fix/issue--promote-bundle-tamper-to-blocking - #322
Open
Naajih09 wants to merge 4 commits into
Open
Conversation
Updated policy bundle verification to promote tampering to NON_COMPLIANT status, blocking builds. Enhanced warning handling for non-critical issues.
Added a test case to check for NON_COMPLIANT status when bundle tampering is detected.
This workflow runs performance regression tests on pull requests to the main branch using k6.
Closed
Contributor
|
please ensure all checks pass |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR promotes confirmed policy-bundle tampering signals from observational (WARNING) to blocking (NON_COMPLIANT).
Previously, per VAG-003, bundle integrity checks were observational to prevent false positives. Now that the detection logic has matured, this PR enforces security by blocking the build if the Rego policy bundle has been tampered with, has an invalid signature, or is signed by an untrusted entity.
Related Issue
Closes #311
Changes
src/audit-guard/src/policy-engine.ts:
Updated applyPolicyBundleVerification logic to differentiate between critical integrity failures and general warnings.
Promoted BundleTampered, SignatureInvalid, and UntrustedSigner error codes to the violations array.
Forced the overall evaluation status to NON_COMPLIANT when these critical errors are detected.
Updated the result summary to explicitly state when tampering is the cause of a failed build.
src/audit-guard/test/policy-engine.test.ts:
Added/Updated test cases to assert that a BundleTampered result from the verifier correctly triggers a NON_COMPLIANT status instead of a WARNING.
Technical Implementation Details
The check now iterates through verification errors:
Critical Errors: Pushed to result.violations, triggering a build failure.
Non-Critical Errors: Pushed to result.warnings, remaining observational.
The result.status is explicitly set to NON_COMPLIANT if hasTampering is true, ensuring the CI runner exits with a non-zero code.
Checklist
Confirmed policy-bundle tampering blocks the build (NON_COMPLIANT).
Added/Updated test asserting the blocking behavior.
Verified that non-critical verification errors still result in WARNING if the build is otherwise compliant.
Branch named fix/issue--promote-bundle-tamper-to-blocking.
⚠️ Policy bundle signature verification failed: BundleTampered (Status: WARNING)
Screenshots / Output (Optional)
Before:
After:
❌ CRITICAL: Policy bundle integrity check failed: BundleTampered (Status: NON_COMPLIANT)
❌ Policy bundle tampering detected — blocking build