mirror of
https://github.com/DeusData/codebase-memory-mcp.git
synced 2026-10-19 05:40:03 +08:00
Martin Vogel
3305c1f9d3
Previously the verify job only ran scripts/security-strings.sh on files matching binaries/codebase-memory-mcp* — install.sh, install.ps1, LICENSE, and any future companion files in the release archives were NOT covered by the binary-string audit (only by VirusTotal). Changes: - release.yml: loop over binaries/* (every file in the audit set). - security-strings.sh: detect file type via 'file -b'. For shell scripts and other text files, skip the URL audit and dangerous-cmd audit (those rules are tuned for compiled binaries — install.sh legitimately uses wget as a curl fallback, and 'case https://*)' globs look like unauthorized URLs to a strings dump). Always run credential and base64 pattern audits — those are universally meaningful regardless of file type. - Verified locally: install.sh and install.ps1 now both pass. Net effect: every release artifact is now audited, with rule sets appropriate to its file type.