcheck -S styleexits 0 with no output, coverage 206 / 330 / 270 / 77 all at 100 percent with the gate at 99. Seven commits on the tip of19.x, the new one by the same author, passing both hooks when replayed, no forbidden strings.Approve. The one LOW is a printed line that over-states, not a check that under-performs, and the anchor itself is sound.
Both LOW from the sixth review fixed in
0a0cea1andfb6c1ed:OVERRIDEis printed only when the anchor check actually failed (an unneeded reason now prints asoverride declared and not needed), andtests/measureasserts which fixture paths were sampled instead of how many. Coverage 273/273 and 78/78, CI green.