Skip to content

Wo 594/hook fixture authorization #50

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ppiankov merged 3 commits into from
Aug 1, 2026
Merged

Wo 594/hook fixture authorization #50

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e0a3e6a
feat: authorize exact hook fixtures
ppiankov Jul 31, 2026
6a35668
chore: bump version to 0.36.1
ppiankov Jul 31, 2026
2531c87
test: use intrinsic secret for hook fixtures (config-independent)
ppiankov Jul 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,29 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

## [Unreleased]

## [0.36.1] - 2026-07-31

### Added

- The generated pre-commit hook can authorize specific test fixtures that intentionally
contain secret-shaped values, so a project's own detector fixtures can be committed
without disabling the hook. Authorization is a committed, value-free manifest of exact
per-file, per-line fingerprints; run `pastewatch-cli hook fixture-fingerprint <file>`
to produce an entry without printing the fixture contents. Any unapproved secret, a
moved or edited fixture, a stale fingerprint, an inline self-authorization comment, or
a malformed manifest still blocks the commit.

### Fixed

- Hardened the generated hook and its staged-diff scanning against bypass: hook edits
refuse symlinked, dangling-symlinked, and hard-linked hook files and pin file identity
(device/inode) across the write to close TOCTOU races; hook upgrades replace only the
exact marker-bounded generated section and preserve existing permissions; the staged
scan disables external diff drivers, textconv, and rename detection so a fixture cannot
spoof its authorized path; and the manifest parser rejects duplicate keys, fractional
or overflowing numbers, and manifest changes made in the same commit that consumes its
authority — all failing closed.

## [0.36.0] - 2026-07-31

### Changed
Expand Down
4 changes: 2 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Pastewatch
[![Stable](https://img.shields.io/badge/status-stable-brightgreen)](https://github.com/ppiankov/pastewatch/releases)
[![Version](https://img.shields.io/badge/version-0.36.0-blue)](https://github.com/ppiankov/pastewatch/releases/tag/v0.36.0)
[![Version](https://img.shields.io/badge/version-0.36.1-blue)](https://github.com/ppiankov/pastewatch/releases/tag/v0.36.1)
[![License: MIT](https://img.shields.io/badge/license-MIT-yellow)](LICENSE)
[![CI](https://github.com/ppiankov/pastewatch/actions/workflows/ci.yml/badge.svg)](https://github.com/ppiankov/pastewatch/actions/workflows/ci.yml)
[![ANCC](https://img.shields.io/badge/ANCC-compliant-brightgreen)](https://ancc.dev)
Expand Down Expand Up @@ -486,6 +486,6 @@ Do not pretend it guarantees compliance or safety.

## Project Status

**Status: Stable, feature-complete** · **v0.36.0** · Accepting compatibility and bug fixes only
**Status: Stable, feature-complete** · **v0.36.1** · Accepting compatibility and bug fixes only

Pastewatch is stable and in maintenance mode. See [docs/status.md](docs/status.md) for the full feature-milestone breakdown.
Loading
Loading