diff --git a/docs/DEPENDENCY-REVIEW.md b/docs/DEPENDENCY-REVIEW.md index 760f9a8..c2d0b06 100644 --- a/docs/DEPENDENCY-REVIEW.md +++ b/docs/DEPENDENCY-REVIEW.md @@ -5,7 +5,8 @@ by the desktop lockfile. Root independently verified all 121 original archive members and the exact two-line patch using `tools/glib-regression/verify_vendor.py`. The patched source retains original LF bytes; provenance records were updated after removing an unintended Windows newline conversion. Optimized Linux tests -now pass; native desktop validation and the broad security gate stay open. +now pass; native Linux release compilation and packaged startup also passed. +Native graphical interaction and the broad security gate stay open. Recorded 2026-10-13 against commit `4e60038c2f3b0a7b1d2dd0f4361309a735ee140f`. This is an advisory inventory and dependency-path review, not a complete security @@ -52,7 +53,7 @@ sent to the advisory service, and npm used the configured registry audit endpoin ## Findings and disposition -### Linux desktop GLib unsoundness: unresolved +### Initial Linux desktop GLib finding: subsequently locally remediated `glib 0.18.5` matches [RUSTSEC-2024-0429](https://rustsec.org/advisories/RUSTSEC-2024-0429.html). @@ -108,11 +109,11 @@ performance; native appearance review/testing remains a separate open gate. ## Remaining review scope -- Execute established `cargo audit` against both lockfiles before release, - including informational findings; do not treat this OSV fallback as an - equivalent full audit of the project's source or target resolution. -- Resolve/review Linux GLib exposure with upstream-compatible evidence and - preserve reproducible findings; retain the maintenance notices until resolved. +- Keep established `cargo audit` current before subsequent releases, including + informational findings. The completed scan below supersedes the earlier OSV + fallback for current lockfiles; it does not audit project source. +- Maintain the reviewed GLib backport and preserve reproducible findings; + native graphical interaction and the maintenance notices remain open. - Audit native vendored ggml/llama runtime, FFmpeg/codec builds, Vulkan loader, copied CRT and OS webviews separately. Cargo/npm locks do not inventory their bundled native source versions or OS security patch state. @@ -122,7 +123,8 @@ performance; native appearance review/testing remains a separate open gate. ## Compatible GLib remediation research -Research recorded 2026-10-13; no patch has been applied or tested yet. +The following records research on 2026-10-13 before applying the patch. +The subsequent implementation and execution evidence follows below. The official [upstream fix](https://github.com/gtk-rs/gtk-rs-core/commit/b5a4071e439bef2b5eea76c3aa25e5ae84839e34) is exactly two changed lines in `glib/src/variant_iter.rs`: the local output pointer becomes mutable and the variadic C call receives `&mut p` instead of @@ -227,5 +229,56 @@ Raw WSL evidence: `/home/karl/.cache/searchi-validation/glib-optimized-20261013.log`, SHA-256 `98ce2a1580e6b73f58040d6efefdbdcc2dcb5e2cab6f64dc88d8a9424a0031dc`. This validates the focused iterator regression, not all GLib memory safety or -the patched native desktop. Desktop interaction, broad security review and the +the patched native desktop. Subsequent native 0.1.4 compilation and packaged +startup passed with this selected local crate; see [Linux package evidence](LINUX-0.1.4.md). +Desktop interaction, broad security review and the separate macro maintenance notice remain open. + +## Current established scanner execution + +On 2026-10-13 at 15:52:51 UTC, official `cargo-audit 0.22.2` inspected both +current lockfiles using RustSec database revision +`6aed84668c23d7f535077a9fe918bf1fa0f6a5bc`, containing 1310 advisories. +The workspace scan fetched the database; the desktop scan reused that exact +checkout with `--no-fetch`. Its JSON database commit fields are null in that +mode; the independently read Git revision above identifies the shared checkout. +No advisory ignore list, target filter or yanked-check bypass was used. + +The [official Windows artifact](https://github.com/rustsec/rustsec/releases/tag/cargo-audit%2Fv0.22.2) +was verified against GitHub's published digest before extracting/executing: +6192256 bytes, archive SHA-256 +`0a7316540862c13d954f648917ceacca593747baed6eec180fafa590be2710ab`. +The tool is kept under ignored `.searchi/tools`; it is not an app dependency or +a globally installed replacement. No inference or GPU operation was involved. + +Equivalent commands with that tool available on PATH: + +```sh +cargo audit --file Cargo.lock --db .searchi/dependency-review/rustsec-current --json --deny warnings +cargo audit --file apps/desktop/src-tauri/Cargo.lock --db .searchi/dependency-review/rustsec-current --json --deny warnings --no-fetch +``` + +Both reported zero vulnerability-class findings, but both exited **1** because +warnings were denied. Workspace warning: `paste 1.0.15`, RUSTSEC-2024-0436; +desktop warning: `proc-macro-error 1.0.4`, RUSTSEC-2024-0370. The paths/dispositions +above remain applicable. This is not a fully green strict audit. No speculative +macro/framework migration or silent warning suppression was introduced. + +The scanner does not list the local GLib override as the affected registry +package. This omission is not proof of remediation: the independent 121-file +archive comparison, exact upstream patch and optimized iterator tests remain +the evidence for this local backport. Their stored log hash was rechecked and +the original-archive verifier rerun successfully on the current vendor tree. + +| Current input/report | SHA-256 | +| --- | --- | +| Workspace lockfile | `f6f995c96bf8554175423edfaccbdf61b88a52a5742c660a4a6346395139eb6e` | +| Desktop lockfile | `12b3522694a2a85c937b59b3d8128b10517b2393f6ceb6c105fb75c28e4d398e` | +| Workspace audit JSON | `7fee9db9cf1dca04b82b915cfff76a3fee0023c7fb419d61b287b46d394ec461` | +| Desktop audit JSON | `b4a039d05ad54be81cd0673af5fe9c281193449bb03cc882fe65843a6437d65c` | + +Ignored reports and stderr files live in +`.searchi/dependency-review/cargo-audit-0.22.2-current/`. +Advisory data changes; repeat this established scan before future releases. +Registry scanning does not cover native runtime/codec source, platform webviews, +unreported issues or project-level security, whose gates stay open. diff --git a/docs/ROADMAP.md b/docs/ROADMAP.md index d3b868d..1c6e485 100644 --- a/docs/ROADMAP.md +++ b/docs/ROADMAP.md @@ -156,8 +156,10 @@ release. Keep their evidence and unchecked production gates intact. - [ ] Formatting, lint, tests and security/dependency review. - [x] Inventory locked Rust/npm advisories; prepare byte-verified compatible upstream GLib iterator backport for the Linux desktop dependency graph. - - [ ] Execute optimized Linux backport regressions and native desktop checks; - complete native runtime and source security review. See DEPENDENCY-REVIEW.md. + - [x] Execute optimized Linux GLib backport regressions: three tests and the owner-lifetime compile-fail test passed; stored log hash and all 121 upstream source files reverified. + - [x] Native Linux 0.1.4 desktop build and packaged CPU startup use the selected local GLib backport; native graphical interaction remains unchecked. + - [x] Execute cargo-audit 0.22.2 against both current lockfiles with a fresh RustSec database and warnings denied; zero vulnerability-class findings, two tracked maintenance notices and exit 1. See DEPENDENCY-REVIEW.md. + - [ ] Complete native graphical interaction and broader native runtime/source security review. No broad security gate is closed by these narrow checks. - [ ] CPU benchmarks: filename p95 <50 ms/1M records; text <150 ms/100K documents; semantic <500 ms on declared hardware. - [ ] Measure cold start, indexing throughput, RAM, disk and idle CPU. - [ ] Record the very first foreground query and distinct unseen queries after