Pin puppet_litmus unconditionally; drop the no-token litmus 1.x fallback - #633
Open
amitkarsale wants to merge 1 commit into
Open
Pin puppet_litmus unconditionally; drop the no-token litmus 1.x fallback#633amitkarsale wants to merge 1 commit into
amitkarsale wants to merge 1 commit into
Conversation
Mend's CI-upload scan resolves this Gemfile without PUPPET_FORGE_TOKEN set, so it walks the `if ENV["PUPPET_FORGE_TOKEN"].to_s.empty?` branch and reports ancient litmus 1.x (and its old transitive deps) as the real dependency tree, even though every real bundle install (which has the token) resolves current litmus 2.x. Same root cause and fix puppet_agent applied in PA-7824 (puppetlabs/puppetlabs-puppet_agent@7b8e24e): drop the token-gated fallback and pin unconditionally. .sync.yml override added so a future `pdk update` doesn't regenerate the fallback from the shared pdk-templates default. Co-Authored-By: WOZCODE <contact@withwoz.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Mend's CI-upload scan for this repo (
puppet_modulesproduct in the CVEremediation hub) resolves
GemfilewithoutPUPPET_FORGE_TOKENset, soit walks the
if ENV["PUPPET_FORGE_TOKEN"].to_s.empty?branch and reportsancient
puppet_litmus1.x (and its stale transitive deps, e.g. oldbolt/jwt) as the real dependency tree — inflating CVE counts for a version
nobody actually tests with. A normal
bundle install(which does have thetoken, e.g. in this repo's own CI) resolves
puppet_litmus2.x fine.Raised in https://perforce.slack.com/archives/C0BHQDASRRA/p1788771803282819.
Same root cause and fix
puppet_agentalready applied inPA-7824.
What
Gemfile: drop the token-gated fallback, pinpuppet_litmusunconditionallyto the version already used on the "token present" branch.
.sync.yml: add the matchingGemfile: overrides:entry so a futurepdk updatedoesn't regenerate the fallback from the shared pdk-templatesdefault (this is the same mechanism already used in modules that don't have
this bug, e.g.
puppetlabs-stdlib).Test plan