Repository navigation
Develop - #527
Merged
Merged
Develop#527
Conversation
* fix: retain dAuth secrets after dispatched job create failure What changed: - Keep a new job's staged CID and dAuth bundle when create dispatch may have reached a worker, including pending timeouts. - Roll back before dispatch and preserve existing update and scale-up behavior. - Cover partial delivery, timeout retry, and create/update classification in isolated tests. Why: - A timed-out create previously removed secrets while dispatched R1DB workers continued retrying dAuth. * fix: surface uncertain Deeploy creates and reject same-job retries What changed: - Reject sequential retries of retained create attempts and overlapping creates on one manager. - Mark retained failed and timed-out creates as dispatch-uncertain in API responses. - Cover retry and lifecycle behavior and document the accepted retention limit. Why: - A retry must not replace the CID-bound bundle still needed by workers from an uncertain first attempt, and callers need to know that failure does not prove cancellation. * Update ver.py
…ed finding contract on read (RM-062, RM-117, RM-118) (#526) What changed: - RM-062: archived findings are read through flat_finding_from_dict (read_archived_findings, wired into PassReport.from_dict and JobArchive.from_dict). A foreign or future schema_version raises; unstamped v0 findings stay readable. New end-to-end test: triage follows its finding across the passes of one job. - RM-117: CSRF findings carry AffectedAsset(url=path, parameter=normalised form action, method=POST), so there is one finding per page + action. - Version: ver.py 2.10.472, RedMesh backend 0.13.0. - RM-118: new authenticated_action finding field (performed | attempted | not_permitted | not_applicable), stamped by the credential probes and validated; probe_display_name is stamped in the flat walk; deterministic report-findings fixture built from real probe output, shared byte-for-byte with Navigator and the hub. Why: - Client-rerun report fixes. The report must state what happened after a login from a field, not parsed text; CSRF forms on one page must not collide; and the archive read path must refuse a schema it does not understand. Checks: - full red_mesh suite: 6194 passed, 5 skipped - git diff --check: clean
What changed: - Every tracked Dockerfile now fetches the kubo tarball from github.com/ipfs/kubo/releases first and tries dist.ipfs.tech only if that fails. Why: - dist.ipfs.tech timed out (curl exit 28 after 60s), so the image builds for rm3/rm4 failed at the kubo install step. The GitHub release asset for v0.35.0 returned 200 (51.9 MB) in 1.6s. Checks: - curl probe of both URLs: GitHub 200, dist.ipfs.tech timeout. - Fallback chain run under `sh -c 'set -eux'` with a failing first URL: the second URL downloaded and the tarball extracted. - No full docker build run.
* fix: allow stale pending jobs to reach empty-node consensus * fix: tolerate empty pending-job response in chain dist monitor * fix: isolate malformed pipeline metadata in chain dist monitor
cristibleotiu
approved these changes
Oct 6, 2026
toderian
added a commit
that referenced
this pull request
Oct 6, 2026
…tity (#528) * fix(redmesh): keep path segments after ;params in CSRF finding identity What changed: - _csrf_identity_action cuts the query and fragment, then drops `;param` path parameters per segment instead of truncating at the first `;`. - Two regression tests: distinct endpoints behind a `;jsessionid` segment stay two findings; a session id in a middle segment does not move the id. Why: - `/account;jsessionid=ABC/delete` and `/account;jsessionid=ABC/update` both normalised to `/account`, so the CSRF probe's (page, action) dedup dropped the second finding and its evidence. Regression from the RM-117 CSRF finding identity, found while reviewing release PR #527. - No version bump; ships with the next release. Checks: - test_csrf_finding_identity.py: new tests red before the fix, 11 passed after. - red_mesh/tests full suite: 6196 passed, 5 skipped. - git diff --check: clean. * chore: RedMesh 0.13.1, node version 2.10.481 What changed: - REDMESH_BACKEND_VERSION and PENTESTER_API_01 __VER__ 0.13.0 -> 0.13.1. - ver.py 2.10.480 -> 2.10.481. - test_api.py release assertions follow the new version. Why: - Patch release for the CSRF finding identity fix, so reports can tell a 0.13.0 run (collapses `;param` endpoints) from a fixed one. Checks: - test_api.py + test_csrf_finding_identity.py: 230 passed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.