mirror of
https://github.com/DeusData/codebase-memory-mcp.git
synced 2026-11-08 08:53:43 +08:00
Martin Vogel
3e343a3eb2
The pre-release ML false-positive tolerance (single-engine Microsoft "!ml" verdicts downgradable with Defender endpoint evidence, #1340) is reverted by owner decision: cbm does not ship binaries carrying a VirusTotal detection, demonstrably false or not. A "trojan" badge on a release asset is a reputation cost the project is not willing to price in, however good the accompanying evidence. The gate returns to its original form: any detection, by any engine, on any artifact, on any version blocks the release. The endpoint verification tool and the evidence side-channel are removed with it; the notes renderer keeps its extracted-script form but only ever states a verified "0 detections". False positives are resolved upstream instead: verify the bytes on a real Defender endpoint, submit a Microsoft false-positive report for the exact hashes, wait for the detection to clear, then RE-RUN the failed verify job -- which does not rebuild, so the cleared hashes are the shipped hashes. tests/test_vt_gate_zero_tolerance_contract.sh pins the decision: clean passes; 1 malicious and 1 suspicious each block across stable, -rc., -pre and -alpha versions; plus a tripwire for the specific reverted evidence mechanism returning. Loosening this gate again has to consciously delete that contract. The skip_tests dispatch input and the script-extracted notes step survive the revert -- both are orthogonal to gating policy. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
30 lines
1.3 KiB
Bash
30 lines
1.3 KiB
Bash
#!/usr/bin/env bash
|
|
# Append the Security Verification section to the release notes: per-binary
|
|
# sha256 + VirusTotal links. This step only runs after check-virustotal.sh
|
|
# passed, and that gate is ZERO tolerance — any detection blocks the release —
|
|
# so "0 detections" here is a verified statement, never an assumption.
|
|
# Expects: GH_TOKEN, VERSION; run from the verify job workspace (binaries/).
|
|
set -euo pipefail
|
|
|
|
TABLE="\n\n## Security Verification\n\n"
|
|
TABLE+="All release binaries scanned with 70+ antivirus engines — **0 detections**.\n\n"
|
|
TABLE+="| Binary | SHA-256 | VirusTotal |\n"
|
|
TABLE+="|--------|---------|------------|\n"
|
|
|
|
for bin in binaries/codebase-memory-mcp-*; do
|
|
[ -f "$bin" ] || continue
|
|
name=$(basename "$bin")
|
|
sha256=$(sha256sum "$bin" 2>/dev/null | awk '{print $1}' \
|
|
|| shasum -a 256 "$bin" | awk '{print $1}')
|
|
label=$(echo "$name" | sed 's/^codebase-memory-mcp-//' | sed 's/\.exe$//')
|
|
short="${sha256:0:20}..."
|
|
vt_url="https://www.virustotal.com/gui/file/${sha256}/detection"
|
|
TABLE+="| \`${label}\` | \`${short}\` | [0 detections ✅](${vt_url}) |\n"
|
|
done
|
|
|
|
CURRENT=$(gh release view "$VERSION" \
|
|
--json body --jq '.body // ""' --repo "$GITHUB_REPOSITORY")
|
|
printf '%s%b' "$CURRENT" "$TABLE" > /tmp/release_notes.md
|
|
gh release edit "$VERSION" \
|
|
--notes-file /tmp/release_notes.md --repo "$GITHUB_REPOSITORY"
|