feat: add Linux official evidence audit gate#140
Merged
Conversation
📝 WalkthroughWalkthroughThe Linux provisioning script now exposes official distro evidence audits through a reusable report function and two CLI modes. Tests validate report contents, JSON output, drift-check output, and successful exit behavior. ChangesOfficial distro evidence audit
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant CLI
participant main
participant AuditReport
participant Output
CLI->>main: pass audit command
main->>AuditReport: collect summary, matrix, and drift errors
AuditReport-->>main: return JSON-friendly audit report
main->>Output: print JSON or drift-check result
Output-->>CLI: return formatted output and exit status
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/f4_linter_linux_provisioning.py`:
- Around line 2798-2853: Add tests covering the missing CLI failure paths:
invoke main() with mocked linux_official_evidence_drift_errors() returning
errors and assert EXIT_OFFICIAL_EVIDENCE_DRIFT plus correctly formatted stderr
output from _official_evidence_drift_check_message; add subprocess tests for no
mode flag and both mutually exclusive flags, asserting EXIT_INVALID and argparse
error output from _ContractArgumentParser.error().
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 75acf318-41e9-464b-988f-c30ebdca14eb
📒 Files selected for processing (2)
scripts/f4_linter_linux_provisioning.pytests/packaging/test_f4_linter_linux_provisioning.py
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add a release-facing Linux official evidence audit gate.
This PR exposes the official distro evidence drift helpers through a deterministic report helper and CLI check/report modes.
This is an audit/check change only. It does not add new official evidence records, does not promote new mappings, and does not change generated evidence semantics.
What changed
Added:
linux_official_distro_evidence_audit_report()--official-evidence-audit--check-official-evidence-driftAudit report helper
linux_official_distro_evidence_audit_report()returns:summarymatrixdrift_errorsokokis true only whenlinux_official_distro_evidence_drift_errors()is empty.Current state:
CLI report mode
Behavior:
0CLI check mode
Current clean behavior:
Exit behavior:
0when drift errors are empty2when official evidence drift is detectedContract scope
This gate checks drift between the configured official evidence registry and generated ECLI distro evidence.
It is not a live network audit of Debian web pages.
Behavior preserved
Exactly six generated Debian evidence records remain
verified-official-source:deb/yamllintdeb/shellcheckdeb/clang-tidydeb/cppcheckdeb/clang-formatdeb/checkstyleNo Docker helper record is promoted.
No non-Debian mapping is promoted.
All Docker DEB helper records remain
repository-local-policy/current-policy-baseline.RPM/openSUSE/Arch/Slackware mappings remain unchanged.
Tests
Added tests for:
Existing promotion, Docker baseline, generated manifest, and negative tamper tests remain passing.
Scope controls
This PR does not:
OS_PACKAGE_NAMESValidation
Passed locally / by agent report:
Observed results:
Additional CLI smoke:
Safety:
Next work
A follow-up PR can wire this official evidence audit gate into release verification or packaging evidence checks, still without promoting additional distro families.
Summary by CodeRabbit
New Features
Tests