Repository navigation
fix(census): isolate authenticated release metadata reads - #257
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The clean-room census could not inspect latest releases on macOS arm64: all 13 documented repositories returned anonymous GitHub API rate-limit errors, so those rows stayed
LATEST_RELEASE_UNKNOWNbefore installer execution.Use the workflow's existing read-only GitHub token only for the parent process's latest-release metadata request. Installer downloads and subprocesses retain the explicit credential-free environment. Authenticated redirects are confined to the HTTPS GitHub API origin; repository-path injection and invalid credential header bytes are refused without logging the credential. No additional workflow permission is requested.
Demonstration: the new parent-request control first failed because metadata had no explicit authenticated Request. It now observes the fixture Bearer header on the API request, while the actual private installer verifies that caller credentials are absent. All 19 controls pass, including anonymous fallback, repository redirects, cross-origin/plaintext refusal and a metadata 403 remaining UNKNOWN without installer execution. Existing hash, release-identity and version gates are unchanged.
The census manifest is unchanged. Hosted six-platform clean-room results will measure the effect; success is not assumed for downstream anonymous installer requests or existing version/platform gaps. No resident installer run or package publication was performed locally. Full hosted CI remains required.
Bead: aegis-tnr
Overlap preflight: 5b81ced1e84e363cabef5a0e1537e3794b799cd2a4d5f4c8364478d0b00dad04