Skip to content

Add threat model and debugging comments for code reviewers #4

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
assisted-by-ai wants to merge 1 commit into from
Closed

Add threat model and debugging comments for code reviewers #4

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions derivative-maker
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@
## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

## Comments for reviewers:
## Verbose logs (set -x) are preferred for build debugging.
## Secret leak prevention in CI must be handled at the CI/environment level, not by disabling trace output.
set -x
set -e

Expand Down
2 changes: 2 additions & 0 deletions help-steps/pre
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -176,6 +176,8 @@ exit code $interactive_chroot_shell_bash_exit_code, cleanup and exit as requeste
}

exception_handler_retry() {
## Comments for reviewers:
## threat model: command line is considered trusted in derivative-maker.
if [ ! "$dist_build_dispatch_before_retry" = "" ]; then
$output_cmd "${cyan}${bold}INFO: dispatch before retry (--retry-before)...: $dist_build_dispatch_before_retry ${reset}"
dist_build_dispatch_before_retry_exit_code="0"
Expand Down
4 changes: 4 additions & 0 deletions help-steps/variables
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -791,6 +791,8 @@ set_default_variable() {

if [ -z "${!var_name:-}" ]; then
#printf "%s\n" "INFO: Variable '$var_name' is already set? No. - Setting: $var_name='$var_content'"
## Comments for reviewers:
## threat model: command line is considered trusted in derivative-maker.
eval "$var_name='$var_content'"
return 0
fi
Expand Down Expand Up @@ -913,6 +915,8 @@ fi

## {{{ buildconfig.d

## Comments for reviewers:
## threat model: files on the file system are considered trusted.
[ -n "$dist_build_config_dirs" ] || dist_build_config_dirs="${source_code_folder_dist}/buildconfig.d /etc/buildconfig-dist.d ../buildconfig.d"

dist_build_source_config_dir() {
Expand Down