Current · 2026-10-16
Source and test code 239cc2e: 183 GNU/Linux tests after Windows fixture canonicalization; release recipe measured at f72371a. Final publication receipts are separate.
Download reportSecOps Codemark 0.4.1 release tooling review
Date: 2026-10-16 UTC. Qualified source and test code: 239cc2ecc0e3c114769978a87bd70730e3cb383d. The release recipe was separately reproduced at f72371ae987ad2299778d0f8a637bda85740c38f.
Scope and method
Focused review of source staging, generated output preservation, local instruction exclusions, native archiver preflight, website report routes and their regression tests. Reproductions used synthetic private-directory fixtures in a networkless namespace. No real private user files or keys were used. A separate review checked the final packaging patch; this is not an independent external audit or certification.
| Confirmed defect | Correction and regression |
|---|---|
| Selected source directory replaced by a symlink | Reject each selected source root before traversing it; outside-tree fixture contents are not packaged |
| Existing generated target or output symlink overwritten | Check every generated target before artifact writes, including dangling links; create portable and checksums exclusively; preserve existing bytes and modes |
| Nested local instruction files included | Screen path components and private instruction names consistently; ordinary public source remains included |
| Missing requested archiver reported after output creation | Check required native Zupt before creating output; missing-tool regression leaves no output directory |
| Reports with different extensions sharing one readable route | Validate report filenames and route stems before writing the site; rejected existing and new output trees remain unchanged |
| Strict website validation attempted before download staging | Bilingual release guide stages checksum-checked artifacts first; the complete documented workflow passed with a fresh output |
Verification
183 tests passed, zero failed or skipped, in 7.276 seconds. 11 portable checks passed outside the source tree with isolated Python. Real OpenSSL 3.5.7 and Zupt 5.2.10 were available for the native fixtures. Ruff, formatting, Pyright and bounded selected-source secret screening passed. Read the qualification, test log and portable record for exact scope.
The first candidate CI run exposed an unresolved temporary root in the new Windows website test fixture. The fixture now resolves that root as production does; publication path validation and assertions were preserved. The complete GNU/Linux suite passed after this correction. The exact final-source six-job matrix remains a publication gate and is linked from the release.
Preserved contracts and limits
Runtime CLI arguments, snapshot and attestation schemas, mandatory hybrid authentication, private bundle format, deterministic ZIP metadata and staged executable intent are preserved. This patch changes release-tooling validation and the version identifier.
Build output must be new for every attempt. Later filesystem, compression or archive-test failures can leave incomplete output and are not a successful release. The builder is not host containment against a concurrent privileged process. Filename screening does not certify the absence of source-embedded secrets.
Native Zupt 5.2.10 qualifies extracted file bytes but does not restore POSIX modes or ACLs. Never refresh an integrity snapshot to hide a permission mismatch. Historical similarity and pipeline figures remain tied to their original 0.4.0 experiments; no new accuracy or speed ranking is claimed.
Resumo em português brasileiro
Foram corrigidas a travessia por links nas raízes de fontes, sobrescritas de destinos, inclusão de instruções privadas aninhadas, detecção tardia da ausência do compressor e colisões de rotas dos relatórios. O guia novo prepara os downloads antes da validação estrita. Passaram 183 testes e 11 verificações do portátil; os resultados têm o escopo e a revisão acima. A revisão é focal e não representa auditoria externa independente. Falhas posteriores do compressor exigem nova saída, e o limite de permissões do Zupt permanece documentado.