charon-ml, aeneas: declare GithubRepo provenance — both were UNSCANNED - #574
Merged
Merged
Conversation
The nightly scan's second warning line (below the CPE-coverage one) reports:
⚠ 35 package(s) emitted NO vuln query (no OSV ecosystem, no GitHub repo,
not GnuProject/Sourceforge) — UNSCANNED, reported as 0 findings
That is a strictly worse class than "queried, found nothing": these packages
were never asked. charon-ml and aeneas are on that list, and both have a plain
GitHub upstream that just was never declared.
charon-ml → AeneasVerif/charon (Apache-2.0, confirmed via API)
aeneas → AeneasVerif/aeneas (Apache-2.0, confirmed via API)
Both sources are gs://-mirrored, and `Provenance::from_url` deliberately
declines gs:// — so nothing could infer these; they had to be declared.
Neither currently resolves any advisory (OSV GIT query returns 0 for both
repos, checked today), so this changes no finding today. That is the point: a
queried zero is an answer, an unqueried zero is not. From here they ride the
OSV GIT / GHSA path like every other GithubRepo package.
Verified with `pkgmgr check-onboarding` against this branch: 80 gaps -> 78, and
neither package appears in the output any more.
## The other three could NOT be fixed, and the reason matters
menhir, visitors and unionfind are also on the unscanned list. All three are
fpottier projects on gitlab.inria.fr, and each build.ncl header already says:
"no `Gitlab` provenance category yet — minimal-supply-chain#347"
That category HAS since shipped on the tooling side (sc#347/#348 + pm#511):
`Provenance::Gitlab { host, owner, repo }` exists in the Rust parser and
scan.rs routes it. But the minimal STDLIB contract never got it. From the
stdlib in use (`attr_classes.ncl`), the accepted set is exactly:
'GithubRepo 'GnuProject 'Sourceforge 'Website
Declaring 'Gitlab under `| Attrs` therefore fails the contract outright —
`minimal dump` aborts with "failed to validate source_provenance" and the WHOLE
package set fails to evaluate, not just that package.
psmisc appears to contradict this: it ships `category = 'Gitlab` on main today.
It does not — psmisc's attrs block carries NO `| Attrs` annotation, so it is
never contract-checked. That is an accident, not a pattern to copy, and it means
we currently have one package whose provenance the contract has never seen.
So the pkgs half of the GitLab provenance work was never merely forgotten — it
was not expressible. Raising the stdlib gap is a minimal-side decision, so this
PR stops at the two packages that can land today rather than working around a
contract.
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe package declarations for Aeneas and Charon now include GitHub source provenance metadata. The metadata identifies each repository by source category, owner, and repository name. ChangesSource provenance
Estimated code review effort: 1 (Trivial) | ~5 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
twitchyliquid64
approved these changes
Aug 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The nightly scan's second warning line — the one below the CPE-coverage line I've been chasing — reports:
That's a strictly worse class than "queried, found nothing": these were never asked.
charon-mlandaeneasare on that list, and both have a plain GitHub upstream that simply was never declared.AeneasVerif/charonAeneasVerif/aeneasBoth sources are gs://-mirrored, and
Provenance::from_urldeliberately declinesgs://— so nothing could infer these; they had to be declared.Neither resolves any advisory today (OSV GIT query returns 0 for both repos, checked). That's the point — a queried zero is an answer, an unqueried zero is not. From here they ride the OSV GIT / GHSA path like every other GithubRepo package.
Verified with
pkgmgr check-onboardingagainst this branch: 80 gaps → 78, and neither package appears in the output any more.The other three couldn't be fixed, and the reason is the interesting part
menhir,visitorsandunionfindare also on the unscanned list. All three are fpottier projects ongitlab.inria.fr, and each build.ncl header already says so:That category has since shipped on the tooling side (sc#347/#348 + pm#511):
Provenance::Gitlab { host, owner, repo }exists in the Rust parser andscan.rsroutes it. But the minimal stdlib contract never got it. Fromattr_classes.nclin the stdlib actually in use, the accepted set is exactly:Declaring
'Gitlabunder| Attrsfails the contract outright — and not gracefully.minimal dumpaborts withfailed to validate source_provenanceand the whole package set fails to evaluate, not just that package. I hit exactly this and it silently turned acheck-onboardingrun into "0 packages evaluated successfully", which reads as a pass.psmisclooks like a counter-example. It isn't.psmiscshipscategory = 'Gitlabon main today — but its attrs block carries no| Attrsannotation, so it is never contract-checked. That's an accident rather than a pattern to copy, and it means we currently have one package whose provenance the contract has never validated.So the pkgs half wasn't forgotten — it wasn't expressible
Raising the stdlib gap is a minimal-side decision, so this PR stops at the two packages that can land today rather than working around a contract. Flagging it here so the next person doesn't rediscover it the same way.
Remaining on the unscanned list after this: 33, including the X11 stack (libdrm, xorgproto, xtrans, xcb-proto, libxau, libx*, atk, at-spi2-core), ghc/ghc-bootstrap, and several vendor CLIs.
Summary by CodeRabbit