{"header":{"message":"ci fixes: allowing a vulnix mirror","description":null,"timestamp":"2026-10-24T09:05:52.899060053Z","authors":[{}]},"hash":"77B2BMZA7P42LG3JWA2XCCOXB26Y36KIVWWPTKODXNMCGUTSUSBQC","authors":[{"login":"pmeunier","key":"AAAAC3NzaC1lZDI1NTE5AAAAILagOJFgwaMNhBWQINinKOXmqS4Gh5NgxgriXwdOoINJ"}],"deps":{"hashes":[["77B2BMZA7P42LG3JWA2XCCOXB26Y36KIVWWPTKODXNMCGUTSUSBQC","ci fixes: allowing a vulnix mirror"],["AA",null],["YJLEG4WRYKKQJMMDRKIRG4T4L7ZZ7N777EKIRSHHWHNZYWZJ7G5AC","Basic CI infra (no runner yet)"],["PCR2LDLTK6XVSBXJL6IMGQP7GSE5UNFCT6WRM2H5EPQ2AZWFRCFAC","update + CI"],["OA64RZOMOMELKGZE4MKMBJH6E6WE7BMP7OZHWQCZENSUZZ2ISXFQC","Debugging jobs synchronisation between builder and main"],["D4OFR55J32745WILDBAYROEZNRTIFG7VGQTOYSXO4CAB7K55RG5QC","CI: keeping track of status"],["AX7NN2MQXFV32SW32M2NKYGSLA775AWFIWUWX3R5YAMPG32HMZMQC","Redesign (fat change)"],["FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC","Audits CI-side"],["XBVCKYCK2YKA2PZTD56GAZFUZ26U6XKQLA6MU3WELNOGJPZUUIXQC","verbose ci output"],["GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC","summarize vulnix scans by CVSS severity and show them in the job list"],["NMJJPK5SGCT2MTSJHDZTFTLN4SNRPDIRGSAHEN6W2MORIHKNPUEAC","kill CI jobs immediately and visibly"],["22HPCW6R66LDCNFTKV4JPDIKM55U7XP5CFMHYYN2TDPQVQ6ATBWAC","ci: SIGTERM before SIGKILL when stopping a job"],["AXSO2WQRYQ724Q75343WBY555VVW5B2UVVB5CPEWBCTXRN5NBLZQC","CI : jobs par système (pijul.toml [systems]) routés vers des runners hétérogènes, runner macOS (darwinModules.ci)"],["6ZEMNMU3LBPUOQICRHOM2KIGB2QHQNB5GBCP4NJPMKOWYYX5GSQAC","Using a Vulnix mirror"],["IS5JL73JHDDJQGGGYBUUJNEBFT3STOKGB7V33M6J44CB2TPOVPXQC","Avoid saving the result"],["VNUSSLWM24R3PINF54IN4ZVKLFDMCO5BCQRBM2GGIGJZOVANS3TQC","CI: download the correct channel"],["VSP7Q7PXDDI4E6WAOAPSQVNIFALK2J3KG2IQNEQWQEXMKE2SPJKQC","Use the exit status of scripts in addition to build"]],"deps":["YJLEG4WRYKKQJMMDRKIRG4T4L7ZZ7N777EKIRSHHWHNZYWZJ7G5AC","PCR2LDLTK6XVSBXJL6IMGQP7GSE5UNFCT6WRM2H5EPQ2AZWFRCFAC","OA64RZOMOMELKGZE4MKMBJH6E6WE7BMP7OZHWQCZENSUZZ2ISXFQC","D4OFR55J32745WILDBAYROEZNRTIFG7VGQTOYSXO4CAB7K55RG5QC","AX7NN2MQXFV32SW32M2NKYGSLA775AWFIWUWX3R5YAMPG32HMZMQC","FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC","XBVCKYCK2YKA2PZTD56GAZFUZ26U6XKQLA6MU3WELNOGJPZUUIXQC","GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC","NMJJPK5SGCT2MTSJHDZTFTLN4SNRPDIRGSAHEN6W2MORIHKNPUEAC","22HPCW6R66LDCNFTKV4JPDIKM55U7XP5CFMHYYN2TDPQVQ6ATBWAC","AXSO2WQRYQ724Q75343WBY555VVW5B2UVVB5CPEWBCTXRN5NBLZQC","6ZEMNMU3LBPUOQICRHOM2KIGB2QHQNB5GBCP4NJPMKOWYYX5GSQAC"],"known":["VNUSSLWM24R3PINF54IN4ZVKLFDMCO5BCQRBM2GGIGJZOVANS3TQC","IS5JL73JHDDJQGGGYBUUJNEBFT3STOKGB7V33M6J44CB2TPOVPXQC","VSP7Q7PXDDI4E6WAOAPSQVNIFALK2J3KG2IQNEQWQEXMKE2SPJKQC"]},"hunks":[{"Edit":{"inode":{"change":6,"pos":4686340},"path":"ci.nix","line":20,"atom":{"EdgeMap":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":12,"pos":4924},"to":{"change":13,"start":0,"end":103},"introduced_by":13}],"inode":{"change":6,"pos":4686340}}},"contents":[{"Del":{"text":" ${optionalString (cfg.vulnixMirror != null) \"vulnix_mirror = ${builtins.toJSON cfg.vulnixMirror}\"}","pos":"6ZEMNMU3LBPUOQICRHOM2KIGB2QHQNB5GBCP4NJPMKOWYYX5GSQAC:102"}}]}},{"Edit":{"inode":{"change":6,"pos":4686340},"path":"ci.nix","line":61,"atom":{"EdgeMap":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":6,"pos":4687268},"to":{"change":13,"start":104,"end":350},"introduced_by":13}],"inode":{"change":6,"pos":4686340}}},"contents":[{"Del":{"text":" vulnixMirror = mkOption {","pos":"6ZEMNMU3LBPUOQICRHOM2KIGB2QHQNB5GBCP4NJPMKOWYYX5GSQAC:133"}},{"Del":{"text":" type = types.nullOr types.str;","pos":"6ZEMNMU3LBPUOQICRHOM2KIGB2QHQNB5GBCP4NJPMKOWYYX5GSQAC:170"}},{"Del":{"text":" default = null;","pos":"6ZEMNMU3LBPUOQICRHOM2KIGB2QHQNB5GBCP4NJPMKOWYYX5GSQAC:192"}},{"Del":{"text":" example = \"https://nix.int.coturnix.fr/nvd/\";","pos":"6ZEMNMU3LBPUOQICRHOM2KIGB2QHQNB5GBCP4NJPMKOWYYX5GSQAC:244"}},{"Del":{"text":" description = \"Mirror of the NVD JSON feeds for vulnix (`--mirror`); null = nvd.nist.gov.\";","pos":"6ZEMNMU3LBPUOQICRHOM2KIGB2QHQNB5GBCP4NJPMKOWYYX5GSQAC:342"}},{"Del":{"text":" };","pos":"6ZEMNMU3LBPUOQICRHOM2KIGB2QHQNB5GBCP4NJPMKOWYYX5GSQAC:349"}}]}},{"Edit":{"inode":{"change":6,"pos":4686340},"path":"ci.nix","line":69,"atom":{"EdgeMap":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":6,"pos":4687432},"to":{"change":7,"start":4432,"end":4678},"introduced_by":7}],"inode":{"change":6,"pos":4686340}}},"contents":[{"Del":{"text":" # Seul scanner du CI : vulnix (a besoin des sorties + `.drv` de build).","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:4511"}},{"Del":{"text":" # Binaire FIXE, jamais de code du dépôt. cargo-audit / pnpm audit (source,","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:4596"}},{"Del":{"text":" # cheap) tournent côté script de déploiement, pas ici.","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:4662"}},{"Del":{"text":" vulnix","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:4677"}}]}},{"Edit":{"inode":{"change":2,"pos":65},"path":"ci/src/main.rs","line":40,"atom":{"EdgeMap":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":12,"pos":5661},"to":{"change":13,"start":351,"end":600},"introduced_by":13}],"inode":{"change":2,"pos":65}}},"contents":[{"Del":{"text":" /// Miroir des flux NVD pour vulnix (`--mirror`), à défaut nvd.nist.gov.","pos":"6ZEMNMU3LBPUOQICRHOM2KIGB2QHQNB5GBCP4NJPMKOWYYX5GSQAC:429"}},{"Del":{"text":" /// NVD est lent et coupe souvent les téléchargements : un scan en échec","pos":"6ZEMNMU3LBPUOQICRHOM2KIGB2QHQNB5GBCP4NJPMKOWYYX5GSQAC:509"}},{"Del":{"text":" /// n'archive aucun rapport.","pos":"6ZEMNMU3LBPUOQICRHOM2KIGB2QHQNB5GBCP4NJPMKOWYYX5GSQAC:542"}},{"Del":{"text":" #[serde(default)]","pos":"6ZEMNMU3LBPUOQICRHOM2KIGB2QHQNB5GBCP4NJPMKOWYYX5GSQAC:564"}},{"Del":{"text":" vulnix_mirror: Option,","pos":"6ZEMNMU3LBPUOQICRHOM2KIGB2QHQNB5GBCP4NJPMKOWYYX5GSQAC:599"}}]}},{"Edit":{"inode":{"change":2,"pos":65},"path":"ci/src/main.rs","line":257,"atom":{"EdgeMap":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":6,"pos":4841329},"to":{"change":7,"start":4679,"end":4701},"introduced_by":7},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":7,"pos":4701},"to":{"change":13,"start":601,"end":653},"introduced_by":13}],"inode":{"change":2,"pos":65}}},"contents":[{"Del":{"text":" t.vulnix,","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:4700"}},{"Del":{"text":" config.config.vulnix_mirror.as_deref(),","pos":"6ZEMNMU3LBPUOQICRHOM2KIGB2QHQNB5GBCP4NJPMKOWYYX5GSQAC:652"}}]}},{"Replacement":{"inode":{"change":2,"pos":65},"path":"ci/src/main.rs","line":271,"ins":{"up_context":[{"change":8,"pos":53}],"down_context":[{"change":6,"pos":4841865}],"flag":"BLOCK","start":0,"end":71,"inode":{"change":2,"pos":65}},"del":{"edges":[{"previous":"","flag":"DELETED","from":{"change":8,"pos":53},"to":{"change":7,"start":4702,"end":4786},"introduced_by":8},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":6,"pos":4841794},"to":{"change":7,"start":4702,"end":4786},"introduced_by":7}],"inode":{"change":2,"pos":65}},"ins_contents":[{"Add":{"text":" let status = if let Ok((code, results)) = result {","pos":"77B2BMZA7P42LG3JWA2XCCOXB26Y36KIVWWPTKODXNMCGUTSUSBQC:70"}}],"del_contents":[{"Del":{"text":" let status = if let Ok((code, results, scan_report)) = result {","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:4785"}}]}},{"Replacement":{"inode":{"change":2,"pos":65},"path":"ci/src/main.rs","line":276,"ins":{"up_context":[{"change":6,"pos":4842027}],"down_context":[{"change":6,"pos":4842027}],"flag":"BLOCK","start":72,"end":119,"inode":{"change":2,"pos":65}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":6,"pos":4842027},"to":{"change":7,"start":4787,"end":4828},"introduced_by":7}],"inode":{"change":2,"pos":65}},"ins_contents":[{"Add":{"text":" scan_report: None,","pos":"77B2BMZA7P42LG3JWA2XCCOXB26Y36KIVWWPTKODXNMCGUTSUSBQC:118"}}],"del_contents":[{"Del":{"text":" scan_report,","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:4827"}}]}},{"Edit":{"inode":{"change":2,"pos":65},"path":"ci/src/main.rs","line":316,"atom":{"EdgeMap":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":11716},"to":{"change":7,"start":4877,"end":4880},"introduced_by":7},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":7,"pos":4880},"to":{"change":9,"start":325,"end":615},"introduced_by":9},{"previous":"","flag":"DELETED","from":{"change":9,"pos":615},"to":{"change":7,"start":5053,"end":5167},"introduced_by":9},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":7,"pos":5053},"to":{"change":7,"start":5053,"end":5167},"introduced_by":7},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":7,"pos":5167},"to":{"change":9,"start":616,"end":648},"introduced_by":9},{"previous":"","flag":"DELETED","from":{"change":9,"pos":648},"to":{"change":7,"start":5189,"end":5282},"introduced_by":9},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":7,"pos":5189},"to":{"change":7,"start":5189,"end":5282},"introduced_by":7},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":7,"pos":5282},"to":{"change":10,"start":4550,"end":4705},"introduced_by":10},{"previous":"","flag":"DELETED","from":{"change":10,"pos":4705},"to":{"change":7,"start":5282,"end":5374},"introduced_by":10},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":7,"pos":5282},"to":{"change":7,"start":5282,"end":5374},"introduced_by":7},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":7,"pos":5374},"to":{"change":9,"start":649,"end":823},"introduced_by":9},{"previous":"","flag":"DELETED","from":{"change":9,"pos":823},"to":{"change":7,"start":5689,"end":5862},"introduced_by":9},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":7,"pos":5689},"to":{"change":7,"start":5689,"end":5862},"introduced_by":7}],"inode":{"change":2,"pos":65}}},"contents":[{"Del":{"text":"}","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:4878"}},{"Del":{"text":"","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:4879"}},{"Del":{"text":"/// Lance un outil FIXE (analyseur) et capture `(stdout, stderr)` SÉPARÉMENT —","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:407"}},{"Del":{"text":"/// stdout est du JSON destiné au Nest, le mélanger au bruit de stderr le rendrait","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:492"}},{"Del":{"text":"/// illisible. `kill_on_drop` + select sur `kill_rx` pour rester interruptible.","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:572"}},{"Del":{"text":"/// None si l'outil n'a pas pu démarrer.","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:614"}},{"Del":{"text":"async fn run_capture(","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:5074"}},{"Del":{"text":" mut cmd: tokio::process::Command,","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:5112"}},{"Del":{"text":" kill_rx: &mut tokio::sync::oneshot::Receiver<()>,","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:5166"}},{"Del":{"text":") -> Option<(String, String)> {","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:647"}},{"Del":{"text":" cmd.stdin(Stdio::null())","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:5217"}},{"Del":{"text":" .stdout(Stdio::piped())","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:5249"}},{"Del":{"text":" .stderr(Stdio::piped())","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:5281"}},{"Del":{"text":" // Groupe de processus propre : `kill_on_drop` ne tue que le fils","pos":"NMJJPK5SGCT2MTSJHDZTFTLN4SNRPDIRGSAHEN6W2MORIHKNPUEAC:4623"}},{"Del":{"text":" // direct, or l'outil peut en lancer d'autres.","pos":"NMJJPK5SGCT2MTSJHDZTFTLN4SNRPDIRGSAHEN6W2MORIHKNPUEAC:4678"}},{"Del":{"text":" .process_group(0)","pos":"NMJJPK5SGCT2MTSJHDZTFTLN4SNRPDIRGSAHEN6W2MORIHKNPUEAC:4704"}},{"Del":{"text":" .kill_on_drop(true);","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:5310"}},{"Del":{"text":" tokio::select! {","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:5331"}},{"Del":{"text":" out = cmd.output() => match out {","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:5373"}},{"Del":{"text":" Ok(o) => Some((","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:676"}},{"Del":{"text":" String::from_utf8_lossy(&o.stdout).into_owned(),","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:741"}},{"Del":{"text":" String::from_utf8_lossy(&o.stderr).into_owned(),","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:806"}},{"Del":{"text":" )),","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:822"}},{"Del":{"text":" Err(e) => {","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:5712"}},{"Del":{"text":" debug!(\"scan tool failed to start: {:?}\", e);","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:5774"}},{"Del":{"text":" None","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:5795"}},{"Del":{"text":" }","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:5809"}},{"Del":{"text":" },","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:5820"}},{"Del":{"text":" _ = &mut *kill_rx => None,","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:5855"}},{"Del":{"text":" }","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:5861"}}]}},{"Edit":{"inode":{"change":2,"pos":65},"path":"ci/src/main.rs","line":324,"atom":{"EdgeMap":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":11855},"to":{"change":7,"start":5863,"end":5881},"introduced_by":7},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":7,"pos":5881},"to":{"change":13,"start":654,"end":687},"introduced_by":13}],"inode":{"change":2,"pos":65}}},"contents":[{"Del":{"text":" vulnix: bool,","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:5880"}},{"Del":{"text":" vulnix_mirror: Option<&str>,","pos":"6ZEMNMU3LBPUOQICRHOM2KIGB2QHQNB5GBCP4NJPMKOWYYX5GSQAC:686"}}]}},{"Replacement":{"inode":{"change":2,"pos":65},"path":"ci/src/main.rs","line":325,"ins":{"up_context":[{"change":5,"pos":148}],"down_context":[{"change":4,"pos":1929}],"flag":"BLOCK","start":120,"end":182,"inode":{"change":2,"pos":65}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":148},"to":{"change":7,"start":5882,"end":5960},"introduced_by":7}],"inode":{"change":2,"pos":65}},"ins_contents":[{"Add":{"text":") -> Result<(Option, HashMap), Error> {","pos":"77B2BMZA7P42LG3JWA2XCCOXB26Y36KIVWWPTKODXNMCGUTSUSBQC:181"}}],"del_contents":[{"Del":{"text":") -> Result<(Option, HashMap, Option), Error> {","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:5959"}}]}},{"Edit":{"inode":{"change":2,"pos":65},"path":"ci/src/main.rs","line":391,"atom":{"EdgeMap":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":7,"pos":6028},"to":{"change":7,"start":6028,"end":6464},"introduced_by":7},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":7,"pos":6464},"to":{"change":9,"start":824,"end":1251},"introduced_by":9},{"previous":"","flag":"DELETED","from":{"change":9,"pos":1251},"to":{"change":7,"start":6588,"end":6632},"introduced_by":9},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":7,"pos":6588},"to":{"change":7,"start":6588,"end":6632},"introduced_by":7},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":7,"pos":6701},"to":{"change":7,"start":6701,"end":6765},"introduced_by":7},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":7,"pos":6765},"to":{"change":9,"start":1252,"end":1291},"introduced_by":9},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":9,"pos":1291},"to":{"change":13,"start":688,"end":789},"introduced_by":13},{"previous":"","flag":"DELETED","from":{"change":13,"pos":789},"to":{"change":7,"start":6790,"end":6869},"introduced_by":13},{"previous":"","flag":"DELETED","from":{"change":9,"pos":1291},"to":{"change":7,"start":6790,"end":6869},"introduced_by":9},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":7,"pos":6790},"to":{"change":7,"start":6790,"end":6869},"introduced_by":7},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":7,"pos":6869},"to":{"change":9,"start":1292,"end":2401},"introduced_by":9},{"previous":"","flag":"DELETED","from":{"change":9,"pos":2401},"to":{"change":7,"start":7263,"end":7277},"introduced_by":9},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":7,"pos":7263},"to":{"change":7,"start":7263,"end":7277},"introduced_by":7},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":7,"pos":7277},"to":{"change":9,"start":2402,"end":2412},"introduced_by":9}],"inode":{"change":2,"pos":65}}},"contents":[{"Del":{"text":"","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:6028"}},{"Del":{"text":" // Scan vulnix optionnel, SUR l'hôte de build (cibles fraîchement réalisées","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:6116"}},{"Del":{"text":" // → sorties + graphe `.drv` présents, réseau dispo). C'est le seul scanner","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:6204"}},{"Del":{"text":" // ici : vulnix a besoin du store de build, contrairement à cargo-audit /","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:6287"}},{"Del":{"text":" // pnpm (source, cheap) qui tournent dans le script de déploiement. Binaire","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:6372"}},{"Del":{"text":" // FIXE du service (ci.nix), pas de code du dépôt. `-C` = clôture d'exécution.","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:6463"}},{"Del":{"text":" // Non bloquant. `--json` : sortie MACHINE (une entrée par dérivation, avec","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:909"}},{"Del":{"text":" // `affected_by` et `cvssv3_basescore`), que le Nest parse pour compter les","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:993"}},{"Del":{"text":" // vulnérabilités par sévérité et les afficher dans la liste des jobs.","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:1077"}},{"Del":{"text":" // `Status.scan_report` ne porte donc QUE ce JSON ; l'entête lisible et le","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:1161"}},{"Del":{"text":" // bruit de stderr ne vont qu'au log du job.","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:1214"}},{"Del":{"text":" let mut scan_report = None;","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:1250"}},{"Del":{"text":" if push_code == Some(0) && vulnix {","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:6631"}},{"Del":{"text":" let mut c = tokio::process::Command::new(\"vulnix\");","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:6764"}},{"Del":{"text":" c.arg(\"--json\").arg(\"-C\");","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:1290"}},{"Del":{"text":" if let Some(m) = vulnix_mirror {","pos":"6ZEMNMU3LBPUOQICRHOM2KIGB2QHQNB5GBCP4NJPMKOWYYX5GSQAC:732"}},{"Del":{"text":" c.arg(\"--mirror\").arg(m);","pos":"6ZEMNMU3LBPUOQICRHOM2KIGB2QHQNB5GBCP4NJPMKOWYYX5GSQAC:774"}},{"Del":{"text":" }","pos":"6ZEMNMU3LBPUOQICRHOM2KIGB2QHQNB5GBCP4NJPMKOWYYX5GSQAC:788"}},{"Del":{"text":" for p in result.values() {","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:6828"}},{"Del":{"text":" c.arg(p);","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:6854"}},{"Del":{"text":" }","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:6868"}},{"Del":{"text":" if let Some((stdout, stderr)) = run_capture(c, kill_rx).await {","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:1367"}},{"Del":{"text":" let mut log = String::from(\"== vulnix --json -C (closures bâties) ==\\n\");","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:1458"}},{"Del":{"text":" log.push_str(&stdout);","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:1497"}},{"Del":{"text":" if !stderr.is_empty() {","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:1537"}},{"Del":{"text":" log.push_str(\"\\n[stderr]\\n\");","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:1587"}},{"Del":{"text":" log.push_str(&stderr);","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:1630"}},{"Del":{"text":" }","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:1648"}},{"Del":{"text":" log.push('\\n');","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:1680"}},{"Del":{"text":" if let Some(ref mut file) = files {","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:1732"}},{"Del":{"text":" use tokio::io::AsyncWriteExt;","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:1782"}},{"Del":{"text":" file.write_all(log.as_bytes()).await?;","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:1841"}},{"Del":{"text":" file.flush().await?;","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:1882"}},{"Del":{"text":" }","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:1900"}},{"Del":{"text":" // Une sortie non-JSON (vulnix tué en cours, erreur de base CVE)","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:1982"}},{"Del":{"text":" // n'est pas une preuve exploitable : mieux vaut ne rien persister","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:2065"}},{"Del":{"text":" // qu'un rapport illisible dans une colonne write-once. Le log,","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:2145"}},{"Del":{"text":" // lui, garde la trace de ce qui s'est passé.","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:2208"}},{"Del":{"text":" let out = stdout.trim();","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:2249"}},{"Del":{"text":" if serde_json::from_str::(out).is_ok() {","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:2325"}},{"Del":{"text":" scan_report = Some(out.to_string());","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:2382"}},{"Del":{"text":" }","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:2400"}},{"Del":{"text":" }","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:7276"}},{"Del":{"text":" }","pos":"GGWQZTTKTFU7L5FSTWP2P22BF4Q2WGL47TKHRTHJCDJV5JMSP5XQC:2411"}}]}},{"Replacement":{"inode":{"change":2,"pos":65},"path":"ci/src/main.rs","line":392,"ins":{"up_context":[{"change":7,"pos":7314}],"down_context":[{"change":3,"pos":14173}],"flag":"BLOCK","start":183,"end":454,"inode":{"change":2,"pos":65}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":7,"pos":7314},"to":{"change":7,"start":7314,"end":7359},"introduced_by":7}],"inode":{"change":2,"pos":65}},"ins_contents":[{"Add":{"text":" // Plus de scan vulnix ici : le runner n'a pas accès au réseau, donc pas","pos":"77B2BMZA7P42LG3JWA2XCCOXB26Y36KIVWWPTKODXNMCGUTSUSBQC:265"}},{"Add":{"text":" // aux flux NVD. `Status.scan_report` reste dans le protocole (rapports","pos":"77B2BMZA7P42LG3JWA2XCCOXB26Y36KIVWWPTKODXNMCGUTSUSBQC:345"}},{"Add":{"text":" // déjà archivés, runners plus anciens) mais part toujours vide.","pos":"77B2BMZA7P42LG3JWA2XCCOXB26Y36KIVWWPTKODXNMCGUTSUSBQC:421"}},{"Add":{"text":" Ok((push_code, result))","pos":"77B2BMZA7P42LG3JWA2XCCOXB26Y36KIVWWPTKODXNMCGUTSUSBQC:453"}}],"del_contents":[{"Del":{"text":" Ok((push_code, result, scan_report))","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:7358"}}]}},{"Replacement":{"inode":{"change":2,"pos":65},"path":"ci/src/main.rs","line":397,"ins":{"up_context":[{"change":3,"pos":14186}],"down_context":[{"change":2,"pos":14578}],"flag":"BLOCK","start":455,"end":490,"inode":{"change":2,"pos":65}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":14186},"to":{"change":7,"start":7360,"end":7401},"introduced_by":7}],"inode":{"change":2,"pos":65}},"ins_contents":[{"Add":{"text":" Ok((code, HashMap::new()))","pos":"77B2BMZA7P42LG3JWA2XCCOXB26Y36KIVWWPTKODXNMCGUTSUSBQC:489"}}],"del_contents":[{"Del":{"text":" Ok((code, HashMap::new(), None))","pos":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC:7400"}}]}},{"Replacement":{"inode":{"change":2,"pos":14618},"path":"ci/src/lib.rs","line":28,"ins":{"up_context":[{"change":3,"pos":14703}],"down_context":[{"change":7,"pos":8135}],"flag":"BLOCK","start":491,"end":757,"inode":{"change":2,"pos":14618}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":14703},"to":{"change":11,"start":312,"end":722},"introduced_by":11}],"inode":{"change":2,"pos":14618}},"ins_contents":[{"Add":{"text":" /// vulnix scan requested by the Nest (`scan` / `scan_on_deploy`). IGNORED","pos":"77B2BMZA7P42LG3JWA2XCCOXB26Y36KIVWWPTKODXNMCGUTSUSBQC:569"}},{"Add":{"text":" /// by this runner: it has no network access, hence no NVD feeds, so it no","pos":"77B2BMZA7P42LG3JWA2XCCOXB26Y36KIVWWPTKODXNMCGUTSUSBQC:648"}},{"Add":{"text":" /// longer scans and always sends `Status.scan_report = None`. Kept for","pos":"77B2BMZA7P42LG3JWA2XCCOXB26Y36KIVWWPTKODXNMCGUTSUSBQC:724"}},{"Add":{"text":" /// protocol compatibility.","pos":"77B2BMZA7P42LG3JWA2XCCOXB26Y36KIVWWPTKODXNMCGUTSUSBQC:756"}}],"del_contents":[{"Del":{"text":" /// vulnix: scans the built CLOSURES (results) AFTER build+push. It is the","pos":"22HPCW6R66LDCNFTKV4JPDIKM55U7XP5CFMHYYN2TDPQVQ6ATBWAC:390"}},{"Del":{"text":" /// ONLY scanner here — it needs the build host (outputs + `.drv`). SOURCE","pos":"22HPCW6R66LDCNFTKV4JPDIKM55U7XP5CFMHYYN2TDPQVQ6ATBWAC:471"}},{"Del":{"text":" /// scans (cargo-audit / pnpm audit) are cheap and run in the deployment","pos":"22HPCW6R66LDCNFTKV4JPDIKM55U7XP5CFMHYYN2TDPQVQ6ATBWAC:548"}},{"Del":{"text":" /// script, not here. FIXED binary of the service (see ci.nix), no code from","pos":"22HPCW6R66LDCNFTKV4JPDIKM55U7XP5CFMHYYN2TDPQVQ6ATBWAC:629"}},{"Del":{"text":" /// the repository is run. Output captured in Status.scan_report.","pos":"22HPCW6R66LDCNFTKV4JPDIKM55U7XP5CFMHYYN2TDPQVQ6ATBWAC:699"}},{"Del":{"text":" /// Non-blocking.","pos":"22HPCW6R66LDCNFTKV4JPDIKM55U7XP5CFMHYYN2TDPQVQ6ATBWAC:721"}}]}}],"owner":"pijul","repo":"nest","login":null}

…

Dependencies

Change contents

Review