fix(security): nosec B108 on SPIRE socket path in spiffe.py - #264
Merged
Merged
Conversation
The /tmp/spire-agent/public/api.sock path is the SPIRE Workload API standard Unix domain socket location. It is not a temp file created by this code -- it is a pre-existing socket managed by the SPIRE agent process. B108 is a false positive here. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…x.py Both calls use urllib.request.Request objects with explicit HTTPS endpoints, not raw URL strings. Bandit B310 fires because it cannot statically resolve the Request object's scheme, making these false positives. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add per-file-ignores for T201 (intentional prints in benchmarks and soak scripts) - Move _CLAIM_SEQUENCE global after imports in session/manager.py to fix E402 - Combine nested ifs in sev_snp.py (SIM102) - Remove unused X509Svid import in spiffe.py (F401) - Collapse nested with statements in test_low_batch_186_187_191_194.py (SIM117) - Remove unnecessary assignment before return in test_tee_dev_mode_freeze.py (RET504) - All ruff auto-fixable issues resolved via ruff --fix (64 files touched) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- manager.py: access PolicyBundle attributes via PolicyStore.bundle property (PolicyStore wraps PolicyBundle; bundle_hash and manifest live on the inner object) - benchmarks.py: add Iterator[None] return type to _quiet() contextmanager - benchmarks.py: use TEEProvider.SOFTWARE_ONLY enum value instead of bare string Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
PolicyStore exposes bundle_hash and manifest via the .bundle property, not as direct attributes. Update _make_ctx() mocks to use policy_bundle.bundle.bundle_hash and policy_bundle.bundle.manifest.version. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
socket.AF_UNIX is absent from Windows mypy stubs. The code already has a try/except AttributeError guard, so this is a known platform difference. Added type: ignore[attr-defined] and a warn_unused_ignores = false mypy override so Linux CI does not reject the suppress comment as unused. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
bandit B108was flagging/tmp/spire-agent/public/api.sockinspiffe.py:26as a hardcoded temp directory (CWE-377)# nosec B108with an inline justification commentRoot cause
The security scan step in the CI
testmatrix job runsbanditbeforepytest. When bandit exits non-zero on B108, the step fails and the entire job fails. Becausefail-fastis true by default, the matrix strategy then cancels all other platform/version jobs — making it look like tests are failing everywhere when bandit is the actual culprit.Test plan
🤖 Generated with Claude Code