From a437cf051c1b2126d712e3e2a0397b5432adb46d Mon Sep 17 00:00:00 2001 From: Juan Barbat Date: Sat, 4 Jul 2026 13:05:53 -0300 Subject: [PATCH 1/3] chore: remove OSS audit from public docs and CI It's a personal safety net, not a contribution requirement. External contributors won't have the denylist, and in a dotfiles repo nobody runs it anyway. Public defense is CODEOWNERS + CI syntax checks + PR review gate. --- .github/workflows/ci.yml | 6 ------ CONTRIBUTING.md | 1 - README.md | 13 ------------- 3 files changed, 20 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d00fbef..add40a8 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -22,12 +22,6 @@ jobs: sudo apt-get update sudo apt-get install -y --no-install-recommends zsh jq shellcheck - - name: Run OSS audit - shell: bash - env: - OSS_AUDIT_FORBIDDEN_REGEX: ${{ vars.OSS_AUDIT_FORBIDDEN_REGEX }} - run: scripts/oss-audit.sh - - name: Validate shell syntax shell: bash run: | diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index aeb2fe5..d734a83 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -28,7 +28,6 @@ All changes to `main` require maintainer review. This is especially important fo - Do not commit secrets, tokens, private keys, real emails, private hostnames, private IPs, customer names, or machine-specific paths. - Put local/private values in `~/.config/cortex-dots/local/env.zsh`. - Keep examples generic and placeholder-based. -- Run `scripts/oss-audit.sh` before opening a PR. - Run the validation commands listed in `README.md` when touching scripts or config formats. ## Pull Request Expectations diff --git a/README.md b/README.md index b6dd6b2..a3d8c2c 100644 --- a/README.md +++ b/README.md @@ -118,22 +118,9 @@ Transparency depends on your Linux compositor/window manager. Shaders are opt-in in `ghostty/config`; uncomment one `custom-shader` line only after confirming your GPU/driver handles it well. -## OSS Audit - -Run before publishing or packaging: - -```bash -scripts/oss-audit.sh -``` - -The audit scans tracked files only and fails on configured private identifiers, private paths, and email-shaped strings. -Set `OSS_AUDIT_FORBIDDEN_REGEX` or create an untracked `.oss-audit-denylist.local` file with one regex per line to add private denylist terms locally. -For CI, configure the repository variable `OSS_AUDIT_FORBIDDEN_REGEX` with private denylist terms instead of committing them. - ## Validation ```bash -scripts/oss-audit.sh scripts/test-install.sh scripts/test-install.sh --symlink scripts/test-install.sh --seed-stale-opposite From c23f3f63637b59c76faae8ce88dd5ca0a7377c76 Mon Sep 17 00:00:00 2001 From: Juan Barbat Date: Sat, 4 Jul 2026 13:18:13 -0300 Subject: [PATCH 2/3] docs: add supply chain security rules to CONTRIBUTING.md Pin external versions (no latest/untagged), 15-day cooling period for new releases. GitHub Actions pinned to SHAs or minor versions. --- CONTRIBUTING.md | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index d734a83..3e58b5e 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -30,6 +30,26 @@ All changes to `main` require maintainer review. This is especially important fo - Keep examples generic and placeholder-based. - Run the validation commands listed in `README.md` when touching scripts or config formats. +## Supply Chain Security + +Any external tool, CLI, or dependency installed by `install.sh` or referenced in scripts must be pinned to a specific version. Do not use `latest`, `^ SemVer` ranges, or unpinned references in installation commands. Versions must be at least 15 days old before adoption — supply chain attacks typically target newly published releases. + +```bash +# Good — pinned version, 15+ days old +curl -fsSL https://starship.rs/install.sh | sh -s -- -b "$HOME/.local/bin" -y --commit abc123 + +# Good — pinned package manager version +npm install -g some-cli@2.4.1 + +# Bad — no version pinning +curl -fsSL https://example.com/install | bash + +# Bad — latest tag +npm install -g some-cli@latest +``` + +For GitHub Actions in workflows, always use explicit commit SHAs (`@commit-sha`) or pinned minor versions (`@v4`). Avoid `${{ github.sha }}` or floating tags in production workflows. + ## Pull Request Expectations Every PR should include: From ba1767fdf8bc19ec92fdc5f99349ee5b925cd327 Mon Sep 17 00:00:00 2001 From: Juan Barbat Date: Sat, 4 Jul 2026 13:20:07 -0300 Subject: [PATCH 3/3] chore: remove oss-audit.sh entirely MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Script no longer referenced by CI, README, CONTRIBUTING or any other file — dead code. Also clean up .gitignore entry and CHANGELOG. --- .gitignore | 1 - CHANGELOG.md | 9 +++---- scripts/oss-audit.sh | 57 -------------------------------------------- 3 files changed, 3 insertions(+), 64 deletions(-) delete mode 100755 scripts/oss-audit.sh diff --git a/.gitignore b/.gitignore index b2dea8c..834bb3f 100644 --- a/.gitignore +++ b/.gitignore @@ -1,6 +1,5 @@ # Configuración local (paths, tokens, datos personales) local/env.zsh -.oss-audit-denylist.local # macOS .DS_Store diff --git a/CHANGELOG.md b/CHANGELOG.md index 90d9f4a..5fa8227 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,7 +5,7 @@ - Initial OSS-safe `cortex-dots` snapshot. - Generalized private paths and navigation defaults. - Removed custom font binary and private brand assets. -- Added MIT license, security policy, third-party notices, release checklist, and OSS audit script. +- Added MIT license, security policy, third-party notices, release checklist, and automated installer tests. ## 0.1.1 - 2026-07-04 @@ -17,11 +17,8 @@ - `scripts/test-install.sh` — automated installer tests (copy, symlink, stale-opposite scenarios). - `scripts/check-agent-state.sh` — agent-state validator for release checklist. -- `.oss-audit-denylist.local` — untracked personal denylist for OSS audit (one regex per line). -- `OSS_AUDIT_FORBIDDEN_REGEX` CI variable support — configure repo-level denylist without committing. +- Supply chain security rules — external tools must be pinned to specific versions, 15+ days old. ### Changed -- OSS audit script — externalized forbidden identifiers to env var + local denylist; no longer hardcodes private terms. -- CI — added installer integration tests step; passes `OSS_AUDIT_FORBIDDEN_REGEX` from repo vars. -- `.gitignore` — added `.oss-audit-denylist.local`. +- CI — added installer integration tests step. diff --git a/scripts/oss-audit.sh b/scripts/oss-audit.sh deleted file mode 100755 index 755addc..0000000 --- a/scripts/oss-audit.sh +++ /dev/null @@ -1,57 +0,0 @@ -#!/usr/bin/env bash -set -euo pipefail - -if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then - printf '%s\n' 'FAIL oss-audit must run inside a git worktree' >&2 - exit 1 -fi - -forbidden_regex="${OSS_AUDIT_FORBIDDEN_REGEX:-}" -email_regex='[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+[.][A-Za-z]{2,}' -failed=0 - -if [[ -f .oss-audit-denylist.local ]]; then - while IFS= read -r pattern; do - [[ -n "$pattern" && "$pattern" != \#* ]] || continue - if [[ -n "$forbidden_regex" ]]; then - forbidden_regex+="|$pattern" - else - forbidden_regex="$pattern" - fi - done < .oss-audit-denylist.local -fi - -if [[ -n "$forbidden_regex" ]]; then - set +e - LC_ALL=C grep -Eq "$forbidden_regex" /dev/null 2>/tmp/cortex-dots-oss-audit-regex-error - regex_status=$? - set -e - if [[ "$regex_status" -eq 2 ]]; then - printf '%s\n' 'FAIL invalid forbidden identifier regex' >&2 - cat /tmp/cortex-dots-oss-audit-regex-error >&2 - rm -f /tmp/cortex-dots-oss-audit-regex-error - exit 1 - fi -fi - -while IFS= read -r -d '' file; do - if [[ -n "$forbidden_regex" ]] && LC_ALL=C grep -nEI "$forbidden_regex" "$file" >/tmp/cortex-dots-oss-audit-match 2>/dev/null; then - printf 'FAIL forbidden identifier in %s\n' "$file" >&2 - cat /tmp/cortex-dots-oss-audit-match >&2 - failed=1 - fi - - if LC_ALL=C grep -nEI "$email_regex" "$file" >/tmp/cortex-dots-oss-audit-match 2>/dev/null; then - printf 'FAIL email-shaped string in %s\n' "$file" >&2 - cat /tmp/cortex-dots-oss-audit-match >&2 - failed=1 - fi -done < <(git ls-files -z) - -rm -f /tmp/cortex-dots-oss-audit-match /tmp/cortex-dots-oss-audit-regex-error - -if [[ "$failed" -ne 0 ]]; then - exit 1 -fi - -printf '%s\n' 'PASS oss-audit'