Repository navigation
Conversation
…g audit Adds passive Ruby inventory and RubyGems/Bundler configuration audit to enterprise telemetry as optional ruby_inventory and ruby_config_audit sections, collected in a new ruby_scan phase. Declared, locked, installed and cached evidence stay separate. Sources that are shared, unreadable, cancelled or budget-limited are partial so prior evidence is never retired on unproven absence. The collector never executes Ruby, Bundler, gemspecs or Gemfiles, never extracts archives, and reports credentials as configured only.
Add optional conda_inventory and conda_config_audit telemetry sections collected in a new conda_scan phase. The scanner passively reads conda-meta receipts, extracted package caches, environment manifests, explicit, conda-lock and rattler locks, and the .condarc family plus saved environment state and process variables. It never executes conda, mamba, pixi or Python, never activates environments, never reads credential contents and never resolves dependencies. Discovery covers standard installation roots, verified CONDA_PREFIX, CONDA_ROOT, envs_dirs and pkgs_dirs leads, the environments.txt registry and project search roots. Sources carry discovery parents so a later scan of a surviving ancestor can prove removal; unreadable, cancelled, protected or budget-limited inputs leave their sources partial instead of retiring prior evidence. Channel, proxy and artifact URLs are emitted without credentials, query strings, fragments or Conda token path components. Findings conda-001 through conda-004 report unencrypted channels, disabled TLS verification, embedded credentials and disabled safety checks. Existing Python discovery and output are unchanged.
A requested spec with ? or # is a URL-like request rather than a match spec, so it is redacted whole like one with userinfo or a token path. The fuzz oracle now looks for token components only inside a URL path: a host or local directory named "t" is not a token. Keep the three crasher inputs as regression seeds.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Adds passive Conda package inventory and configuration audit to enterprise telemetry through optional
conda_inventoryandconda_config_auditsections, collected in a newconda_scanphase.conda-meta/*.jsonreceipts, cached packages from extractedpkgs/<dist>/infometadata (repodata_record.json, falling back toindex.json), declared requirements fromenvironment.yml/environment.yaml/env.yml/env.yaml/environment.json, and locked packages from@EXPLICITfiles, conda-lock v1 and rattler/pixi v6 locks.~/.conda, macOS Homebrew casks and/optprefixes, Windows%LOCALAPPDATA%\conda\conda), verifiedCONDA_PREFIX/CONDA_ROOT/MAMBA_ROOT_PREFIX,envs_dirsandpkgs_dirsleads from configuration, the~/.conda/environments.txtregistry and project search roots. Pixi and project-local prefixes are found by theirconda-metadirectory..condarc/condarc/condarc.dsettings across system, installation, user, environment and process scopes, plus savedconda-meta/statevariables and project manifest channels, and reports ambient, per-environment and per-project precedence chains. Emits findingsconda-001throughconda-004.~/.netrc,~/_netrcand the anaconda-client token directory are checked for existence only./t/<token>path components from every channel, proxy, artifact and requested-spec URL before emission or identity generation. Environment-variable references are not treated as literal credentials.internal/model/testdata/conda_inventory_v1_golden.json, sha256c1f8ecfe26760e3d92dd5210557fb14441ce7152e02fcbb62ad742b4cd22c491) and parser, scanner, configuration, limit, cancellation, removal and redaction regressions, plus aFuzzCondaMetadatatarget.The collector never executes conda, mamba, micromamba, pixi, Python or shells, never runs activation scripts or plugins, never makes network calls and never solves dependencies. Conda packages are reported without language labels. Community output and existing Python discovery remain unchanged. Updates README and scan-coverage documentation.
Known limitations: archive-only cache entries are reported as unsupported rather than identified; wheel rows in locks and caches are reported as unsupported; rattler caches,
.mambarc,MAMBARCand Pixi configuration are not read; manifests with selectors orsel()are partial.Type of change
Testing
gofmt,go vet,go mod tidywithout drift,golangci-lint(0 issues),git diff --check.go test ./... -race -count=1; Conda detector, configaudit, model and telemetry packages at-race -count=3.FuzzCondaMetadata5 minutes at 4 workers after the first CI fuzz run found a requested spec with a fragment passing through; the fix redacts query/fragment requests and the crasher inputs are kept as seeds.make smoke(45/45); gosec with no findings in the changed files.Related Issues
Stacks on the Ruby scanner from #258 (open); rebase after it merges. Builds on the NuGet scanner from #239 and the Composer configuration helpers from #238.