stm_app

stm_app copied to clipboard

Include merge commits in contributor history

1

Only direct commits (1 parent) are assigned to contributors by including the files affected by the commit as contributions. A maintainer doing the hard work of merging PRs would get...

rimutaka

Rust muncher limitations + sensitive info leakage

3

## Limitations The Rust Muncher should be a bit more detailed and accurate. The initial implementation cut a few corners. 1. `for X in Y {...}` - make this a...

rimutaka

At the moment there is a function that removes or hashes some potentially sensitive info in reports just before submitting them to INBOX. This is a bit risky because changes...

rimutaka

Example: "modulo04/node_modules/emoji-regex/index.js", "modulo04/node_modules/@babel/plugin-transform-typeof-symbol/LICENSE", "modulo02/node_modules/date-fns/locale/fr/index.d.ts", "modulo02/node_modules/validator/lib/isMACAddress.js", "modulo08/tdd/node_modules/@types/istanbul-lib-report/package.json", "modulo02/node_modules/through/package.json", "modulo02/node_modules/rxjs/_esm2015/internal/util/root.js", "modulo04/node_modules/caniuse-lite/data/features/svg.js", "modulo02/node_modules/@sentry/types/dist/index.d.ts", "modulo04/node_modules/webpack/lib/wasm/WebAssemblyJavascriptGenerator.js", There should be a way to filter them out before any further processing. A temp workaround was added in...

rimutaka

### File access The current version of the windows app is packaged to run at full trust when all it needs is: 1. access to the working directory to read...

rimutaka

Relying on a git app being installed works fine if stm runs as a full trust application, but being partial trust (windows store, snap, see #11 for more) requires GIT...

rimutaka

Biuld reproducibility

1

How do we know that there are no vulnerabilities or backdoors introduced into the build via dependencies? * https://security.googleblog.com/2021/07/measuring-security-risks-in-open-source.html * https://github.com/rust-secure-code/cargo-supply-chain * https://www.reddit.com/r/rust/comments/ofurfs/how_to_achieve_identical_compilations_of_the_same/

rimutaka

I see multiple `Invalid ref` msgs, but can't remember what they mean and if this can be a sign of a bigger problem. E.g. ``` Apr 11 07:59:12.744 INFO pu{idx=0}:...

rimutaka

The current regex for Cargo.toml is too primitive to be useful. Try parsing https://github.com/matrix-org/matrix-rust-sdk/blob/master/matrix_sdk/Cargo.toml with it. ```toml [package] authors = ["Damir Jelić "] description = "A high level Matrix client-server...

rimutaka

File renaming does not show up in the log and can only be tracked per file. At the moment renaming a file will to the contributor's line count, but not...

rimutaka