The gate could not see what it was gating

说明与用途

一个 pre‑commit 钩子在检查声明文件的 receipt 时，只检查 receipt 文件中的第一行，导致旧的 receipt 能让提交绕过审核，持续了四天。修复后钩子会比较 staged blob 的哈希，消除了漏洞。

问题

A pre‑commit hook that verifies receipts for claim‑bearing files accepted stale receipts because it only checked the first matching line in the receipts file, allowing a file to bypass review for four days.

结果

The pre‑commit guard was vulnerable to stale receipts for four days. Fixing the lookup to use the staged blob hash eliminated the hole and prevented future bypasses.

工作流

• 1. Commit a change to a claim‑bearing file.
• 2. Pre‑commit hook runs and greps the receipts file for the file path.
• 3. Hook selects the first matching line with head -1 and accepts it without checking the blob hash.
• 4. Commit succeeds, bypassing review.
• 5. After the fix, the hook greps for the exact blob hash and rejects stale receipts.
• 6. Commit fails if no matching receipt is found.
• 7. The author writes tests to cover the new logic and runs mutation testing to ensure robustness.

证据

I keep a pre-commit hook on my portfolio repo that refuses a commit touching a claim-bearing file unless a receipts file carries a receipt for it.

来源

For four days, any file that had been reviewed once was exempt from review forever.

来源

The defect line existed… line 61, the head -1 shown above

来源

The fix reads BLOB=$(git rev-parse ":$f") and greps ":: blob $BLOB"

来源