nordisk/holger
Commits
c83655e18c45Merge hol311/main-installtest into main (lane HOL-311-RELEASE): installtest imports the intel bundle before the cargo probe (cherry-pick -x of 2749c1b9 from hol311/release). Gate (dwarf KVM, holger hol311/release 2749c1b9): installtest GREEN 07:08Z, every leg PASS (intel, cargo walked to AVAILABLE, pip, npm, sandbox, board)c6dbf62c7a83installtest imports the intel bundle before the cargo probe (lane HOL-311-RELEASE). Since the cargo door (HOL-CARGO-PUBLISH-DOOR, c6ef70be) the probe crate walks the intake chain, and a box with no advisory database holds every scan (HOLGER-INTEL-MISSING, fail closed), so the cargo leg pushed before the intel leg stayed at INGESTED. RED: the 3.1.1 KVM installtest on dwarf (4602ea31, 07:00Z): FAIL cargo, held at INGESTED, vulnerability (holger-intel-osv): no vulnerability data; pip and npm, pushed after the import, passed. GREEN: the KVM rerun. rustfmt, xtask check --locked934293c78f55Merge hol311/main-fixes into main (lane HOL-311-RELEASE): a build without the scanners compiles again (cherry-pick -x b034fba0 from heimdall-allin/hol312: WINDOWS_LAUNCHER_FINDING held in server-lib, so both holger-downstream rows build) and clippy -D warnings is clean on holger-server-lib (the not(intake) is_chain_view stub, cargo_door only with intake+fmt-rust, the depset enums without jobs). Gate (dwarf ci4, merged tree): clippy -D warnings --all-targets default and supply-chain, --no-default-features --lib; check --locked holger-downstream pid1 and fetch,downstream-wg,paired; metadata --locked root, estate, holger-estate-front, holger-downstream. The same commits are on hol311/release (4602ea31, b3634d04)1f96dd523d34clippy -D warnings clean again on holger-server-lib (lane HOL-311-RELEASE): the not(intake) is_chain_view stub goes (no caller without intake, 352d4291), cargo_door is computed only where it is read (intake + fmt-rust, c6ef70be), and DepsetOp/DepsetOut allow dead_code without jobs (every set call answers Unimplemented there). RED at 4602ea31: clippy --all-targets -D warnings failed on default (is_chain_view never used) and supply-chain (DepsetOp fields never read); GREEN (dwarf ci4): clippy -D warnings default --all-targets, supply-chain --all-targets, check --locked holger-downstream pid1 and fetch,downstream-wg,paired, metadata --locked root/estate/holger-estate-front/holger-downstream9705757ba8f6hol312: a build without the scanners compiles again (WINDOWS_LAUNCHER_FINDING held in server-lib)0ae58dd9593aMerge secfix/d3-pom-bounds into main (lane SEC-FIX-HOL, SEC-REVIEW-2026-11-01 D3)1dee79196067Merge secfix/f1-grpc-xff into main (lane SEC-FIX-HOL, SEC-REVIEW-2026-11-01 F1, gRPC)2f8d023769a9Merge secfix/d4-set-revision into main (lane SEC-FIX-HOL, SEC-REVIEW-2026-11-01 D4)7484c9c1f922Merge secfix/cli-suite-p19 into main (lane SEC-FIX-HOL, SEC-REVIEW P2/P3 follow-up)f6f39e75729brustfmt the D4, F1 (gRPC) and D3 set: formatting only76a50351279dGREEN (SEC-REVIEW D3): POMs capped at 1 MiB, BOM imports at 16 deep, DOCTYPE read to its own >6fcf794e1af1RED (SEC-REVIEW D3): a POM past 1 MiB is parsed, and BOM imports nest without a depth limit996153d1d302GREEN (SEC-REVIEW F1, gRPC): a trusted front's forwarded client is the client on the gRPC door87a9db1cebd5GREEN (SEC-REVIEW D4): a set vote names the revision it was shownb3c448849258RED (SEC-REVIEW D4): a set vote is not bound to the set the approver was shown515963aa9addThe CLI suite's box requires no scan: its raw files repository is a side door otherwise (follow-up to SEC-REVIEW P2/P3)30c78f488532RED (SEC-REVIEW F1, gRPC): a trusted front's X-Forwarded-For is ignored on the gRPC door (compile-RED: client_via)dc5f9646d955Merge secfix/guard-every-door into main (lane SEC-FIX-HOL, SEC-REVIEW-2026-11-01 guard)ba766195c9d9Merge secfix/f1-trusted-xff into main (lane SEC-FIX-HOL, SEC-REVIEW-2026-11-01 F1)8de77ea19a4eMerge secfix/k2-keyfile-tmp into main (lane SEC-FIX-HOL, SEC-REVIEW-2026-11-01 K2)03589a6f16b5Merge secfix/k1-deb-coordinate into main (lane SEC-FIX-HOL, SEC-REVIEW-2026-11-01 K1)19e49c69a60aMerge secfix/w1-launchers into main (lane SEC-FIX-HOL, SEC-REVIEW-2026-11-01 W1)39aa0befdf95Merge secfix/d2-maven-segments into main (lane SEC-FIX-HOL, SEC-REVIEW-2026-11-01 D2)6a9a53223753Merge secfix/p12-yank-owner into main (lane SEC-FIX-HOL, SEC-REVIEW-2026-11-01 P12)52261df019d3Merge secfix/p11-foreign-registry into main (lane SEC-FIX-HOL, SEC-REVIEW-2026-11-01 P11)03bb6c9b3087Merge secfix/p10-chain-view into main (lane SEC-FIX-HOL, SEC-REVIEW-2026-11-01 P10)e99a871f53c9Merge secfix/p9-promotion-dest into main (lane SEC-FIX-HOL, SEC-REVIEW-2026-11-01 P9)4f61b4ba16b3Merge secfix/p8-group-members into main (lane SEC-FIX-HOL, SEC-REVIEW-2026-11-01 P8)5602d9fb7e90Merge secfix/p7-inert-attachments into main (lane SEC-FIX-HOL, SEC-REVIEW-2026-11-01 P7)a5704380bc52Merge secfix/p6-critical-chain into main (lane SEC-FIX-HOL, SEC-REVIEW-2026-11-01 P6)efe4c8e90145GREEN (SEC-REVIEW D2): classifier and type must be Maven path segments; closure paths checked before a fetche04488198c29GREEN (SEC-REVIEW W1): only setuptools/distlib launcher names are excused; that WARN stops auto-approve5db7e3033db0GREEN (SEC-REVIEW F1): from ron_trusted_proxies the right-most X-Forwarded-For is the client (HTTP door: visitors, admission, audit '<client> via <front>')94936081d0bdRED (SEC-REVIEW F1): a trusted front's X-Forwarded-For is ignored (compile-RED: the new helpers)5b8f3781aa9cGREEN (SEC-REVIEW K2): write_private makes a fresh, uniquely named temporary (create_new, 0600) and renames it in3d881195c2e1RED (SEC-REVIEW D2): a POM classifier or type with a path in it is fetched3c752fda9ce0RED (SEC-REVIEW W1): any PE named *.exe up to 256 KiB is excused as a Windows launcher352d4291f340GREEN (SEC-REVIEW P10): one is_chain_view predicate for the wiring, the views and the side doors2c98f1de137dGREEN (SEC-REVIEW guard): MigrationService.Start refused on a Holger with an intake chain, holger-intake-2027ba67fd8e24GREEN (SEC-REVIEW K1): a stanza that disagrees with its pool coordinate is not listed; malformed and repeated fields dropped2395b0295731RED (SEC-REVIEW K1): the signed Packages stanza takes Package/Version/Architecture from the control (compile-RED: the new signature)1ce18793b1c7RED (SEC-REVIEW K2): a planted .keytmp symlink redirects a private key write10c7f5d8ee99GREEN (SEC-REVIEW P11): a crate with a dependency on another registry gets no index lineb9fbe0d79a91RED (SEC-REVIEW P11): a dependency's registry-index goes into the cargo index row0652fb7cd471GREEN (SEC-REVIEW P12): a yank is its publisher's or a Repository Admin's; only an Admin undoes an Admin'se12cd7a56001RED (SEC-REVIEW P12): any Importer yanks any crate, and undoes an Admin's yank055a7fb51f8eRED (SEC-REVIEW guard): every write door is enumerated, and MigrationService.Start lands bytes raw18e2d6898381RED (SEC-REVIEW P10): a handler-backed deb repository is neither a view nor a side door73abe8f2cd8eGREEN (SEC-REVIEW P9): IntakeChain::promotion_refusal on the RPC and the Promote job600d349f5455RED (SEC-REVIEW P9): PromoteArtifact writes into a side door