Backport official GLib iterator safety fix for Linux desktop

2026-10-13 10:35:50 +02:00
1 parent 43c43ebdc9
commit 8ef874c609
@@ -0,0 +1,215 @@
+# Dependency advisory review
+
+Current disposition: the compatible upstream GLib fix is now vendored and selected
+by the desktop lockfile. Root independently verified all 121 original archive
+members and the exact two-line patch using `tools/glib-regression/verify_vendor.py`.
+The patched source retains original LF bytes; provenance records were updated
+after removing an unintended Windows newline conversion. Optimized Linux tests
+and native desktop validation remain pending; the broad security gate stays open.
+
+Recorded 2026-10-13 against commit `4e60038c2f3b0a7b1d2dd0f4361309a735ee140f`.
+This is an advisory inventory and dependency-path review, not a complete security
+assessment or a cleared production release gate. No dependencies were changed.
+
+## Method and reproducible inputs
+
+- Parsed both complete Cargo lockfiles with Python 3.14 `tomllib`; checked every
+  registry package, including target-specific and inactive optional packages.
+  Workspace: 343 registry entries; desktop: 580; union: 639 unique name/version
+  pairs. Local project crates are outside the registry advisory scan.
+- Submitted exact crate versions in seven bounded batches to the official
+  [OSV querybatch API](https://google.github.io/osv.dev/post-v1-querybatch/),
+  checked response counts, retained raw results and fetched every matched full
+  advisory. This is not a `cargo audit` execution; cargo-audit was unavailable.
+- Independently cloned the official
+  [RustSec advisory database](https://github.com/RustSec/advisory-db), revision
+  `d5f46becf4d442d460e1fce5e12f2c0f00924868`, and inspected the matched primary
+  records and affected function/version ranges. OSV and RustSec synchronization
+  can differ; a future release must rerun an up-to-date established scanner.
+- Ran `npm audit --json` (npm 11.19.0) from `apps/desktop`, exit 0, using its
+  complete package-lock. Report: **zero reported vulnerabilities**, 81 dependency
+  total as reported by npm (4 production, 78 development, overlapping optional
+  classifications). This is a registry advisory result, not code inspection.
+- Used `cargo tree --locked --offline --target all` inverse queries, plus the
+  workspace `--all-features` graph and Windows-specific graph, to distinguish
+  locked entries from actually selected dependency paths. No compilation,
+  inference, installation, GPU execution or global environment changes occurred.
+
+| Input | SHA-256 |
+| --- | --- |
+| `Cargo.lock` | `1627cbcff7f212129b5ce331da219cd6f075124ff37098a1219375f2d3ddb895` |
+| `apps/desktop/src-tauri/Cargo.lock` | `e061f2c0aab97710a6647711eef42a60a0eb5b0f1ad3beb9e5b11db51cb12d21` |
+| `apps/desktop/package-lock.json` | `07f493ca3fd0e63f2e1fbcf7da3a7487e7843220f4778df9c140a16d205d345a` |
+
+OSV observation UTC: `2026-10-13T08:17:49.245379+00:00`.
+Ignored raw evidence: `.searchi/dependency-review/osv.json`, one JSON per matched
+advisory, and `.searchi/npm-audit-current.json`. Their SHA-256 values are
+`e7ac1f1c460c70533f9fffd54660c3cdd47ba552bb8b988f6d1daf52a4e1db83`
+and `3f97e5ef2b8fa01651de5937b697788712fdcfee58486493d8e97dd859576904`
+respectively. No secrets or file contents were sent; package names/versions were
+sent to the advisory service, and npm used the configured registry audit endpoint.
+
+## Findings and disposition
+
+### Linux desktop GLib unsoundness: unresolved
+
+`glib 0.18.5` matches
+[RUSTSEC-2024-0429](https://rustsec.org/advisories/RUSTSEC-2024-0429.html).
+`GHSA-wrw7-89jp-8q8g` is its alias, not a second independent issue. RustSec
+classifies it as informational **unsound**: `VariantStrIter` iteration can invoke
+undefined behavior and crash optimized builds. Affected versions start at
+0.15.0; the advisory lists a fix from 0.20.0. There is no CVSS severity in this
+record, and no demonstrated searchi exploit.
+
+The selected Linux GUI graph contains GLib through GTK 0.18.2, WebKitGTK,
+Tao/Wry and Tauri 2.12.3; this is not only an unused lockfile entry. The Windows
+inverse query has no selected GLib path. Project source searches found no direct
+`VariantStrIter` or `str_iter` calls, but that does not establish absence of
+indirect calls in the native framework. Headless workspace search does not
+select this desktop graph.
+
+Do not force a second GLib major into the lockfile and call this fixed: GTK's
+0.18 dependency constraint would still select the affected version. Before a
+Linux production release, establish the framework call-path exposure and use a
+compatible upstream fix/backport or an explicitly reviewed patch. Test the
+actual native Linux GUI after remediation. No silent advisory suppression or
+blanket acceptance was added.
+
+### Unmaintained compile-time dependencies: tracked
+
+- `proc-macro-error 1.0.4` matches
+  [RUSTSEC-2024-0370](https://rustsec.org/advisories/RUSTSEC-2024-0370.html).
+  Selected Linux GTK/GLib macro graph: `glib-macros` / `gtk3-macros` →
+  `proc-macro-error`. This is an upstream maintenance notice, not a disclosed
+  runtime exploit. Resolve with the compatible framework update/remediation;
+  do not replace transitive macro crates blindly.
+- `paste 1.0.15` matches
+  [RUSTSEC-2024-0436](https://rustsec.org/advisories/RUSTSEC-2024-0436.html).
+  It is locked only in the root workspace and selected by the optional
+  `tokenizers 0.22.2` path with `--all-features` (historical MiniLM feature),
+  not the ordinary default workspace graph or desktop graph. It is also a
+  maintenance notice, not a disclosed exploit. Consider removing the historical
+  optional backend or updating its compatible upstream dependency separately;
+  this must not change the required genuine Google production backend.
+
+The OSV batch returned these three unique RustSec findings and the GLib alias.
+No other matched advisory was returned for the 639 exact versions. That narrow
+statement does not mean all dependencies are secure.
+
+### New Windows appearance dependencies
+
+The normal Windows graph selects `window-vibrancy 0.8.1` directly and through
+Tauri; native appearance also uses `windows-sys 0.61` APIs. Their locked versions
+and all transitive registry entries were included in the scan. No matching OSV
+advisory was returned for these appearance packages. Advisory scanning does not
+prove safety of searchi's unsafe Windows calls, handle ownership or compositor
+performance; native appearance review/testing remains a separate open gate.
+
+## Remaining review scope
+
+- Execute established `cargo audit` against both lockfiles before release,
+  including informational findings; do not treat this OSV fallback as an
+  equivalent full audit of the project's source or target resolution.
+- Resolve/review Linux GLib exposure with upstream-compatible evidence and
+  preserve reproducible findings; retain the maintenance notices until resolved.
+- Audit native vendored ggml/llama runtime, FFmpeg/codec builds, Vulkan loader,
+  copied CRT and OS webviews separately. Cargo/npm locks do not inventory their
+  bundled native source versions or OS security patch state.
+- Source-level security review, release signatures, licenses, dependency
+  tampering, malicious packages, unreported vulnerabilities and clean-machine
+  tests are not covered here. No production security gate is checked off.
+
+## Compatible GLib remediation research
+
+Research recorded 2026-10-13; no patch has been applied or tested yet.
+The official [upstream fix](https://github.com/gtk-rs/gtk-rs-core/commit/b5a4071e439bef2b5eea76c3aa25e5ae84839e34)
+is exactly two changed lines in `glib/src/variant_iter.rs`: the local output
+pointer becomes mutable and the variadic C call receives `&mut p` instead of
+`&p`. The original author and maintainer reviewed it in
+[PR 1343](https://github.com/gtk-rs/gtk-rs-core/pull/1343).
+
+```diff
+- let p: *mut libc::c_char = std::ptr::null_mut();
+ let mut p: *mut libc::c_char = std::ptr::null_mut();
+  // existing g_variant_get_child call, existing format and other arguments
+- &p,
+ &mut p,
+```
+
+This patch applies to the selected 0.18.5 source without public API changes.
+It restores the out-parameter's writable storage; it does not change the
+returned string's ownership or lifetime. The iterator borrows `&'a Variant`;
+`array_iter_str` first validates exact array-of-strings type; the `&s` GLib
+format returns a borrowed string whose owner remains the variant. Iteration
+bounds continue to guard child indices. Do not change that format to allocated
+`s`, drop the variant, invent a `'static` lifetime, or remove UTF-8 validation.
+The patch changes the Rust aliasing contract of the pointer variable only.
+
+The official crates.io API lists 0.18.5 as the latest 0.18 release, with no
+0.18.6/backport release. The PR's backported label does not prove a released
+0.18 fix: its RustSec record still marks all 0.15–0.19 versions affected.
+The [Wry GTK4/WebKitGTK6 migration PR](https://github.com/tauri-apps/wry/pull/1530)
+was open/unmerged when queried (updated 2026-07-22). That future platform change
+is not a present compatible fix for searchi's locked GTK3 graph. No independently
+verified maintained compatible fork was selected.
+
+### Source exposure review
+
+The affected helper is private to `VariantStrIter`; its constructor is
+crate-private and the public `Variant::array_iter_str` factory enforces the
+string-array type. Its five iterator entry points call that helper directly.
+A recursive search of locally available registry Rust sources found factory
+calls only in GLib documentation/tests, rather than selected GTK/WebKit/Tauri
+code. Additional inspected conversion paths matter: GLib's `FromVariant for
+Vec<T>` uses `child_value(i).get()` rather than this iterator; Tao's portal theme
+path uses `dbus::arg::Variant<u32>`, a different type, rather than GLib's borrowed
+string iterator. These paths therefore do not demonstrate the affected call.
+This is static source evidence, not a linker-level or runtime whole-program
+reachability proof; generated code, future dependency changes and indirect
+platform paths remain reasons to fix the library rather than waive the finding.
+
+### Proposed bounded implementation and validation
+
+1. Copy the complete official `glib 0.18.5` crate into a reviewed vendor path,
+   retaining its MIT license and upstream metadata. Verify the original crate
+   archive SHA-256 `233daaf6e83ae6a12a52055f568f9d7cf4671dabb78ff9560ab6da230ce00ee5`
+   against the existing lockfile checksum. Record the original archive and
+   exact upstream commit; apply only the two-line upstream fix initially.
+2. Add a desktop-workspace `[patch.crates-io] glib = { path = ... }`, regenerate
+   its lockfile and verify inverse dependency trees resolve all Linux GTK/GLib
+   consumers to the one patched 0.18.5 crate. Do not introduce duplicate 0.20,
+   patch the shared user Cargo cache, or modify the headless engine graph.
+3. Run actual Linux **optimized** regressions against the patched library:
+   existing upstream string iteration tests plus explicit `next`, `next_back`,
+   `nth`, `nth_back`, `last`, exhaustion, empty arrays and multilingual strings.
+   Include a compile-fail lifetime check preventing results outliving the
+   variant. Test the same Release optimization used by the desktop package;
+   debug-only passing tests miss the documented optimizer-sensitive failure.
+4. Build and exercise the native Linux desktop with the patched graph and
+   record source/diff hashes. Keep this advisory in the inventory as
+   **locally remediated by reviewed upstream backport**, not a false registry
+   advisory disappearance: an exact-version scanner may continue flagging
+   0.18.5 or skip local packages. Track replacement by a compatible upstream
+   release and the separate unmaintained macro notice.
+
+This proposal avoids an unverified external fork and a broad GTK migration.
+The cost is explicitly owning a small documented vendor patch and its future
+review; root coordination and actual Linux validation are required before
+claiming remediation.
+
+## Prepared local backport (execution pending)
+
+The desktop manifest now overrides GLib with `vendor/glib`. All 121 upstream
+files were compared byte-for-byte with the official archive; the only difference
+is the two-line upstream change in `src/variant_iter.rs`. The original archive
+hash describes the unmodified archive, not a patched archive. Provenance and
+per-file original/patched hashes live separately in `vendor/glib-backport`; no
+Cargo user cache was modified. The locked complete desktop metadata contains
+exactly one GLib package, version 0.18.5 with the local path and no registry
+source. The all-target inverse graph selects it for every GTK/WebKit consumer.
+
+An isolated `tools/glib-regression` harness and lockfile are prepared for actual
+optimized Linux execution, including an owner-lifetime compile-fail doctest.
+No Linux compilation/test or native desktop check has been executed for this
+backport yet. The advisory remains recorded as unresolved validation, and the
+separate macro maintenance notice remains open.
@@ -109,6 +109,10 @@ Status: implementation started; no production release yet. Windows VM tests use
 - [ ] Verify detailed performance UI interaction on native desktop platforms;
  repeat overhead measurements on representative libraries and hardware.
 - [ ] Formatting, lint, tests and security/dependency review.
+  - [x] Inventory locked Rust/npm advisories; prepare byte-verified compatible
+    upstream GLib iterator backport for the Linux desktop dependency graph.
+  - [ ] Execute optimized Linux backport regressions and native desktop checks;
+    complete native runtime and source security review. See DEPENDENCY-REVIEW.md.
 - [ ] CPU benchmarks: filename p95 <50 ms/1M records; text <150 ms/100K documents; semantic <500 ms on declared hardware.
 - [ ] Measure cold start, indexing throughput, RAM, disk and idle CPU.
 - [ ] Record the very first foreground query and distinct unseen queries after