{"header":{"message":"Audits CI-side","description":null,"timestamp":"2026-07-24T04:53:46.782167267Z","authors":[{}]},"hash":"FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC","authors":[{"login":"pmeunier","key":"AAAAC3NzaC1lZDI1NTE5AAAAILagOJFgwaMNhBWQINinKOXmqS4Gh5NgxgriXwdOoINJ"}],"deps":{"hashes":[["FU37JBX4JISRV26VYEMLU3LZ67CVTUO62JP6H6SO6P2RAIIHRUMAC","Audits CI-side"],["AA",null],["D4SBRY6KHEAMGUEVWSUYHNCRYXCOC5JJ3N3DQ47ZXOXQGT73VERAC","Initial patch"],["YJLEG4WRYKKQJMMDRKIRG4T4L7ZZ7N777EKIRSHHWHNZYWZJ7G5AC","Basic CI infra (no runner yet)"],["YYJ76Q7V6G7FHSNZ25MU3ZZY5KGXIODBHLWOZUGB4FIKL7PUCNAAC","Initial attempt at CI/CD"],["PCR2LDLTK6XVSBXJL6IMGQP7GSE5UNFCT6WRM2H5EPQ2AZWFRCFAC","update + CI"],["OA64RZOMOMELKGZE4MKMBJH6E6WE7BMP7OZHWQCZENSUZZ2ISXFQC","Debugging jobs synchronisation between builder and main"],["D4OFR55J32745WILDBAYROEZNRTIFG7VGQTOYSXO4CAB7K55RG5QC","CI: keeping track of status"],["ORCJ7RGZ67ULJKZ66PBIZBLSCUJ7LJ6EEKXAOYJUJPBZWM5A75FQC","jobs: send the right thing immediately"],["AX7NN2MQXFV32SW32M2NKYGSLA775AWFIWUWX3R5YAMPG32HMZMQC","Redesign (fat change)"],["IS5JL73JHDDJQGGGYBUUJNEBFT3STOKGB7V33M6J44CB2TPOVPXQC","Avoid saving the result"]],"deps":["D4SBRY6KHEAMGUEVWSUYHNCRYXCOC5JJ3N3DQ47ZXOXQGT73VERAC","YJLEG4WRYKKQJMMDRKIRG4T4L7ZZ7N777EKIRSHHWHNZYWZJ7G5AC","YYJ76Q7V6G7FHSNZ25MU3ZZY5KGXIODBHLWOZUGB4FIKL7PUCNAAC","PCR2LDLTK6XVSBXJL6IMGQP7GSE5UNFCT6WRM2H5EPQ2AZWFRCFAC","OA64RZOMOMELKGZE4MKMBJH6E6WE7BMP7OZHWQCZENSUZZ2ISXFQC","D4OFR55J32745WILDBAYROEZNRTIFG7VGQTOYSXO4CAB7K55RG5QC","ORCJ7RGZ67ULJKZ66PBIZBLSCUJ7LJ6EEKXAOYJUJPBZWM5A75FQC","AX7NN2MQXFV32SW32M2NKYGSLA775AWFIWUWX3R5YAMPG32HMZMQC"],"known":["IS5JL73JHDDJQGGGYBUUJNEBFT3STOKGB7V33M6J44CB2TPOVPXQC"]},"hunks":[{"Edit":{"inode":{"change":4,"pos":3476},"path":"ui/src/routes/[user]/[repo]/jobs/[job]/+page.ts","line":23,"atom":{"NewVertex":{"up_context":[{"change":9,"pos":4738948}],"down_context":[{"change":9,"pos":4738948}],"flag":"BLOCK","start":0,"end":43,"inode":{"change":4,"pos":3476}}},"contents":[{"Add":" scan_report: data.scan_report ?? null,"}]}},{"Edit":{"inode":{"change":4,"pos":3950},"path":"ui/src/routes/[user]/[repo]/jobs/[job]/+page.svelte","line":364,"atom":{"NewVertex":{"up_context":[{"change":4,"pos":5799}],"down_context":[{"change":4,"pos":5864}],"flag":"BLOCK","start":44,"end":360,"inode":{"change":4,"pos":3950}}},"contents":[{"Add":""},{"Add":" {#if data.scan_report}"},{"Add":"

Security scan

"},{"Add":"

"},{"Add":" Vulnerability scan attached to this deployment (SMSI evidence — retained,"},{"Add":" tamper-protected)."},{"Add":"

"},{"Add":"

{data.scan_report}

"},{"Add":" {/if}"}]}},{"Edit":{"inode":{"change":4,"pos":3950},"path":"ui/src/routes/[user]/[repo]/jobs/[job]/+page.svelte","line":487,"atom":{"NewVertex":{"up_context":[{"change":9,"pos":4751957}],"down_context":[{"change":9,"pos":4751957}],"flag":"BLOCK","start":361,"end":786,"inode":{"change":4,"pos":3950}}},"contents":[{"Add":" }"},{"Add":""},{"Add":" .scan-pre {"},{"Add":" margin-top: 0.5rem;"},{"Add":" padding: 0.75rem;"},{"Add":" max-height: 400px;"},{"Add":" overflow: auto;"},{"Add":" white-space: pre-wrap;"},{"Add":" word-break: break-word;"},{"Add":" font-family: 'Iosevka Term', 'Terminus', ui-monospace, monospace;"},{"Add":" font-size: 12.5px;"},{"Add":" line-height: 1.4;"},{"Add":" background: var(--term-bg, #0a0e13);"},{"Add":" color: var(--term-fg, #c9d1d9);"},{"Add":" border: 1px solid var(--term-border, oklch(72% 0.18 155 / 0.35));"}]}},{"Edit":{"inode":{"change":2,"pos":104971},"path":"ui/src/routes/[user]/[repo]/admin/+page.svelte","line":109,"atom":{"NewVertex":{"up_context":[{"change":9,"pos":4800732}],"down_context":[{"change":9,"pos":4800732}],"flag":"BLOCK","start":787,"end":956,"inode":{"change":2,"pos":104971}}},"contents":[{"Add":" "},{"Add":" scan"},{"Add":" "}]}},{"Edit":{"inode":{"change":2,"pos":104971},"path":"ui/src/routes/[user]/[repo]/admin/+page.svelte","line":126,"atom":{"NewVertex":{"up_context":[{"change":9,"pos":4801400}],"down_context":[{"change":9,"pos":4801400}],"flag":"BLOCK","start":957,"end":1118,"inode":{"change":2,"pos":104971}}},"contents":[{"Add":" "},{"Add":"

"},{"Add":" "}]}},{"Edit":{"inode":{"change":2,"pos":104971},"path":"ui/src/routes/[user]/[repo]/admin/+page.svelte","line":166,"atom":{"NewVertex":{"up_context":[{"change":9,"pos":4802805}],"down_context":[{"change":9,"pos":4802805}],"flag":"BLOCK","start":1119,"end":1247,"inode":{"change":2,"pos":104971}}},"contents":[{"Add":"

"},{"Add":" "},{"Add":"

"}]}},{"Replacement":{"inode":{"change":2,"pos":104971},"path":"ui/src/routes/[user]/[repo]/admin/+page.svelte","line":233,"ins":{"up_context":[{"change":9,"pos":4804306}],"down_context":[{"change":9,"pos":4804355}],"flag":"BLOCK","start":1248,"end":1304,"inode":{"change":2,"pos":104971}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":9,"pos":4804306},"to":{"change":9,"start":4804306,"end":4804355},"introduced_by":9}],"inode":{"change":2,"pos":104971}},"ins_contents":[{"Add":" grid-template-columns: 1fr 2.5rem 2.5rem 4rem auto;"}],"del_contents":[{"Del":" grid-template-columns: 1fr 2.5rem 4rem auto;\n"}]}},{"Edit":{"inode":{"change":2,"pos":104971},"path":"ui/src/routes/[user]/[repo]/admin/+page.svelte","line":237,"atom":{"NewVertex":{"up_context":[{"change":9,"pos":4804371}],"down_context":[{"change":9,"pos":4804371}],"flag":"BLOCK","start":1305,"end":1318,"inode":{"change":2,"pos":104971}}},"contents":[{"Add":" .scan-hdr,"}]}},{"Edit":{"inode":{"change":2,"pos":104971},"path":"ui/src/routes/[user]/[repo]/admin/+page.svelte","line":243,"atom":{"NewVertex":{"up_context":[{"change":9,"pos":4804425}],"down_context":[{"change":9,"pos":4804425}],"flag":"BLOCK","start":1319,"end":1333,"inode":{"change":2,"pos":104971}}},"contents":[{"Add":" .scan-cell,"}]}},{"Edit":{"inode":{"change":9,"pos":84953},"path":"ui/src/lib/bindings/JobDetailResponse.ts","line":10,"atom":{"NewVertex":{"up_context":[{"change":9,"pos":85221}],"down_context":[{"change":9,"pos":85221}],"flag":"BLOCK","start":1334,"end":1364,"inode":{"change":9,"pos":84953}}},"contents":[{"Add":" scan_report: string | null;"}]}},{"Edit":{"inode":{"change":9,"pos":88479},"path":"ui/src/lib/bindings/ChannelSetting.ts","line":7,"atom":{"NewVertex":{"up_context":[{"change":9,"pos":88689}],"down_context":[{"change":9,"pos":88689}],"flag":"BLOCK","start":1365,"end":1392,"inode":{"change":9,"pos":88479}}},"contents":[{"Add":" scan_on_deploy: boolean;"}]}},{"FileAdd":{"meta":{"basename":"2026-07-23-000001-0000_channel_scan_on_deploy","metadata":576},"context":[{"change":2,"pos":297727}],"contents":[]}},{"FileAdd":{"meta":{"basename":"up.sql","metadata":0},"context":[{"change":0,"pos":1450}],"contents":[{"Add":"-- Politique par CANAL : « scanner les vulnérabilités à chaque déploiement de ce"},{"Add":"-- canal ». Gouvernée par les admins (comme ci_enabled), donc INDÉPENDANTE de ce"},{"Add":"-- que les développeurs mettent dans le dépôt → séparation des tâches (ISO 27001)."},{"Add":"ALTER TABLE channel_settings ADD COLUMN scan_on_deploy BOOLEAN NOT NULL DEFAULT false;"},{"Add":""},{"Add":"GRANT ALL PRIVILEGES ON channel_settings TO pijul;"}]}},{"FileAdd":{"meta":{"basename":"down.sql","metadata":0},"context":[{"change":0,"pos":1450}],"contents":[{"Add":"ALTER TABLE channel_settings DROP COLUMN scan_on_deploy;"}]}},{"FileAdd":{"meta":{"basename":"2026-07-23-000000-0000_job_scan_report","metadata":576},"context":[{"change":2,"pos":297727}],"contents":[]}},{"FileAdd":{"meta":{"basename":"up.sql","metadata":0},"context":[{"change":0,"pos":2026}],"contents":[{"Add":"-- Rapport de scan de vulnérabilités (cargo-audit + pnpm audit + vulnix) attaché"},{"Add":"-- au job CI qui l'a produit. C'est une PREUVE SMSI : durable (pas un log rotatif)"},{"Add":"-- et défendable, donc on la protège au niveau du SGBD."},{"Add":"ALTER TABLE jobs ADD COLUMN scan_report TEXT;"},{"Add":""},{"Add":"GRANT ALL PRIVILEGES ON jobs TO pijul;"},{"Add":""},{"Add":"-- Durée de rétention des preuves de scan : SOURCE DE VÉRITÉ UNIQUE. Définie ici"},{"Add":"-- une seule fois ; utilisée par le trigger ci-dessous ET lue par l'ISMS"},{"Add":"-- (Coturnix/iso27001, générateur smsi_scan_retention.py) qui la DÉRIVE de cette"},{"Add":"-- migration → pas de dérive entre la doc et l'infra. Vérifiable aussi en prod :"},{"Add":"-- `SELECT smsi_scan_report_retention();`."},{"Add":"-- >>> ISMS-RETENTION: 3 years <<< (marqueur stable parsé par l'ISMS)"},{"Add":"CREATE OR REPLACE FUNCTION smsi_scan_report_retention() RETURNS interval"},{"Add":" LANGUAGE sql IMMUTABLE AS $$ SELECT INTERVAL '3 years' $$;"},{"Add":""},{"Add":"-- « Clause de non-altération » (rétention SMSI) : une fois écrit, un scan_report"},{"Add":"-- ne peut plus être MODIFIÉ (write-once), et le job qui le porte ne peut pas être"},{"Add":"-- SUPPRIMÉ tant que la durée de rétention n'est pas écoulée. La première écriture"},{"Add":"-- (NULL → valeur) et les updates qui ne touchent pas la colonne (ended, status,"},{"Add":"-- last_heartbeat, results) restent autorisés."},{"Add":"CREATE OR REPLACE FUNCTION jobs_scan_report_guard() RETURNS trigger AS $$"},{"Add":"BEGIN"},{"Add":" IF TG_OP = 'UPDATE' THEN"},{"Add":" IF OLD.scan_report IS NOT NULL"},{"Add":" AND NEW.scan_report IS DISTINCT FROM OLD.scan_report THEN"},{"Add":" RAISE EXCEPTION"},{"Add":" 'scan_report est une preuve SMSI write-once et ne peut être modifiée (job %)',"},{"Add":" OLD.id;"},{"Add":" END IF;"},{"Add":" RETURN NEW;"},{"Add":" ELSIF TG_OP = 'DELETE' THEN"},{"Add":" IF OLD.scan_report IS NOT NULL"},{"Add":" AND OLD.started > now() - smsi_scan_report_retention() THEN"},{"Add":" RAISE EXCEPTION"},{"Add":" 'job % porte une preuve de scan SMSI dans sa fenêtre de rétention et ne peut être supprimé',"},{"Add":" OLD.id;"},{"Add":" END IF;"},{"Add":" RETURN OLD;"},{"Add":" END IF;"},{"Add":" RETURN NULL;"},{"Add":"END;"},{"Add":"$$ LANGUAGE plpgsql;"},{"Add":""},{"Add":"CREATE TRIGGER jobs_scan_report_guard"},{"Add":" BEFORE UPDATE OR DELETE ON jobs"},{"Add":" FOR EACH ROW EXECUTE FUNCTION jobs_scan_report_guard();"}]}},{"FileAdd":{"meta":{"basename":"down.sql","metadata":0},"context":[{"change":0,"pos":2026}],"contents":[{"Add":"DROP TRIGGER IF EXISTS jobs_scan_report_guard ON jobs;"},{"Add":"DROP FUNCTION IF EXISTS jobs_scan_report_guard();"},{"Add":"DROP FUNCTION IF EXISTS smsi_scan_report_retention();"},{"Add":"ALTER TABLE jobs DROP COLUMN scan_report;"}]}},{"Edit":{"inode":{"change":9,"pos":4686340},"path":"ci.nix","line":57,"atom":{"NewVertex":{"up_context":[{"change":9,"pos":4687432}],"down_context":[{"change":9,"pos":4687432}],"flag":"BLOCK","start":4432,"end":4678,"inode":{"change":9,"pos":4686340}}},"contents":[{"Add":" # Seul scanner du CI : vulnix (a besoin des sorties + `.drv` de build)."},{"Add":" # Binaire FIXE, jamais de code du dépôt. cargo-audit / pnpm audit (source,"},{"Add":" # cheap) tournent côté script de déploiement, pas ici."},{"Add":" vulnix"}]}},{"Edit":{"inode":{"change":3,"pos":65},"path":"ci/src/main.rs","line":219,"atom":{"NewVertex":{"up_context":[{"change":9,"pos":4841329}],"down_context":[{"change":9,"pos":4841329}],"flag":"BLOCK","start":4679,"end":4701,"inode":{"change":3,"pos":65}}},"contents":[{"Add":" t.vulnix,"}]}},{"Replacement":{"inode":{"change":3,"pos":65},"path":"ci/src/main.rs","line":233,"ins":{"up_context":[{"change":9,"pos":4841794}],"down_context":[{"change":9,"pos":4841865}],"flag":"BLOCK","start":4702,"end":4786,"inode":{"change":3,"pos":65}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":9,"pos":4841794},"to":{"change":9,"start":4841794,"end":4841865},"introduced_by":9}],"inode":{"change":3,"pos":65}},"ins_contents":[{"Add":" let status = if let Ok((code, results, scan_report)) = result {"}],"del_contents":[{"Del":" let status = if let Ok((code, results)) = result {\n"}]}},{"Edit":{"inode":{"change":3,"pos":65},"path":"ci/src/main.rs","line":238,"atom":{"NewVertex":{"up_context":[{"change":9,"pos":4842027}],"down_context":[{"change":9,"pos":4842027}],"flag":"BLOCK","start":4787,"end":4828,"inode":{"change":3,"pos":65}}},"contents":[{"Add":" scan_report,"}]}},{"Edit":{"inode":{"change":3,"pos":65},"path":"ci/src/main.rs","line":245,"atom":{"NewVertex":{"up_context":[{"change":9,"pos":4842266}],"down_context":[{"change":9,"pos":4842266}],"flag":"BLOCK","start":4829,"end":4876,"inode":{"change":3,"pos":65}}},"contents":[{"Add":" scan_report: None,"}]}},{"Edit":{"inode":{"change":3,"pos":65},"path":"ci/src/main.rs","line":278,"atom":{"NewVertex":{"up_context":[{"change":5,"pos":11716}],"down_context":[{"change":3,"pos":13633}],"flag":"BLOCK","start":4877,"end":5862,"inode":{"change":3,"pos":65}}},"contents":[{"Add":"}"},{"Add":""},{"Add":"/// Lance un outil FIXE (analyseur) et capture stdout+stderr. `kill_on_drop` +"},{"Add":"/// select sur `kill_rx` pour rester interruptible. None si l'outil n'a pas pu"},{"Add":"/// démarrer."},{"Add":"async fn run_capture("},{"Add":" mut cmd: tokio::process::Command,"},{"Add":" kill_rx: &mut tokio::sync::oneshot::Receiver<()>,"},{"Add":") -> Option {"},{"Add":" cmd.stdin(Stdio::null())"},{"Add":" .stdout(Stdio::piped())"},{"Add":" .stderr(Stdio::piped())"},{"Add":" .kill_on_drop(true);"},{"Add":" tokio::select! {"},{"Add":" out = cmd.output() => match out {"},{"Add":" Ok(o) => {"},{"Add":" let mut s = String::from_utf8_lossy(&o.stdout).into_owned();"},{"Add":" if !o.stderr.is_empty() {"},{"Add":" s.push_str(\"\\n[stderr]\\n\");"},{"Add":" s.push_str(&String::from_utf8_lossy(&o.stderr));"},{"Add":" }"},{"Add":" Some(s)"},{"Add":" }"},{"Add":" Err(e) => {"},{"Add":" debug!(\"scan tool failed to start: {:?}\", e);"},{"Add":" None"},{"Add":" }"},{"Add":" },"},{"Add":" _ = &mut *kill_rx => None,"},{"Add":" }"}]}},{"Edit":{"inode":{"change":3,"pos":65},"path":"ci/src/main.rs","line":316,"atom":{"NewVertex":{"up_context":[{"change":5,"pos":11855}],"down_context":[{"change":7,"pos":94}],"flag":"BLOCK","start":5863,"end":5881,"inode":{"change":3,"pos":65}}},"contents":[{"Add":" vulnix: bool,"}]}},{"Replacement":{"inode":{"change":3,"pos":65},"path":"ci/src/main.rs","line":318,"ins":{"up_context":[{"change":7,"pos":148}],"down_context":[{"change":6,"pos":1929}],"flag":"BLOCK","start":5882,"end":5960,"inode":{"change":3,"pos":65}},"del":{"edges":[{"previous":"","flag":"DELETED","from":{"change":7,"pos":148},"to":{"change":5,"start":11968,"end":12030},"introduced_by":7},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":11968},"to":{"change":5,"start":11968,"end":12030},"introduced_by":5}],"inode":{"change":3,"pos":65}},"ins_contents":[{"Add":") -> Result<(Option, HashMap, Option), Error> {"}],"del_contents":[{"Del":") -> Result<(Option, HashMap), Error> {\n"}]}},{"Replacement":{"inode":{"change":3,"pos":65},"path":"ci/src/main.rs","line":379,"ins":{"up_context":[{"change":5,"pos":14053}],"down_context":[{"change":5,"pos":14173}],"flag":"BLOCK","start":5961,"end":7359,"inode":{"change":3,"pos":65}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":14053},"to":{"change":7,"start":208,"end":272},"introduced_by":7}],"inode":{"change":3,"pos":65}},"ins_contents":[{"Add":" let push_code = dump_cmd(cmd, &mut files, kill_rx).await?;"},{"Add":""},{"Add":" // Scan vulnix optionnel, SUR l'hôte de build (cibles fraîchement réalisées"},{"Add":" // → sorties + graphe `.drv` présents, réseau dispo). C'est le seul scanner"},{"Add":" // ici : vulnix a besoin du store de build, contrairement à cargo-audit /"},{"Add":" // pnpm (source, cheap) qui tournent dans le script de déploiement. Binaire"},{"Add":" // FIXE du service (ci.nix), pas de code du dépôt. `-C` = clôture d'exécution."},{"Add":" // Sortie capturée (Status.scan_report) et recopiée au log. Non bloquant."},{"Add":" let mut report = String::new();"},{"Add":" if push_code == Some(0) && vulnix {"},{"Add":" report.push_str(\"== vulnix -C (closures bâties) ==\\n\");"},{"Add":" let mut c = tokio::process::Command::new(\"vulnix\");"},{"Add":" c.arg(\"-C\");"},{"Add":" for p in result.values() {"},{"Add":" c.arg(p);"},{"Add":" }"},{"Add":" report.push_str(&run_capture(c, kill_rx).await.unwrap_or_default());"},{"Add":" report.push('\\n');"},{"Add":" }"},{"Add":" let scan_report = if report.is_empty() {"},{"Add":" None"},{"Add":" } else {"},{"Add":" if let Some(ref mut file) = files {"},{"Add":" use tokio::io::AsyncWriteExt;"},{"Add":" file.write_all(report.as_bytes()).await?;"},{"Add":" file.flush().await?;"},{"Add":" }"},{"Add":" Some(report)"},{"Add":" };"},{"Add":""},{"Add":" Ok((push_code, result, scan_report))"}],"del_contents":[{"Del":" Ok((dump_cmd(cmd, &mut files, kill_rx).await?, result))\n"}]}},{"Replacement":{"inode":{"change":3,"pos":65},"path":"ci/src/main.rs","line":411,"ins":{"up_context":[{"change":5,"pos":14186}],"down_context":[{"change":3,"pos":14578}],"flag":"BLOCK","start":7360,"end":7401,"inode":{"change":3,"pos":65}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":14186},"to":{"change":5,"start":14186,"end":14221},"introduced_by":5}],"inode":{"change":3,"pos":65}},"ins_contents":[{"Add":" Ok((code, HashMap::new(), None))"}],"del_contents":[{"Del":" Ok((code, HashMap::new()))\n"}]}},{"Edit":{"inode":{"change":3,"pos":14618},"path":"ci/src/lib.rs","line":11,"atom":{"NewVertex":{"up_context":[{"change":5,"pos":14505}],"down_context":[{"change":5,"pos":14505}],"flag":"BLOCK","start":7402,"end":7705,"inode":{"change":3,"pos":14618}}},"contents":[{"Add":" /// Sortie du scan de vulnérabilités (`nix run .#audit -- `) quand le"},{"Add":" /// trigger a demandé `scan`. Persistée comme preuve SMSI côté Nest. `default`"},{"Add":" /// pour rester compatible avec les anciens payloads sans ce champ."},{"Add":" #[serde(default)]"},{"Add":" pub scan_report: Option,"}]}},{"Edit":{"inode":{"change":3,"pos":14618},"path":"ci/src/lib.rs","line":27,"atom":{"NewVertex":{"up_context":[{"change":5,"pos":14703}],"down_context":[{"change":9,"pos":4843094}],"flag":"BLOCK","start":7706,"end":8179,"inode":{"change":3,"pos":14618}}},"contents":[{"Add":" /// vulnix : scanne les CLOSURES bâties (résultats) APRÈS build+push. C'est le"},{"Add":" /// SEUL scanner ici — il a besoin de l'hôte de build (sorties + `.drv`). Les"},{"Add":" /// scans de SOURCE (cargo-audit / pnpm audit) sont cheap et tournent dans le"},{"Add":" /// script de déploiement, pas ici. Binaire FIXE du service (cf. ci.nix), aucun"},{"Add":" /// code du dépôt exécuté. Sortie capturée dans Status.scan_report. Non bloquant."},{"Add":" #[serde(default)]"},{"Add":" pub vulnix: bool,"}]}},{"Edit":{"inode":{"change":2,"pos":424301},"path":"api/src/repository/admin.rs","line":51,"atom":{"NewVertex":{"up_context":[{"change":9,"pos":4895737}],"down_context":[{"change":2,"pos":425338}],"flag":"BLOCK","start":8180,"end":8369,"inode":{"change":2,"pos":424301}}},"contents":[{"Add":" /// Politique de veille : scanner les vulnérabilités à chaque déploiement de"},{"Add":" /// ce canal (option `scan` du trigger CI). Gouverné par les admins."},{"Add":" pub scan_on_deploy: bool,"}]}},{"Replacement":{"inode":{"change":2,"pos":424301},"path":"api/src/repository/admin.rs","line":134,"ins":{"up_context":[{"change":9,"pos":4896690}],"down_context":[{"change":9,"pos":4896810}],"flag":"BLOCK","start":8370,"end":8575,"inode":{"change":2,"pos":424301}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":9,"pos":4896690},"to":{"change":9,"start":4896690,"end":4896810},"introduced_by":9}],"inode":{"change":2,"pos":424301}},"ins_contents":[{"Add":" .select(("},{"Add":" cs::channel,"},{"Add":" cs::ci_enabled,"},{"Add":" cs::min_signatures,"},{"Add":" cs::scan_on_deploy,"},{"Add":" ))"},{"Add":" .get_results::<(String, bool, i32, bool)>(&mut db)"}],"del_contents":[{"Del":" .select((cs::channel, cs::ci_enabled, cs::min_signatures))\n .get_results::<(String, bool, i32)>(&mut db)\n"}]}},{"Replacement":{"inode":{"change":2,"pos":424301},"path":"api/src/repository/admin.rs","line":143,"ins":{"up_context":[{"change":9,"pos":4896847}],"down_context":[{"change":9,"pos":4897001}],"flag":"BLOCK","start":8576,"end":8817,"inode":{"change":2,"pos":424301}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":9,"pos":4896847},"to":{"change":9,"start":4896847,"end":4897001},"introduced_by":9}],"inode":{"change":2,"pos":424301}},"ins_contents":[{"Add":" .map("},{"Add":" |(channel, ci_enabled, min_signatures, scan_on_deploy)| ChannelSetting {"},{"Add":" channel,"},{"Add":" ci_enabled,"},{"Add":" min_signatures,"},{"Add":" scan_on_deploy,"},{"Add":" },"},{"Add":" )"}],"del_contents":[{"Del":" .map(|(channel, ci_enabled, min_signatures)| ChannelSetting {\n channel,\n ci_enabled,\n min_signatures,\n })\n"}]}},{"Edit":{"inode":{"change":2,"pos":424301},"path":"api/src/repository/admin.rs","line":344,"atom":{"NewVertex":{"up_context":[{"change":9,"pos":4898829}],"down_context":[{"change":9,"pos":4898829}],"flag":"BLOCK","start":8818,"end":8866,"inode":{"change":2,"pos":424301}}},"contents":[{"Add":" #[serde(default)]"},{"Add":" scan_on_deploy: bool,"}]}},{"Edit":{"inode":{"change":2,"pos":424301},"path":"api/src/repository/admin.rs","line":376,"atom":{"NewVertex":{"up_context":[{"change":9,"pos":4899719}],"down_context":[{"change":9,"pos":4899719}],"flag":"BLOCK","start":8867,"end":8923,"inode":{"change":2,"pos":424301}}},"contents":[{"Add":" cs::scan_on_deploy.eq(form.scan_on_deploy),"}]}},{"Edit":{"inode":{"change":2,"pos":424301},"path":"api/src/repository/admin.rs","line":383,"atom":{"NewVertex":{"up_context":[{"change":9,"pos":4899937}],"down_context":[{"change":9,"pos":4899937}],"flag":"BLOCK","start":8924,"end":8989,"inode":{"change":2,"pos":424301}}},"contents":[{"Add":" cs::scan_on_deploy.eq(excluded(cs::scan_on_deploy)),"}]}},{"Replacement":{"inode":{"change":2,"pos":431834},"path":"api/src/replication.rs","line":354,"ins":{"up_context":[{"change":9,"pos":4908331}],"down_context":[{"change":9,"pos":4908368}],"flag":"BLOCK","start":8990,"end":9053,"inode":{"change":2,"pos":431834}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":9,"pos":4908331},"to":{"change":9,"start":4908331,"end":4908368},"introduced_by":9}],"inode":{"change":2,"pos":431834}},"ins_contents":[{"Add":" let (ci_enabled, scan_on_deploy): (bool, bool) = {"}],"del_contents":[{"Del":" let ci_enabled: bool = {\n"}]}},{"Replacement":{"inode":{"change":2,"pos":431834},"path":"api/src/replication.rs","line":362,"ins":{"up_context":[{"change":9,"pos":4908739}],"down_context":[{"change":9,"pos":4908832}],"flag":"BLOCK","start":9054,"end":9177,"inode":{"change":2,"pos":431834}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":9,"pos":4908739},"to":{"change":9,"start":4908739,"end":4908832},"introduced_by":9}],"inode":{"change":2,"pos":431834}},"ins_contents":[{"Add":" .select((cs::ci_enabled, cs::scan_on_deploy))"},{"Add":" .get_result::<(bool, bool)>(&mut db)"}],"del_contents":[{"Del":" .select(cs::ci_enabled)\n .get_result::(&mut db)\n"}]}},{"Replacement":{"inode":{"change":2,"pos":431834},"path":"api/src/replication.rs","line":365,"ins":{"up_context":[{"change":9,"pos":4908859}],"down_context":[{"change":9,"pos":4908897}],"flag":"BLOCK","start":9178,"end":9225,"inode":{"change":2,"pos":431834}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":9,"pos":4908859},"to":{"change":9,"start":4908859,"end":4908897},"introduced_by":9}],"inode":{"change":2,"pos":431834}},"ins_contents":[{"Add":" .unwrap_or((false, false))"}],"del_contents":[{"Del":" .unwrap_or(false)\n"}]}},{"Edit":{"inode":{"change":2,"pos":431834},"path":"api/src/replication.rs","line":414,"atom":{"NewVertex":{"up_context":[{"change":9,"pos":4911009}],"down_context":[{"change":9,"pos":4911009}],"flag":"BLOCK","start":9226,"end":9521,"inode":{"change":2,"pos":431834}}},"contents":[{"Add":" // Politique par canal (channel_settings.scan_on_deploy,"},{"Add":" // gouvernée par les admins) : scanne (vulnix) CHAQUE"},{"Add":" // déploiement auto de ce canal si activée. ISO 27001 A.8.8."},{"Add":" vulnix: scan_on_deploy,"}]}},{"Edit":{"inode":{"change":4,"pos":32096},"path":"api/src/jobs.rs","line":154,"atom":{"NewVertex":{"up_context":[{"change":9,"pos":4944811}],"down_context":[{"change":4,"pos":34736}],"flag":"BLOCK","start":9522,"end":9727,"inode":{"change":4,"pos":32096}}},"contents":[{"Add":" /// Rapport de scan de vulnérabilités (preuve SMSI) attaché au job, s'il y en"},{"Add":" /// a un. Présenté à l'auditeur dans la page du job — pas besoin de psql."},{"Add":" pub scan_report: Option,"}]}},{"Edit":{"inode":{"change":4,"pos":32096},"path":"api/src/jobs.rs","line":206,"atom":{"NewVertex":{"up_context":[{"change":8,"pos":677}],"down_context":[{"change":9,"pos":4945003}],"flag":"BLOCK","start":9728,"end":9970,"inode":{"change":4,"pos":32096}}},"contents":[{"Add":" let scan_report: Option = jobs::jobs"},{"Add":" .find(path.job_id)"},{"Add":" .select(jobs::scan_report)"},{"Add":" .get_result::>(&mut db)"},{"Add":" .await"},{"Add":" .optional()?"},{"Add":" .flatten();"}]}},{"Edit":{"inode":{"change":4,"pos":32096},"path":"api/src/jobs.rs","line":221,"atom":{"NewVertex":{"up_context":[{"change":9,"pos":4945193}],"down_context":[{"change":9,"pos":4945193}],"flag":"BLOCK","start":9971,"end":10000,"inode":{"change":4,"pos":32096}}},"contents":[{"Add":" scan_report,"}]}},{"Edit":{"inode":{"change":4,"pos":32096},"path":"api/src/jobs.rs","line":232,"atom":{"NewVertex":{"up_context":[{"change":9,"pos":4945300}],"down_context":[{"change":4,"pos":35884}],"flag":"BLOCK","start":10001,"end":10203,"inode":{"change":4,"pos":32096}}},"contents":[{"Add":" /// Coche « lancer aussi le scan de vulnérabilités » (envoyer `scan=true`)."},{"Add":" /// `default` : les soumissions existantes (sans ce champ) restent valides."},{"Add":" #[serde(default)]"},{"Add":" scan: bool,"}]}},{"Edit":{"inode":{"change":4,"pos":32096},"path":"api/src/jobs.rs","line":328,"atom":{"NewVertex":{"up_context":[{"change":9,"pos":4947890}],"down_context":[{"change":9,"pos":4947890}],"flag":"BLOCK","start":10204,"end":10860,"inode":{"change":4,"pos":32096}}},"contents":[{"Add":" // Politique par canal (gouvernée par les admins) OU coche manuelle du"},{"Add":" // formulaire de retry : l'un ou l'autre force le scan."},{"Add":" let scan_on_deploy: bool = {"},{"Add":" use crate::db::channel_settings::dsl as cs;"},{"Add":" let mut db = config.db.get().await?;"},{"Add":" cs::channel_settings"},{"Add":" .filter(cs::repo_id.eq(repo))"},{"Add":" .filter(cs::channel.eq(&channel))"},{"Add":" .select(cs::scan_on_deploy)"},{"Add":" .get_result::(&mut db)"},{"Add":" .await"},{"Add":" .unwrap_or(false)"},{"Add":" };"},{"Add":" // Politique admin OU coche manuelle du formulaire de retry active le scan."}]}},{"Edit":{"inode":{"change":4,"pos":32096},"path":"api/src/jobs.rs","line":349,"atom":{"NewVertex":{"up_context":[{"change":9,"pos":4948090}],"down_context":[{"change":9,"pos":4948090}],"flag":"BLOCK","start":10861,"end":10910,"inode":{"change":4,"pos":32096}}},"contents":[{"Add":" vulnix: form.scan || scan_on_deploy,"}]}},{"Edit":{"inode":{"change":4,"pos":32096},"path":"api/src/jobs.rs","line":499,"atom":{"NewVertex":{"up_context":[{"change":9,"pos":4951247}],"down_context":[{"change":9,"pos":4951247}],"flag":"BLOCK","start":10911,"end":11404,"inode":{"change":4,"pos":32096}}},"contents":[{"Add":""},{"Add":" // Preuve SMSI : rapport de scan write-once (garde SGBD, cf. migration"},{"Add":" // job_scan_report). On l'écrit avant le branchement results/code car la"},{"Add":" // branche « code » retourne tôt. Un rejeu au même contenu passe le trigger."},{"Add":" if let Some(report) = status.scan_report.as_deref() {"},{"Add":" diesel::update(jobs::jobs.find(id))"},{"Add":" .filter(jobs::key.eq(key.clone()))"},{"Add":" .set(jobs::scan_report.eq(report))"},{"Add":" .execute(&mut db)"},{"Add":" .await?;"},{"Add":" }"},{"Add":""}]}},{"Edit":{"inode":{"change":2,"pos":521565},"path":"api/src/db.rs","line":60,"atom":{"NewVertex":{"up_context":[{"change":9,"pos":4991961}],"down_context":[{"change":9,"pos":4991961}],"flag":"BLOCK","start":11405,"end":11437,"inode":{"change":2,"pos":521565}}},"contents":[{"Add":" scan_on_deploy -> Bool,"}]}},{"Edit":{"inode":{"change":2,"pos":521565},"path":"api/src/db.rs","line":195,"atom":{"NewVertex":{"up_context":[{"change":9,"pos":4992446}],"down_context":[{"change":2,"pos":524564}],"flag":"BLOCK","start":11438,"end":11477,"inode":{"change":2,"pos":521565}}},"contents":[{"Add":" scan_report -> Nullable,"}]}}],"owner":"pijul","repo":"nest","token":"qTpYVdyW5B4qQwn5sbbbBP1EHJjLFKPgXupv8g2sdOc=","login":null}

…

Dependencies

Change contents