From d6bb826aa35ebab23fa3a97cfb7705de5c147c8f Mon Sep 17 00:00:00 2001 From: Nils Lehnen <30603423+iderex@users.noreply.github.com> Date: Wed, 16 Sep 2026 18:40:00 +0200 Subject: [PATCH] Derive what the root holds, rather than listing it in the security policy [#332] The inventory a reporter reads to decide what to look for named one licence while two texts stand, named neither the code of conduct nor the register under security/, and never named CONTRIBUTING.md: git ls-tree --name-only origin/main | grep -v -E '^(src|tests|docs|\.github)$' .editorconfig .gitattributes .gitignore CODE_OF_CONDUCT.md CONTRIBUTING.md Cargo.lock Cargo.toml DCO LICENSE-APACHE LICENSE-MIT NOTICE.md README.md SECURITY.md rust-toolchain.toml rustfmt.toml security Three of those arrived after the inventory was written and none of the three opened it: git log origin/main --format='%h %ad %s' --date=short -1 -S'a README, two issue templates' -- SECURITY.md c6d3694 2026-08-26 Make the security policy read the tree it describes (#200) (#203) git log origin/main --diff-filter=A --format='%h %ad' --date=short \ -- LICENSE-APACHE CODE_OF_CONDUCT.md security/statements.json 89b9102 2026-09-05 a9dfdca 2026-09-04 2939128 2026-09-02 CONTRIBUTING.md is the other case and it is not drift: it was here before that sentence was written and the sentence never named it. What it cost is the purpose of the paragraph. Its own first line tells a reporter to read the tree before deciding what to look for, so an item missing from it is a surface a reporter does not know is there. The register under security/ is the one that matters: it is where a scanner exclusion and a dismissed finding are stated publicly rather than suppressed quietly, so a wrong entry in it is a class nothing looks at with nothing saying so, and the list gave no sign a register of that kind exists. The licence half is smaller and clearer - README.md and the notice both say two texts stand and either suffices, and this file said the licence. So the file-by-file tail is derived rather than extended. The kinds a reporter needs are kept and named: the crate, the suite, the decision records and the index, the gate-parity document, the workflows and the shell scripts they run, the templates, and the register. What the root itself holds is handed to the reader as the command above, which is what the two paragraphs under "What somebody could actually report" already do for the workflows and the shell scripts, and what the paragraph directly under the inventory already did for the count. That paragraph is why this is not a second enumeration. It says of itself that the inventory is a list, that a list drifts, and that this is what happened. It drifted three more times in the eleven days after it landed, so the account of this instance is added under it rather than replacing what is there. It was found by reading the inventory against the tree while working the board, not by anything reporting it. bash .github/doc-paths/doc-paths.sh check | tail -1 Every path these documents name resolves against the tracked set. bash .github/statements/statements.sh check | tail -1 Every directive this repository excludes has a published statement saying why, and what is consequently not looked for. What this does not prevent: nothing compares this file's description of the tree against the tree. The path check refuses a name with no file, which is the opposite direction, and it never asks whether a file went unnamed. Closes #332 Signed-off-by: Nils Lehnen <30603423+iderex@users.noreply.github.com> --- SECURITY.md | 34 ++++++++++++++++++++++++++++++---- 1 file changed, 30 insertions(+), 4 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 20d92de..0ddff98 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -36,10 +36,15 @@ Read the tree before deciding what to look for. The description calls this the shared core every Flowfin client uses. What it holds is a Rust crate under `src/` and its suite under `tests/`, decision records under `docs/decisions` and the index that lists them, GitHub Actions workflows and the shell scripts those -workflows run, a gate-parity document, this file, the licence, a DCO, a notice, a -README, two issue templates with the config beside them, a pull-request template, -a manifest, a lockfile, a toolchain pin, and a `.gitattributes` that fixes the -line ending. +workflows run, a gate-parity document beside those records, two issue templates +and a pull-request template beside those workflows, a register under `security/` +in which every scanner exclusion and every dismissed finding carries a published +statement, and the prose and the settings files at the root, among them the +`.gitattributes` that fixes the line ending. What the root itself holds is read +rather than listed here, for the reason the second paragraph below gives, and the +command returns the register named above along with the files: + + git ls-tree --name-only origin/main | grep -v -E '^(src|tests|docs|\.github)$' THIS PARAGRAPH NAMED NEITHER THE CRATE NOR THE SUITE, AND THE ONE AFTER IT SAID THE CORE WAS NOT WRITTEN. Both were true when they were written and had stopped @@ -61,6 +66,27 @@ count beside it always said to derive it and still does: git ls-tree -r --name-only origin/main | wc -l +IT DRIFTED AGAIN, THREE TIMES IN THE ELEVEN DAYS AFTER THAT SENTENCE LANDED, +WHICH IS WHY THE FILE-BY-FILE PART OF IT IS DERIVED NOW RATHER THAN EXTENDED. It +named one licence while two texts stand, each of them sufficient on its own, +which is what `README.md` and the notice both say. It named neither the code of +conduct nor the register under `security/`. And it never named `CONTRIBUTING.md`, +which was here before it was written, so that omission is not drift and is the +one the derived line repairs by construction. Each of the three arrivals came in +a change that had no reason to open this paragraph: + + git log origin/main --diff-filter=A --format='%h %ad' --date=short \ + -- LICENSE-APACHE CODE_OF_CONDUCT.md security/statements.json + 89b9102 2026-09-05 + a9dfdca 2026-09-04 + 2939128 2026-09-02 + +The register is the item that cost the most by being absent. It is where a +scanner exclusion and a dismissed finding are stated publicly rather than +suppressed quietly, so a wrong entry in it is a class nothing looks at and +nothing says so, and a reporter taking this list for the map would not have known +a register of that kind was here. + There are no releases and no tags. How many branches there are moves with every change in flight, so it is derived here rather than counted: